comparing a7df8b81ae024889759f604ddd1bd26e845fee7c and feat/vote-xrpc-endpoints on bretton.dev/coves

-12

.env.test.example

···

       1
       1
       -
       # Test Environment Configuration

     

       2
       2
       -
       # This file contains environment variables for running tests

     

       3
       3
       -
       # Copy this file to .env.test and update with your actual values

     

       4
       4
       -
       

     

       5
       5
       -
       # Test Database Configuration

     

       6
       6
       -
       TEST_DATABASE_URL=postgres://your_test_user:your_test_password@localhost:5434/coves_test?sslmode=disable

     

       7
       7
       -
       

     

       8
       8
       -
       # Test Server Configuration (if needed)

     

       9
       9
       -
       TEST_PORT=8081

     

       10
       10
       -
       

     

       11
       11
       -
       # Test CAR Storage Directory

     

       12
       12
       -
       TEST_CAR_STORAGE_DIR=/tmp/coves_test_carstore

+17 -10

docs/LOCAL_DEVELOPMENT.md

···

       190
       190
        
       ### Testing Commands

     

       191
       191
        
       

     

       192
       192
        
       ```bash

     

       193
       193
       -
       make test              # Run all tests with test database

     

       194
       194
       -
       make test-db-reset     # Reset test database

     

       193
       193
       +
       make test              # Run all tests (starts test DB, runs migrations, executes tests)

     

       194
       194
       +
       make test-db-reset     # Reset test database (clean slate)

     

       195
       195
       +
       make test-db-stop      # Stop test database

     

       195
       196
        
       ```

     

       196
       197
        
       

     

       198
       198
       +
       **See [TESTING_SUMMARY.md](../TESTING_SUMMARY.md) for complete testing documentation.**

     

       199
       199
       +
       

     

       197
       200
        
       ### Workflow Commands

     

       198
       201
        
       

     

       199
       202
        
       ```bash

     
···

       385
       388
        
       

     

       386
       389
        
       ## Environment Variables

     

       387
       390
        
       

     

       388
       388
       -
       All configuration is in `.env.dev`:

     

       391
       391
       +
       All configuration is in [.env.dev](../.env.dev) - a single file for both development and testing:

     

       389
       392
        
       

     

       390
       390
       -
       ### Database Configuration

     

       393
       393
       +
       ### Development Database (Port 5433)

     

       391
       394
        
       ```bash

     

       392
       395
        
       POSTGRES_HOST=localhost

     

       393
       396
        
       POSTGRES_PORT=5433

     
···

       396
       399
        
       POSTGRES_PASSWORD=dev_password

     

       397
       400
        
       ```

     

       398
       401
        
       

     

       402
       402
       +
       ### Test Database (Port 5434)

     

       403
       403
       +
       ```bash

     

       404
       404
       +
       POSTGRES_TEST_DB=coves_test

     

       405
       405
       +
       POSTGRES_TEST_USER=test_user

     

       406
       406
       +
       POSTGRES_TEST_PASSWORD=test_password

     

       407
       407
       +
       POSTGRES_TEST_PORT=5434

     

       408
       408
       +
       ```

     

       409
       409
       +
       

     

       399
       410
        
       ### PDS Configuration

     

       400
       411
        
       ```bash

     

       401
       412
        
       PDS_HOSTNAME=localhost

     
···

       405
       416
        
       PDS_SERVICE_HANDLE_DOMAINS=.local.coves.dev

     

       406
       417
        
       ```

     

       407
       418
        
       

     

       408
       408
       -
       ### Relay Configuration

     

       409
       409
       -
       ```bash

     

       410
       410
       -
       BGS_PORT=2471

     

       411
       411
       -
       BGS_ADMIN_KEY=dev-admin-key

     

       412
       412
       -
       ```

     

       413
       413
       -
       

     

       414
       419
        
       ### AppView Configuration

     

       415
       420
        
       ```bash

     

       416
       421
        
       APPVIEW_PORT=8081

     
···

       424
       429
        
       LOG_LEVEL=debug

     

       425
       430
        
       ```

     

       426
       431
        
       

     

       432
       432
       +
       **No separate `.env.test` file needed!** All configuration (dev + test) is in `.env.dev`.

     

       433
       433
       +
       

     

       427
       434
        
       ## Next Steps

     

       428
       435
        
       

     

       429
       436
        
       1. **Build the Firehose Subscriber** - Create the AppView component that subscribes to the relay

-10

internal/core/users/repository.go

···

       1
       1
       -
       package users

     

       2
       2
       -
       

     

       3
       3
       -
       type UserRepository interface {

     

       4
       4
       -
       	Create(user *User) (*User, error)

     

       5
       5
       -
       	GetByID(id int) (*User, error)

     

       6
       6
       -
       	GetByEmail(email string) (*User, error)

     

       7
       7
       -
       	GetByUsername(username string) (*User, error)

     

       8
       8
       -
       	Update(user *User) (*User, error)

     

       9
       9
       -
       	Delete(id int) error

     

       10
       10
       -
       }

-272

internal/core/users/service_test.go

···

       1
       1
       -
       package users_test

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"fmt"

     

       5
       5
       -
       	"testing"

     

       6
       6
       -
       	"time"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/users"

     

       9
       9
       -
       )

     

       10
       10
       -
       

     

       11
       11
       -
       type mockUserRepository struct {

     

       12
       12
       -
       	users      map[int]*users.User

     

       13
       13
       -
       	nextID     int

     

       14
       14
       -
       	shouldFail bool

     

       15
       15
       -
       }

     

       16
       16
       -
       

     

       17
       17
       -
       func newMockUserRepository() *mockUserRepository {

     

       18
       18
       -
       	return &mockUserRepository{

     

       19
       19
       -
       		users:  make(map[int]*users.User),

     

       20
       20
       -
       		nextID: 1,

     

       21
       21
       -
       	}

     

       22
       22
       -
       }

     

       23
       23
       -
       

     

       24
       24
       -
       func (m *mockUserRepository) Create(user *users.User) (*users.User, error) {

     

       25
       25
       -
       	if m.shouldFail {

     

       26
       26
       -
       		return nil, fmt.Errorf("mock: database error")

     

       27
       27
       -
       	}

     

       28
       28
       -
       	

     

       29
       29
       -
       	user.ID = m.nextID

     

       30
       30
       -
       	m.nextID++

     

       31
       31
       -
       	user.CreatedAt = time.Now()

     

       32
       32
       -
       	user.UpdatedAt = time.Now()

     

       33
       33
       -
       	

     

       34
       34
       -
       	m.users[user.ID] = user

     

       35
       35
       -
       	return user, nil

     

       36
       36
       -
       }

     

       37
       37
       -
       

     

       38
       38
       -
       func (m *mockUserRepository) GetByID(id int) (*users.User, error) {

     

       39
       39
       -
       	if m.shouldFail {

     

       40
       40
       -
       		return nil, fmt.Errorf("mock: database error")

     

       41
       41
       -
       	}

     

       42
       42
       -
       	

     

       43
       43
       -
       	user, exists := m.users[id]

     

       44
       44
       -
       	if !exists {

     

       45
       45
       -
       		return nil, fmt.Errorf("repository: user not found")

     

       46
       46
       -
       	}

     

       47
       47
       -
       	return user, nil

     

       48
       48
       -
       }

     

       49
       49
       -
       

     

       50
       50
       -
       func (m *mockUserRepository) GetByEmail(email string) (*users.User, error) {

     

       51
       51
       -
       	if m.shouldFail {

     

       52
       52
       -
       		return nil, fmt.Errorf("mock: database error")

     

       53
       53
       -
       	}

     

       54
       54
       -
       	

     

       55
       55
       -
       	for _, user := range m.users {

     

       56
       56
       -
       		if user.Email == email {

     

       57
       57
       -
       			return user, nil

     

       58
       58
       -
       		}

     

       59
       59
       -
       	}

     

       60
       60
       -
       	return nil, fmt.Errorf("repository: user not found")

     

       61
       61
       -
       }

     

       62
       62
       -
       

     

       63
       63
       -
       func (m *mockUserRepository) GetByUsername(username string) (*users.User, error) {

     

       64
       64
       -
       	if m.shouldFail {

     

       65
       65
       -
       		return nil, fmt.Errorf("mock: database error")

     

       66
       66
       -
       	}

     

       67
       67
       -
       	

     

       68
       68
       -
       	for _, user := range m.users {

     

       69
       69
       -
       		if user.Username == username {

     

       70
       70
       -
       			return user, nil

     

       71
       71
       -
       		}

     

       72
       72
       -
       	}

     

       73
       73
       -
       	return nil, fmt.Errorf("repository: user not found")

     

       74
       74
       -
       }

     

       75
       75
       -
       

     

       76
       76
       -
       func (m *mockUserRepository) Update(user *users.User) (*users.User, error) {

     

       77
       77
       -
       	if m.shouldFail {

     

       78
       78
       -
       		return nil, fmt.Errorf("mock: database error")

     

       79
       79
       -
       	}

     

       80
       80
       -
       	

     

       81
       81
       -
       	if _, exists := m.users[user.ID]; !exists {

     

       82
       82
       -
       		return nil, fmt.Errorf("repository: user not found")

     

       83
       83
       -
       	}

     

       84
       84
       -
       	

     

       85
       85
       -
       	user.UpdatedAt = time.Now()

     

       86
       86
       -
       	m.users[user.ID] = user

     

       87
       87
       -
       	return user, nil

     

       88
       88
       -
       }

     

       89
       89
       -
       

     

       90
       90
       -
       func (m *mockUserRepository) Delete(id int) error {

     

       91
       91
       -
       	if m.shouldFail {

     

       92
       92
       -
       		return fmt.Errorf("mock: database error")

     

       93
       93
       -
       	}

     

       94
       94
       -
       	

     

       95
       95
       -
       	if _, exists := m.users[id]; !exists {

     

       96
       96
       -
       		return fmt.Errorf("repository: user not found")

     

       97
       97
       -
       	}

     

       98
       98
       -
       	

     

       99
       99
       -
       	delete(m.users, id)

     

       100
       100
       -
       	return nil

     

       101
       101
       -
       }

     

       102
       102
       -
       

     

       103
       103
       -
       func TestCreateUser(t *testing.T) {

     

       104
       104
       -
       	repo := newMockUserRepository()

     

       105
       105
       -
       	service := users.NewUserService(repo)

     

       106
       106
       -
       	

     

       107
       107
       -
       	tests := []struct {

     

       108
       108
       -
       		name    string

     

       109
       109
       -
       		req     users.CreateUserRequest

     

       110
       110
       -
       		wantErr bool

     

       111
       111
       -
       		errMsg  string

     

       112
       112
       -
       	}{

     

       113
       113
       -
       		{

     

       114
       114
       -
       			name: "valid user",

     

       115
       115
       -
       			req: users.CreateUserRequest{

     

       116
       116
       -
       				Email:    "test@example.com",

     

       117
       117
       -
       				Username: "testuser",

     

       118
       118
       -
       			},

     

       119
       119
       -
       			wantErr: false,

     

       120
       120
       -
       		},

     

       121
       121
       -
       		{

     

       122
       122
       -
       			name: "empty email",

     

       123
       123
       -
       			req: users.CreateUserRequest{

     

       124
       124
       -
       				Email:    "",

     

       125
       125
       -
       				Username: "testuser",

     

       126
       126
       -
       			},

     

       127
       127
       -
       			wantErr: true,

     

       128
       128
       -
       			errMsg:  "email is required",

     

       129
       129
       -
       		},

     

       130
       130
       -
       		{

     

       131
       131
       -
       			name: "empty username",

     

       132
       132
       -
       			req: users.CreateUserRequest{

     

       133
       133
       -
       				Email:    "test@example.com",

     

       134
       134
       -
       				Username: "",

     

       135
       135
       -
       			},

     

       136
       136
       -
       			wantErr: true,

     

       137
       137
       -
       			errMsg:  "username is required",

     

       138
       138
       -
       		},

     

       139
       139
       -
       		{

     

       140
       140
       -
       			name: "invalid email format",

     

       141
       141
       -
       			req: users.CreateUserRequest{

     

       142
       142
       -
       				Email:    "invalidemail",

     

       143
       143
       -
       				Username: "testuser",

     

       144
       144
       -
       			},

     

       145
       145
       -
       			wantErr: true,

     

       146
       146
       -
       			errMsg:  "invalid email format",

     

       147
       147
       -
       		},

     

       148
       148
       -
       		{

     

       149
       149
       -
       			name: "short username",

     

       150
       150
       -
       			req: users.CreateUserRequest{

     

       151
       151
       -
       				Email:    "test@example.com",

     

       152
       152
       -
       				Username: "ab",

     

       153
       153
       -
       			},

     

       154
       154
       -
       			wantErr: true,

     

       155
       155
       -
       			errMsg:  "username must be at least 3 characters",

     

       156
       156
       -
       		},

     

       157
       157
       -
       	}

     

       158
       158
       -
       	

     

       159
       159
       -
       	for _, tt := range tests {

     

       160
       160
       -
       		t.Run(tt.name, func(t *testing.T) {

     

       161
       161
       -
       			user, err := service.CreateUser(tt.req)

     

       162
       162
       -
       			

     

       163
       163
       -
       			if tt.wantErr {

     

       164
       164
       -
       				if err == nil {

     

       165
       165
       -
       					t.Errorf("expected error but got none")

     

       166
       166
       -
       				} else if tt.errMsg != "" && err.Error() != "service: "+tt.errMsg {

     

       167
       167
       -
       					t.Errorf("expected error message '%s' but got '%s'", tt.errMsg, err.Error())

     

       168
       168
       -
       				}

     

       169
       169
       -
       			} else {

     

       170
       170
       -
       				if err != nil {

     

       171
       171
       -
       					t.Errorf("unexpected error: %v", err)

     

       172
       172
       -
       				}

     

       173
       173
       -
       				if user == nil {

     

       174
       174
       -
       					t.Errorf("expected user but got nil")

     

       175
       175
       -
       				}

     

       176
       176
       -
       			}

     

       177
       177
       -
       		})

     

       178
       178
       -
       	}

     

       179
       179
       -
       }

     

       180
       180
       -
       

     

       181
       181
       -
       func TestCreateUserDuplicates(t *testing.T) {

     

       182
       182
       -
       	repo := newMockUserRepository()

     

       183
       183
       -
       	service := users.NewUserService(repo)

     

       184
       184
       -
       	

     

       185
       185
       -
       	req := users.CreateUserRequest{

     

       186
       186
       -
       		Email:    "test@example.com",

     

       187
       187
       -
       		Username: "testuser",

     

       188
       188
       -
       	}

     

       189
       189
       -
       	

     

       190
       190
       -
       	_, err := service.CreateUser(req)

     

       191
       191
       -
       	if err != nil {

     

       192
       192
       -
       		t.Fatalf("unexpected error creating first user: %v", err)

     

       193
       193
       -
       	}

     

       194
       194
       -
       	

     

       195
       195
       -
       	_, err = service.CreateUser(req)

     

       196
       196
       -
       	if err == nil {

     

       197
       197
       -
       		t.Errorf("expected error for duplicate email but got none")

     

       198
       198
       -
       	} else if err.Error() != "service: email already exists" {

     

       199
       199
       -
       		t.Errorf("unexpected error message: %v", err)

     

       200
       200
       -
       	}

     

       201
       201
       -
       	

     

       202
       202
       -
       	req2 := users.CreateUserRequest{

     

       203
       203
       -
       		Email:    "different@example.com",

     

       204
       204
       -
       		Username: "testuser",

     

       205
       205
       -
       	}

     

       206
       206
       -
       	

     

       207
       207
       -
       	_, err = service.CreateUser(req2)

     

       208
       208
       -
       	if err == nil {

     

       209
       209
       -
       		t.Errorf("expected error for duplicate username but got none")

     

       210
       210
       -
       	} else if err.Error() != "service: username already exists" {

     

       211
       211
       -
       		t.Errorf("unexpected error message: %v", err)

     

       212
       212
       -
       	}

     

       213
       213
       -
       }

     

       214
       214
       -
       

     

       215
       215
       -
       func TestGetUserByID(t *testing.T) {

     

       216
       216
       -
       	repo := newMockUserRepository()

     

       217
       217
       -
       	service := users.NewUserService(repo)

     

       218
       218
       -
       	

     

       219
       219
       -
       	createdUser, err := service.CreateUser(users.CreateUserRequest{

     

       220
       220
       -
       		Email:    "test@example.com",

     

       221
       221
       -
       		Username: "testuser",

     

       222
       222
       -
       	})

     

       223
       223
       -
       	if err != nil {

     

       224
       224
       -
       		t.Fatalf("failed to create user: %v", err)

     

       225
       225
       -
       	}

     

       226
       226
       -
       	

     

       227
       227
       -
       	tests := []struct {

     

       228
       228
       -
       		name    string

     

       229
       229
       -
       		id      int

     

       230
       230
       -
       		wantErr bool

     

       231
       231
       -
       		errMsg  string

     

       232
       232
       -
       	}{

     

       233
       233
       -
       		{

     

       234
       234
       -
       			name:    "valid ID",

     

       235
       235
       -
       			id:      createdUser.ID,

     

       236
       236
       -
       			wantErr: false,

     

       237
       237
       -
       		},

     

       238
       238
       -
       		{

     

       239
       239
       -
       			name:    "invalid ID",

     

       240
       240
       -
       			id:      0,

     

       241
       241
       -
       			wantErr: true,

     

       242
       242
       -
       			errMsg:  "invalid user ID",

     

       243
       243
       -
       		},

     

       244
       244
       -
       		{

     

       245
       245
       -
       			name:    "non-existent ID",

     

       246
       246
       -
       			id:      999,

     

       247
       247
       -
       			wantErr: true,

     

       248
       248
       -
       			errMsg:  "user not found",

     

       249
       249
       -
       		},

     

       250
       250
       -
       	}

     

       251
       251
       -
       	

     

       252
       252
       -
       	for _, tt := range tests {

     

       253
       253
       -
       		t.Run(tt.name, func(t *testing.T) {

     

       254
       254
       -
       			user, err := service.GetUserByID(tt.id)

     

       255
       255
       -
       			

     

       256
       256
       -
       			if tt.wantErr {

     

       257
       257
       -
       				if err == nil {

     

       258
       258
       -
       					t.Errorf("expected error but got none")

     

       259
       259
       -
       				} else if tt.errMsg != "" && err.Error() != "service: "+tt.errMsg {

     

       260
       260
       -
       					t.Errorf("expected error message '%s' but got '%s'", tt.errMsg, err.Error())

     

       261
       261
       -
       				}

     

       262
       262
       -
       			} else {

     

       263
       263
       -
       				if err != nil {

     

       264
       264
       -
       					t.Errorf("unexpected error: %v", err)

     

       265
       265
       -
       				}

     

       266
       266
       -
       				if user == nil {

     

       267
       267
       -
       					t.Errorf("expected user but got nil")

     

       268
       268
       -
       				}

     

       269
       269
       -
       			}

     

       270
       270
       -
       		})

     

       271
       271
       -
       	}

     

       272
       272
       -
       }

-32

internal/db/migrations/005_add_user_maps_indices.sql

···

       1
       1
       -
       -- +goose Up

     

       2
       2
       -
       -- +goose StatementBegin

     

       3
       3
       -
       

     

       4
       4
       -
       -- Note: The user_maps table is created by GORM's AutoMigrate in the carstore package

     

       5
       5
       -
       -- Only add indices if the table exists

     

       6
       6
       -
       DO $$

     

       7
       7
       -
       BEGIN

     

       8
       8
       -
           -- Check if user_maps table exists

     

       9
       9
       -
           IF EXISTS (SELECT 1 FROM information_schema.tables WHERE table_name = 'user_maps') THEN

     

       10
       10
       -
               -- Check if column exists before creating index

     

       11
       11
       -
               IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = 'user_maps' AND column_name = 'did') THEN

     

       12
       12
       -
                   -- Explicit column name specified in GORM tag

     

       13
       13
       -
                   CREATE INDEX IF NOT EXISTS idx_user_maps_did ON user_maps(did);

     

       14
       14
       -
               END IF;

     

       15
       15
       -
               

     

       16
       16
       -
               -- Add index on created_at if column exists

     

       17
       17
       -
               IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name = 'user_maps' AND column_name = 'created_at') THEN

     

       18
       18
       -
                   CREATE INDEX IF NOT EXISTS idx_user_maps_created_at ON user_maps(created_at);

     

       19
       19
       -
               END IF;

     

       20
       20
       -
           END IF;

     

       21
       21
       -
       END $$;

     

       22
       22
       -
       

     

       23
       23
       -
       -- +goose StatementEnd

     

       24
       24
       -
       

     

       25
       25
       -
       -- +goose Down

     

       26
       26
       -
       -- +goose StatementBegin

     

       27
       27
       -
       

     

       28
       28
       -
       -- Remove indices if they exist

     

       29
       29
       -
       DROP INDEX IF EXISTS idx_user_maps_did;

     

       30
       30
       -
       DROP INDEX IF EXISTS idx_user_maps_created_at;

     

       31
       31
       -
       

     

       32
       32
       -
       -- +goose StatementEnd

-1

.claude/commands/create-pr.md

···

       4
       4
        
       

     

       5
       5
        
       ## Behavior

     

       6
       6
        
       - Creates a new branch based on current changes

     

       7
       7
       -
       - Formats modified files using Biome

     

       8
       7
        
       - Analyzes changes and automatically splits into logical commits when appropriate

     

       9
       8
        
       - Each commit focuses on a single logical change or feature

     

       10
       9
        
       - Creates descriptive commit messages for each logical unit

+85

internal/atproto/lexicon/social/coves/actor/signup.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.actor.signup",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Register a new account on the Coves instance. Creates account on PDS and indexes in AppView.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["handle", "email", "password"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "handle": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "handle",

     

       17
       17
       +
                     "description": "Requested handle for the account (e.g., alice.coves.dev)"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "email": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "description": "Email address for account recovery and notifications"

     

       22
       22
       +
                   },

     

       23
       23
       +
                   "password": {

     

       24
       24
       +
                     "type": "string",

     

       25
       25
       +
                     "description": "Account password (must meet strength requirements)"

     

       26
       26
       +
                   },

     

       27
       27
       +
                   "inviteCode": {

     

       28
       28
       +
                     "type": "string",

     

       29
       29
       +
                     "description": "Invite code (required if instance has invite-only registration)"

     

       30
       30
       +
                   }

     

       31
       31
       +
                 }

     

       32
       32
       +
               }

     

       33
       33
       +
             },

     

       34
       34
       +
             "output": {

     

       35
       35
       +
               "encoding": "application/json",

     

       36
       36
       +
               "schema": {

     

       37
       37
       +
                 "type": "object",

     

       38
       38
       +
                 "required": ["did", "handle", "accessJwt", "refreshJwt"],

     

       39
       39
       +
                 "properties": {

     

       40
       40
       +
                   "did": {

     

       41
       41
       +
                     "type": "string",

     

       42
       42
       +
                     "format": "did",

     

       43
       43
       +
                     "description": "The DID of the newly created account"

     

       44
       44
       +
                   },

     

       45
       45
       +
                   "handle": {

     

       46
       46
       +
                     "type": "string",

     

       47
       47
       +
                     "format": "handle",

     

       48
       48
       +
                     "description": "The handle of the newly created account"

     

       49
       49
       +
                   },

     

       50
       50
       +
                   "accessJwt": {

     

       51
       51
       +
                     "type": "string",

     

       52
       52
       +
                     "description": "Access token for authenticated requests"

     

       53
       53
       +
                   },

     

       54
       54
       +
                   "refreshJwt": {

     

       55
       55
       +
                     "type": "string",

     

       56
       56
       +
                     "description": "Refresh token for obtaining new access tokens"

     

       57
       57
       +
                   }

     

       58
       58
       +
                 }

     

       59
       59
       +
               }

     

       60
       60
       +
             },

     

       61
       61
       +
             "errors": [

     

       62
       62
       +
               {

     

       63
       63
       +
                 "name": "InvalidHandle",

     

       64
       64
       +
                 "description": "Handle does not meet format requirements"

     

       65
       65
       +
               },

     

       66
       66
       +
               {

     

       67
       67
       +
                 "name": "HandleNotAvailable",

     

       68
       68
       +
                 "description": "The requested handle is already taken"

     

       69
       69
       +
               },

     

       70
       70
       +
               {

     

       71
       71
       +
                 "name": "InvalidInviteCode",

     

       72
       72
       +
                 "description": "The provided invite code is invalid or expired"

     

       73
       73
       +
               },

     

       74
       74
       +
               {

     

       75
       75
       +
                 "name": "InvalidEmail",

     

       76
       76
       +
                 "description": "The email address is invalid"

     

       77
       77
       +
               },

     

       78
       78
       +
               {

     

       79
       79
       +
                 "name": "WeakPassword",

     

       80
       80
       +
                 "description": "Password does not meet strength requirements"

     

       81
       81
       +
               }

     

       82
       82
       +
             ]

     

       83
       83
       +
           }

     

       84
       84
       +
         }

     

       85
       85
       +
       }

+254

internal/jetstream/user_consumer.go

···

       1
       1
       +
       package jetstream

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"Coves/internal/core/users"

     

       11
       11
       +
       	"github.com/gorilla/websocket"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // JetstreamEvent represents an event from the Jetstream firehose

     

       15
       15
       +
       // Jetstream documentation: https://docs.bsky.app/docs/advanced-guides/jetstream

     

       16
       16
       +
       type JetstreamEvent struct {

     

       17
       17
       +
       	Did    string          `json:"did"`

     

       18
       18
       +
       	TimeUS int64           `json:"time_us"`

     

       19
       19
       +
       	Kind   string          `json:"kind"` // "account", "commit", "identity"

     

       20
       20
       +
       	Account *AccountEvent  `json:"account,omitempty"`

     

       21
       21
       +
       	Identity *IdentityEvent `json:"identity,omitempty"`

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       type AccountEvent struct {

     

       25
       25
       +
       	Active bool   `json:"active"`

     

       26
       26
       +
       	Did    string `json:"did"`

     

       27
       27
       +
       	Seq    int64  `json:"seq"`

     

       28
       28
       +
       	Time   string `json:"time"`

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       type IdentityEvent struct {

     

       32
       32
       +
       	Did    string `json:"did"`

     

       33
       33
       +
       	Handle string `json:"handle"`

     

       34
       34
       +
       	Seq    int64  `json:"seq"`

     

       35
       35
       +
       	Time   string `json:"time"`

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       // UserEventConsumer consumes user-related events from Jetstream

     

       39
       39
       +
       type UserEventConsumer struct {

     

       40
       40
       +
       	userService users.UserService

     

       41
       41
       +
       	wsURL       string

     

       42
       42
       +
       	pdsFilter   string // Optional: only index users from specific PDS

     

       43
       43
       +
       }

     

       44
       44
       +
       

     

       45
       45
       +
       // NewUserEventConsumer creates a new Jetstream consumer for user events

     

       46
       46
       +
       func NewUserEventConsumer(userService users.UserService, wsURL string, pdsFilter string) *UserEventConsumer {

     

       47
       47
       +
       	return &UserEventConsumer{

     

       48
       48
       +
       		userService: userService,

     

       49
       49
       +
       		wsURL:       wsURL,

     

       50
       50
       +
       		pdsFilter:   pdsFilter,

     

       51
       51
       +
       	}

     

       52
       52
       +
       }

     

       53
       53
       +
       

     

       54
       54
       +
       // Start begins consuming events from Jetstream

     

       55
       55
       +
       // Runs indefinitely, reconnecting on errors

     

       56
       56
       +
       func (c *UserEventConsumer) Start(ctx context.Context) error {

     

       57
       57
       +
       	log.Printf("Starting Jetstream user consumer: %s", c.wsURL)

     

       58
       58
       +
       

     

       59
       59
       +
       	for {

     

       60
       60
       +
       		select {

     

       61
       61
       +
       		case <-ctx.Done():

     

       62
       62
       +
       			log.Println("Jetstream consumer shutting down")

     

       63
       63
       +
       			return ctx.Err()

     

       64
       64
       +
       		default:

     

       65
       65
       +
       			if err := c.connect(ctx); err != nil {

     

       66
       66
       +
       				log.Printf("Jetstream connection error: %v. Retrying in 5s...", err)

     

       67
       67
       +
       				time.Sleep(5 * time.Second)

     

       68
       68
       +
       				continue

     

       69
       69
       +
       			}

     

       70
       70
       +
       		}

     

       71
       71
       +
       	}

     

       72
       72
       +
       }

     

       73
       73
       +
       

     

       74
       74
       +
       // connect establishes WebSocket connection and processes events

     

       75
       75
       +
       func (c *UserEventConsumer) connect(ctx context.Context) error {

     

       76
       76
       +
       	conn, _, err := websocket.DefaultDialer.DialContext(ctx, c.wsURL, nil)

     

       77
       77
       +
       	if err != nil {

     

       78
       78
       +
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       79
       79
       +
       	}

     

       80
       80
       +
       	defer conn.Close()

     

       81
       81
       +
       

     

       82
       82
       +
       	log.Println("Connected to Jetstream")

     

       83
       83
       +
       

     

       84
       84
       +
       	// Set read deadline to detect connection issues

     

       85
       85
       +
       	conn.SetReadDeadline(time.Now().Add(60 * time.Second))

     

       86
       86
       +
       

     

       87
       87
       +
       	// Set pong handler to keep connection alive

     

       88
       88
       +
       	conn.SetPongHandler(func(string) error {

     

       89
       89
       +
       		conn.SetReadDeadline(time.Now().Add(60 * time.Second))

     

       90
       90
       +
       		return nil

     

       91
       91
       +
       	})

     

       92
       92
       +
       

     

       93
       93
       +
       	// Start ping ticker

     

       94
       94
       +
       	ticker := time.NewTicker(30 * time.Second)

     

       95
       95
       +
       	defer ticker.Stop()

     

       96
       96
       +
       

     

       97
       97
       +
       	done := make(chan struct{})

     

       98
       98
       +
       

     

       99
       99
       +
       	// Goroutine to send pings

     

       100
       100
       +
       	// TODO: Fix race condition - multiple goroutines can call close(done) concurrently

     

       101
       101
       +
       	// Use sync.Once to ensure close(done) is called exactly once

     

       102
       102
       +
       	// See PR review issue #4

     

       103
       103
       +
       	go func() {

     

       104
       104
       +
       		for {

     

       105
       105
       +
       			select {

     

       106
       106
       +
       			case <-ticker.C:

     

       107
       107
       +
       				if err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {

     

       108
       108
       +
       					log.Printf("Ping error: %v", err)

     

       109
       109
       +
       					close(done)

     

       110
       110
       +
       					return

     

       111
       111
       +
       				}

     

       112
       112
       +
       			case <-done:

     

       113
       113
       +
       				return

     

       114
       114
       +
       			case <-ctx.Done():

     

       115
       115
       +
       				return

     

       116
       116
       +
       			}

     

       117
       117
       +
       		}

     

       118
       118
       +
       	}()

     

       119
       119
       +
       

     

       120
       120
       +
       	// Read messages

     

       121
       121
       +
       	for {

     

       122
       122
       +
       		select {

     

       123
       123
       +
       		case <-ctx.Done():

     

       124
       124
       +
       			return ctx.Err()

     

       125
       125
       +
       		case <-done:

     

       126
       126
       +
       			return fmt.Errorf("connection closed")

     

       127
       127
       +
       		default:

     

       128
       128
       +
       			_, message, err := conn.ReadMessage()

     

       129
       129
       +
       			if err != nil {

     

       130
       130
       +
       				close(done)

     

       131
       131
       +
       				return fmt.Errorf("read error: %w", err)

     

       132
       132
       +
       			}

     

       133
       133
       +
       

     

       134
       134
       +
       			// Reset read deadline on successful read

     

       135
       135
       +
       			conn.SetReadDeadline(time.Now().Add(60 * time.Second))

     

       136
       136
       +
       

     

       137
       137
       +
       			if err := c.handleEvent(ctx, message); err != nil {

     

       138
       138
       +
       				log.Printf("Error handling event: %v", err)

     

       139
       139
       +
       				// Continue processing other events

     

       140
       140
       +
       			}

     

       141
       141
       +
       		}

     

       142
       142
       +
       	}

     

       143
       143
       +
       }

     

       144
       144
       +
       

     

       145
       145
       +
       // handleEvent processes a single Jetstream event

     

       146
       146
       +
       func (c *UserEventConsumer) handleEvent(ctx context.Context, data []byte) error {

     

       147
       147
       +
       	var event JetstreamEvent

     

       148
       148
       +
       	if err := json.Unmarshal(data, &event); err != nil {

     

       149
       149
       +
       		return fmt.Errorf("failed to parse event: %w", err)

     

       150
       150
       +
       	}

     

       151
       151
       +
       

     

       152
       152
       +
       	// We're interested in identity events (handle updates) and account events (new users)

     

       153
       153
       +
       	switch event.Kind {

     

       154
       154
       +
       	case "identity":

     

       155
       155
       +
       		return c.handleIdentityEvent(ctx, &event)

     

       156
       156
       +
       	case "account":

     

       157
       157
       +
       		return c.handleAccountEvent(ctx, &event)

     

       158
       158
       +
       	default:

     

       159
       159
       +
       		// Ignore other event types (commits, etc.)

     

       160
       160
       +
       		return nil

     

       161
       161
       +
       	}

     

       162
       162
       +
       }

     

       163
       163
       +
       

     

       164
       164
       +
       // HandleIdentityEventPublic is a public wrapper for testing

     

       165
       165
       +
       func (c *UserEventConsumer) HandleIdentityEventPublic(ctx context.Context, event *JetstreamEvent) error {

     

       166
       166
       +
       	return c.handleIdentityEvent(ctx, event)

     

       167
       167
       +
       }

     

       168
       168
       +
       

     

       169
       169
       +
       // handleIdentityEvent processes identity events (handle changes)

     

       170
       170
       +
       func (c *UserEventConsumer) handleIdentityEvent(ctx context.Context, event *JetstreamEvent) error {

     

       171
       171
       +
       	if event.Identity == nil {

     

       172
       172
       +
       		return fmt.Errorf("identity event missing identity data")

     

       173
       173
       +
       	}

     

       174
       174
       +
       

     

       175
       175
       +
       	did := event.Identity.Did

     

       176
       176
       +
       	handle := event.Identity.Handle

     

       177
       177
       +
       

     

       178
       178
       +
       	if did == "" || handle == "" {

     

       179
       179
       +
       		return fmt.Errorf("identity event missing did or handle")

     

       180
       180
       +
       	}

     

       181
       181
       +
       

     

       182
       182
       +
       	log.Printf("Identity event: %s → %s", did, handle)

     

       183
       183
       +
       

     

       184
       184
       +
       	// For now, we'll create/update user on identity events

     

       185
       185
       +
       	// In a full implementation, you'd want to:

     

       186
       186
       +
       	// 1. Check if user exists

     

       187
       187
       +
       	// 2. Update handle if changed

     

       188
       188
       +
       	// 3. Resolve PDS URL from DID document

     

       189
       189
       +
       

     

       190
       190
       +
       	// Simplified: just try to create user (will be idempotent)

     

       191
       191
       +
       	// We need PDS URL - for now use a placeholder

     

       192
       192
       +
       	// TODO: Implement DID→PDS resolution via PLC directory (https://plc.directory/{did})

     

       193
       193
       +
       	// For production federation support, resolve PDS endpoint from DID document

     

       194
       194
       +
       	// For local dev, this works fine since we filter to our own PDS

     

       195
       195
       +
       	// See PR review issue #2

     

       196
       196
       +
       	pdsURL := "https://bsky.social" // Default Bluesky PDS

     

       197
       197
       +
       

     

       198
       198
       +
       	_, err := c.userService.CreateUser(ctx, users.CreateUserRequest{

     

       199
       199
       +
       		DID:    did,

     

       200
       200
       +
       		Handle: handle,

     

       201
       201
       +
       		PDSURL: pdsURL,

     

       202
       202
       +
       	})

     

       203
       203
       +
       

     

       204
       204
       +
       	if err != nil {

     

       205
       205
       +
       		// Check if it's a duplicate error (expected for idempotency)

     

       206
       206
       +
       		if isDuplicateError(err) {

     

       207
       207
       +
       			log.Printf("User already indexed: %s (%s)", handle, did)

     

       208
       208
       +
       			return nil

     

       209
       209
       +
       		}

     

       210
       210
       +
       		return fmt.Errorf("failed to create user: %w", err)

     

       211
       211
       +
       	}

     

       212
       212
       +
       

     

       213
       213
       +
       	log.Printf("Indexed new user: %s (%s)", handle, did)

     

       214
       214
       +
       	return nil

     

       215
       215
       +
       }

     

       216
       216
       +
       

     

       217
       217
       +
       // handleAccountEvent processes account events (account creation/updates)

     

       218
       218
       +
       func (c *UserEventConsumer) handleAccountEvent(ctx context.Context, event *JetstreamEvent) error {

     

       219
       219
       +
       	if event.Account == nil {

     

       220
       220
       +
       		return fmt.Errorf("account event missing account data")

     

       221
       221
       +
       	}

     

       222
       222
       +
       

     

       223
       223
       +
       	did := event.Account.Did

     

       224
       224
       +
       	if did == "" {

     

       225
       225
       +
       		return fmt.Errorf("account event missing did")

     

       226
       226
       +
       	}

     

       227
       227
       +
       

     

       228
       228
       +
       	// Account events don't include handle, so we can't index yet

     

       229
       229
       +
       	// We'll wait for the corresponding identity event

     

       230
       230
       +
       	log.Printf("Account event for %s (waiting for identity event)", did)

     

       231
       231
       +
       	return nil

     

       232
       232
       +
       }

     

       233
       233
       +
       

     

       234
       234
       +
       // isDuplicateError checks if error is due to duplicate DID/handle

     

       235
       235
       +
       func isDuplicateError(err error) bool {

     

       236
       236
       +
       	if err == nil {

     

       237
       237
       +
       		return false

     

       238
       238
       +
       	}

     

       239
       239
       +
       	errStr := err.Error()

     

       240
       240
       +
       	return contains(errStr, "already exists") || contains(errStr, "already taken") || contains(errStr, "duplicate")

     

       241
       241
       +
       }

     

       242
       242
       +
       

     

       243
       243
       +
       func contains(s, substr string) bool {

     

       244
       244
       +
       	return len(s) >= len(substr) && (s == substr || len(s) > len(substr) && anySubstring(s, substr))

     

       245
       245
       +
       }

     

       246
       246
       +
       

     

       247
       247
       +
       func anySubstring(s, substr string) bool {

     

       248
       248
       +
       	for i := 0; i <= len(s)-len(substr); i++ {

     

       249
       249
       +
       		if s[i:i+len(substr)] == substr {

     

       250
       250
       +
       			return true

     

       251
       251
       +
       		}

     

       252
       252
       +
       	}

     

       253
       253
       +
       	return false

     

       254
       254
       +
       }

-8

.idea/.gitignore

···

       1
       1
       -
       # Default ignored files

     

       2
       2
       -
       /shelf/

     

       3
       3
       -
       /workspace.xml

     

       4
       4
       -
       # Editor-based HTTP Client requests

     

       5
       5
       -
       /httpRequests/

     

       6
       6
       -
       # Datasource local storage ignored files

     

       7
       7
       -
       /dataSources/

     

       8
       8
       -
       /dataSources.local.xml

-9

.idea/Coves.iml

···

       1
       1
       -
       <?xml version="1.0" encoding="UTF-8"?>

     

       2
       2
       -
       <module type="WEB_MODULE" version="4">

     

       3
       3
       -
         <component name="Go" enabled="true" />

     

       4
       4
       -
         <component name="NewModuleRootManager">

     

       5
       5
       -
           <content url="file://$MODULE_DIR$" />

     

       6
       6
       -
           <orderEntry type="inheritedJdk" />

     

       7
       7
       -
           <orderEntry type="sourceFolder" forTests="false" />

     

       8
       8
       -
         </component>

     

       9
       9
       -
       </module>

-17

.idea/dataSources.xml

···

       1
       1
       -
       <?xml version="1.0" encoding="UTF-8"?>

     

       2
       2
       -
       <project version="4">

     

       3
       3
       -
         <component name="DataSourceManagerImpl" format="xml" multifile-model="true">

     

       4
       4
       -
           <data-source source="LOCAL" name="postgres@localhost" uuid="66e25b60-2901-4e78-bdb8-343f2c71fb79">

     

       5
       5
       -
             <driver-ref>postgresql</driver-ref>

     

       6
       6
       -
             <synchronize>true</synchronize>

     

       7
       7
       -
             <jdbc-driver>org.postgresql.Driver</jdbc-driver>

     

       8
       8
       -
             <jdbc-url>jdbc:postgresql://localhost:5433/postgres</jdbc-url>

     

       9
       9
       -
             <jdbc-additional-properties>

     

       10
       10
       -
               <property name="com.intellij.clouds.kubernetes.db.host.port" />

     

       11
       11
       -
               <property name="com.intellij.clouds.kubernetes.db.enabled" value="false" />

     

       12
       12
       -
               <property name="com.intellij.clouds.kubernetes.db.container.port" />

     

       13
       13
       -
             </jdbc-additional-properties>

     

       14
       14
       -
             <working-dir>$ProjectFileDir$</working-dir>

     

       15
       15
       -
           </data-source>

     

       16
       16
       -
         </component>

     

       17
       17
       -
       </project>

-8

.idea/modules.xml

···

       1
       1
       -
       <?xml version="1.0" encoding="UTF-8"?>

     

       2
       2
       -
       <project version="4">

     

       3
       3
       -
         <component name="ProjectModuleManager">

     

       4
       4
       -
           <modules>

     

       5
       5
       -
             <module fileurl="file://$PROJECT_DIR$/.idea/Coves.iml" filepath="$PROJECT_DIR$/.idea/Coves.iml" />

     

       6
       6
       -
           </modules>

     

       7
       7
       -
         </component>

     

       8
       8
       -
       </project>

-6

.idea/vcs.xml

···

       1
       1
       -
       <?xml version="1.0" encoding="UTF-8"?>

     

       2
       2
       -
       <project version="4">

     

       3
       3
       -
         <component name="VcsDirectoryMappings">

     

       4
       4
       -
           <mapping directory="$PROJECT_DIR$" vcs="Git" />

     

       5
       5
       -
         </component>

     

       6
       6
       -
       </project>

+88

internal/atproto/identity/caching_resolver.go

···

       1
       1
       +
       package identity

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"log"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       // cachingResolver wraps a base resolver with caching

     

       9
       9
       +
       type cachingResolver struct {

     

       10
       10
       +
       	base  Resolver

     

       11
       11
       +
       	cache IdentityCache

     

       12
       12
       +
       }

     

       13
       13
       +
       

     

       14
       14
       +
       // newCachingResolver creates a new caching resolver

     

       15
       15
       +
       func newCachingResolver(base Resolver, cache IdentityCache) Resolver {

     

       16
       16
       +
       	return &cachingResolver{

     

       17
       17
       +
       		base:  base,

     

       18
       18
       +
       		cache: cache,

     

       19
       19
       +
       	}

     

       20
       20
       +
       }

     

       21
       21
       +
       

     

       22
       22
       +
       // Resolve resolves a handle or DID to complete identity information

     

       23
       23
       +
       // First checks cache, then falls back to base resolver

     

       24
       24
       +
       func (r *cachingResolver) Resolve(ctx context.Context, identifier string) (*Identity, error) {

     

       25
       25
       +
       	// Try cache first

     

       26
       26
       +
       	cached, err := r.cache.Get(ctx, identifier)

     

       27
       27
       +
       	if err == nil {

     

       28
       28
       +
       		// Cache hit - mark it as from cache

     

       29
       29
       +
       		cached.Method = MethodCache

     

       30
       30
       +
       		return cached, nil

     

       31
       31
       +
       	}

     

       32
       32
       +
       

     

       33
       33
       +
       	// Cache miss - resolve using base resolver

     

       34
       34
       +
       	identity, err := r.base.Resolve(ctx, identifier)

     

       35
       35
       +
       	if err != nil {

     

       36
       36
       +
       		return nil, err

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	// Cache the resolved identity (ignore cache errors, just log them)

     

       40
       40
       +
       	if cacheErr := r.cache.Set(ctx, identity); cacheErr != nil {

     

       41
       41
       +
       		log.Printf("Warning: failed to cache identity for %s: %v", identifier, cacheErr)

     

       42
       42
       +
       	}

     

       43
       43
       +
       

     

       44
       44
       +
       	return identity, nil

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       // ResolveHandle specifically resolves a handle to DID and PDS URL

     

       48
       48
       +
       func (r *cachingResolver) ResolveHandle(ctx context.Context, handle string) (did, pdsURL string, err error) {

     

       49
       49
       +
       	identity, err := r.Resolve(ctx, handle)

     

       50
       50
       +
       	if err != nil {

     

       51
       51
       +
       		return "", "", err

     

       52
       52
       +
       	}

     

       53
       53
       +
       

     

       54
       54
       +
       	return identity.DID, identity.PDSURL, nil

     

       55
       55
       +
       }

     

       56
       56
       +
       

     

       57
       57
       +
       // ResolveDID retrieves a DID document and extracts the PDS endpoint

     

       58
       58
       +
       func (r *cachingResolver) ResolveDID(ctx context.Context, did string) (*DIDDocument, error) {

     

       59
       59
       +
       	// Try to get from cache first

     

       60
       60
       +
       	cached, err := r.cache.Get(ctx, did)

     

       61
       61
       +
       	if err == nil {

     

       62
       62
       +
       		// We have cached identity, construct a simple DID document

     

       63
       63
       +
       		return &DIDDocument{

     

       64
       64
       +
       			DID: cached.DID,

     

       65
       65
       +
       			Service: []Service{

     

       66
       66
       +
       				{

     

       67
       67
       +
       					ID:              "#atproto_pds",

     

       68
       68
       +
       					Type:            "AtprotoPersonalDataServer",

     

       69
       69
       +
       					ServiceEndpoint: cached.PDSURL,

     

       70
       70
       +
       				},

     

       71
       71
       +
       			},

     

       72
       72
       +
       		}, nil

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Cache miss - use base resolver

     

       76
       76
       +
       	return r.base.ResolveDID(ctx, did)

     

       77
       77
       +
       }

     

       78
       78
       +
       

     

       79
       79
       +
       // Purge removes an identifier from the cache and propagates to base

     

       80
       80
       +
       func (r *cachingResolver) Purge(ctx context.Context, identifier string) error {

     

       81
       81
       +
       	// Purge from cache

     

       82
       82
       +
       	if err := r.cache.Purge(ctx, identifier); err != nil {

     

       83
       83
       +
       		return err

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	// Propagate to base resolver (though it typically won't cache)

     

       87
       87
       +
       	return r.base.Purge(ctx, identifier)

     

       88
       88
       +
       }

+45

internal/atproto/identity/errors.go

···

       1
       1
       +
       package identity

     

       2
       2
       +
       

     

       3
       3
       +
       import "fmt"

     

       4
       4
       +
       

     

       5
       5
       +
       // ErrNotFound is returned when an identity cannot be resolved

     

       6
       6
       +
       type ErrNotFound struct {

     

       7
       7
       +
       	Identifier string

     

       8
       8
       +
       	Reason     string

     

       9
       9
       +
       }

     

       10
       10
       +
       

     

       11
       11
       +
       func (e *ErrNotFound) Error() string {

     

       12
       12
       +
       	if e.Reason != "" {

     

       13
       13
       +
       		return fmt.Sprintf("identity not found: %s (%s)", e.Identifier, e.Reason)

     

       14
       14
       +
       	}

     

       15
       15
       +
       	return fmt.Sprintf("identity not found: %s", e.Identifier)

     

       16
       16
       +
       }

     

       17
       17
       +
       

     

       18
       18
       +
       // ErrInvalidIdentifier is returned for malformed handles or DIDs

     

       19
       19
       +
       type ErrInvalidIdentifier struct {

     

       20
       20
       +
       	Identifier string

     

       21
       21
       +
       	Reason     string

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       func (e *ErrInvalidIdentifier) Error() string {

     

       25
       25
       +
       	return fmt.Sprintf("invalid identifier %s: %s", e.Identifier, e.Reason)

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // ErrCacheMiss is returned when an identifier is not in the cache

     

       29
       29
       +
       type ErrCacheMiss struct {

     

       30
       30
       +
       	Identifier string

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       func (e *ErrCacheMiss) Error() string {

     

       34
       34
       +
       	return fmt.Sprintf("cache miss: %s", e.Identifier)

     

       35
       35
       +
       }

     

       36
       36
       +
       

     

       37
       37
       +
       // ErrResolutionFailed is returned when resolution fails for reasons other than not found

     

       38
       38
       +
       type ErrResolutionFailed struct {

     

       39
       39
       +
       	Identifier string

     

       40
       40
       +
       	Reason     string

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       func (e *ErrResolutionFailed) Error() string {

     

       44
       44
       +
       	return fmt.Sprintf("resolution failed for %s: %s", e.Identifier, e.Reason)

     

       45
       45
       +
       }

+40

internal/atproto/identity/resolver.go

···

       1
       1
       +
       package identity

     

       2
       2
       +
       

     

       3
       3
       +
       import "context"

     

       4
       4
       +
       

     

       5
       5
       +
       // Resolver provides methods for resolving atProto identities

     

       6
       6
       +
       type Resolver interface {

     

       7
       7
       +
       	// Resolve resolves a handle or DID to complete identity information

     

       8
       8
       +
       	// The identifier can be either:

     

       9
       9
       +
       	// - A handle (e.g., "alice.bsky.social")

     

       10
       10
       +
       	// - A DID (e.g., "did:plc:abc123")

     

       11
       11
       +
       	Resolve(ctx context.Context, identifier string) (*Identity, error)

     

       12
       12
       +
       

     

       13
       13
       +
       	// ResolveHandle specifically resolves a handle to DID and PDS URL

     

       14
       14
       +
       	// This is a convenience method for handle-only resolution

     

       15
       15
       +
       	ResolveHandle(ctx context.Context, handle string) (did, pdsURL string, err error)

     

       16
       16
       +
       

     

       17
       17
       +
       	// ResolveDID retrieves a DID document and extracts the PDS endpoint

     

       18
       18
       +
       	ResolveDID(ctx context.Context, did string) (*DIDDocument, error)

     

       19
       19
       +
       

     

       20
       20
       +
       	// Purge removes an identifier from the cache

     

       21
       21
       +
       	// The identifier can be either a handle or DID

     

       22
       22
       +
       	Purge(ctx context.Context, identifier string) error

     

       23
       23
       +
       }

     

       24
       24
       +
       

     

       25
       25
       +
       // IdentityCache provides caching for resolved identities

     

       26
       26
       +
       type IdentityCache interface {

     

       27
       27
       +
       	// Get retrieves a cached identity by handle or DID

     

       28
       28
       +
       	Get(ctx context.Context, identifier string) (*Identity, error)

     

       29
       29
       +
       

     

       30
       30
       +
       	// Set caches an identity with the given TTL

     

       31
       31
       +
       	// This should cache bidirectionally (both handle and DID as keys)

     

       32
       32
       +
       	Set(ctx context.Context, identity *Identity) error

     

       33
       33
       +
       

     

       34
       34
       +
       	// Delete removes a cached identity by identifier

     

       35
       35
       +
       	Delete(ctx context.Context, identifier string) error

     

       36
       36
       +
       

     

       37
       37
       +
       	// Purge removes all cache entries associated with an identifier

     

       38
       38
       +
       	// (both handle and DID if applicable)

     

       39
       39
       +
       	Purge(ctx context.Context, identifier string) error

     

       40
       40
       +
       }

+35

internal/atproto/identity/types.go

···

       1
       1
       +
       package identity

     

       2
       2
       +
       

     

       3
       3
       +
       import "time"

     

       4
       4
       +
       

     

       5
       5
       +
       // ResolutionMethod indicates how an identity was resolved

     

       6
       6
       +
       type ResolutionMethod string

     

       7
       7
       +
       

     

       8
       8
       +
       const (

     

       9
       9
       +
       	MethodCache ResolutionMethod = "cache"

     

       10
       10
       +
       	MethodDNS   ResolutionMethod = "dns"

     

       11
       11
       +
       	MethodHTTPS ResolutionMethod = "https"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // Identity represents a fully resolved atProto identity

     

       15
       15
       +
       type Identity struct {

     

       16
       16
       +
       	DID        string           // Decentralized Identifier (e.g., "did:plc:abc123")

     

       17
       17
       +
       	Handle     string           // Human-readable handle (e.g., "alice.bsky.social")

     

       18
       18
       +
       	PDSURL     string           // Personal Data Server URL

     

       19
       19
       +
       	ResolvedAt time.Time        // When this identity was resolved

     

       20
       20
       +
       	Method     ResolutionMethod // How it was resolved (cache, DNS, HTTPS)

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // DIDDocument represents an AT Protocol DID document

     

       24
       24
       +
       // For now, we only extract the PDS service endpoint

     

       25
       25
       +
       type DIDDocument struct {

     

       26
       26
       +
       	DID     string

     

       27
       27
       +
       	Service []Service

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       // Service represents a service entry in a DID document

     

       31
       31
       +
       type Service struct {

     

       32
       32
       +
       	ID              string

     

       33
       33
       +
       	Type            string

     

       34
       34
       +
       	ServiceEndpoint string

     

       35
       35
       +
       }

+58

internal/db/migrations/002_create_identity_cache_table.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- +goose StatementBegin

     

       3
       3
       +
       CREATE TABLE identity_cache (

     

       4
       4
       +
           -- Can lookup by either handle or DID

     

       5
       5
       +
           identifier TEXT PRIMARY KEY,

     

       6
       6
       +
       

     

       7
       7
       +
           -- Cached resolution data

     

       8
       8
       +
           did TEXT NOT NULL,

     

       9
       9
       +
           handle TEXT,

     

       10
       10
       +
           pds_url TEXT,

     

       11
       11
       +
       

     

       12
       12
       +
           -- Resolution metadata

     

       13
       13
       +
           resolved_at TIMESTAMP WITH TIME ZONE NOT NULL,

     

       14
       14
       +
           resolution_method TEXT NOT NULL, -- 'dns', 'https', 'cache'

     

       15
       15
       +
       

     

       16
       16
       +
           -- Cache management

     

       17
       17
       +
           expires_at TIMESTAMP WITH TIME ZONE NOT NULL,

     

       18
       18
       +
           created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,

     

       19
       19
       +
           updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP

     

       20
       20
       +
       );

     

       21
       21
       +
       

     

       22
       22
       +
       -- Index for reverse lookup (DID → handle)

     

       23
       23
       +
       CREATE INDEX idx_identity_cache_did ON identity_cache(did);

     

       24
       24
       +
       

     

       25
       25
       +
       -- Index for expiry cleanup

     

       26
       26
       +
       CREATE INDEX idx_identity_cache_expires ON identity_cache(expires_at);

     

       27
       27
       +
       

     

       28
       28
       +
       -- Function to normalize handles to lowercase

     

       29
       29
       +
       CREATE OR REPLACE FUNCTION normalize_handle() RETURNS TRIGGER AS $$

     

       30
       30
       +
       BEGIN

     

       31
       31
       +
           IF NEW.handle IS NOT NULL THEN

     

       32
       32
       +
               NEW.handle = LOWER(TRIM(NEW.handle));

     

       33
       33
       +
           END IF;

     

       34
       34
       +
           IF TG_OP = 'INSERT' OR TG_OP = 'UPDATE' THEN

     

       35
       35
       +
               -- Normalize identifier if it looks like a handle (contains a dot)

     

       36
       36
       +
               IF NEW.identifier LIKE '%.%' THEN

     

       37
       37
       +
                   NEW.identifier = LOWER(TRIM(NEW.identifier));

     

       38
       38
       +
               END IF;

     

       39
       39
       +
           END IF;

     

       40
       40
       +
           NEW.updated_at = CURRENT_TIMESTAMP;

     

       41
       41
       +
           RETURN NEW;

     

       42
       42
       +
       END;

     

       43
       43
       +
       $$ LANGUAGE plpgsql;

     

       44
       44
       +
       

     

       45
       45
       +
       -- Trigger to normalize handles automatically

     

       46
       46
       +
       CREATE TRIGGER normalize_handle_trigger

     

       47
       47
       +
           BEFORE INSERT OR UPDATE ON identity_cache

     

       48
       48
       +
           FOR EACH ROW

     

       49
       49
       +
           EXECUTE FUNCTION normalize_handle();

     

       50
       50
       +
       

     

       51
       51
       +
       -- +goose StatementEnd

     

       52
       52
       +
       

     

       53
       53
       +
       -- +goose Down

     

       54
       54
       +
       -- +goose StatementBegin

     

       55
       55
       +
       DROP TRIGGER IF EXISTS normalize_handle_trigger ON identity_cache;

     

       56
       56
       +
       DROP FUNCTION IF EXISTS normalize_handle();

     

       57
       57
       +
       DROP TABLE IF EXISTS identity_cache;

     

       58
       58
       +
       -- +goose StatementEnd

+1 -1

PRD.md

···

       19
       19
        
       ### Phase 1: Core Forum Platform (Web)

     

       20
       20
        
       

     

       21
       21
        
       #### Must Have:

     

       22
       22
       -
       - **Indigo PDS Integration** - Use existing atProto infrastructure (no CAR file reimplementation!)

     

       22
       22
       +
       - **Indigo PDS Integration**1 - Use existing atProto infrastructure (no CAR file reimplementation!)

     

       23
       23
        
       - User registration with phone verification (verified badge)

     

       24
       24
        
       - Community creation, subscription, and discovery

     

       25
       25
        
       - Post creation (text initially, then image/video/article)

+69

internal/db/migrations/003_create_oauth_tables.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Create OAuth tables for managing OAuth flow state and user sessions

     

       3
       3
       +
       

     

       4
       4
       +
       -- Temporary state during OAuth authorization flow (30 min TTL)

     

       5
       5
       +
       -- This stores the intermediate state between redirect to auth server and callback

     

       6
       6
       +
       CREATE TABLE oauth_requests (

     

       7
       7
       +
           id SERIAL PRIMARY KEY,

     

       8
       8
       +
           state TEXT UNIQUE NOT NULL,                     -- OAuth state parameter (CSRF protection)

     

       9
       9
       +
           did TEXT NOT NULL,                              -- User's DID (resolved from handle)

     

       10
       10
       +
           handle TEXT NOT NULL,                           -- User's handle (e.g., alice.bsky.social)

     

       11
       11
       +
           pds_url TEXT NOT NULL,                          -- User's PDS URL

     

       12
       12
       +
           pkce_verifier TEXT NOT NULL,                    -- PKCE code verifier

     

       13
       13
       +
           dpop_private_jwk JSONB NOT NULL,                -- DPoP private key (ES256) for this session

     

       14
       14
       +
           dpop_authserver_nonce TEXT,                     -- DPoP nonce from authorization server

     

       15
       15
       +
           auth_server_iss TEXT NOT NULL,                  -- Authorization server issuer

     

       16
       16
       +
           return_url TEXT,                                -- Optional return URL after login

     

       17
       17
       +
           created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP

     

       18
       18
       +
       );

     

       19
       19
       +
       

     

       20
       20
       +
       -- Long-lived user sessions (7 day TTL, auto-refreshed)

     

       21
       21
       +
       -- This stores authenticated user sessions with OAuth tokens

     

       22
       22
       +
       CREATE TABLE oauth_sessions (

     

       23
       23
       +
           id SERIAL PRIMARY KEY,

     

       24
       24
       +
           did TEXT UNIQUE NOT NULL,                       -- User's DID (primary identifier)

     

       25
       25
       +
           handle TEXT NOT NULL,                           -- User's handle (can change)

     

       26
       26
       +
           pds_url TEXT NOT NULL,                          -- User's PDS URL

     

       27
       27
       +
           access_token TEXT NOT NULL,                     -- OAuth access token (DPoP-bound)

     

       28
       28
       +
           refresh_token TEXT NOT NULL,                    -- OAuth refresh token

     

       29
       29
       +
           dpop_private_jwk JSONB NOT NULL,                -- DPoP private key for this session

     

       30
       30
       +
           dpop_authserver_nonce TEXT,                     -- DPoP nonce for auth server token endpoint

     

       31
       31
       +
           dpop_pds_nonce TEXT,                            -- DPoP nonce for PDS requests

     

       32
       32
       +
           auth_server_iss TEXT NOT NULL,                  -- Authorization server issuer

     

       33
       33
       +
           expires_at TIMESTAMP WITH TIME ZONE NOT NULL,   -- Token expiration time

     

       34
       34
       +
           created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,

     

       35
       35
       +
           updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP

     

       36
       36
       +
       );

     

       37
       37
       +
       

     

       38
       38
       +
       -- Indexes for efficient lookups

     

       39
       39
       +
       CREATE INDEX idx_oauth_requests_state ON oauth_requests(state);

     

       40
       40
       +
       CREATE INDEX idx_oauth_requests_created_at ON oauth_requests(created_at);

     

       41
       41
       +
       CREATE INDEX idx_oauth_sessions_did ON oauth_sessions(did);

     

       42
       42
       +
       CREATE INDEX idx_oauth_sessions_expires_at ON oauth_sessions(expires_at);

     

       43
       43
       +
       

     

       44
       44
       +
       -- Function to update updated_at timestamp

     

       45
       45
       +
       -- +goose StatementBegin

     

       46
       46
       +
       CREATE OR REPLACE FUNCTION update_oauth_session_updated_at()

     

       47
       47
       +
       RETURNS TRIGGER AS $$

     

       48
       48
       +
       BEGIN

     

       49
       49
       +
           NEW.updated_at = CURRENT_TIMESTAMP;

     

       50
       50
       +
           RETURN NEW;

     

       51
       51
       +
       END;

     

       52
       52
       +
       $$ LANGUAGE plpgsql;

     

       53
       53
       +
       -- +goose StatementEnd

     

       54
       54
       +
       

     

       55
       55
       +
       -- Trigger to automatically update updated_at

     

       56
       56
       +
       CREATE TRIGGER oauth_sessions_updated_at

     

       57
       57
       +
           BEFORE UPDATE ON oauth_sessions

     

       58
       58
       +
           FOR EACH ROW

     

       59
       59
       +
           EXECUTE FUNCTION update_oauth_session_updated_at();

     

       60
       60
       +
       

     

       61
       61
       +
       -- +goose Down

     

       62
       62
       +
       DROP TRIGGER IF EXISTS oauth_sessions_updated_at ON oauth_sessions;

     

       63
       63
       +
       DROP FUNCTION IF EXISTS update_oauth_session_updated_at();

     

       64
       64
       +
       DROP INDEX IF EXISTS idx_oauth_sessions_expires_at;

     

       65
       65
       +
       DROP INDEX IF EXISTS idx_oauth_sessions_did;

     

       66
       66
       +
       DROP INDEX IF EXISTS idx_oauth_requests_created_at;

     

       67
       67
       +
       DROP INDEX IF EXISTS idx_oauth_requests_state;

     

       68
       68
       +
       DROP TABLE IF EXISTS oauth_sessions;

     

       69
       69
       +
       DROP TABLE IF EXISTS oauth_requests;

+39

internal/db/migrations/006_encrypt_community_credentials.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Enable pgcrypto extension for encryption at rest

     

       3
       3
       +
       CREATE EXTENSION IF NOT EXISTS pgcrypto;

     

       4
       4
       +
       

     

       5
       5
       +
       -- Create encryption key table (single-row config table)

     

       6
       6
       +
       -- SECURITY: In production, use environment variable or external key management

     

       7
       7
       +
       CREATE TABLE encryption_keys (

     

       8
       8
       +
           id INTEGER PRIMARY KEY CHECK (id = 1),

     

       9
       9
       +
           key_data BYTEA NOT NULL,

     

       10
       10
       +
           created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,

     

       11
       11
       +
           rotated_at TIMESTAMP WITH TIME ZONE

     

       12
       12
       +
       );

     

       13
       13
       +
       

     

       14
       14
       +
       -- Insert default encryption key

     

       15
       15
       +
       INSERT INTO encryption_keys (id, key_data)

     

       16
       16
       +
       VALUES (1, gen_random_bytes(32))

     

       17
       17
       +
       ON CONFLICT (id) DO NOTHING;

     

       18
       18
       +
       

     

       19
       19
       +
       -- Add encrypted columns

     

       20
       20
       +
       ALTER TABLE communities

     

       21
       21
       +
           ADD COLUMN pds_access_token_encrypted BYTEA,

     

       22
       22
       +
           ADD COLUMN pds_refresh_token_encrypted BYTEA;

     

       23
       23
       +
       

     

       24
       24
       +
       -- Add index for communities with credentials

     

       25
       25
       +
       CREATE INDEX idx_communities_encrypted_tokens ON communities(did) WHERE pds_access_token_encrypted IS NOT NULL;

     

       26
       26
       +
       

     

       27
       27
       +
       -- Security comments

     

       28
       28
       +
       COMMENT ON TABLE encryption_keys IS 'Encryption keys for sensitive data - RESTRICT ACCESS';

     

       29
       29
       +
       COMMENT ON COLUMN communities.pds_access_token_encrypted IS 'Encrypted JWT - decrypt with pgp_sym_decrypt';

     

       30
       30
       +
       COMMENT ON COLUMN communities.pds_refresh_token_encrypted IS 'Encrypted refresh token - decrypt with pgp_sym_decrypt';

     

       31
       31
       +
       

     

       32
       32
       +
       -- +goose Down

     

       33
       33
       +
       DROP INDEX IF EXISTS idx_communities_encrypted_tokens;

     

       34
       34
       +
       

     

       35
       35
       +
       ALTER TABLE communities

     

       36
       36
       +
           DROP COLUMN IF EXISTS pds_access_token_encrypted,

     

       37
       37
       +
           DROP COLUMN IF EXISTS pds_refresh_token_encrypted;

     

       38
       38
       +
       

     

       39
       39
       +
       DROP TABLE IF EXISTS encryption_keys;

+4 -4

internal/api/middleware/ratelimit.go

···

       9
       9
        
       // RateLimiter implements a simple in-memory rate limiter

     

       10
       10
        
       // For production, consider using Redis or a distributed rate limiter

     

       11
       11
        
       type RateLimiter struct {

     

       12
       12
       -
       	mu       sync.Mutex

     

       13
       12
        
       	clients  map[string]*clientLimit

     

       14
       14
       -
       	requests int           // Max requests per window

     

       15
       15
       -
       	window   time.Duration // Time window

     

       13
       13
       +
       	requests int

     

       14
       14
       +
       	window   time.Duration

     

       15
       15
       +
       	mu       sync.Mutex

     

       16
       16
        
       }

     

       17
       17
        
       

     

       18
       18
        
       type clientLimit struct {

     

       19
       19
       -
       	count     int

     

       20
       19
        
       	resetTime time.Time

     

       20
       20
       +
       	count     int

     

       21
       21
        
       }

     

       22
       22
        
       

     

       23
       23
        
       // NewRateLimiter creates a new rate limiter

+2 -2

internal/core/errors/errors.go

···

       36
       36
        
       }

     

       37
       37
        
       

     

       38
       38
        
       type NotFoundError struct {

     

       39
       39
       -
       	Resource string

     

       40
       39
        
       	ID       interface{}

     

       40
       40
       +
       	Resource string

     

       41
       41
        
       }

     

       42
       42
        
       

     

       43
       43
        
       func (e NotFoundError) Error() string {

     
···

       64
       64
        
       		Resource: resource,

     

       65
       65
        
       		ID:       id,

     

       66
       66
        
       	}

     

       67
       67
       -
       }
     

       67
       67
       +
       }

+8 -8

internal/core/users/user.go

···

       8
       8
        
       // This is NOT the user's repository - that lives in the PDS

     

       9
       9
        
       // This table only tracks metadata for efficient AppView queries

     

       10
       10
        
       type User struct {

     

       11
       11
       -
       	DID       string    `json:"did" db:"did"`           // atProto DID (e.g., did:plc:xyz123)

     

       12
       12
       -
       	Handle    string    `json:"handle" db:"handle"`     // Human-readable handle (e.g., alice.coves.dev)

     

       13
       13
       -
       	PDSURL    string    `json:"pdsUrl" db:"pds_url"`    // User's PDS host URL (supports federation)

     

       14
       11
        
       	CreatedAt time.Time `json:"createdAt" db:"created_at"`

     

       15
       12
        
       	UpdatedAt time.Time `json:"updatedAt" db:"updated_at"`

     

       13
       13
       +
       	DID       string    `json:"did" db:"did"`

     

       14
       14
       +
       	Handle    string    `json:"handle" db:"handle"`

     

       15
       15
       +
       	PDSURL    string    `json:"pdsUrl" db:"pds_url"`

     

       16
       16
        
       }

     

       17
       17
        
       

     

       18
       18
        
       // CreateUserRequest represents the input for creating a new user

     
···

       32
       32
        
       

     

       33
       33
        
       // RegisterAccountResponse represents the response from PDS account creation

     

       34
       34
        
       type RegisterAccountResponse struct {

     

       35
       35
       -
       	DID         string `json:"did"`

     

       36
       36
       -
       	Handle      string `json:"handle"`

     

       37
       37
       -
       	AccessJwt   string `json:"accessJwt"`

     

       38
       38
       -
       	RefreshJwt  string `json:"refreshJwt"`

     

       39
       39
       -
       	PDSURL      string `json:"pdsUrl"`

     

       35
       35
       +
       	DID        string `json:"did"`

     

       36
       36
       +
       	Handle     string `json:"handle"`

     

       37
       37
       +
       	AccessJwt  string `json:"accessJwt"`

     

       38
       38
       +
       	RefreshJwt string `json:"refreshJwt"`

     

       39
       39
       +
       	PDSURL     string `json:"pdsUrl"`

     

       40
       40
        
       }

+35

internal/db/migrations/007_add_password_encryption.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- +goose StatementBegin

     

       3
       3
       +
       -- V2.0: Add encrypted password column for PDS account recovery

     

       4
       4
       +
       -- CRITICAL FIX: Password must be encrypted (not hashed) for session recovery

     

       5
       5
       +
       -- When access/refresh tokens expire (90-day window), we need the plaintext password

     

       6
       6
       +
       -- to call com.atproto.server.createSession - bcrypt hashing prevents this

     

       7
       7
       +
       

     

       8
       8
       +
       -- Add encrypted password column

     

       9
       9
       +
       ALTER TABLE communities ADD COLUMN pds_password_encrypted BYTEA;

     

       10
       10
       +
       

     

       11
       11
       +
       -- Drop legacy plaintext token columns (we now use *_encrypted versions from migration 006)

     

       12
       12
       +
       ALTER TABLE communities DROP COLUMN IF EXISTS pds_access_token;

     

       13
       13
       +
       ALTER TABLE communities DROP COLUMN IF EXISTS pds_refresh_token;

     

       14
       14
       +
       

     

       15
       15
       +
       -- Drop legacy password_hash column from migration 005 (never used in production)

     

       16
       16
       +
       ALTER TABLE communities DROP COLUMN IF EXISTS pds_password_hash;

     

       17
       17
       +
       

     

       18
       18
       +
       -- Add comment

     

       19
       19
       +
       COMMENT ON COLUMN communities.pds_password_encrypted IS 'Encrypted community PDS password (pgp_sym_encrypt) - required for session recovery when tokens expire';

     

       20
       20
       +
       

     

       21
       21
       +
       -- +goose StatementEnd

     

       22
       22
       +
       

     

       23
       23
       +
       -- +goose Down

     

       24
       24
       +
       -- +goose StatementBegin

     

       25
       25
       +
       -- Restore legacy columns (for rollback compatibility)

     

       26
       26
       +
       ALTER TABLE communities ADD COLUMN pds_access_token TEXT;

     

       27
       27
       +
       ALTER TABLE communities ADD COLUMN pds_refresh_token TEXT;

     

       28
       28
       +
       ALTER TABLE communities ADD COLUMN pds_password_hash TEXT;

     

       29
       29
       +
       

     

       30
       30
       +
       -- Drop encrypted password

     

       31
       31
       +
       ALTER TABLE communities DROP COLUMN IF EXISTS pds_password_encrypted;

     

       32
       32
       +
       

     

       33
       33
       +
       -- Restore old comment

     

       34
       34
       +
       COMMENT ON COLUMN communities.pds_password_hash IS 'bcrypt hash of community PDS password (DEPRECATED - cannot recover plaintext)';

     

       35
       35
       +
       -- +goose StatementEnd

-80

internal/atproto/did/generator.go

···

       1
       1
       -
       package did

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"crypto/rand"

     

       5
       5
       -
       	"encoding/base32"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"strings"

     

       8
       8
       -
       )

     

       9
       9
       -
       

     

       10
       10
       -
       // Generator creates DIDs for Coves entities

     

       11
       11
       -
       type Generator struct {

     

       12
       12
       -
       	plcDirectoryURL string

     

       13
       13
       -
       	isDevEnv        bool

     

       14
       14
       -
       }

     

       15
       15
       -
       

     

       16
       16
       -
       // NewGenerator creates a new DID generator

     

       17
       17
       -
       // isDevEnv: true for local development (no PLC registration), false for production (register with PLC)

     

       18
       18
       -
       // plcDirectoryURL: URL for PLC directory (e.g., "https://plc.directory")

     

       19
       19
       -
       func NewGenerator(isDevEnv bool, plcDirectoryURL string) *Generator {

     

       20
       20
       -
       	return &Generator{

     

       21
       21
       -
       		isDevEnv:        isDevEnv,

     

       22
       22
       -
       		plcDirectoryURL: plcDirectoryURL,

     

       23
       23
       -
       	}

     

       24
       24
       -
       }

     

       25
       25
       -
       

     

       26
       26
       -
       // GenerateCommunityDID creates a new random DID for a community

     

       27
       27
       -
       // Format: did:plc:{base32-random}

     

       28
       28
       -
       //

     

       29
       29
       -
       // Dev mode (isDevEnv=true):  Generates did:plc:xxx without registering to PLC

     

       30
       30
       -
       // Prod mode (isDevEnv=false): Generates did:plc:xxx AND registers with PLC directory

     

       31
       31
       -
       //

     

       32
       32
       -
       // See: https://github.com/bluesky-social/did-method-plc

     

       33
       33
       -
       func (g *Generator) GenerateCommunityDID() (string, error) {

     

       34
       34
       -
       	// Generate 16 random bytes for the DID identifier

     

       35
       35
       -
       	randomBytes := make([]byte, 16)

     

       36
       36
       -
       	if _, err := rand.Read(randomBytes); err != nil {

     

       37
       37
       -
       		return "", fmt.Errorf("failed to generate random DID: %w", err)

     

       38
       38
       -
       	}

     

       39
       39
       -
       

     

       40
       40
       -
       	// Encode as base32 (lowercase, no padding) - matches PLC format

     

       41
       41
       -
       	encoded := base32.StdEncoding.EncodeToString(randomBytes)

     

       42
       42
       -
       	encoded = strings.ToLower(strings.TrimRight(encoded, "="))

     

       43
       43
       -
       

     

       44
       44
       -
       	did := fmt.Sprintf("did:plc:%s", encoded)

     

       45
       45
       -
       

     

       46
       46
       -
       	// TODO: In production (isDevEnv=false), register this DID with PLC directory

     

       47
       47
       -
       	// This would involve:

     

       48
       48
       -
       	// 1. Generate signing keypair for the DID

     

       49
       49
       -
       	// 2. Create DID document with service endpoints

     

       50
       50
       -
       	// 3. POST to plcDirectoryURL to register

     

       51
       51
       -
       	// 4. Store keypair securely for future DID updates

     

       52
       52
       -
       	//

     

       53
       53
       -
       	// For now, we just generate the identifier (works fine for local dev)

     

       54
       54
       -
       	// Production PLC registration is not yet implemented - DIDs are generated

     

       55
       55
       -
       	// locally but not registered with the PLC directory. This is acceptable

     

       56
       56
       -
       	// for development and private instances, but production deployments should

     

       57
       57
       -
       	// implement full PLC registration to ensure DIDs are globally resolvable.

     

       58
       58
       -
       	_ = g.isDevEnv // Acknowledge that isDevEnv will be used when PLC registration is implemented

     

       59
       59
       -
       

     

       60
       60
       -
       	return did, nil

     

       61
       61
       -
       }

     

       62
       62
       -
       

     

       63
       63
       -
       // ValidateDID checks if a DID string is properly formatted

     

       64
       64
       -
       // Supports did:plc, did:web (for instances)

     

       65
       65
       -
       func ValidateDID(did string) bool {

     

       66
       66
       -
       	if !strings.HasPrefix(did, "did:") {

     

       67
       67
       -
       		return false

     

       68
       68
       -
       	}

     

       69
       69
       -
       

     

       70
       70
       -
       	parts := strings.Split(did, ":")

     

       71
       71
       -
       	if len(parts) < 3 {

     

       72
       72
       -
       		return false

     

       73
       73
       -
       	}

     

       74
       74
       -
       

     

       75
       75
       -
       	method := parts[1]

     

       76
       76
       -
       	identifier := parts[2]

     

       77
       77
       -
       

     

       78
       78
       -
       	// Basic validation: method and identifier must not be empty

     

       79
       79
       -
       	return method != "" && identifier != ""

     

       80
       80
       -
       }

-127

internal/atproto/did/generator_test.go

···

       1
       1
       -
       package did

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"strings"

     

       5
       5
       -
       	"testing"

     

       6
       6
       -
       )

     

       7
       7
       -
       

     

       8
       8
       -
       func TestGenerateCommunityDID(t *testing.T) {

     

       9
       9
       -
       	tests := []struct {

     

       10
       10
       -
       		name            string

     

       11
       11
       -
       		plcDirectoryURL string

     

       12
       12
       -
       		want            string

     

       13
       13
       -
       		isDevEnv        bool

     

       14
       14
       -
       	}{

     

       15
       15
       -
       		{

     

       16
       16
       -
       			name:            "generates did:plc in dev mode",

     

       17
       17
       -
       			isDevEnv:        true,

     

       18
       18
       -
       			plcDirectoryURL: "https://plc.directory",

     

       19
       19
       -
       			want:            "did:plc:",

     

       20
       20
       -
       		},

     

       21
       21
       -
       		{

     

       22
       22
       -
       			name:            "generates did:plc in prod mode",

     

       23
       23
       -
       			isDevEnv:        false,

     

       24
       24
       -
       			plcDirectoryURL: "https://plc.directory",

     

       25
       25
       -
       			want:            "did:plc:",

     

       26
       26
       -
       		},

     

       27
       27
       -
       	}

     

       28
       28
       -
       

     

       29
       29
       -
       	for _, tt := range tests {

     

       30
       30
       -
       		t.Run(tt.name, func(t *testing.T) {

     

       31
       31
       -
       			g := NewGenerator(tt.isDevEnv, tt.plcDirectoryURL)

     

       32
       32
       -
       			did, err := g.GenerateCommunityDID()

     

       33
       33
       -
       			if err != nil {

     

       34
       34
       -
       				t.Fatalf("GenerateCommunityDID() error = %v", err)

     

       35
       35
       -
       			}

     

       36
       36
       -
       

     

       37
       37
       -
       			if !strings.HasPrefix(did, tt.want) {

     

       38
       38
       -
       				t.Errorf("GenerateCommunityDID() = %v, want prefix %v", did, tt.want)

     

       39
       39
       -
       			}

     

       40
       40
       -
       

     

       41
       41
       -
       			// Verify it's a valid DID

     

       42
       42
       -
       			if !ValidateDID(did) {

     

       43
       43
       -
       				t.Errorf("Generated DID failed validation: %v", did)

     

       44
       44
       -
       			}

     

       45
       45
       -
       		})

     

       46
       46
       -
       	}

     

       47
       47
       -
       }

     

       48
       48
       -
       

     

       49
       49
       -
       func TestGenerateCommunityDID_Uniqueness(t *testing.T) {

     

       50
       50
       -
       	g := NewGenerator(true, "https://plc.directory")

     

       51
       51
       -
       

     

       52
       52
       -
       	// Generate 100 DIDs and ensure they're all unique

     

       53
       53
       -
       	dids := make(map[string]bool)

     

       54
       54
       -
       	for i := 0; i < 100; i++ {

     

       55
       55
       -
       		did, err := g.GenerateCommunityDID()

     

       56
       56
       -
       		if err != nil {

     

       57
       57
       -
       			t.Fatalf("GenerateCommunityDID() error = %v", err)

     

       58
       58
       -
       		}

     

       59
       59
       -
       

     

       60
       60
       -
       		if dids[did] {

     

       61
       61
       -
       			t.Errorf("Duplicate DID generated: %v", did)

     

       62
       62
       -
       		}

     

       63
       63
       -
       		dids[did] = true

     

       64
       64
       -
       	}

     

       65
       65
       -
       }

     

       66
       66
       -
       

     

       67
       67
       -
       func TestValidateDID(t *testing.T) {

     

       68
       68
       -
       	tests := []struct {

     

       69
       69
       -
       		name string

     

       70
       70
       -
       		did  string

     

       71
       71
       -
       		want bool

     

       72
       72
       -
       	}{

     

       73
       73
       -
       		{

     

       74
       74
       -
       			name: "valid did:plc",

     

       75
       75
       -
       			did:  "did:plc:z72i7hdynmk6r22z27h6tvur",

     

       76
       76
       -
       			want: true,

     

       77
       77
       -
       		},

     

       78
       78
       -
       		{

     

       79
       79
       -
       			name: "valid did:plc with base32",

     

       80
       80
       -
       			did:  "did:plc:abc123xyz",

     

       81
       81
       -
       			want: true,

     

       82
       82
       -
       		},

     

       83
       83
       -
       		{

     

       84
       84
       -
       			name: "valid did:web",

     

       85
       85
       -
       			did:  "did:web:coves.social",

     

       86
       86
       -
       			want: true,

     

       87
       87
       -
       		},

     

       88
       88
       -
       		{

     

       89
       89
       -
       			name: "valid did:web with path",

     

       90
       90
       -
       			did:  "did:web:coves.social:community:gaming",

     

       91
       91
       -
       			want: true,

     

       92
       92
       -
       		},

     

       93
       93
       -
       		{

     

       94
       94
       -
       			name: "invalid: missing prefix",

     

       95
       95
       -
       			did:  "plc:abc123",

     

       96
       96
       -
       			want: false,

     

       97
       97
       -
       		},

     

       98
       98
       -
       		{

     

       99
       99
       -
       			name: "invalid: missing method",

     

       100
       100
       -
       			did:  "did::abc123",

     

       101
       101
       -
       			want: false,

     

       102
       102
       -
       		},

     

       103
       103
       -
       		{

     

       104
       104
       -
       			name: "invalid: missing identifier",

     

       105
       105
       -
       			did:  "did:plc:",

     

       106
       106
       -
       			want: false,

     

       107
       107
       -
       		},

     

       108
       108
       -
       		{

     

       109
       109
       -
       			name: "invalid: only did",

     

       110
       110
       -
       			did:  "did:",

     

       111
       111
       -
       			want: false,

     

       112
       112
       -
       		},

     

       113
       113
       -
       		{

     

       114
       114
       -
       			name: "invalid: empty string",

     

       115
       115
       -
       			did:  "",

     

       116
       116
       -
       			want: false,

     

       117
       117
       -
       		},

     

       118
       118
       -
       	}

     

       119
       119
       -
       

     

       120
       120
       -
       	for _, tt := range tests {

     

       121
       121
       -
       		t.Run(tt.name, func(t *testing.T) {

     

       122
       122
       -
       			if got := ValidateDID(tt.did); got != tt.want {

     

       123
       123
       -
       				t.Errorf("ValidateDID(%v) = %v, want %v", tt.did, got, tt.want)

     

       124
       124
       -
       			}

     

       125
       125
       -
       		})

     

       126
       126
       -
       	}

     

       127
       127
       -
       }

-210

internal/api/handlers/oauth/callback.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/oauth"

     

       5
       5
       -
       	"log"

     

       6
       6
       -
       	"net/http"

     

       7
       7
       -
       	"os"

     

       8
       8
       -
       	"strings"

     

       9
       9
       -
       	"time"

     

       10
       10
       -
       

     

       11
       11
       -
       	oauthCore "Coves/internal/core/oauth"

     

       12
       12
       -
       )

     

       13
       13
       -
       

     

       14
       14
       -
       const (

     

       15
       15
       -
       	sessionName = "coves_session"

     

       16
       16
       -
       	sessionDID  = "did"

     

       17
       17
       -
       )

     

       18
       18
       -
       

     

       19
       19
       -
       // CallbackHandler handles OAuth callback

     

       20
       20
       -
       type CallbackHandler struct {

     

       21
       21
       -
       	sessionStore oauthCore.SessionStore

     

       22
       22
       -
       }

     

       23
       23
       -
       

     

       24
       24
       -
       // NewCallbackHandler creates a new callback handler

     

       25
       25
       -
       func NewCallbackHandler(sessionStore oauthCore.SessionStore) *CallbackHandler {

     

       26
       26
       -
       	return &CallbackHandler{

     

       27
       27
       -
       		sessionStore: sessionStore,

     

       28
       28
       -
       	}

     

       29
       29
       -
       }

     

       30
       30
       -
       

     

       31
       31
       -
       // HandleCallback processes the OAuth callback

     

       32
       32
       -
       // GET /oauth/callback?code=...&state=...&iss=...

     

       33
       33
       -
       func (h *CallbackHandler) HandleCallback(w http.ResponseWriter, r *http.Request) {

     

       34
       34
       -
       	// Extract query parameters

     

       35
       35
       -
       	code := r.URL.Query().Get("code")

     

       36
       36
       -
       	state := r.URL.Query().Get("state")

     

       37
       37
       -
       	iss := r.URL.Query().Get("iss")

     

       38
       38
       -
       	errorParam := r.URL.Query().Get("error")

     

       39
       39
       -
       	errorDesc := r.URL.Query().Get("error_description")

     

       40
       40
       -
       

     

       41
       41
       -
       	// Check for authorization errors

     

       42
       42
       -
       	if errorParam != "" {

     

       43
       43
       -
       		log.Printf("OAuth error: %s - %s", errorParam, errorDesc)

     

       44
       44
       -
       		http.Error(w, "Authorization failed", http.StatusBadRequest)

     

       45
       45
       -
       		return

     

       46
       46
       -
       	}

     

       47
       47
       -
       

     

       48
       48
       -
       	// Validate required parameters

     

       49
       49
       -
       	if code == "" || state == "" || iss == "" {

     

       50
       50
       -
       		http.Error(w, "Missing required OAuth parameters", http.StatusBadRequest)

     

       51
       51
       -
       		return

     

       52
       52
       -
       	}

     

       53
       53
       -
       

     

       54
       54
       -
       	// Retrieve and delete OAuth request atomically to prevent replay attacks

     

       55
       55
       -
       	oauthReq, err := h.sessionStore.GetAndDeleteRequest(state)

     

       56
       56
       -
       	if err != nil {

     

       57
       57
       -
       		log.Printf("Failed to retrieve OAuth request for state %s: %v", state, err)

     

       58
       58
       -
       		http.Error(w, "Invalid or expired authorization request", http.StatusBadRequest)

     

       59
       59
       -
       		return

     

       60
       60
       -
       	}

     

       61
       61
       -
       

     

       62
       62
       -
       	// Verify issuer matches

     

       63
       63
       -
       	if iss != oauthReq.AuthServerIss {

     

       64
       64
       -
       		log.Printf("Issuer mismatch: expected %s, got %s", oauthReq.AuthServerIss, iss)

     

       65
       65
       -
       		http.Error(w, "Authorization server mismatch", http.StatusBadRequest)

     

       66
       66
       -
       		return

     

       67
       67
       -
       	}

     

       68
       68
       -
       

     

       69
       69
       -
       	// Get OAuth client configuration (supports base64 encoding)

     

       70
       70
       -
       	privateJWK, err := GetEnvBase64OrPlain("OAUTH_PRIVATE_JWK")

     

       71
       71
       -
       	if err != nil {

     

       72
       72
       -
       		log.Printf("Failed to load OAuth private key: %v", err)

     

       73
       73
       -
       		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)

     

       74
       74
       -
       		return

     

       75
       75
       -
       	}

     

       76
       76
       -
       	if privateJWK == "" {

     

       77
       77
       -
       		http.Error(w, "OAuth not configured", http.StatusInternalServerError)

     

       78
       78
       -
       		return

     

       79
       79
       -
       	}

     

       80
       80
       -
       

     

       81
       81
       -
       	privateKey, err := oauth.ParseJWKFromJSON([]byte(privateJWK))

     

       82
       82
       -
       	if err != nil {

     

       83
       83
       -
       		log.Printf("Failed to parse OAuth private key: %v", err)

     

       84
       84
       -
       		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)

     

       85
       85
       -
       		return

     

       86
       86
       -
       	}

     

       87
       87
       -
       

     

       88
       88
       -
       	appviewURL := getAppViewURL()

     

       89
       89
       -
       	clientID := getClientID(appviewURL)

     

       90
       90
       -
       	redirectURI := appviewURL + "/oauth/callback"

     

       91
       91
       -
       

     

       92
       92
       -
       	// Create OAuth client

     

       93
       93
       -
       	client := oauth.NewClient(clientID, privateKey, redirectURI)

     

       94
       94
       -
       

     

       95
       95
       -
       	// Parse DPoP key from OAuth request

     

       96
       96
       -
       	dpopKey, err := oauth.ParseJWKFromJSON([]byte(oauthReq.DPoPPrivateJWK))

     

       97
       97
       -
       	if err != nil {

     

       98
       98
       -
       		log.Printf("Failed to parse DPoP key: %v", err)

     

       99
       99
       -
       		http.Error(w, "Failed to restore session key", http.StatusInternalServerError)

     

       100
       100
       -
       		return

     

       101
       101
       -
       	}

     

       102
       102
       -
       

     

       103
       103
       -
       	// Exchange authorization code for tokens

     

       104
       104
       -
       	tokenResp, err := client.InitialTokenRequest(

     

       105
       105
       -
       		r.Context(),

     

       106
       106
       -
       		code,

     

       107
       107
       -
       		oauthReq.AuthServerIss,

     

       108
       108
       -
       		oauthReq.PKCEVerifier,

     

       109
       109
       -
       		oauthReq.DPoPAuthServerNonce,

     

       110
       110
       -
       		dpopKey,

     

       111
       111
       -
       	)

     

       112
       112
       -
       	if err != nil {

     

       113
       113
       -
       		log.Printf("Failed to exchange code for tokens: %v", err)

     

       114
       114
       -
       		http.Error(w, "Failed to obtain access tokens", http.StatusInternalServerError)

     

       115
       115
       -
       		return

     

       116
       116
       -
       	}

     

       117
       117
       -
       

     

       118
       118
       -
       	// Verify token type is DPoP

     

       119
       119
       -
       	if tokenResp.TokenType != "DPoP" {

     

       120
       120
       -
       		log.Printf("Expected DPoP token type, got: %s", tokenResp.TokenType)

     

       121
       121
       -
       		http.Error(w, "Invalid token type", http.StatusInternalServerError)

     

       122
       122
       -
       		return

     

       123
       123
       -
       	}

     

       124
       124
       -
       

     

       125
       125
       -
       	// Verify subject (DID) matches

     

       126
       126
       -
       	if tokenResp.Sub != oauthReq.DID {

     

       127
       127
       -
       		log.Printf("DID mismatch: expected %s, got %s", oauthReq.DID, tokenResp.Sub)

     

       128
       128
       -
       		http.Error(w, "Identity verification failed", http.StatusBadRequest)

     

       129
       129
       -
       		return

     

       130
       130
       -
       	}

     

       131
       131
       -
       

     

       132
       132
       -
       	// Calculate token expiration

     

       133
       133
       -
       	expiresAt := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)

     

       134
       134
       -
       

     

       135
       135
       -
       	// Serialize DPoP key for storage

     

       136
       136
       -
       	dpopKeyJSON, err := oauth.JWKToJSON(dpopKey)

     

       137
       137
       -
       	if err != nil {

     

       138
       138
       -
       		log.Printf("Failed to serialize DPoP key: %v", err)

     

       139
       139
       -
       		http.Error(w, "Failed to store session", http.StatusInternalServerError)

     

       140
       140
       -
       		return

     

       141
       141
       -
       	}

     

       142
       142
       -
       

     

       143
       143
       -
       	// Save OAuth session to database

     

       144
       144
       -
       	session := &oauthCore.OAuthSession{

     

       145
       145
       -
       		DID:                 oauthReq.DID,

     

       146
       146
       -
       		Handle:              oauthReq.Handle,

     

       147
       147
       -
       		PDSURL:              oauthReq.PDSURL,

     

       148
       148
       -
       		AccessToken:         tokenResp.AccessToken,

     

       149
       149
       -
       		RefreshToken:        tokenResp.RefreshToken,

     

       150
       150
       -
       		DPoPPrivateJWK:      string(dpopKeyJSON),

     

       151
       151
       -
       		DPoPAuthServerNonce: tokenResp.DpopAuthserverNonce,

     

       152
       152
       -
       		DPoPPDSNonce:        "", // Will be populated on first PDS request

     

       153
       153
       -
       		AuthServerIss:       oauthReq.AuthServerIss,

     

       154
       154
       -
       		ExpiresAt:           expiresAt,

     

       155
       155
       -
       	}

     

       156
       156
       -
       

     

       157
       157
       -
       	if saveErr := h.sessionStore.SaveSession(session); saveErr != nil {

     

       158
       158
       -
       		log.Printf("Failed to save OAuth session: %v", saveErr)

     

       159
       159
       -
       		http.Error(w, "Failed to save session", http.StatusInternalServerError)

     

       160
       160
       -
       		return

     

       161
       161
       -
       	}

     

       162
       162
       -
       

     

       163
       163
       -
       	// Note: OAuth request already deleted atomically in GetAndDeleteRequest above

     

       164
       164
       -
       

     

       165
       165
       -
       	// Create HTTP session cookie

     

       166
       166
       -
       	cookieStore := GetCookieStore()

     

       167
       167
       -
       	httpSession, err := cookieStore.Get(r, sessionName)

     

       168
       168
       -
       	if err != nil {

     

       169
       169
       -
       		log.Printf("Failed to get cookie session: %v", err)

     

       170
       170
       -
       		// Try to create a new session anyway

     

       171
       171
       -
       		httpSession, err = cookieStore.New(r, sessionName)

     

       172
       172
       -
       		if err != nil {

     

       173
       173
       -
       			log.Printf("Failed to create new session: %v", err)

     

       174
       174
       -
       			http.Error(w, "Failed to create session", http.StatusInternalServerError)

     

       175
       175
       -
       			return

     

       176
       176
       -
       		}

     

       177
       177
       -
       	}

     

       178
       178
       -
       

     

       179
       179
       -
       	httpSession.Values[sessionDID] = oauthReq.DID

     

       180
       180
       -
       	httpSession.Options.MaxAge = SessionMaxAge

     

       181
       181
       -
       	httpSession.Options.HttpOnly = true

     

       182
       182
       -
       	httpSession.Options.Secure = !isDevelopment() // HTTPS only in production

     

       183
       183
       -
       	httpSession.Options.SameSite = http.SameSiteLaxMode

     

       184
       184
       -
       

     

       185
       185
       -
       	if err := httpSession.Save(r, w); err != nil {

     

       186
       186
       -
       		log.Printf("Failed to save HTTP session: %v", err)

     

       187
       187
       -
       		http.Error(w, "Failed to create session", http.StatusInternalServerError)

     

       188
       188
       -
       		return

     

       189
       189
       -
       	}

     

       190
       190
       -
       

     

       191
       191
       -
       	// Determine redirect URL

     

       192
       192
       -
       	returnURL := oauthReq.ReturnURL

     

       193
       193
       -
       	if returnURL == "" {

     

       194
       194
       -
       		returnURL = "/"

     

       195
       195
       -
       	}

     

       196
       196
       -
       

     

       197
       197
       -
       	// Redirect user back to application

     

       198
       198
       -
       	http.Redirect(w, r, returnURL, http.StatusFound)

     

       199
       199
       -
       }

     

       200
       200
       -
       

     

       201
       201
       -
       // isDevelopment checks if we're running in development mode

     

       202
       202
       -
       func isDevelopment() bool {

     

       203
       203
       -
       	// Explicitly check for localhost/127.0.0.1 on any port

     

       204
       204
       -
       	appviewURL := os.Getenv("APPVIEW_PUBLIC_URL")

     

       205
       205
       -
       	return appviewURL == "" ||

     

       206
       206
       -
       		strings.HasPrefix(appviewURL, "http://localhost:") ||

     

       207
       207
       -
       		strings.HasPrefix(appviewURL, "http://localhost/") ||

     

       208
       208
       -
       		strings.HasPrefix(appviewURL, "http://127.0.0.1:") ||

     

       209
       209
       -
       		strings.HasPrefix(appviewURL, "http://127.0.0.1/")

     

       210
       210
       -
       }

-131

internal/api/handlers/oauth/env_test.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"encoding/base64"

     

       5
       5
       -
       	"os"

     

       6
       6
       -
       	"testing"

     

       7
       7
       -
       )

     

       8
       8
       -
       

     

       9
       9
       -
       func TestGetEnvBase64OrPlain(t *testing.T) {

     

       10
       10
       -
       	tests := []struct {

     

       11
       11
       -
       		name      string

     

       12
       12
       -
       		envKey    string

     

       13
       13
       -
       		envValue  string

     

       14
       14
       -
       		want      string

     

       15
       15
       -
       		wantError bool

     

       16
       16
       -
       	}{

     

       17
       17
       -
       		{

     

       18
       18
       -
       			name:      "plain JSON value",

     

       19
       19
       -
       			envKey:    "TEST_PLAIN_JSON",

     

       20
       20
       -
       			envValue:  `{"alg":"ES256","kty":"EC"}`,

     

       21
       21
       -
       			want:      `{"alg":"ES256","kty":"EC"}`,

     

       22
       22
       -
       			wantError: false,

     

       23
       23
       -
       		},

     

       24
       24
       -
       		{

     

       25
       25
       -
       			name:      "base64 encoded value",

     

       26
       26
       -
       			envKey:    "TEST_BASE64_JSON",

     

       27
       27
       -
       			envValue:  "base64:" + base64.StdEncoding.EncodeToString([]byte(`{"alg":"ES256","kty":"EC"}`)),

     

       28
       28
       -
       			want:      `{"alg":"ES256","kty":"EC"}`,

     

       29
       29
       -
       			wantError: false,

     

       30
       30
       -
       		},

     

       31
       31
       -
       		{

     

       32
       32
       -
       			name:      "empty value",

     

       33
       33
       -
       			envKey:    "TEST_EMPTY",

     

       34
       34
       -
       			envValue:  "",

     

       35
       35
       -
       			want:      "",

     

       36
       36
       -
       			wantError: false,

     

       37
       37
       -
       		},

     

       38
       38
       -
       		{

     

       39
       39
       -
       			name:      "invalid base64",

     

       40
       40
       -
       			envKey:    "TEST_INVALID_BASE64",

     

       41
       41
       -
       			envValue:  "base64:not-valid-base64!!!",

     

       42
       42
       -
       			want:      "",

     

       43
       43
       -
       			wantError: true,

     

       44
       44
       -
       		},

     

       45
       45
       -
       		{

     

       46
       46
       -
       			name:      "plain string with special chars",

     

       47
       47
       -
       			envKey:    "TEST_SPECIAL_CHARS",

     

       48
       48
       -
       			envValue:  "secret-with-dashes_and_underscores",

     

       49
       49
       -
       			want:      "secret-with-dashes_and_underscores",

     

       50
       50
       -
       			wantError: false,

     

       51
       51
       -
       		},

     

       52
       52
       -
       		{

     

       53
       53
       -
       			name:      "base64 encoded hex string",

     

       54
       54
       -
       			envKey:    "TEST_BASE64_HEX",

     

       55
       55
       -
       			envValue:  "base64:" + base64.StdEncoding.EncodeToString([]byte("f1132c01b1a625a865c6c455a75ee793")),

     

       56
       56
       -
       			want:      "f1132c01b1a625a865c6c455a75ee793",

     

       57
       57
       -
       			wantError: false,

     

       58
       58
       -
       		},

     

       59
       59
       -
       	}

     

       60
       60
       -
       

     

       61
       61
       -
       	for _, tt := range tests {

     

       62
       62
       -
       		t.Run(tt.name, func(t *testing.T) {

     

       63
       63
       -
       			// Set environment variable

     

       64
       64
       -
       			if tt.envValue != "" {

     

       65
       65
       -
       				if err := os.Setenv(tt.envKey, tt.envValue); err != nil {

     

       66
       66
       -
       					t.Fatalf("Failed to set env var: %v", err)

     

       67
       67
       -
       				}

     

       68
       68
       -
       				defer func() {

     

       69
       69
       -
       					if err := os.Unsetenv(tt.envKey); err != nil {

     

       70
       70
       -
       						t.Errorf("Failed to unset env var: %v", err)

     

       71
       71
       -
       					}

     

       72
       72
       -
       				}()

     

       73
       73
       -
       			}

     

       74
       74
       -
       

     

       75
       75
       -
       			got, err := GetEnvBase64OrPlain(tt.envKey)

     

       76
       76
       -
       

     

       77
       77
       -
       			if (err != nil) != tt.wantError {

     

       78
       78
       -
       				t.Errorf("GetEnvBase64OrPlain() error = %v, wantError %v", err, tt.wantError)

     

       79
       79
       -
       				return

     

       80
       80
       -
       			}

     

       81
       81
       -
       

     

       82
       82
       -
       			if got != tt.want {

     

       83
       83
       -
       				t.Errorf("GetEnvBase64OrPlain() = %v, want %v", got, tt.want)

     

       84
       84
       -
       			}

     

       85
       85
       -
       		})

     

       86
       86
       -
       	}

     

       87
       87
       -
       }

     

       88
       88
       -
       

     

       89
       89
       -
       func TestGetEnvBase64OrPlain_RealWorldJWK(t *testing.T) {

     

       90
       90
       -
       	// Test with a real JWK (the one from .env.dev)

     

       91
       91
       -
       	realJWK := `{"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}`

     

       92
       92
       -
       

     

       93
       93
       -
       	tests := []struct {

     

       94
       94
       -
       		name     string

     

       95
       95
       -
       		envValue string

     

       96
       96
       -
       		want     string

     

       97
       97
       -
       	}{

     

       98
       98
       -
       		{

     

       99
       99
       -
       			name:     "plain JWK",

     

       100
       100
       -
       			envValue: realJWK,

     

       101
       101
       -
       			want:     realJWK,

     

       102
       102
       -
       		},

     

       103
       103
       -
       		{

     

       104
       104
       -
       			name:     "base64 encoded JWK",

     

       105
       105
       -
       			envValue: "base64:" + base64.StdEncoding.EncodeToString([]byte(realJWK)),

     

       106
       106
       -
       			want:     realJWK,

     

       107
       107
       -
       		},

     

       108
       108
       -
       	}

     

       109
       109
       -
       

     

       110
       110
       -
       	for _, tt := range tests {

     

       111
       111
       -
       		t.Run(tt.name, func(t *testing.T) {

     

       112
       112
       -
       			if err := os.Setenv("TEST_REAL_JWK", tt.envValue); err != nil {

     

       113
       113
       -
       				t.Fatalf("Failed to set env var: %v", err)

     

       114
       114
       -
       			}

     

       115
       115
       -
       			defer func() {

     

       116
       116
       -
       				if err := os.Unsetenv("TEST_REAL_JWK"); err != nil {

     

       117
       117
       -
       					t.Errorf("Failed to unset env var: %v", err)

     

       118
       118
       -
       				}

     

       119
       119
       -
       			}()

     

       120
       120
       -
       

     

       121
       121
       -
       			got, err := GetEnvBase64OrPlain("TEST_REAL_JWK")

     

       122
       122
       -
       			if err != nil {

     

       123
       123
       -
       				t.Fatalf("unexpected error: %v", err)

     

       124
       124
       -
       			}

     

       125
       125
       -
       

     

       126
       126
       -
       			if got != tt.want {

     

       127
       127
       -
       				t.Errorf("GetEnvBase64OrPlain() = %v, want %v", got, tt.want)

     

       128
       128
       -
       			}

     

       129
       129
       -
       		})

     

       130
       130
       -
       	}

     

       131
       131
       -
       }

-53

internal/api/handlers/oauth/jwks.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/oauth"

     

       5
       5
       -
       	"encoding/json"

     

       6
       6
       -
       	"log"

     

       7
       7
       -
       	"net/http"

     

       8
       8
       -
       

     

       9
       9
       -
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       10
       10
       -
       )

     

       11
       11
       -
       

     

       12
       12
       -
       // HandleJWKS serves the JSON Web Key Set (JWKS) containing the public key

     

       13
       13
       -
       // GET /oauth/jwks.json

     

       14
       14
       -
       func HandleJWKS(w http.ResponseWriter, r *http.Request) {

     

       15
       15
       -
       	// Get private key from environment (supports base64 encoding)

     

       16
       16
       -
       	privateJWK, err := GetEnvBase64OrPlain("OAUTH_PRIVATE_JWK")

     

       17
       17
       -
       	if err != nil {

     

       18
       18
       -
       		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)

     

       19
       19
       -
       		return

     

       20
       20
       -
       	}

     

       21
       21
       -
       	if privateJWK == "" {

     

       22
       22
       -
       		http.Error(w, "OAuth not configured", http.StatusInternalServerError)

     

       23
       23
       -
       		return

     

       24
       24
       -
       	}

     

       25
       25
       -
       

     

       26
       26
       -
       	// Parse private key

     

       27
       27
       -
       	privateKey, err := oauth.ParseJWKFromJSON([]byte(privateJWK))

     

       28
       28
       -
       	if err != nil {

     

       29
       29
       -
       		http.Error(w, "Failed to parse private key", http.StatusInternalServerError)

     

       30
       30
       -
       		return

     

       31
       31
       -
       	}

     

       32
       32
       -
       

     

       33
       33
       -
       	// Get public key

     

       34
       34
       -
       	publicKey, err := privateKey.PublicKey()

     

       35
       35
       -
       	if err != nil {

     

       36
       36
       -
       		http.Error(w, "Failed to get public key", http.StatusInternalServerError)

     

       37
       37
       -
       		return

     

       38
       38
       -
       	}

     

       39
       39
       -
       

     

       40
       40
       -
       	// Create JWKS

     

       41
       41
       -
       	jwks := jwk.NewSet()

     

       42
       42
       -
       	if err := jwks.AddKey(publicKey); err != nil {

     

       43
       43
       -
       		http.Error(w, "Failed to create JWKS", http.StatusInternalServerError)

     

       44
       44
       -
       		return

     

       45
       45
       -
       	}

     

       46
       46
       -
       

     

       47
       47
       -
       	// Serve JWKS

     

       48
       48
       -
       	w.Header().Set("Content-Type", "application/json")

     

       49
       49
       -
       	w.WriteHeader(http.StatusOK)

     

       50
       50
       -
       	if err := json.NewEncoder(w).Encode(jwks); err != nil {

     

       51
       51
       -
       		log.Printf("Failed to encode JWKS response: %v", err)

     

       52
       52
       -
       	}

     

       53
       53
       -
       }

-177

internal/api/handlers/oauth/login.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/identity"

     

       5
       5
       -
       	"Coves/internal/atproto/oauth"

     

       6
       6
       -
       	"encoding/json"

     

       7
       7
       -
       	"log"

     

       8
       8
       -
       	"net/http"

     

       9
       9
       -
       	"net/url"

     

       10
       10
       -
       	"strings"

     

       11
       11
       -
       

     

       12
       12
       -
       	oauthCore "Coves/internal/core/oauth"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       // LoginHandler handles OAuth login flow initiation

     

       16
       16
       -
       type LoginHandler struct {

     

       17
       17
       -
       	identityResolver identity.Resolver

     

       18
       18
       -
       	sessionStore     oauthCore.SessionStore

     

       19
       19
       -
       }

     

       20
       20
       -
       

     

       21
       21
       -
       // NewLoginHandler creates a new login handler

     

       22
       22
       -
       func NewLoginHandler(identityResolver identity.Resolver, sessionStore oauthCore.SessionStore) *LoginHandler {

     

       23
       23
       -
       	return &LoginHandler{

     

       24
       24
       -
       		identityResolver: identityResolver,

     

       25
       25
       -
       		sessionStore:     sessionStore,

     

       26
       26
       -
       	}

     

       27
       27
       -
       }

     

       28
       28
       -
       

     

       29
       29
       -
       // HandleLogin initiates the OAuth login flow

     

       30
       30
       -
       // POST /oauth/login

     

       31
       31
       -
       // Body: { "handle": "alice.bsky.social" }

     

       32
       32
       -
       func (h *LoginHandler) HandleLogin(w http.ResponseWriter, r *http.Request) {

     

       33
       33
       -
       	if r.Method != http.MethodPost {

     

       34
       34
       -
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       35
       35
       -
       		return

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	// Parse request body

     

       39
       39
       -
       	var req struct {

     

       40
       40
       -
       		Handle    string `json:"handle"`

     

       41
       41
       -
       		ReturnURL string `json:"returnUrl,omitempty"`

     

       42
       42
       -
       	}

     

       43
       43
       -
       

     

       44
       44
       -
       	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {

     

       45
       45
       -
       		http.Error(w, "Invalid request body", http.StatusBadRequest)

     

       46
       46
       -
       		return

     

       47
       47
       -
       	}

     

       48
       48
       -
       

     

       49
       49
       -
       	// Normalize handle

     

       50
       50
       -
       	handle := strings.TrimSpace(strings.ToLower(req.Handle))

     

       51
       51
       -
       	handle = strings.TrimPrefix(handle, "@")

     

       52
       52
       -
       

     

       53
       53
       -
       	// Validate handle format

     

       54
       54
       -
       	if handle == "" || !strings.Contains(handle, ".") {

     

       55
       55
       -
       		http.Error(w, "Invalid handle format", http.StatusBadRequest)

     

       56
       56
       -
       		return

     

       57
       57
       -
       	}

     

       58
       58
       -
       

     

       59
       59
       -
       	// Resolve handle to DID and PDS

     

       60
       60
       -
       	resolved, err := h.identityResolver.Resolve(r.Context(), handle)

     

       61
       61
       -
       	if err != nil {

     

       62
       62
       -
       		log.Printf("Failed to resolve handle %s: %v", handle, err)

     

       63
       63
       -
       		http.Error(w, "Unable to find that account", http.StatusBadRequest)

     

       64
       64
       -
       		return

     

       65
       65
       -
       	}

     

       66
       66
       -
       

     

       67
       67
       -
       	// Get OAuth client configuration (supports base64 encoding)

     

       68
       68
       -
       	privateJWK, err := GetEnvBase64OrPlain("OAUTH_PRIVATE_JWK")

     

       69
       69
       -
       	if err != nil {

     

       70
       70
       -
       		log.Printf("Failed to load OAuth private key: %v", err)

     

       71
       71
       -
       		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)

     

       72
       72
       -
       		return

     

       73
       73
       -
       	}

     

       74
       74
       -
       	if privateJWK == "" {

     

       75
       75
       -
       		http.Error(w, "OAuth not configured", http.StatusInternalServerError)

     

       76
       76
       -
       		return

     

       77
       77
       -
       	}

     

       78
       78
       -
       

     

       79
       79
       -
       	privateKey, err := oauth.ParseJWKFromJSON([]byte(privateJWK))

     

       80
       80
       -
       	if err != nil {

     

       81
       81
       -
       		log.Printf("Failed to parse OAuth private key: %v", err)

     

       82
       82
       -
       		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)

     

       83
       83
       -
       		return

     

       84
       84
       -
       	}

     

       85
       85
       -
       

     

       86
       86
       -
       	appviewURL := getAppViewURL()

     

       87
       87
       -
       	clientID := getClientID(appviewURL)

     

       88
       88
       -
       	redirectURI := appviewURL + "/oauth/callback"

     

       89
       89
       -
       

     

       90
       90
       -
       	// Create OAuth client

     

       91
       91
       -
       	client := oauth.NewClient(clientID, privateKey, redirectURI)

     

       92
       92
       -
       

     

       93
       93
       -
       	// Discover auth server from PDS

     

       94
       94
       -
       	pdsURL := resolved.PDSURL

     

       95
       95
       -
       	authServerIss, err := client.ResolvePDSAuthServer(r.Context(), pdsURL)

     

       96
       96
       -
       	if err != nil {

     

       97
       97
       -
       		log.Printf("Failed to resolve auth server for PDS %s: %v", pdsURL, err)

     

       98
       98
       -
       		http.Error(w, "Failed to discover authorization server", http.StatusInternalServerError)

     

       99
       99
       -
       		return

     

       100
       100
       -
       	}

     

       101
       101
       -
       

     

       102
       102
       -
       	// Fetch auth server metadata

     

       103
       103
       -
       	authMeta, err := client.FetchAuthServerMetadata(r.Context(), authServerIss)

     

       104
       104
       -
       	if err != nil {

     

       105
       105
       -
       		log.Printf("Failed to fetch auth server metadata: %v", err)

     

       106
       106
       -
       		http.Error(w, "Failed to fetch authorization server metadata", http.StatusInternalServerError)

     

       107
       107
       -
       		return

     

       108
       108
       -
       	}

     

       109
       109
       -
       

     

       110
       110
       -
       	// Generate DPoP key for this session

     

       111
       111
       -
       	dpopKey, err := oauth.GenerateDPoPKey()

     

       112
       112
       -
       	if err != nil {

     

       113
       113
       -
       		log.Printf("Failed to generate DPoP key: %v", err)

     

       114
       114
       -
       		http.Error(w, "Failed to generate session key", http.StatusInternalServerError)

     

       115
       115
       -
       		return

     

       116
       116
       -
       	}

     

       117
       117
       -
       

     

       118
       118
       -
       	// Send PAR request

     

       119
       119
       -
       	parResp, err := client.SendPARRequest(r.Context(), authMeta, handle, "atproto transition:generic", dpopKey)

     

       120
       120
       -
       	if err != nil {

     

       121
       121
       -
       		log.Printf("Failed to send PAR request: %v", err)

     

       122
       122
       -
       		http.Error(w, "Failed to initiate authorization", http.StatusInternalServerError)

     

       123
       123
       -
       		return

     

       124
       124
       -
       	}

     

       125
       125
       -
       

     

       126
       126
       -
       	// Serialize DPoP key to JSON

     

       127
       127
       -
       	dpopKeyJSON, err := oauth.JWKToJSON(dpopKey)

     

       128
       128
       -
       	if err != nil {

     

       129
       129
       -
       		log.Printf("Failed to serialize DPoP key: %v", err)

     

       130
       130
       -
       		http.Error(w, "Failed to store session key", http.StatusInternalServerError)

     

       131
       131
       -
       		return

     

       132
       132
       -
       	}

     

       133
       133
       -
       

     

       134
       134
       -
       	// Save OAuth request state to database

     

       135
       135
       -
       	oauthReq := &oauthCore.OAuthRequest{

     

       136
       136
       -
       		State:               parResp.State,

     

       137
       137
       -
       		DID:                 resolved.DID,

     

       138
       138
       -
       		Handle:              handle,

     

       139
       139
       -
       		PDSURL:              pdsURL,

     

       140
       140
       -
       		PKCEVerifier:        parResp.PKCEVerifier,

     

       141
       141
       -
       		DPoPPrivateJWK:      string(dpopKeyJSON),

     

       142
       142
       -
       		DPoPAuthServerNonce: parResp.DpopAuthserverNonce,

     

       143
       143
       -
       		AuthServerIss:       authServerIss,

     

       144
       144
       -
       		ReturnURL:           req.ReturnURL,

     

       145
       145
       -
       	}

     

       146
       146
       -
       

     

       147
       147
       -
       	if saveErr := h.sessionStore.SaveRequest(oauthReq); saveErr != nil {

     

       148
       148
       -
       		log.Printf("Failed to save OAuth request: %v", saveErr)

     

       149
       149
       -
       		http.Error(w, "Failed to save authorization state", http.StatusInternalServerError)

     

       150
       150
       -
       		return

     

       151
       151
       -
       	}

     

       152
       152
       -
       

     

       153
       153
       -
       	// Build authorization URL

     

       154
       154
       -
       	authURL, err := url.Parse(authMeta.AuthorizationEndpoint)

     

       155
       155
       -
       	if err != nil {

     

       156
       156
       -
       		log.Printf("Invalid authorization endpoint: %v", err)

     

       157
       157
       -
       		http.Error(w, "Invalid authorization endpoint", http.StatusInternalServerError)

     

       158
       158
       -
       		return

     

       159
       159
       -
       	}

     

       160
       160
       -
       

     

       161
       161
       -
       	query := authURL.Query()

     

       162
       162
       -
       	query.Set("client_id", clientID)

     

       163
       163
       -
       	query.Set("request_uri", parResp.RequestURI)

     

       164
       164
       -
       	authURL.RawQuery = query.Encode()

     

       165
       165
       -
       

     

       166
       166
       -
       	// Return authorization URL to client

     

       167
       167
       -
       	resp := map[string]string{

     

       168
       168
       -
       		"authorizationUrl": authURL.String(),

     

       169
       169
       -
       		"state":            parResp.State,

     

       170
       170
       -
       	}

     

       171
       171
       -
       

     

       172
       172
       -
       	w.Header().Set("Content-Type", "application/json")

     

       173
       173
       -
       	w.WriteHeader(http.StatusOK)

     

       174
       174
       -
       	if err := json.NewEncoder(w).Encode(resp); err != nil {

     

       175
       175
       -
       		log.Printf("Failed to encode response: %v", err)

     

       176
       176
       -
       	}

     

       177
       177
       -
       }

-86

internal/api/handlers/oauth/metadata.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"encoding/json"

     

       5
       5
       -
       	"net/http"

     

       6
       6
       -
       	"os"

     

       7
       7
       -
       	"strings"

     

       8
       8
       -
       )

     

       9
       9
       -
       

     

       10
       10
       -
       // ClientMetadata represents OAuth 2.0 client metadata (RFC 7591)

     

       11
       11
       -
       // Served at /oauth/client-metadata.json

     

       12
       12
       -
       type ClientMetadata struct {

     

       13
       13
       -
       	ClientID                    string   `json:"client_id"`

     

       14
       14
       -
       	ClientName                  string   `json:"client_name"`

     

       15
       15
       -
       	ClientURI                   string   `json:"client_uri"`

     

       16
       16
       -
       	Scope                       string   `json:"scope"`

     

       17
       17
       -
       	TokenEndpointAuthMethod     string   `json:"token_endpoint_auth_method"`

     

       18
       18
       -
       	TokenEndpointAuthSigningAlg string   `json:"token_endpoint_auth_signing_alg"`

     

       19
       19
       -
       	ApplicationType             string   `json:"application_type"`

     

       20
       20
       -
       	JwksURI                     string   `json:"jwks_uri,omitempty"`

     

       21
       21
       -
       	RedirectURIs                []string `json:"redirect_uris"`

     

       22
       22
       -
       	GrantTypes                  []string `json:"grant_types"`

     

       23
       23
       -
       	ResponseTypes               []string `json:"response_types"`

     

       24
       24
       -
       	DpopBoundAccessTokens       bool     `json:"dpop_bound_access_tokens"`

     

       25
       25
       -
       }

     

       26
       26
       -
       

     

       27
       27
       -
       // HandleClientMetadata serves the OAuth client metadata

     

       28
       28
       -
       // GET /oauth/client-metadata.json

     

       29
       29
       -
       func HandleClientMetadata(w http.ResponseWriter, r *http.Request) {

     

       30
       30
       -
       	appviewURL := getAppViewURL()

     

       31
       31
       -
       

     

       32
       32
       -
       	// Determine client ID based on environment

     

       33
       33
       -
       	clientID := getClientID(appviewURL)

     

       34
       34
       -
       	jwksURI := ""

     

       35
       35
       -
       

     

       36
       36
       -
       	// Only include JWKS URI in production (not for loopback clients)

     

       37
       37
       -
       	if !strings.HasPrefix(appviewURL, "http://localhost") && !strings.HasPrefix(appviewURL, "http://127.0.0.1") {

     

       38
       38
       -
       		jwksURI = appviewURL + "/oauth/jwks.json"

     

       39
       39
       -
       	}

     

       40
       40
       -
       

     

       41
       41
       -
       	metadata := ClientMetadata{

     

       42
       42
       -
       		ClientID:                    clientID,

     

       43
       43
       -
       		ClientName:                  "Coves",

     

       44
       44
       -
       		ClientURI:                   appviewURL,

     

       45
       45
       -
       		RedirectURIs:                []string{appviewURL + "/oauth/callback"},

     

       46
       46
       -
       		GrantTypes:                  []string{"authorization_code", "refresh_token"},

     

       47
       47
       -
       		ResponseTypes:               []string{"code"},

     

       48
       48
       -
       		Scope:                       "atproto transition:generic",

     

       49
       49
       -
       		TokenEndpointAuthMethod:     "private_key_jwt",

     

       50
       50
       -
       		TokenEndpointAuthSigningAlg: "ES256",

     

       51
       51
       -
       		DpopBoundAccessTokens:       true,

     

       52
       52
       -
       		ApplicationType:             "web",

     

       53
       53
       -
       		JwksURI:                     jwksURI,

     

       54
       54
       -
       	}

     

       55
       55
       -
       

     

       56
       56
       -
       	w.Header().Set("Content-Type", "application/json")

     

       57
       57
       -
       	w.WriteHeader(http.StatusOK)

     

       58
       58
       -
       	if err := json.NewEncoder(w).Encode(metadata); err != nil {

     

       59
       59
       -
       		// Log encoding errors but don't return error response (headers already sent)

     

       60
       60
       -
       		// This follows Go's standard practice for HTTP handlers

     

       61
       61
       -
       		_ = err

     

       62
       62
       -
       	}

     

       63
       63
       -
       }

     

       64
       64
       -
       

     

       65
       65
       -
       // getAppViewURL returns the public URL of the AppView

     

       66
       66
       -
       func getAppViewURL() string {

     

       67
       67
       -
       	url := os.Getenv("APPVIEW_PUBLIC_URL")

     

       68
       68
       -
       	if url == "" {

     

       69
       69
       -
       		// Default to localhost for development

     

       70
       70
       -
       		url = "http://localhost:8081"

     

       71
       71
       -
       	}

     

       72
       72
       -
       	return strings.TrimSuffix(url, "/")

     

       73
       73
       -
       }

     

       74
       74
       -
       

     

       75
       75
       -
       // getClientID returns the OAuth client ID based on environment

     

       76
       76
       -
       // For localhost development, use loopback client identifier

     

       77
       77
       -
       // For production, use HTTPS URL to client metadata

     

       78
       78
       -
       func getClientID(appviewURL string) string {

     

       79
       79
       -
       	// Development: use loopback client (http://localhost?...)

     

       80
       80
       -
       	if strings.HasPrefix(appviewURL, "http://localhost") || strings.HasPrefix(appviewURL, "http://127.0.0.1") {

     

       81
       81
       -
       		return "http://localhost?redirect_uri=" + appviewURL + "/oauth/callback&scope=atproto%20transition:generic"

     

       82
       82
       -
       	}

     

       83
       83
       -
       

     

       84
       84
       -
       	// Production: use HTTPS URL to client metadata

     

       85
       85
       -
       	return appviewURL + "/oauth/client-metadata.json"

     

       86
       86
       -
       }

-167

internal/atproto/oauth/dpop.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"crypto/ecdsa"

     

       5
       5
       -
       	"crypto/elliptic"

     

       6
       6
       -
       	"crypto/rand"

     

       7
       7
       -
       	"crypto/sha256"

     

       8
       8
       -
       	"encoding/base64"

     

       9
       9
       -
       	"encoding/json"

     

       10
       10
       -
       	"fmt"

     

       11
       11
       -
       	"time"

     

       12
       12
       -
       

     

       13
       13
       -
       	"github.com/lestrrat-go/jwx/v2/jwa"

     

       14
       14
       -
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       15
       15
       -
       	"github.com/lestrrat-go/jwx/v2/jws"

     

       16
       16
       -
       	"github.com/lestrrat-go/jwx/v2/jwt"

     

       17
       17
       -
       )

     

       18
       18
       -
       

     

       19
       19
       -
       // DPoP (Demonstrating Proof of Possession) - RFC 9449

     

       20
       20
       -
       // Binds access tokens to specific clients using cryptographic proofs

     

       21
       21
       -
       

     

       22
       22
       -
       // GenerateDPoPKey generates a new ES256 (NIST P-256) keypair for DPoP

     

       23
       23
       -
       // Each OAuth session should have its own unique DPoP key

     

       24
       24
       -
       func GenerateDPoPKey() (jwk.Key, error) {

     

       25
       25
       -
       	// Generate ES256 private key

     

       26
       26
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       27
       27
       -
       	if err != nil {

     

       28
       28
       -
       		return nil, fmt.Errorf("failed to generate ECDSA key: %w", err)

     

       29
       29
       -
       	}

     

       30
       30
       -
       

     

       31
       31
       -
       	// Convert to JWK

     

       32
       32
       -
       	jwkKey, err := jwk.FromRaw(privateKey)

     

       33
       33
       -
       	if err != nil {

     

       34
       34
       -
       		return nil, fmt.Errorf("failed to create JWK from private key: %w", err)

     

       35
       35
       -
       	}

     

       36
       36
       -
       

     

       37
       37
       -
       	// Set JWK parameters

     

       38
       38
       -
       	if err := jwkKey.Set(jwk.AlgorithmKey, jwa.ES256); err != nil {

     

       39
       39
       -
       		return nil, fmt.Errorf("failed to set algorithm: %w", err)

     

       40
       40
       -
       	}

     

       41
       41
       -
       	if err := jwkKey.Set(jwk.KeyUsageKey, "sig"); err != nil {

     

       42
       42
       -
       		return nil, fmt.Errorf("failed to set key usage: %w", err)

     

       43
       43
       -
       	}

     

       44
       44
       -
       

     

       45
       45
       -
       	return jwkKey, nil

     

       46
       46
       -
       }

     

       47
       47
       -
       

     

       48
       48
       -
       // CreateDPoPProof creates a DPoP proof JWT for HTTP requests

     

       49
       49
       -
       // Parameters:

     

       50
       50
       -
       //   - privateKey: The DPoP private key (ES256) as JWK

     

       51
       51
       -
       //   - method: HTTP method (e.g., "POST", "GET")

     

       52
       52
       -
       //   - uri: Full HTTP URI (e.g., "https://pds.example.com/xrpc/com.atproto.server.getSession")

     

       53
       53
       -
       //   - nonce: Optional server-provided nonce (empty on first request, use nonce from 401 response on retry)

     

       54
       54
       -
       //   - accessToken: Optional access token hash (required when using access token)

     

       55
       55
       -
       func CreateDPoPProof(privateKey jwk.Key, method, uri, nonce, accessToken string) (string, error) {

     

       56
       56
       -
       	// Get public key for JWK thumbprint

     

       57
       57
       -
       	pubKey, err := privateKey.PublicKey()

     

       58
       58
       -
       	if err != nil {

     

       59
       59
       -
       		return "", fmt.Errorf("failed to get public key: %w", err)

     

       60
       60
       -
       	}

     

       61
       61
       -
       

     

       62
       62
       -
       	// Create JWT builder

     

       63
       63
       -
       	builder := jwt.NewBuilder().

     

       64
       64
       -
       		Claim("htm", method).            // HTTP method

     

       65
       65
       -
       		Claim("htu", uri).               // HTTP URI

     

       66
       66
       -
       		Claim("iat", time.Now().Unix()). // Issued at

     

       67
       67
       -
       		Claim("jti", generateJTI())      // Unique JWT ID

     

       68
       68
       -
       

     

       69
       69
       -
       	// Add nonce if provided (required after first DPoP request)

     

       70
       70
       -
       	if nonce != "" {

     

       71
       71
       -
       		builder = builder.Claim("nonce", nonce)

     

       72
       72
       -
       	}

     

       73
       73
       -
       

     

       74
       74
       -
       	// Add access token hash if provided (required when using access token)

     

       75
       75
       -
       	if accessToken != "" {

     

       76
       76
       -
       		ath := hashAccessToken(accessToken)

     

       77
       77
       -
       		builder = builder.Claim("ath", ath)

     

       78
       78
       -
       	}

     

       79
       79
       -
       

     

       80
       80
       -
       	// Build the token

     

       81
       81
       -
       	token, err := builder.Build()

     

       82
       82
       -
       	if err != nil {

     

       83
       83
       -
       		return "", fmt.Errorf("failed to build JWT: %w", err)

     

       84
       84
       -
       	}

     

       85
       85
       -
       

     

       86
       86
       -
       	// Serialize the token payload to JSON

     

       87
       87
       -
       	payloadBytes, err := json.Marshal(token)

     

       88
       88
       -
       	if err != nil {

     

       89
       89
       -
       		return "", fmt.Errorf("failed to marshal token: %w", err)

     

       90
       90
       -
       	}

     

       91
       91
       -
       

     

       92
       92
       -
       	// Create headers with DPoP-specific fields

     

       93
       93
       -
       	// RFC 9449 requires the "jwk" header to contain the public key as a JSON object

     

       94
       94
       -
       	headers := jws.NewHeaders()

     

       95
       95
       -
       	if setErr := headers.Set(jws.AlgorithmKey, jwa.ES256); setErr != nil {

     

       96
       96
       -
       		return "", fmt.Errorf("failed to set algorithm: %w", setErr)

     

       97
       97
       -
       	}

     

       98
       98
       -
       	if setErr := headers.Set(jws.TypeKey, "dpop+jwt"); setErr != nil {

     

       99
       99
       -
       		return "", fmt.Errorf("failed to set type: %w", setErr)

     

       100
       100
       -
       	}

     

       101
       101
       -
       	// Set the public JWK directly - jwx library will handle serialization

     

       102
       102
       -
       	if setErr := headers.Set(jws.JWKKey, pubKey); setErr != nil {

     

       103
       103
       -
       		return "", fmt.Errorf("failed to set JWK: %w", setErr)

     

       104
       104
       -
       	}

     

       105
       105
       -
       

     

       106
       106
       -
       	// Sign using jws.Sign to preserve custom headers

     

       107
       107
       -
       	// (jwt.Sign() overrides headers, so we use jws.Sign() directly)

     

       108
       108
       -
       	signed, err := jws.Sign(payloadBytes, jws.WithKey(jwa.ES256, privateKey, jws.WithProtectedHeaders(headers)))

     

       109
       109
       -
       	if err != nil {

     

       110
       110
       -
       		return "", fmt.Errorf("failed to sign JWT: %w", err)

     

       111
       111
       -
       	}

     

       112
       112
       -
       

     

       113
       113
       -
       	return string(signed), nil

     

       114
       114
       -
       }

     

       115
       115
       -
       

     

       116
       116
       -
       // generateJTI generates a unique JWT ID for DPoP proofs

     

       117
       117
       -
       func generateJTI() string {

     

       118
       118
       -
       	// Generate 16 random bytes

     

       119
       119
       -
       	b := make([]byte, 16)

     

       120
       120
       -
       	if _, err := rand.Read(b); err != nil {

     

       121
       121
       -
       		// Fallback to timestamp-based ID

     

       122
       122
       -
       		return fmt.Sprintf("%d", time.Now().UnixNano())

     

       123
       123
       -
       	}

     

       124
       124
       -
       	return base64.RawURLEncoding.EncodeToString(b)

     

       125
       125
       -
       }

     

       126
       126
       -
       

     

       127
       127
       -
       // hashAccessToken creates the 'ath' (access token hash) claim

     

       128
       128
       -
       // ath = base64url(SHA-256(access_token))

     

       129
       129
       -
       func hashAccessToken(accessToken string) string {

     

       130
       130
       -
       	hash := sha256.Sum256([]byte(accessToken))

     

       131
       131
       -
       	return base64.RawURLEncoding.EncodeToString(hash[:])

     

       132
       132
       -
       }

     

       133
       133
       -
       

     

       134
       134
       -
       // ParseJWKFromJSON parses a JWK from JSON bytes

     

       135
       135
       -
       func ParseJWKFromJSON(data []byte) (jwk.Key, error) {

     

       136
       136
       -
       	key, err := jwk.ParseKey(data)

     

       137
       137
       -
       	if err != nil {

     

       138
       138
       -
       		return nil, fmt.Errorf("failed to parse JWK: %w", err)

     

       139
       139
       -
       	}

     

       140
       140
       -
       	return key, nil

     

       141
       141
       -
       }

     

       142
       142
       -
       

     

       143
       143
       -
       // JWKToJSON converts a JWK to JSON bytes

     

       144
       144
       -
       func JWKToJSON(key jwk.Key) ([]byte, error) {

     

       145
       145
       -
       	data, err := json.Marshal(key)

     

       146
       146
       -
       	if err != nil {

     

       147
       147
       -
       		return nil, fmt.Errorf("failed to marshal JWK: %w", err)

     

       148
       148
       -
       	}

     

       149
       149
       -
       	return data, nil

     

       150
       150
       -
       }

     

       151
       151
       -
       

     

       152
       152
       -
       // GetPublicJWKS creates a JWKS (JSON Web Key Set) response for the public key

     

       153
       153
       -
       // This is served at /oauth/jwks.json

     

       154
       154
       -
       func GetPublicJWKS(privateKey jwk.Key) (jwk.Set, error) {

     

       155
       155
       -
       	pubKey, err := privateKey.PublicKey()

     

       156
       156
       -
       	if err != nil {

     

       157
       157
       -
       		return nil, fmt.Errorf("failed to get public key: %w", err)

     

       158
       158
       -
       	}

     

       159
       159
       -
       

     

       160
       160
       -
       	// Create JWK Set

     

       161
       161
       -
       	set := jwk.NewSet()

     

       162
       162
       -
       	if err := set.AddKey(pubKey); err != nil {

     

       163
       163
       -
       		return nil, fmt.Errorf("failed to add key to set: %w", err)

     

       164
       164
       -
       	}

     

       165
       165
       -
       

     

       166
       166
       -
       	return set, nil

     

       167
       167
       -
       }

-172

internal/atproto/oauth/dpop_test.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"encoding/base64"

     

       5
       5
       -
       	"encoding/json"

     

       6
       6
       -
       	"strings"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       )

     

       9
       9
       -
       

     

       10
       10
       -
       // TestCreateDPoPProof tests DPoP proof generation and structure

     

       11
       11
       -
       func TestCreateDPoPProof(t *testing.T) {

     

       12
       12
       -
       	// Generate a test DPoP key

     

       13
       13
       -
       	dpopKey, err := GenerateDPoPKey()

     

       14
       14
       -
       	if err != nil {

     

       15
       15
       -
       		t.Fatalf("Failed to generate DPoP key: %v", err)

     

       16
       16
       -
       	}

     

       17
       17
       -
       

     

       18
       18
       -
       	// Create a DPoP proof

     

       19
       19
       -
       	proof, err := CreateDPoPProof(dpopKey, "POST", "https://example.com/token", "", "")

     

       20
       20
       -
       	if err != nil {

     

       21
       21
       -
       		t.Fatalf("Failed to create DPoP proof: %v", err)

     

       22
       22
       -
       	}

     

       23
       23
       -
       

     

       24
       24
       -
       	// DPoP proof should be a JWT in form: header.payload.signature

     

       25
       25
       -
       	parts := strings.Split(proof, ".")

     

       26
       26
       -
       	if len(parts) != 3 {

     

       27
       27
       -
       		t.Fatalf("Expected 3 parts in JWT, got %d", len(parts))

     

       28
       28
       -
       	}

     

       29
       29
       -
       

     

       30
       30
       -
       	// Decode and inspect the header

     

       31
       31
       -
       	headerJSON, decodeErr := base64.RawURLEncoding.DecodeString(parts[0])

     

       32
       32
       -
       	if decodeErr != nil {

     

       33
       33
       -
       		t.Fatalf("Failed to decode header: %v", decodeErr)

     

       34
       34
       -
       	}

     

       35
       35
       -
       

     

       36
       36
       -
       	var header map[string]interface{}

     

       37
       37
       -
       	if unmarshalErr := json.Unmarshal(headerJSON, &header); unmarshalErr != nil {

     

       38
       38
       -
       		t.Fatalf("Failed to unmarshal header: %v", unmarshalErr)

     

       39
       39
       -
       	}

     

       40
       40
       -
       

     

       41
       41
       -
       	t.Logf("DPoP Header: %s", string(headerJSON))

     

       42
       42
       -
       

     

       43
       43
       -
       	// Verify required header fields

     

       44
       44
       -
       	if header["alg"] != "ES256" {

     

       45
       45
       -
       		t.Errorf("Expected alg=ES256, got %v", header["alg"])

     

       46
       46
       -
       	}

     

       47
       47
       -
       	if header["typ"] != "dpop+jwt" {

     

       48
       48
       -
       		t.Errorf("Expected typ=dpop+jwt, got %v", header["typ"])

     

       49
       49
       -
       	}

     

       50
       50
       -
       

     

       51
       51
       -
       	// Verify JWK is present and is a JSON object

     

       52
       52
       -
       	jwkValue, hasJWK := header["jwk"]

     

       53
       53
       -
       	if !hasJWK {

     

       54
       54
       -
       		t.Fatal("Header missing 'jwk' field")

     

       55
       55
       -
       	}

     

       56
       56
       -
       

     

       57
       57
       -
       	// JWK should be a map/object, not a string

     

       58
       58
       -
       	jwkMap, ok := jwkValue.(map[string]interface{})

     

       59
       59
       -
       	if !ok {

     

       60
       60
       -
       		t.Fatalf("JWK is not a JSON object, got type: %T, value: %v", jwkValue, jwkValue)

     

       61
       61
       -
       	}

     

       62
       62
       -
       

     

       63
       63
       -
       	// Verify JWK has required fields for EC key

     

       64
       64
       -
       	if jwkMap["kty"] != "EC" {

     

       65
       65
       -
       		t.Errorf("Expected kty=EC, got %v", jwkMap["kty"])

     

       66
       66
       -
       	}

     

       67
       67
       -
       	if jwkMap["crv"] != "P-256" {

     

       68
       68
       -
       		t.Errorf("Expected crv=P-256, got %v", jwkMap["crv"])

     

       69
       69
       -
       	}

     

       70
       70
       -
       	if _, hasX := jwkMap["x"]; !hasX {

     

       71
       71
       -
       		t.Error("JWK missing 'x' coordinate")

     

       72
       72
       -
       	}

     

       73
       73
       -
       	if _, hasY := jwkMap["y"]; !hasY {

     

       74
       74
       -
       		t.Error("JWK missing 'y' coordinate")

     

       75
       75
       -
       	}

     

       76
       76
       -
       

     

       77
       77
       -
       	// Verify private key is NOT in the public JWK

     

       78
       78
       -
       	if _, hasD := jwkMap["d"]; hasD {

     

       79
       79
       -
       		t.Error("SECURITY: JWK contains private key component 'd'!")

     

       80
       80
       -
       	}

     

       81
       81
       -
       

     

       82
       82
       -
       	// Decode and inspect the payload

     

       83
       83
       -
       	payloadJSON, err := base64.RawURLEncoding.DecodeString(parts[1])

     

       84
       84
       -
       	if err != nil {

     

       85
       85
       -
       		t.Fatalf("Failed to decode payload: %v", err)

     

       86
       86
       -
       	}

     

       87
       87
       -
       

     

       88
       88
       -
       	var payload map[string]interface{}

     

       89
       89
       -
       	if err := json.Unmarshal(payloadJSON, &payload); err != nil {

     

       90
       90
       -
       		t.Fatalf("Failed to unmarshal payload: %v", err)

     

       91
       91
       -
       	}

     

       92
       92
       -
       

     

       93
       93
       -
       	t.Logf("DPoP Payload: %s", string(payloadJSON))

     

       94
       94
       -
       

     

       95
       95
       -
       	// Verify required payload claims

     

       96
       96
       -
       	if payload["htm"] != "POST" {

     

       97
       97
       -
       		t.Errorf("Expected htm=POST, got %v", payload["htm"])

     

       98
       98
       -
       	}

     

       99
       99
       -
       	if payload["htu"] != "https://example.com/token" {

     

       100
       100
       -
       		t.Errorf("Expected htu=https://example.com/token, got %v", payload["htu"])

     

       101
       101
       -
       	}

     

       102
       102
       -
       	if _, hasIAT := payload["iat"]; !hasIAT {

     

       103
       103
       -
       		t.Error("Payload missing 'iat' (issued at)")

     

       104
       104
       -
       	}

     

       105
       105
       -
       	if _, hasJTI := payload["jti"]; !hasJTI {

     

       106
       106
       -
       		t.Error("Payload missing 'jti' (JWT ID)")

     

       107
       107
       -
       	}

     

       108
       108
       -
       }

     

       109
       109
       -
       

     

       110
       110
       -
       // TestDPoPProofWithNonce tests DPoP proof with nonce

     

       111
       111
       -
       func TestDPoPProofWithNonce(t *testing.T) {

     

       112
       112
       -
       	dpopKey, err := GenerateDPoPKey()

     

       113
       113
       -
       	if err != nil {

     

       114
       114
       -
       		t.Fatalf("Failed to generate DPoP key: %v", err)

     

       115
       115
       -
       	}

     

       116
       116
       -
       

     

       117
       117
       -
       	testNonce := "test-nonce-12345"

     

       118
       118
       -
       	proof, err := CreateDPoPProof(dpopKey, "POST", "https://example.com/token", testNonce, "")

     

       119
       119
       -
       	if err != nil {

     

       120
       120
       -
       		t.Fatalf("Failed to create DPoP proof: %v", err)

     

       121
       121
       -
       	}

     

       122
       122
       -
       

     

       123
       123
       -
       	// Decode payload

     

       124
       124
       -
       	parts := strings.Split(proof, ".")

     

       125
       125
       -
       	payloadJSON, err := base64.RawURLEncoding.DecodeString(parts[1])

     

       126
       126
       -
       	if err != nil {

     

       127
       127
       -
       		t.Fatalf("Failed to decode payload: %v", err)

     

       128
       128
       -
       	}

     

       129
       129
       -
       	var payload map[string]interface{}

     

       130
       130
       -
       	if err := json.Unmarshal(payloadJSON, &payload); err != nil {

     

       131
       131
       -
       		t.Fatalf("Failed to unmarshal payload: %v", err)

     

       132
       132
       -
       	}

     

       133
       133
       -
       

     

       134
       134
       -
       	if payload["nonce"] != testNonce {

     

       135
       135
       -
       		t.Errorf("Expected nonce=%s, got %v", testNonce, payload["nonce"])

     

       136
       136
       -
       	}

     

       137
       137
       -
       }

     

       138
       138
       -
       

     

       139
       139
       -
       // TestDPoPProofWithAccessToken tests DPoP proof with access token hash

     

       140
       140
       -
       func TestDPoPProofWithAccessToken(t *testing.T) {

     

       141
       141
       -
       	dpopKey, err := GenerateDPoPKey()

     

       142
       142
       -
       	if err != nil {

     

       143
       143
       -
       		t.Fatalf("Failed to generate DPoP key: %v", err)

     

       144
       144
       -
       	}

     

       145
       145
       -
       

     

       146
       146
       -
       	testToken := "test-access-token"

     

       147
       147
       -
       	proof, err := CreateDPoPProof(dpopKey, "GET", "https://example.com/resource", "", testToken)

     

       148
       148
       -
       	if err != nil {

     

       149
       149
       -
       		t.Fatalf("Failed to create DPoP proof: %v", err)

     

       150
       150
       -
       	}

     

       151
       151
       -
       

     

       152
       152
       -
       	// Decode payload

     

       153
       153
       -
       	parts := strings.Split(proof, ".")

     

       154
       154
       -
       	payloadJSON, err := base64.RawURLEncoding.DecodeString(parts[1])

     

       155
       155
       -
       	if err != nil {

     

       156
       156
       -
       		t.Fatalf("Failed to decode payload: %v", err)

     

       157
       157
       -
       	}

     

       158
       158
       -
       	var payload map[string]interface{}

     

       159
       159
       -
       	if err := json.Unmarshal(payloadJSON, &payload); err != nil {

     

       160
       160
       -
       		t.Fatalf("Failed to unmarshal payload: %v", err)

     

       161
       161
       -
       	}

     

       162
       162
       -
       

     

       163
       163
       -
       	ath, hasATH := payload["ath"]

     

       164
       164
       -
       	if !hasATH {

     

       165
       165
       -
       		t.Fatal("Payload missing 'ath' (access token hash)")

     

       166
       166
       -
       	}

     

       167
       167
       -
       	if ath == "" {

     

       168
       168
       -
       		t.Error("Access token hash is empty")

     

       169
       169
       -
       	}

     

       170
       170
       -
       

     

       171
       171
       -
       	t.Logf("Access token hash: %v", ath)

     

       172
       172
       -
       }

-201

internal/atproto/xrpc/dpop_transport.go

···

       1
       1
       -
       package xrpc

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/oauth"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"log"

     

       7
       7
       -
       	"net/http"

     

       8
       8
       -
       	"sync"

     

       9
       9
       -
       

     

       10
       10
       -
       	oauthCore "Coves/internal/core/oauth"

     

       11
       11
       -
       

     

       12
       12
       -
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       // DPoPTransport is an http.RoundTripper that automatically adds DPoP proofs to requests

     

       16
       16
       -
       // It intercepts HTTP requests and:

     

       17
       17
       -
       // 1. Adds Authorization: DPoP <access_token>

     

       18
       18
       -
       // 2. Creates and adds DPoP proof JWT

     

       19
       19
       -
       // 3. Handles nonce rotation (retries on 401 with new nonce)

     

       20
       20
       -
       // 4. Updates nonces in session store

     

       21
       21
       -
       type DPoPTransport struct {

     

       22
       22
       -
       	base         http.RoundTripper       // Underlying transport (usually http.DefaultTransport)

     

       23
       23
       -
       	session      *oauthCore.OAuthSession // User's OAuth session

     

       24
       24
       -
       	sessionStore oauthCore.SessionStore  // For updating nonces

     

       25
       25
       -
       	dpopKey      jwk.Key                 // Parsed DPoP private key

     

       26
       26
       -
       	mu           sync.Mutex              // Protects nonce updates

     

       27
       27
       -
       }

     

       28
       28
       -
       

     

       29
       29
       -
       // NewDPoPTransport creates a new DPoP-enabled HTTP transport

     

       30
       30
       -
       func NewDPoPTransport(base http.RoundTripper, session *oauthCore.OAuthSession, sessionStore oauthCore.SessionStore) (*DPoPTransport, error) {

     

       31
       31
       -
       	if base == nil {

     

       32
       32
       -
       		base = http.DefaultTransport

     

       33
       33
       -
       	}

     

       34
       34
       -
       

     

       35
       35
       -
       	// Parse DPoP private key from session

     

       36
       36
       -
       	dpopKey, err := oauth.ParseJWKFromJSON([]byte(session.DPoPPrivateJWK))

     

       37
       37
       -
       	if err != nil {

     

       38
       38
       -
       		return nil, fmt.Errorf("failed to parse DPoP key: %w", err)

     

       39
       39
       -
       	}

     

       40
       40
       -
       

     

       41
       41
       -
       	return &DPoPTransport{

     

       42
       42
       -
       		base:         base,

     

       43
       43
       -
       		session:      session,

     

       44
       44
       -
       		sessionStore: sessionStore,

     

       45
       45
       -
       		dpopKey:      dpopKey,

     

       46
       46
       -
       	}, nil

     

       47
       47
       -
       }

     

       48
       48
       -
       

     

       49
       49
       -
       // RoundTrip implements http.RoundTripper

     

       50
       50
       -
       // This is called for every HTTP request made by the client

     

       51
       51
       -
       func (t *DPoPTransport) RoundTrip(req *http.Request) (*http.Response, error) {

     

       52
       52
       -
       	// Clone the request (don't modify original)

     

       53
       53
       -
       	req = req.Clone(req.Context())

     

       54
       54
       -
       

     

       55
       55
       -
       	// Add Authorization header with DPoP-bound access token

     

       56
       56
       -
       	req.Header.Set("Authorization", "DPoP "+t.session.AccessToken)

     

       57
       57
       -
       

     

       58
       58
       -
       	// Determine which nonce to use based on the target URL

     

       59
       59
       -
       	nonce := t.getDPoPNonce(req.URL.String())

     

       60
       60
       -
       

     

       61
       61
       -
       	// Create DPoP proof for this specific request

     

       62
       62
       -
       	dpopProof, err := oauth.CreateDPoPProof(

     

       63
       63
       -
       		t.dpopKey,

     

       64
       64
       -
       		req.Method,

     

       65
       65
       -
       		req.URL.String(),

     

       66
       66
       -
       		nonce,

     

       67
       67
       -
       		t.session.AccessToken,

     

       68
       68
       -
       	)

     

       69
       69
       -
       	if err != nil {

     

       70
       70
       -
       		return nil, fmt.Errorf("failed to create DPoP proof: %w", err)

     

       71
       71
       -
       	}

     

       72
       72
       -
       

     

       73
       73
       -
       	// Add DPoP proof header

     

       74
       74
       -
       	req.Header.Set("DPoP", dpopProof)

     

       75
       75
       -
       

     

       76
       76
       -
       	// Execute the request

     

       77
       77
       -
       	resp, err := t.base.RoundTrip(req)

     

       78
       78
       -
       	if err != nil {

     

       79
       79
       -
       		return nil, err

     

       80
       80
       -
       	}

     

       81
       81
       -
       

     

       82
       82
       -
       	// Handle DPoP nonce rotation

     

       83
       83
       -
       	if resp.StatusCode == http.StatusUnauthorized {

     

       84
       84
       -
       		// Check if server provided a new nonce

     

       85
       85
       -
       		newNonce := resp.Header.Get("DPoP-Nonce")

     

       86
       86
       -
       		if newNonce != "" {

     

       87
       87
       -
       			// Update nonce and retry request once

     

       88
       88
       -
       			t.updateDPoPNonce(req.URL.String(), newNonce)

     

       89
       89
       -
       

     

       90
       90
       -
       			// Close the 401 response body

     

       91
       91
       -
       			if err := resp.Body.Close(); err != nil {

     

       92
       92
       -
       				log.Printf("Failed to close response body: %v", err)

     

       93
       93
       -
       			}

     

       94
       94
       -
       

     

       95
       95
       -
       			// Retry with new nonce

     

       96
       96
       -
       			return t.retryWithNewNonce(req, newNonce)

     

       97
       97
       -
       		}

     

       98
       98
       -
       	}

     

       99
       99
       -
       

     

       100
       100
       -
       	// Check for nonce update even on successful responses

     

       101
       101
       -
       	if newNonce := resp.Header.Get("DPoP-Nonce"); newNonce != "" {

     

       102
       102
       -
       		t.updateDPoPNonce(req.URL.String(), newNonce)

     

       103
       103
       -
       	}

     

       104
       104
       -
       

     

       105
       105
       -
       	return resp, nil

     

       106
       106
       -
       }

     

       107
       107
       -
       

     

       108
       108
       -
       // getDPoPNonce determines which DPoP nonce to use for a given URL

     

       109
       109
       -
       func (t *DPoPTransport) getDPoPNonce(url string) string {

     

       110
       110
       -
       	t.mu.Lock()

     

       111
       111
       -
       	defer t.mu.Unlock()

     

       112
       112
       -
       

     

       113
       113
       -
       	// If URL is to the PDS, use PDS nonce

     

       114
       114
       -
       	if contains(url, t.session.PDSURL) {

     

       115
       115
       -
       		return t.session.DPoPPDSNonce

     

       116
       116
       -
       	}

     

       117
       117
       -
       

     

       118
       118
       -
       	// If URL is to auth server, use auth server nonce

     

       119
       119
       -
       	if contains(url, t.session.AuthServerIss) {

     

       120
       120
       -
       		return t.session.DPoPAuthServerNonce

     

       121
       121
       -
       	}

     

       122
       122
       -
       

     

       123
       123
       -
       	// Default: no nonce (first request to this server)

     

       124
       124
       -
       	return ""

     

       125
       125
       -
       }

     

       126
       126
       -
       

     

       127
       127
       -
       // updateDPoPNonce updates the appropriate nonce based on URL

     

       128
       128
       -
       func (t *DPoPTransport) updateDPoPNonce(url, newNonce string) {

     

       129
       129
       -
       	t.mu.Lock()

     

       130
       130
       -
       

     

       131
       131
       -
       	// Read DID inside lock to avoid race condition

     

       132
       132
       -
       	did := t.session.DID

     

       133
       133
       -
       

     

       134
       134
       -
       	// Update PDS nonce

     

       135
       135
       -
       	if contains(url, t.session.PDSURL) {

     

       136
       136
       -
       		t.session.DPoPPDSNonce = newNonce

     

       137
       137
       -
       		t.mu.Unlock()

     

       138
       138
       -
       		// Persist to database (async, best-effort)

     

       139
       139
       -
       		go func() {

     

       140
       140
       -
       			if err := t.sessionStore.UpdatePDSNonce(did, newNonce); err != nil {

     

       141
       141
       -
       				log.Printf("Failed to update PDS nonce: %v", err)

     

       142
       142
       -
       			}

     

       143
       143
       -
       		}()

     

       144
       144
       -
       		return

     

       145
       145
       -
       	}

     

       146
       146
       -
       

     

       147
       147
       -
       	// Update auth server nonce

     

       148
       148
       -
       	if contains(url, t.session.AuthServerIss) {

     

       149
       149
       -
       		t.session.DPoPAuthServerNonce = newNonce

     

       150
       150
       -
       		t.mu.Unlock()

     

       151
       151
       -
       		// Persist to database (async, best-effort)

     

       152
       152
       -
       		go func() {

     

       153
       153
       -
       			if err := t.sessionStore.UpdateAuthServerNonce(did, newNonce); err != nil {

     

       154
       154
       -
       				log.Printf("Failed to update auth server nonce: %v", err)

     

       155
       155
       -
       			}

     

       156
       156
       -
       		}()

     

       157
       157
       -
       		return

     

       158
       158
       -
       	}

     

       159
       159
       -
       

     

       160
       160
       -
       	t.mu.Unlock()

     

       161
       161
       -
       }

     

       162
       162
       -
       

     

       163
       163
       -
       // retryWithNewNonce retries a request with an updated DPoP nonce

     

       164
       164
       -
       func (t *DPoPTransport) retryWithNewNonce(req *http.Request, newNonce string) (*http.Response, error) {

     

       165
       165
       -
       	// Create new DPoP proof with updated nonce

     

       166
       166
       -
       	dpopProof, err := oauth.CreateDPoPProof(

     

       167
       167
       -
       		t.dpopKey,

     

       168
       168
       -
       		req.Method,

     

       169
       169
       -
       		req.URL.String(),

     

       170
       170
       -
       		newNonce,

     

       171
       171
       -
       		t.session.AccessToken,

     

       172
       172
       -
       	)

     

       173
       173
       -
       	if err != nil {

     

       174
       174
       -
       		return nil, fmt.Errorf("failed to create DPoP proof on retry: %w", err)

     

       175
       175
       -
       	}

     

       176
       176
       -
       

     

       177
       177
       -
       	// Update DPoP header

     

       178
       178
       -
       	req.Header.Set("DPoP", dpopProof)

     

       179
       179
       -
       

     

       180
       180
       -
       	// Retry the request (only once - no infinite loops)

     

       181
       181
       -
       	return t.base.RoundTrip(req)

     

       182
       182
       -
       }

     

       183
       183
       -
       

     

       184
       184
       -
       // contains checks if haystack contains needle (case-sensitive)

     

       185
       185
       -
       func contains(haystack, needle string) bool {

     

       186
       186
       -
       	return len(haystack) >= len(needle) && haystack[:len(needle)] == needle ||

     

       187
       187
       -
       		len(haystack) > len(needle) && haystack[len(haystack)-len(needle):] == needle

     

       188
       188
       -
       }

     

       189
       189
       -
       

     

       190
       190
       -
       // AuthenticatedClient creates an HTTP client with DPoP transport

     

       191
       191
       -
       // This is what handlers use to make authenticated requests to the user's PDS

     

       192
       192
       -
       func NewAuthenticatedClient(session *oauthCore.OAuthSession, sessionStore oauthCore.SessionStore) (*http.Client, error) {

     

       193
       193
       -
       	transport, err := NewDPoPTransport(nil, session, sessionStore)

     

       194
       194
       -
       	if err != nil {

     

       195
       195
       -
       		return nil, fmt.Errorf("failed to create DPoP transport: %w", err)

     

       196
       196
       -
       	}

     

       197
       197
       -
       

     

       198
       198
       -
       	return &http.Client{

     

       199
       199
       -
       		Transport: transport,

     

       200
       200
       -
       	}, nil

     

       201
       201
       -
       }

-91

internal/core/oauth/auth_service.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/oauth"

     

       5
       5
       -
       	"context"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       10
       10
       -
       )

     

       11
       11
       -
       

     

       12
       12
       -
       // AuthService handles authentication-related business logic

     

       13
       13
       -
       // Extracted from middleware to maintain clean architecture

     

       14
       14
       -
       type AuthService struct {

     

       15
       15
       -
       	sessionStore SessionStore

     

       16
       16
       -
       	oauthClient  *oauth.Client

     

       17
       17
       -
       }

     

       18
       18
       -
       

     

       19
       19
       -
       // NewAuthService creates a new authentication service

     

       20
       20
       -
       func NewAuthService(sessionStore SessionStore, oauthClient *oauth.Client) *AuthService {

     

       21
       21
       -
       	return &AuthService{

     

       22
       22
       -
       		sessionStore: sessionStore,

     

       23
       23
       -
       		oauthClient:  oauthClient,

     

       24
       24
       -
       	}

     

       25
       25
       -
       }

     

       26
       26
       -
       

     

       27
       27
       -
       // ValidateSession retrieves and validates a user's OAuth session

     

       28
       28
       -
       // Returns the session if valid, error if not found or expired

     

       29
       29
       -
       func (s *AuthService) ValidateSession(ctx context.Context, did string) (*OAuthSession, error) {

     

       30
       30
       -
       	session, err := s.sessionStore.GetSession(did)

     

       31
       31
       -
       	if err != nil {

     

       32
       32
       -
       		return nil, fmt.Errorf("session not found: %w", err)

     

       33
       33
       -
       	}

     

       34
       34
       -
       	return session, nil

     

       35
       35
       -
       }

     

       36
       36
       -
       

     

       37
       37
       -
       // RefreshTokenIfNeeded checks if token needs refresh and refreshes if necessary

     

       38
       38
       -
       // Returns updated session if refreshed, original session otherwise

     

       39
       39
       -
       func (s *AuthService) RefreshTokenIfNeeded(ctx context.Context, session *OAuthSession, threshold time.Duration) (*OAuthSession, error) {

     

       40
       40
       -
       	// Check if token needs refresh

     

       41
       41
       -
       	if time.Until(session.ExpiresAt) >= threshold {

     

       42
       42
       -
       		// Token is still valid, no refresh needed

     

       43
       43
       -
       		return session, nil

     

       44
       44
       -
       	}

     

       45
       45
       -
       

     

       46
       46
       -
       	// Parse DPoP key

     

       47
       47
       -
       	dpopKey, err := oauth.ParseJWKFromJSON([]byte(session.DPoPPrivateJWK))

     

       48
       48
       -
       	if err != nil {

     

       49
       49
       -
       		return nil, fmt.Errorf("failed to parse DPoP key: %w", err)

     

       50
       50
       -
       	}

     

       51
       51
       -
       

     

       52
       52
       -
       	// Refresh token

     

       53
       53
       -
       	tokenResp, err := s.oauthClient.RefreshTokenRequest(

     

       54
       54
       -
       		ctx,

     

       55
       55
       -
       		session.RefreshToken,

     

       56
       56
       -
       		session.AuthServerIss,

     

       57
       57
       -
       		session.DPoPAuthServerNonce,

     

       58
       58
       -
       		dpopKey,

     

       59
       59
       -
       	)

     

       60
       60
       -
       	if err != nil {

     

       61
       61
       -
       		return nil, fmt.Errorf("failed to refresh token: %w", err)

     

       62
       62
       -
       	}

     

       63
       63
       -
       

     

       64
       64
       -
       	// Update session with new tokens

     

       65
       65
       -
       	expiresAt := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)

     

       66
       66
       -
       	if err := s.sessionStore.RefreshSession(session.DID, tokenResp.AccessToken, tokenResp.RefreshToken, expiresAt); err != nil {

     

       67
       67
       -
       		return nil, fmt.Errorf("failed to update session: %w", err)

     

       68
       68
       -
       	}

     

       69
       69
       -
       

     

       70
       70
       -
       	// Update nonce if provided (best effort - non-critical)

     

       71
       71
       -
       	if tokenResp.DpopAuthserverNonce != "" {

     

       72
       72
       -
       		session.DPoPAuthServerNonce = tokenResp.DpopAuthserverNonce

     

       73
       73
       -
       		if updateErr := s.sessionStore.UpdateAuthServerNonce(session.DID, tokenResp.DpopAuthserverNonce); updateErr != nil {

     

       74
       74
       -
       			// Log but don't fail - nonce will be updated on next request

     

       75
       75
       -
       			// (We ignore the error here intentionally as nonce updates are non-critical)

     

       76
       76
       -
       			_ = updateErr

     

       77
       77
       -
       		}

     

       78
       78
       -
       	}

     

       79
       79
       -
       

     

       80
       80
       -
       	// Return updated session

     

       81
       81
       -
       	session.AccessToken = tokenResp.AccessToken

     

       82
       82
       -
       	session.RefreshToken = tokenResp.RefreshToken

     

       83
       83
       -
       	session.ExpiresAt = expiresAt

     

       84
       84
       -
       

     

       85
       85
       -
       	return session, nil

     

       86
       86
       -
       }

     

       87
       87
       -
       

     

       88
       88
       -
       // CreateDPoPKey generates a new DPoP key for a session

     

       89
       89
       -
       func (s *AuthService) CreateDPoPKey() (jwk.Key, error) {

     

       90
       90
       -
       	return oauth.GenerateDPoPKey()

     

       91
       91
       -
       }

-353

internal/core/oauth/repository.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"database/sql"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"time"

     

       8
       8
       -
       )

     

       9
       9
       -
       

     

       10
       10
       -
       // PostgresSessionStore implements SessionStore using PostgreSQL

     

       11
       11
       -
       type PostgresSessionStore struct {

     

       12
       12
       -
       	db *sql.DB

     

       13
       13
       -
       }

     

       14
       14
       -
       

     

       15
       15
       -
       // NewPostgresSessionStore creates a new PostgreSQL-backed session store

     

       16
       16
       -
       func NewPostgresSessionStore(db *sql.DB) SessionStore {

     

       17
       17
       -
       	return &PostgresSessionStore{db: db}

     

       18
       18
       -
       }

     

       19
       19
       -
       

     

       20
       20
       -
       // SaveRequest stores a temporary OAuth request state

     

       21
       21
       -
       func (s *PostgresSessionStore) SaveRequest(req *OAuthRequest) error {

     

       22
       22
       -
       	query := `

     

       23
       23
       -
       		INSERT INTO oauth_requests (

     

       24
       24
       -
       			state, did, handle, pds_url, pkce_verifier,

     

       25
       25
       -
       			dpop_private_jwk, dpop_authserver_nonce, auth_server_iss, return_url

     

       26
       26
       -
       		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)

     

       27
       27
       -
       	`

     

       28
       28
       -
       

     

       29
       29
       -
       	_, err := s.db.Exec(

     

       30
       30
       -
       		query,

     

       31
       31
       -
       		req.State,

     

       32
       32
       -
       		req.DID,

     

       33
       33
       -
       		req.Handle,

     

       34
       34
       -
       		req.PDSURL,

     

       35
       35
       -
       		req.PKCEVerifier,

     

       36
       36
       -
       		req.DPoPPrivateJWK,

     

       37
       37
       -
       		req.DPoPAuthServerNonce,

     

       38
       38
       -
       		req.AuthServerIss,

     

       39
       39
       -
       		req.ReturnURL,

     

       40
       40
       -
       	)

     

       41
       41
       -
       	if err != nil {

     

       42
       42
       -
       		return fmt.Errorf("failed to save OAuth request: %w", err)

     

       43
       43
       -
       	}

     

       44
       44
       -
       

     

       45
       45
       -
       	return nil

     

       46
       46
       -
       }

     

       47
       47
       -
       

     

       48
       48
       -
       // GetRequestByState retrieves an OAuth request by state parameter

     

       49
       49
       -
       func (s *PostgresSessionStore) GetRequestByState(state string) (*OAuthRequest, error) {

     

       50
       50
       -
       	query := `

     

       51
       51
       -
       		SELECT

     

       52
       52
       -
       			state, did, handle, pds_url, pkce_verifier,

     

       53
       53
       -
       			dpop_private_jwk, dpop_authserver_nonce, auth_server_iss,

     

       54
       54
       -
       			COALESCE(return_url, ''), created_at

     

       55
       55
       -
       		FROM oauth_requests

     

       56
       56
       -
       		WHERE state = $1

     

       57
       57
       -
       	`

     

       58
       58
       -
       

     

       59
       59
       -
       	var req OAuthRequest

     

       60
       60
       -
       	err := s.db.QueryRow(query, state).Scan(

     

       61
       61
       -
       		&req.State,

     

       62
       62
       -
       		&req.DID,

     

       63
       63
       -
       		&req.Handle,

     

       64
       64
       -
       		&req.PDSURL,

     

       65
       65
       -
       		&req.PKCEVerifier,

     

       66
       66
       -
       		&req.DPoPPrivateJWK,

     

       67
       67
       -
       		&req.DPoPAuthServerNonce,

     

       68
       68
       -
       		&req.AuthServerIss,

     

       69
       69
       -
       		&req.ReturnURL,

     

       70
       70
       -
       		&req.CreatedAt,

     

       71
       71
       -
       	)

     

       72
       72
       -
       

     

       73
       73
       -
       	if err == sql.ErrNoRows {

     

       74
       74
       -
       		return nil, fmt.Errorf("OAuth request not found for state: %s", state)

     

       75
       75
       -
       	}

     

       76
       76
       -
       	if err != nil {

     

       77
       77
       -
       		return nil, fmt.Errorf("failed to get OAuth request: %w", err)

     

       78
       78
       -
       	}

     

       79
       79
       -
       

     

       80
       80
       -
       	return &req, nil

     

       81
       81
       -
       }

     

       82
       82
       -
       

     

       83
       83
       -
       // GetAndDeleteRequest atomically retrieves and deletes an OAuth request to prevent replay attacks

     

       84
       84
       -
       // This ensures the state parameter can only be used once

     

       85
       85
       -
       func (s *PostgresSessionStore) GetAndDeleteRequest(state string) (*OAuthRequest, error) {

     

       86
       86
       -
       	query := `

     

       87
       87
       -
       		DELETE FROM oauth_requests

     

       88
       88
       -
       		WHERE state = $1

     

       89
       89
       -
       		RETURNING

     

       90
       90
       -
       			state, did, handle, pds_url, pkce_verifier,

     

       91
       91
       -
       			dpop_private_jwk, dpop_authserver_nonce, auth_server_iss,

     

       92
       92
       -
       			COALESCE(return_url, ''), created_at

     

       93
       93
       -
       	`

     

       94
       94
       -
       

     

       95
       95
       -
       	var req OAuthRequest

     

       96
       96
       -
       	err := s.db.QueryRow(query, state).Scan(

     

       97
       97
       -
       		&req.State,

     

       98
       98
       -
       		&req.DID,

     

       99
       99
       -
       		&req.Handle,

     

       100
       100
       -
       		&req.PDSURL,

     

       101
       101
       -
       		&req.PKCEVerifier,

     

       102
       102
       -
       		&req.DPoPPrivateJWK,

     

       103
       103
       -
       		&req.DPoPAuthServerNonce,

     

       104
       104
       -
       		&req.AuthServerIss,

     

       105
       105
       -
       		&req.ReturnURL,

     

       106
       106
       -
       		&req.CreatedAt,

     

       107
       107
       -
       	)

     

       108
       108
       -
       

     

       109
       109
       -
       	if err == sql.ErrNoRows {

     

       110
       110
       -
       		return nil, fmt.Errorf("OAuth request not found or already used: %s", state)

     

       111
       111
       -
       	}

     

       112
       112
       -
       	if err != nil {

     

       113
       113
       -
       		return nil, fmt.Errorf("failed to get and delete OAuth request: %w", err)

     

       114
       114
       -
       	}

     

       115
       115
       -
       

     

       116
       116
       -
       	return &req, nil

     

       117
       117
       -
       }

     

       118
       118
       -
       

     

       119
       119
       -
       // DeleteRequest removes an OAuth request (cleanup after callback)

     

       120
       120
       -
       func (s *PostgresSessionStore) DeleteRequest(state string) error {

     

       121
       121
       -
       	query := `DELETE FROM oauth_requests WHERE state = $1`

     

       122
       122
       -
       

     

       123
       123
       -
       	_, err := s.db.Exec(query, state)

     

       124
       124
       -
       	if err != nil {

     

       125
       125
       -
       		return fmt.Errorf("failed to delete OAuth request: %w", err)

     

       126
       126
       -
       	}

     

       127
       127
       -
       

     

       128
       128
       -
       	return nil

     

       129
       129
       -
       }

     

       130
       130
       -
       

     

       131
       131
       -
       // SaveSession stores a new OAuth session (upsert on DID)

     

       132
       132
       -
       func (s *PostgresSessionStore) SaveSession(session *OAuthSession) error {

     

       133
       133
       -
       	query := `

     

       134
       134
       -
       		INSERT INTO oauth_sessions (

     

       135
       135
       -
       			did, handle, pds_url, access_token, refresh_token,

     

       136
       136
       -
       			dpop_private_jwk, dpop_authserver_nonce, dpop_pds_nonce,

     

       137
       137
       -
       			auth_server_iss, expires_at

     

       138
       138
       -
       		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)

     

       139
       139
       -
       		ON CONFLICT (did) DO UPDATE SET

     

       140
       140
       -
       			handle = EXCLUDED.handle,

     

       141
       141
       -
       			pds_url = EXCLUDED.pds_url,

     

       142
       142
       -
       			access_token = EXCLUDED.access_token,

     

       143
       143
       -
       			refresh_token = EXCLUDED.refresh_token,

     

       144
       144
       -
       			dpop_private_jwk = EXCLUDED.dpop_private_jwk,

     

       145
       145
       -
       			dpop_authserver_nonce = EXCLUDED.dpop_authserver_nonce,

     

       146
       146
       -
       			dpop_pds_nonce = EXCLUDED.dpop_pds_nonce,

     

       147
       147
       -
       			auth_server_iss = EXCLUDED.auth_server_iss,

     

       148
       148
       -
       			expires_at = EXCLUDED.expires_at,

     

       149
       149
       -
       			updated_at = CURRENT_TIMESTAMP

     

       150
       150
       -
       	`

     

       151
       151
       -
       

     

       152
       152
       -
       	_, err := s.db.Exec(

     

       153
       153
       -
       		query,

     

       154
       154
       -
       		session.DID,

     

       155
       155
       -
       		session.Handle,

     

       156
       156
       -
       		session.PDSURL,

     

       157
       157
       -
       		session.AccessToken,

     

       158
       158
       -
       		session.RefreshToken,

     

       159
       159
       -
       		session.DPoPPrivateJWK,

     

       160
       160
       -
       		session.DPoPAuthServerNonce,

     

       161
       161
       -
       		session.DPoPPDSNonce,

     

       162
       162
       -
       		session.AuthServerIss,

     

       163
       163
       -
       		session.ExpiresAt,

     

       164
       164
       -
       	)

     

       165
       165
       -
       	if err != nil {

     

       166
       166
       -
       		return fmt.Errorf("failed to save OAuth session: %w", err)

     

       167
       167
       -
       	}

     

       168
       168
       -
       

     

       169
       169
       -
       	return nil

     

       170
       170
       -
       }

     

       171
       171
       -
       

     

       172
       172
       -
       // GetSession retrieves an OAuth session by DID

     

       173
       173
       -
       func (s *PostgresSessionStore) GetSession(did string) (*OAuthSession, error) {

     

       174
       174
       -
       	query := `

     

       175
       175
       -
       		SELECT

     

       176
       176
       -
       			did, handle, pds_url, access_token, refresh_token,

     

       177
       177
       -
       			dpop_private_jwk,

     

       178
       178
       -
       			COALESCE(dpop_authserver_nonce, ''),

     

       179
       179
       -
       			COALESCE(dpop_pds_nonce, ''),

     

       180
       180
       -
       			auth_server_iss, expires_at, created_at, updated_at

     

       181
       181
       -
       		FROM oauth_sessions

     

       182
       182
       -
       		WHERE did = $1

     

       183
       183
       -
       	`

     

       184
       184
       -
       

     

       185
       185
       -
       	var session OAuthSession

     

       186
       186
       -
       	err := s.db.QueryRow(query, did).Scan(

     

       187
       187
       -
       		&session.DID,

     

       188
       188
       -
       		&session.Handle,

     

       189
       189
       -
       		&session.PDSURL,

     

       190
       190
       -
       		&session.AccessToken,

     

       191
       191
       -
       		&session.RefreshToken,

     

       192
       192
       -
       		&session.DPoPPrivateJWK,

     

       193
       193
       -
       		&session.DPoPAuthServerNonce,

     

       194
       194
       -
       		&session.DPoPPDSNonce,

     

       195
       195
       -
       		&session.AuthServerIss,

     

       196
       196
       -
       		&session.ExpiresAt,

     

       197
       197
       -
       		&session.CreatedAt,

     

       198
       198
       -
       		&session.UpdatedAt,

     

       199
       199
       -
       	)

     

       200
       200
       -
       

     

       201
       201
       -
       	if err == sql.ErrNoRows {

     

       202
       202
       -
       		return nil, fmt.Errorf("session not found for DID: %s", did)

     

       203
       203
       -
       	}

     

       204
       204
       -
       	if err != nil {

     

       205
       205
       -
       		return nil, fmt.Errorf("failed to get OAuth session: %w", err)

     

       206
       206
       -
       	}

     

       207
       207
       -
       

     

       208
       208
       -
       	return &session, nil

     

       209
       209
       -
       }

     

       210
       210
       -
       

     

       211
       211
       -
       // UpdateSession updates an existing OAuth session

     

       212
       212
       -
       func (s *PostgresSessionStore) UpdateSession(session *OAuthSession) error {

     

       213
       213
       -
       	query := `

     

       214
       214
       -
       		UPDATE oauth_sessions SET

     

       215
       215
       -
       			handle = $2,

     

       216
       216
       -
       			pds_url = $3,

     

       217
       217
       -
       			access_token = $4,

     

       218
       218
       -
       			refresh_token = $5,

     

       219
       219
       -
       			dpop_private_jwk = $6,

     

       220
       220
       -
       			dpop_authserver_nonce = $7,

     

       221
       221
       -
       			dpop_pds_nonce = $8,

     

       222
       222
       -
       			auth_server_iss = $9,

     

       223
       223
       -
       			expires_at = $10,

     

       224
       224
       -
       			updated_at = CURRENT_TIMESTAMP

     

       225
       225
       -
       		WHERE did = $1

     

       226
       226
       -
       	`

     

       227
       227
       -
       

     

       228
       228
       -
       	result, err := s.db.Exec(

     

       229
       229
       -
       		query,

     

       230
       230
       -
       		session.DID,

     

       231
       231
       -
       		session.Handle,

     

       232
       232
       -
       		session.PDSURL,

     

       233
       233
       -
       		session.AccessToken,

     

       234
       234
       -
       		session.RefreshToken,

     

       235
       235
       -
       		session.DPoPPrivateJWK,

     

       236
       236
       -
       		session.DPoPAuthServerNonce,

     

       237
       237
       -
       		session.DPoPPDSNonce,

     

       238
       238
       -
       		session.AuthServerIss,

     

       239
       239
       -
       		session.ExpiresAt,

     

       240
       240
       -
       	)

     

       241
       241
       -
       	if err != nil {

     

       242
       242
       -
       		return fmt.Errorf("failed to update OAuth session: %w", err)

     

       243
       243
       -
       	}

     

       244
       244
       -
       

     

       245
       245
       -
       	rows, err := result.RowsAffected()

     

       246
       246
       -
       	if err != nil {

     

       247
       247
       -
       		return fmt.Errorf("failed to check rows affected: %w", err)

     

       248
       248
       -
       	}

     

       249
       249
       -
       	if rows == 0 {

     

       250
       250
       -
       		return fmt.Errorf("session not found for DID: %s", session.DID)

     

       251
       251
       -
       	}

     

       252
       252
       -
       

     

       253
       253
       -
       	return nil

     

       254
       254
       -
       }

     

       255
       255
       -
       

     

       256
       256
       -
       // DeleteSession removes an OAuth session (logout)

     

       257
       257
       -
       func (s *PostgresSessionStore) DeleteSession(did string) error {

     

       258
       258
       -
       	query := `DELETE FROM oauth_sessions WHERE did = $1`

     

       259
       259
       -
       

     

       260
       260
       -
       	_, err := s.db.Exec(query, did)

     

       261
       261
       -
       	if err != nil {

     

       262
       262
       -
       		return fmt.Errorf("failed to delete OAuth session: %w", err)

     

       263
       263
       -
       	}

     

       264
       264
       -
       

     

       265
       265
       -
       	return nil

     

       266
       266
       -
       }

     

       267
       267
       -
       

     

       268
       268
       -
       // RefreshSession updates access and refresh tokens after a token refresh

     

       269
       269
       -
       func (s *PostgresSessionStore) RefreshSession(did, newAccessToken, newRefreshToken string, expiresAt time.Time) error {

     

       270
       270
       -
       	query := `

     

       271
       271
       -
       		UPDATE oauth_sessions SET

     

       272
       272
       -
       			access_token = $2,

     

       273
       273
       -
       			refresh_token = $3,

     

       274
       274
       -
       			expires_at = $4,

     

       275
       275
       -
       			updated_at = CURRENT_TIMESTAMP

     

       276
       276
       -
       		WHERE did = $1

     

       277
       277
       -
       	`

     

       278
       278
       -
       

     

       279
       279
       -
       	result, err := s.db.Exec(query, did, newAccessToken, newRefreshToken, expiresAt)

     

       280
       280
       -
       	if err != nil {

     

       281
       281
       -
       		return fmt.Errorf("failed to refresh OAuth session: %w", err)

     

       282
       282
       -
       	}

     

       283
       283
       -
       

     

       284
       284
       -
       	rows, err := result.RowsAffected()

     

       285
       285
       -
       	if err != nil {

     

       286
       286
       -
       		return fmt.Errorf("failed to check rows affected: %w", err)

     

       287
       287
       -
       	}

     

       288
       288
       -
       	if rows == 0 {

     

       289
       289
       -
       		return fmt.Errorf("session not found for DID: %s", did)

     

       290
       290
       -
       	}

     

       291
       291
       -
       

     

       292
       292
       -
       	return nil

     

       293
       293
       -
       }

     

       294
       294
       -
       

     

       295
       295
       -
       // UpdateAuthServerNonce updates the DPoP nonce for the auth server token endpoint

     

       296
       296
       -
       func (s *PostgresSessionStore) UpdateAuthServerNonce(did, nonce string) error {

     

       297
       297
       -
       	query := `

     

       298
       298
       -
       		UPDATE oauth_sessions SET

     

       299
       299
       -
       			dpop_authserver_nonce = $2,

     

       300
       300
       -
       			updated_at = CURRENT_TIMESTAMP

     

       301
       301
       -
       		WHERE did = $1

     

       302
       302
       -
       	`

     

       303
       303
       -
       

     

       304
       304
       -
       	_, err := s.db.Exec(query, did, nonce)

     

       305
       305
       -
       	if err != nil {

     

       306
       306
       -
       		return fmt.Errorf("failed to update auth server nonce: %w", err)

     

       307
       307
       -
       	}

     

       308
       308
       -
       

     

       309
       309
       -
       	return nil

     

       310
       310
       -
       }

     

       311
       311
       -
       

     

       312
       312
       -
       // UpdatePDSNonce updates the DPoP nonce for PDS requests

     

       313
       313
       -
       func (s *PostgresSessionStore) UpdatePDSNonce(did, nonce string) error {

     

       314
       314
       -
       	query := `

     

       315
       315
       -
       		UPDATE oauth_sessions SET

     

       316
       316
       -
       			dpop_pds_nonce = $2,

     

       317
       317
       -
       			updated_at = CURRENT_TIMESTAMP

     

       318
       318
       -
       		WHERE did = $1

     

       319
       319
       -
       	`

     

       320
       320
       -
       

     

       321
       321
       -
       	_, err := s.db.Exec(query, did, nonce)

     

       322
       322
       -
       	if err != nil {

     

       323
       323
       -
       		return fmt.Errorf("failed to update PDS nonce: %w", err)

     

       324
       324
       -
       	}

     

       325
       325
       -
       

     

       326
       326
       -
       	return nil

     

       327
       327
       -
       }

     

       328
       328
       -
       

     

       329
       329
       -
       // CleanupExpiredRequests removes OAuth requests older than 30 minutes

     

       330
       330
       -
       // Should be called periodically (e.g., via cron job or background goroutine)

     

       331
       331
       -
       func (s *PostgresSessionStore) CleanupExpiredRequests(ctx context.Context) error {

     

       332
       332
       -
       	query := `DELETE FROM oauth_requests WHERE created_at < NOW() - INTERVAL '30 minutes'`

     

       333
       333
       -
       

     

       334
       334
       -
       	_, err := s.db.ExecContext(ctx, query)

     

       335
       335
       -
       	if err != nil {

     

       336
       336
       -
       		return fmt.Errorf("failed to cleanup expired requests: %w", err)

     

       337
       337
       -
       	}

     

       338
       338
       -
       

     

       339
       339
       -
       	return nil

     

       340
       340
       -
       }

     

       341
       341
       -
       

     

       342
       342
       -
       // CleanupExpiredSessions removes OAuth sessions that have been expired for > 7 days

     

       343
       343
       -
       // Gives users time to refresh their tokens before permanent deletion

     

       344
       344
       -
       func (s *PostgresSessionStore) CleanupExpiredSessions(ctx context.Context) error {

     

       345
       345
       -
       	query := `DELETE FROM oauth_sessions WHERE expires_at < NOW() - INTERVAL '7 days'`

     

       346
       346
       -
       

     

       347
       347
       -
       	_, err := s.db.ExecContext(ctx, query)

     

       348
       348
       -
       	if err != nil {

     

       349
       349
       -
       		return fmt.Errorf("failed to cleanup expired sessions: %w", err)

     

       350
       350
       -
       	}

     

       351
       351
       -
       

     

       352
       352
       -
       	return nil

     

       353
       353
       -
       }

-59

internal/core/oauth/session.go

···

       1
       1
       -
       package oauth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"time"

     

       5
       5
       -
       )

     

       6
       6
       -
       

     

       7
       7
       -
       // OAuthRequest represents a temporary OAuth authorization flow state

     

       8
       8
       -
       // Stored during the redirect to auth server, deleted after callback

     

       9
       9
       -
       type OAuthRequest struct {

     

       10
       10
       -
       	CreatedAt           time.Time `db:"created_at"`

     

       11
       11
       -
       	State               string    `db:"state"`

     

       12
       12
       -
       	DID                 string    `db:"did"`

     

       13
       13
       -
       	Handle              string    `db:"handle"`

     

       14
       14
       -
       	PDSURL              string    `db:"pds_url"`

     

       15
       15
       -
       	PKCEVerifier        string    `db:"pkce_verifier"`

     

       16
       16
       -
       	DPoPPrivateJWK      string    `db:"dpop_private_jwk"`

     

       17
       17
       -
       	DPoPAuthServerNonce string    `db:"dpop_authserver_nonce"`

     

       18
       18
       -
       	AuthServerIss       string    `db:"auth_server_iss"`

     

       19
       19
       -
       	ReturnURL           string    `db:"return_url"`

     

       20
       20
       -
       }

     

       21
       21
       -
       

     

       22
       22
       -
       // OAuthSession represents a long-lived authenticated user session

     

       23
       23
       -
       // Stored after successful OAuth login, used for all authenticated requests

     

       24
       24
       -
       type OAuthSession struct {

     

       25
       25
       -
       	ExpiresAt           time.Time `db:"expires_at"`

     

       26
       26
       -
       	CreatedAt           time.Time `db:"created_at"`

     

       27
       27
       -
       	UpdatedAt           time.Time `db:"updated_at"`

     

       28
       28
       -
       	DID                 string    `db:"did"`

     

       29
       29
       -
       	Handle              string    `db:"handle"`

     

       30
       30
       -
       	PDSURL              string    `db:"pds_url"`

     

       31
       31
       -
       	AccessToken         string    `db:"access_token"`

     

       32
       32
       -
       	RefreshToken        string    `db:"refresh_token"`

     

       33
       33
       -
       	DPoPPrivateJWK      string    `db:"dpop_private_jwk"`

     

       34
       34
       -
       	DPoPAuthServerNonce string    `db:"dpop_authserver_nonce"`

     

       35
       35
       -
       	DPoPPDSNonce        string    `db:"dpop_pds_nonce"`

     

       36
       36
       -
       	AuthServerIss       string    `db:"auth_server_iss"`

     

       37
       37
       -
       }

     

       38
       38
       -
       

     

       39
       39
       -
       // SessionStore defines the interface for OAuth session storage

     

       40
       40
       -
       type SessionStore interface {

     

       41
       41
       -
       	// OAuth flow state management

     

       42
       42
       -
       	SaveRequest(req *OAuthRequest) error

     

       43
       43
       -
       	GetRequestByState(state string) (*OAuthRequest, error)

     

       44
       44
       -
       	GetAndDeleteRequest(state string) (*OAuthRequest, error) // Atomic get-and-delete for CSRF protection

     

       45
       45
       -
       	DeleteRequest(state string) error

     

       46
       46
       -
       

     

       47
       47
       -
       	// User session management

     

       48
       48
       -
       	SaveSession(session *OAuthSession) error

     

       49
       49
       -
       	GetSession(did string) (*OAuthSession, error)

     

       50
       50
       -
       	UpdateSession(session *OAuthSession) error

     

       51
       51
       -
       	DeleteSession(did string) error

     

       52
       52
       -
       

     

       53
       53
       -
       	// Token refresh

     

       54
       54
       -
       	RefreshSession(did, newAccessToken, newRefreshToken string, expiresAt time.Time) error

     

       55
       55
       -
       

     

       56
       56
       -
       	// Nonce updates (for DPoP)

     

       57
       57
       -
       	UpdateAuthServerNonce(did, nonce string) error

     

       58
       58
       -
       	UpdatePDSNonce(did, nonce string) error

     

       59
       59
       -
       }

+23

internal/db/migrations/008_add_content_visibility_to_subscriptions.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Add content_visibility column to community_subscriptions table

     

       3
       3
       +
       -- This implements the feed slider (1-5 scale) from DOMAIN_KNOWLEDGE.md

     

       4
       4
       +
       -- 1 = Only show the best/most popular content from this community

     

       5
       5
       +
       -- 5 = Show all content from this community

     

       6
       6
       +
       -- Default = 3 (balanced)

     

       7
       7
       +
       ALTER TABLE community_subscriptions

     

       8
       8
       +
       ADD COLUMN content_visibility INTEGER NOT NULL DEFAULT 3

     

       9
       9
       +
       CHECK (content_visibility >= 1 AND content_visibility <= 5);

     

       10
       10
       +
       

     

       11
       11
       +
       -- Index for feed generation queries (filter by visibility level)

     

       12
       12
       +
       CREATE INDEX idx_subscriptions_visibility ON community_subscriptions(content_visibility);

     

       13
       13
       +
       

     

       14
       14
       +
       -- Composite index for user feed queries (user_did + visibility level)

     

       15
       15
       +
       CREATE INDEX idx_subscriptions_user_visibility ON community_subscriptions(user_did, content_visibility);

     

       16
       16
       +
       

     

       17
       17
       +
       COMMENT ON COLUMN community_subscriptions.content_visibility IS 'Feed slider: 1=only best content, 5=all content (see social.coves.community.subscription lexicon)';

     

       18
       18
       +
       

     

       19
       19
       +
       -- +goose Down

     

       20
       20
       +
       -- Remove content_visibility column and indexes

     

       21
       21
       +
       DROP INDEX IF EXISTS idx_subscriptions_user_visibility;

     

       22
       22
       +
       DROP INDEX IF EXISTS idx_subscriptions_visibility;

     

       23
       23
       +
       ALTER TABLE community_subscriptions DROP COLUMN content_visibility;

+136

internal/atproto/jetstream/community_jetstream_connector.go

···

       1
       1
       +
       package jetstream

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"sync"

     

       9
       9
       +
       	"time"

     

       10
       10
       +
       

     

       11
       11
       +
       	"github.com/gorilla/websocket"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // CommunityJetstreamConnector handles WebSocket connection to Jetstream for community events

     

       15
       15
       +
       type CommunityJetstreamConnector struct {

     

       16
       16
       +
       	consumer *CommunityEventConsumer

     

       17
       17
       +
       	wsURL    string

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // NewCommunityJetstreamConnector creates a new Jetstream WebSocket connector for community events

     

       21
       21
       +
       func NewCommunityJetstreamConnector(consumer *CommunityEventConsumer, wsURL string) *CommunityJetstreamConnector {

     

       22
       22
       +
       	return &CommunityJetstreamConnector{

     

       23
       23
       +
       		consumer: consumer,

     

       24
       24
       +
       		wsURL:    wsURL,

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // Start begins consuming events from Jetstream

     

       29
       29
       +
       // Runs indefinitely, reconnecting on errors

     

       30
       30
       +
       func (c *CommunityJetstreamConnector) Start(ctx context.Context) error {

     

       31
       31
       +
       	log.Printf("Starting Jetstream community consumer: %s", c.wsURL)

     

       32
       32
       +
       

     

       33
       33
       +
       	for {

     

       34
       34
       +
       		select {

     

       35
       35
       +
       		case <-ctx.Done():

     

       36
       36
       +
       			log.Println("Jetstream community consumer shutting down")

     

       37
       37
       +
       			return ctx.Err()

     

       38
       38
       +
       		default:

     

       39
       39
       +
       			if err := c.connect(ctx); err != nil {

     

       40
       40
       +
       				log.Printf("Jetstream community connection error: %v. Retrying in 5s...", err)

     

       41
       41
       +
       				time.Sleep(5 * time.Second)

     

       42
       42
       +
       				continue

     

       43
       43
       +
       			}

     

       44
       44
       +
       		}

     

       45
       45
       +
       	}

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       // connect establishes WebSocket connection and processes events

     

       49
       49
       +
       func (c *CommunityJetstreamConnector) connect(ctx context.Context) error {

     

       50
       50
       +
       	conn, _, err := websocket.DefaultDialer.DialContext(ctx, c.wsURL, nil)

     

       51
       51
       +
       	if err != nil {

     

       52
       52
       +
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       53
       53
       +
       	}

     

       54
       54
       +
       	defer func() {

     

       55
       55
       +
       		if closeErr := conn.Close(); closeErr != nil {

     

       56
       56
       +
       			log.Printf("Failed to close WebSocket connection: %v", closeErr)

     

       57
       57
       +
       		}

     

       58
       58
       +
       	}()

     

       59
       59
       +
       

     

       60
       60
       +
       	log.Println("Connected to Jetstream (community consumer)")

     

       61
       61
       +
       

     

       62
       62
       +
       	// Set read deadline to detect connection issues

     

       63
       63
       +
       	if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       64
       64
       +
       		log.Printf("Failed to set read deadline: %v", err)

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	// Set pong handler to keep connection alive

     

       68
       68
       +
       	conn.SetPongHandler(func(string) error {

     

       69
       69
       +
       		if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       70
       70
       +
       			log.Printf("Failed to set read deadline in pong handler: %v", err)

     

       71
       71
       +
       		}

     

       72
       72
       +
       		return nil

     

       73
       73
       +
       	})

     

       74
       74
       +
       

     

       75
       75
       +
       	// Start ping ticker

     

       76
       76
       +
       	ticker := time.NewTicker(30 * time.Second)

     

       77
       77
       +
       	defer ticker.Stop()

     

       78
       78
       +
       

     

       79
       79
       +
       	done := make(chan struct{})

     

       80
       80
       +
       	var closeOnce sync.Once // Ensure done channel is only closed once

     

       81
       81
       +
       

     

       82
       82
       +
       	// Goroutine to send pings

     

       83
       83
       +
       	go func() {

     

       84
       84
       +
       		for {

     

       85
       85
       +
       			select {

     

       86
       86
       +
       			case <-ticker.C:

     

       87
       87
       +
       				if err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {

     

       88
       88
       +
       					log.Printf("Ping error: %v", err)

     

       89
       89
       +
       					closeOnce.Do(func() { close(done) })

     

       90
       90
       +
       					return

     

       91
       91
       +
       				}

     

       92
       92
       +
       			case <-done:

     

       93
       93
       +
       				return

     

       94
       94
       +
       			case <-ctx.Done():

     

       95
       95
       +
       				return

     

       96
       96
       +
       			}

     

       97
       97
       +
       		}

     

       98
       98
       +
       	}()

     

       99
       99
       +
       

     

       100
       100
       +
       	// Read messages

     

       101
       101
       +
       	for {

     

       102
       102
       +
       		select {

     

       103
       103
       +
       		case <-ctx.Done():

     

       104
       104
       +
       			return ctx.Err()

     

       105
       105
       +
       		case <-done:

     

       106
       106
       +
       			return fmt.Errorf("connection closed")

     

       107
       107
       +
       		default:

     

       108
       108
       +
       			_, message, err := conn.ReadMessage()

     

       109
       109
       +
       			if err != nil {

     

       110
       110
       +
       				closeOnce.Do(func() { close(done) })

     

       111
       111
       +
       				return fmt.Errorf("read error: %w", err)

     

       112
       112
       +
       			}

     

       113
       113
       +
       

     

       114
       114
       +
       			// Reset read deadline on successful read

     

       115
       115
       +
       			if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       116
       116
       +
       				log.Printf("Failed to set read deadline: %v", err)

     

       117
       117
       +
       			}

     

       118
       118
       +
       

     

       119
       119
       +
       			if err := c.handleEvent(ctx, message); err != nil {

     

       120
       120
       +
       				log.Printf("Error handling community event: %v", err)

     

       121
       121
       +
       				// Continue processing other events

     

       122
       122
       +
       			}

     

       123
       123
       +
       		}

     

       124
       124
       +
       	}

     

       125
       125
       +
       }

     

       126
       126
       +
       

     

       127
       127
       +
       // handleEvent processes a single Jetstream event

     

       128
       128
       +
       func (c *CommunityJetstreamConnector) handleEvent(ctx context.Context, data []byte) error {

     

       129
       129
       +
       	var event JetstreamEvent

     

       130
       130
       +
       	if err := json.Unmarshal(data, &event); err != nil {

     

       131
       131
       +
       		return fmt.Errorf("failed to parse event: %w", err)

     

       132
       132
       +
       	}

     

       133
       133
       +
       

     

       134
       134
       +
       	// Pass to consumer's HandleEvent method

     

       135
       135
       +
       	return c.consumer.HandleEvent(ctx, &event)

     

       136
       136
       +
       }

-6

tests/lexicon-test-data/actor/subscription-invalid-visibility.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.subscription",

     

       3
       3
       -
         "community": "did:plc:programmingcommunity",

     

       4
       4
       -
         "createdAt": "2024-06-01T08:00:00Z",

     

       5
       5
       -
         "contentVisibility": 10

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/actor/subscription-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.subscription",

     

       3
       3
       -
         "community": "did:plc:programmingcommunity",

     

       4
       4
       -
         "createdAt": "2024-06-01T08:00:00Z",

     

       5
       5
       -
         "contentVisibility": 3

     

       6
       6
       -
       }

+6

tests/lexicon-test-data/community/subscription-invalid-visibility.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "$type": "social.coves.community.subscription",

     

       3
       3
       +
         "subject": "did:plc:test123",

     

       4
       4
       +
         "createdAt": "2025-01-15T12:00:00Z",

     

       5
       5
       +
         "contentVisibility": 10

     

       6
       6
       +
       }

+6

tests/lexicon-test-data/community/subscription-valid.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "$type": "social.coves.community.subscription",

     

       3
       3
       +
         "subject": "did:plc:test123",

     

       4
       4
       +
         "createdAt": "2025-01-15T12:00:00Z",

     

       5
       5
       +
         "contentVisibility": 3

     

       6
       6
       +
       }

+27

internal/atproto/lexicon/social/coves/community/block.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.block",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "record",

     

       7
       7
       +
             "description": "Record declaring a block relationship against a community. Blocks are public.",

     

       8
       8
       +
             "key": "tid",

     

       9
       9
       +
             "record": {

     

       10
       10
       +
               "type": "object",

     

       11
       11
       +
               "required": ["subject", "createdAt"],

     

       12
       12
       +
               "properties": {

     

       13
       13
       +
                 "subject": {

     

       14
       14
       +
                   "type": "string",

     

       15
       15
       +
                   "format": "did",

     

       16
       16
       +
                   "description": "DID of the community being blocked"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "createdAt": {

     

       19
       19
       +
                   "type": "string",

     

       20
       20
       +
                   "format": "datetime",

     

       21
       21
       +
                   "description": "When the block was created"

     

       22
       22
       +
                 }

     

       23
       23
       +
               }

     

       24
       24
       +
             }

     

       25
       25
       +
           }

     

       26
       26
       +
         }

     

       27
       27
       +
       }

+5 -1

internal/core/communities/errors.go

···

       34
       34
        
       	// ErrBlockNotFound is returned when block doesn't exist

     

       35
       35
        
       	ErrBlockNotFound = errors.New("block not found")

     

       36
       36
        
       

     

       37
       37
       +
       	// ErrBlockAlreadyExists is returned when user has already blocked the community

     

       38
       38
       +
       	ErrBlockAlreadyExists = errors.New("community already blocked")

     

       39
       39
       +
       

     

       37
       40
        
       	// ErrMembershipNotFound is returned when membership doesn't exist

     

       38
       41
        
       	ErrMembershipNotFound = errors.New("membership not found")

     

       39
       42
        
       

     
···

       74
       77
        
       func IsConflict(err error) bool {

     

       75
       78
        
       	return errors.Is(err, ErrCommunityAlreadyExists) ||

     

       76
       79
        
       		errors.Is(err, ErrHandleTaken) ||

     

       77
       77
       -
       		errors.Is(err, ErrSubscriptionAlreadyExists)

     

       80
       80
       +
       		errors.Is(err, ErrSubscriptionAlreadyExists) ||

     

       81
       81
       +
       		errors.Is(err, ErrBlockAlreadyExists)

     

       78
       82
        
       }

     

       79
       83
        
       

     

       80
       84
        
       // IsValidationError checks if error is a validation error

+99

internal/core/communities/token_refresh.go

···

       1
       1
       +
       package communities

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"errors"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"strings"

     

       8
       8
       +
       

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/xrpc"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // refreshPDSToken exchanges a refresh token for new access and refresh tokens

     

       14
       14
       +
       // Uses com.atproto.server.refreshSession endpoint via Indigo SDK

     

       15
       15
       +
       // CRITICAL: Refresh tokens are single-use - old refresh token is revoked on success

     

       16
       16
       +
       func refreshPDSToken(ctx context.Context, pdsURL, currentAccessToken, refreshToken string) (newAccessToken, newRefreshToken string, err error) {

     

       17
       17
       +
       	if pdsURL == "" {

     

       18
       18
       +
       		return "", "", fmt.Errorf("PDS URL is required")

     

       19
       19
       +
       	}

     

       20
       20
       +
       	if refreshToken == "" {

     

       21
       21
       +
       		return "", "", fmt.Errorf("refresh token is required")

     

       22
       22
       +
       	}

     

       23
       23
       +
       

     

       24
       24
       +
       	// Create XRPC client with auth credentials

     

       25
       25
       +
       	// The refresh endpoint requires authentication with the refresh token

     

       26
       26
       +
       	client := &xrpc.Client{

     

       27
       27
       +
       		Host: pdsURL,

     

       28
       28
       +
       		Auth: &xrpc.AuthInfo{

     

       29
       29
       +
       			AccessJwt:  currentAccessToken, // Can be expired (not used for refresh auth)

     

       30
       30
       +
       			RefreshJwt: refreshToken,       // This is what authenticates the refresh request

     

       31
       31
       +
       		},

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	// Call com.atproto.server.refreshSession

     

       35
       35
       +
       	output, err := atproto.ServerRefreshSession(ctx, client)

     

       36
       36
       +
       	if err != nil {

     

       37
       37
       +
       		// Check for expired refresh token (401 Unauthorized)

     

       38
       38
       +
       		// Try typed error first (more reliable), fallback to string check

     

       39
       39
       +
       		var xrpcErr *xrpc.Error

     

       40
       40
       +
       		if errors.As(err, &xrpcErr) && xrpcErr.StatusCode == 401 {

     

       41
       41
       +
       			return "", "", fmt.Errorf("refresh token expired or invalid (needs password re-auth)")

     

       42
       42
       +
       		}

     

       43
       43
       +
       

     

       44
       44
       +
       		// Fallback: string-based detection (in case error isn't wrapped as xrpc.Error)

     

       45
       45
       +
       		errStr := err.Error()

     

       46
       46
       +
       		if strings.Contains(errStr, "401") || strings.Contains(errStr, "Unauthorized") {

     

       47
       47
       +
       			return "", "", fmt.Errorf("refresh token expired or invalid (needs password re-auth)")

     

       48
       48
       +
       		}

     

       49
       49
       +
       

     

       50
       50
       +
       		return "", "", fmt.Errorf("failed to refresh session: %w", err)

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	// Validate response

     

       54
       54
       +
       	if output.AccessJwt == "" || output.RefreshJwt == "" {

     

       55
       55
       +
       		return "", "", fmt.Errorf("refresh response missing tokens")

     

       56
       56
       +
       	}

     

       57
       57
       +
       

     

       58
       58
       +
       	return output.AccessJwt, output.RefreshJwt, nil

     

       59
       59
       +
       }

     

       60
       60
       +
       

     

       61
       61
       +
       // reauthenticateWithPassword creates a new session using stored credentials

     

       62
       62
       +
       // This is the fallback when refresh tokens expire (after ~2 months)

     

       63
       63
       +
       // Uses com.atproto.server.createSession endpoint via Indigo SDK

     

       64
       64
       +
       func reauthenticateWithPassword(ctx context.Context, pdsURL, email, password string) (accessToken, refreshToken string, err error) {

     

       65
       65
       +
       	if pdsURL == "" {

     

       66
       66
       +
       		return "", "", fmt.Errorf("PDS URL is required")

     

       67
       67
       +
       	}

     

       68
       68
       +
       	if email == "" {

     

       69
       69
       +
       		return "", "", fmt.Errorf("email is required")

     

       70
       70
       +
       	}

     

       71
       71
       +
       	if password == "" {

     

       72
       72
       +
       		return "", "", fmt.Errorf("password is required")

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Create unauthenticated XRPC client

     

       76
       76
       +
       	client := &xrpc.Client{

     

       77
       77
       +
       		Host: pdsURL,

     

       78
       78
       +
       	}

     

       79
       79
       +
       

     

       80
       80
       +
       	// Prepare createSession input

     

       81
       81
       +
       	// The identifier can be either email or handle

     

       82
       82
       +
       	input := &atproto.ServerCreateSession_Input{

     

       83
       83
       +
       		Identifier: email,

     

       84
       84
       +
       		Password:   password,

     

       85
       85
       +
       	}

     

       86
       86
       +
       

     

       87
       87
       +
       	// Call com.atproto.server.createSession

     

       88
       88
       +
       	output, err := atproto.ServerCreateSession(ctx, client, input)

     

       89
       89
       +
       	if err != nil {

     

       90
       90
       +
       		return "", "", fmt.Errorf("failed to create session: %w", err)

     

       91
       91
       +
       	}

     

       92
       92
       +
       

     

       93
       93
       +
       	// Validate response

     

       94
       94
       +
       	if output.AccessJwt == "" || output.RefreshJwt == "" {

     

       95
       95
       +
       		return "", "", fmt.Errorf("createSession response missing tokens")

     

       96
       96
       +
       	}

     

       97
       97
       +
       

     

       98
       98
       +
       	return output.AccessJwt, output.RefreshJwt, nil

     

       99
       99
       +
       }

+66

internal/core/communities/token_utils.go

···

       1
       1
       +
       package communities

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"encoding/base64"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"strings"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // parseJWTExpiration extracts the expiration time from a JWT access token

     

       12
       12
       +
       // This function does NOT verify the signature - it only parses the exp claim

     

       13
       13
       +
       // atproto access tokens use standard JWT format with 'exp' claim (Unix timestamp)

     

       14
       14
       +
       func parseJWTExpiration(token string) (time.Time, error) {

     

       15
       15
       +
       	// Remove "Bearer " prefix if present

     

       16
       16
       +
       	token = strings.TrimPrefix(token, "Bearer ")

     

       17
       17
       +
       	token = strings.TrimSpace(token)

     

       18
       18
       +
       

     

       19
       19
       +
       	// JWT format: header.payload.signature

     

       20
       20
       +
       	parts := strings.Split(token, ".")

     

       21
       21
       +
       	if len(parts) != 3 {

     

       22
       22
       +
       		return time.Time{}, fmt.Errorf("invalid JWT format: expected 3 parts, got %d", len(parts))

     

       23
       23
       +
       	}

     

       24
       24
       +
       

     

       25
       25
       +
       	// Decode payload (second part) - use RawURLEncoding (no padding)

     

       26
       26
       +
       	payload, err := base64.RawURLEncoding.DecodeString(parts[1])

     

       27
       27
       +
       	if err != nil {

     

       28
       28
       +
       		return time.Time{}, fmt.Errorf("failed to decode JWT payload: %w", err)

     

       29
       29
       +
       	}

     

       30
       30
       +
       

     

       31
       31
       +
       	// Extract exp claim (Unix timestamp)

     

       32
       32
       +
       	var claims struct {

     

       33
       33
       +
       		Exp int64 `json:"exp"` // Expiration time (seconds since Unix epoch)

     

       34
       34
       +
       	}

     

       35
       35
       +
       	if err := json.Unmarshal(payload, &claims); err != nil {

     

       36
       36
       +
       		return time.Time{}, fmt.Errorf("failed to parse JWT claims: %w", err)

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	if claims.Exp == 0 {

     

       40
       40
       +
       		return time.Time{}, fmt.Errorf("JWT missing 'exp' claim")

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// Convert Unix timestamp to time.Time

     

       44
       44
       +
       	return time.Unix(claims.Exp, 0), nil

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       // NeedsRefresh checks if an access token should be refreshed

     

       48
       48
       +
       // Returns true if the token expires within the next 5 minutes (or is already expired)

     

       49
       49
       +
       // Uses a 5-minute buffer to ensure we refresh before actual expiration

     

       50
       50
       +
       func NeedsRefresh(accessToken string) (bool, error) {

     

       51
       51
       +
       	if accessToken == "" {

     

       52
       52
       +
       		return false, fmt.Errorf("access token is empty")

     

       53
       53
       +
       	}

     

       54
       54
       +
       

     

       55
       55
       +
       	expiration, err := parseJWTExpiration(accessToken)

     

       56
       56
       +
       	if err != nil {

     

       57
       57
       +
       		return false, fmt.Errorf("failed to parse token expiration: %w", err)

     

       58
       58
       +
       	}

     

       59
       59
       +
       

     

       60
       60
       +
       	// Refresh if token expires within 5 minutes

     

       61
       61
       +
       	// This prevents service interruptions from expired tokens

     

       62
       62
       +
       	bufferTime := 5 * time.Minute

     

       63
       63
       +
       	expiresWithinBuffer := time.Now().Add(bufferTime).After(expiration)

     

       64
       64
       +
       

     

       65
       65
       +
       	return expiresWithinBuffer, nil

     

       66
       66
       +
       }

+5 -3

internal/atproto/lexicon/social/coves/community/moderator.json

···

       22
       22
        
                 },

     

       23
       23
        
                 "role": {

     

       24
       24
        
                   "type": "string",

     

       25
       25
       -
                   "enum": ["moderator", "admin"],

     

       25
       25
       +
                   "knownValues": ["moderator", "admin"],

     

       26
       26
       +
                   "maxLength": 64,

     

       26
       27
        
                   "description": "Level of moderation privileges"

     

       27
       28
        
                 },

     

       28
       29
        
                 "permissions": {

     
···

       30
       31
        
                   "description": "Specific permissions granted",

     

       31
       32
        
                   "items": {

     

       32
       33
        
                     "type": "string",

     

       33
       33
       -
                     "enum": [

     

       34
       34
       +
                     "knownValues": [

     

       34
       35
        
                       "remove_posts",

     

       35
       36
        
                       "remove_comments",

     

       36
       37
        
                       "ban_users",

     
···

       38
       39
        
                       "manage_wiki",

     

       39
       40
        
                       "manage_moderators",

     

       40
       41
        
                       "manage_settings"

     

       41
       41
       -
                     ]

     

       42
       42
       +
                     ],

     

       43
       43
       +
                     "maxLength": 64

     

       42
       44
        
                   }

     

       43
       45
        
                 },

     

       44
       46
        
                 "createdAt": {

+1 -1

internal/atproto/lexicon/social/coves/community/subscribe.json

···

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "procedure",

     

       7
       7
       -
             "description": "Subscribe to a community to see its posts in your feed",

     

       7
       7
       +
             "description": "Subscribe to a community to see its posts in your feed. Requires authentication.",

     

       8
       8
        
             "input": {

     

       9
       9
        
               "encoding": "application/json",

     

       10
       10
        
               "schema": {

+1 -1

internal/atproto/lexicon/social/coves/community/unsubscribe.json

···

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "procedure",

     

       7
       7
       -
             "description": "Unsubscribe from a community",

     

       7
       7
       +
             "description": "Unsubscribe from a community. Requires authentication.",

     

       8
       8
        
             "input": {

     

       9
       9
        
               "encoding": "application/json",

     

       10
       10
        
               "schema": {

-6

tests/lexicon-test-data/actor/membership-invalid-reputation.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.membership",

     

       3
       3
       -
         "community": "did:plc:examplecommunity123",

     

       4
       4
       -
         "createdAt": "2024-01-15T10:30:00Z",

     

       5
       5
       -
         "reputation": -50

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/actor/membership-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.membership",

     

       3
       3
       -
         "community": "did:plc:examplecommunity123",

     

       4
       4
       -
         "reputation": 150,

     

       5
       5
       -
         "createdAt": "2024-01-15T10:30:00Z"

     

       6
       6
       -
       }

-38

internal/atproto/lexicon/social/coves/actor/membership.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.membership",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "Membership in a community",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["community", "reputation", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "community": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-identifier",

     

       16
       16
       -
                   "description": "DID or handle of the community"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "reputation": {

     

       19
       19
       -
                   "type": "integer",

     

       20
       20
       -
                   "minimum": 0,

     

       21
       21
       -
                   "default": 0,

     

       22
       22
       -
                   "description": "Reputation score within the community"

     

       23
       23
       -
                 },

     

       24
       24
       -
                 "createdAt": {

     

       25
       25
       -
                   "type": "string",

     

       26
       26
       -
                   "format": "datetime",

     

       27
       27
       -
                   "description": "When the user's membership started"

     

       28
       28
       -
                 },

     

       29
       29
       -
                 "endedAt": {

     

       30
       30
       -
                   "type": "string",

     

       31
       31
       -
                   "format": "datetime",

     

       32
       32
       -
                   "description": "When the membership ended (null if current)"

     

       33
       33
       -
                 }

     

       34
       34
       -
               }

     

       35
       35
       -
             }

     

       36
       36
       -
           }

     

       37
       37
       -
         }

     

       38
       38
       -
       }

+68

internal/db/migrations/010_migrate_community_handles_to_singular.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- +goose StatementBegin

     

       3
       3
       +
       

     

       4
       4
       +
       -- Migration: Rename community handles from .communities. to .community.

     

       5
       5
       +
       -- This aligns with AT Protocol lexicon naming conventions (singular form)

     

       6
       6
       +
       --

     

       7
       7
       +
       -- Background:

     

       8
       8
       +
       -- All atProto record types use singular form (app.bsky.feed.post, app.bsky.graph.follow)

     

       9
       9
       +
       -- This migration updates existing community handles to follow the same pattern

     

       10
       10
       +
       --

     

       11
       11
       +
       -- Examples:

     

       12
       12
       +
       --   gardening.communities.coves.social -> gardening.community.coves.social

     

       13
       13
       +
       --   gaming.communities.coves.social -> gaming.community.coves.social

     

       14
       14
       +
       --

     

       15
       15
       +
       -- Safety: Uses REPLACE which only affects handles containing '.communities.'

     

       16
       16
       +
       -- Rollback: Available via down migration below

     

       17
       17
       +
       

     

       18
       18
       +
       -- Update community handles in the communities table

     

       19
       19
       +
       UPDATE communities

     

       20
       20
       +
       SET handle = REPLACE(handle, '.communities.', '.community.')

     

       21
       21
       +
       WHERE handle LIKE '%.communities.%';

     

       22
       22
       +
       

     

       23
       23
       +
       -- Verify the migration (optional - can be commented out in production)

     

       24
       24
       +
       -- This will fail if any .communities. handles remain

     

       25
       25
       +
       DO $$

     

       26
       26
       +
       DECLARE

     

       27
       27
       +
           old_format_count INTEGER;

     

       28
       28
       +
       BEGIN

     

       29
       29
       +
           SELECT COUNT(*) INTO old_format_count

     

       30
       30
       +
           FROM communities

     

       31
       31
       +
           WHERE handle LIKE '%.communities.%';

     

       32
       32
       +
       

     

       33
       33
       +
           IF old_format_count > 0 THEN

     

       34
       34
       +
               RAISE EXCEPTION 'Migration incomplete: % communities still have .communities. format', old_format_count;

     

       35
       35
       +
           END IF;

     

       36
       36
       +
       

     

       37
       37
       +
           RAISE NOTICE 'Migration successful: All community handles updated to .community. format';

     

       38
       38
       +
       END $$;

     

       39
       39
       +
       

     

       40
       40
       +
       -- +goose StatementEnd

     

       41
       41
       +
       

     

       42
       42
       +
       -- +goose Down

     

       43
       43
       +
       -- +goose StatementBegin

     

       44
       44
       +
       

     

       45
       45
       +
       -- Rollback: Revert handles from .community. back to .communities.

     

       46
       46
       +
       -- Only use this if you need to rollback the naming convention change

     

       47
       47
       +
       

     

       48
       48
       +
       UPDATE communities

     

       49
       49
       +
       SET handle = REPLACE(handle, '.community.', '.communities.')

     

       50
       50
       +
       WHERE handle LIKE '%.community.%';

     

       51
       51
       +
       

     

       52
       52
       +
       -- Verify the rollback

     

       53
       53
       +
       DO $$

     

       54
       54
       +
       DECLARE

     

       55
       55
       +
           new_format_count INTEGER;

     

       56
       56
       +
       BEGIN

     

       57
       57
       +
           SELECT COUNT(*) INTO new_format_count

     

       58
       58
       +
           FROM communities

     

       59
       59
       +
           WHERE handle LIKE '%.community.%';

     

       60
       60
       +
       

     

       61
       61
       +
           IF new_format_count > 0 THEN

     

       62
       62
       +
               RAISE EXCEPTION 'Rollback incomplete: % communities still have .community. format', new_format_count;

     

       63
       63
       +
           END IF;

     

       64
       64
       +
       

     

       65
       65
       +
           RAISE NOTICE 'Rollback successful: All community handles reverted to .communities. format';

     

       66
       66
       +
       END $$;

     

       67
       67
       +
       

     

       68
       68
       +
       -- +goose StatementEnd

+1 -1

tests/lexicon-test-data/community/profile-valid.json

···

       1
       1
        
       {

     

       2
       2
        
         "$type": "social.coves.community.profile",

     

       3
       3
       -
         "handle": "programming.communities.coves.social",

     

       3
       3
       +
         "handle": "programming.community.coves.social",

     

       4
       4
        
         "name": "programming",

     

       5
       5
        
         "displayName": "Programming Community",

     

       6
       6
        
         "description": "A community for programmers",

+9 -7

internal/core/communities/pds_provisioning.go

···

       15
       15
        
       // CommunityPDSAccount represents PDS account credentials for a community

     

       16
       16
        
       type CommunityPDSAccount struct {

     

       17
       17
        
       	DID            string // Community's DID (owns the repository)

     

       18
       18
       -
       	Handle         string // Community's handle (e.g., gaming.communities.coves.social)

     

       18
       18
       +
       	Handle         string // Community's handle (e.g., gaming.community.coves.social)

     

       19
       19
        
       	Email          string // System email for PDS account

     

       20
       20
        
       	Password       string // Cleartext password (MUST be encrypted before database storage)

     

       21
       21
        
       	AccessToken    string // JWT for making API calls as the community

     
···

       67
       67
        
       	}

     

       68
       68
        
       

     

       69
       69
        
       	// 1. Generate unique handle for the community

     

       70
       70
       -
       	// Format: {name}.communities.{instance-domain}

     

       71
       71
       -
       	// Example: "gaming.communities.coves.social"

     

       72
       72
       -
       	handle := fmt.Sprintf("%s.communities.%s", strings.ToLower(communityName), p.instanceDomain)

     

       70
       70
       +
       	// Format: {name}.community.{instance-domain}

     

       71
       71
       +
       	// Example: "gaming.community.coves.social"

     

       72
       72
       +
       	// NOTE: Using SINGULAR "community" to follow atProto lexicon conventions

     

       73
       73
       +
       	// (all record types use singular: app.bsky.feed.post, app.bsky.graph.follow, etc.)

     

       74
       74
       +
       	handle := fmt.Sprintf("%s.community.%s", strings.ToLower(communityName), p.instanceDomain)

     

       73
       75
        
       

     

       74
       76
        
       	// 2. Generate system email for PDS account management

     

       75
       77
        
       	// This email is used for account operations, not for user communication

     

       76
       76
       -
       	email := fmt.Sprintf("community-%s@communities.%s", strings.ToLower(communityName), p.instanceDomain)

     

       78
       78
       +
       	email := fmt.Sprintf("community-%s@community.%s", strings.ToLower(communityName), p.instanceDomain)

     

       77
       79
        
       

     

       78
       80
        
       	// 3. Generate secure random password (32 characters)

     

       79
       81
        
       	// This password is never shown to users - it's for Coves to authenticate as the community

     
···

       116
       118
        
       	// The repository layer handles encryption using pgp_sym_encrypt()

     

       117
       119
        
       	return &CommunityPDSAccount{

     

       118
       120
        
       		DID:            output.Did,        // The community's DID (PDS-generated)

     

       119
       119
       -
       		Handle:         output.Handle,     // e.g., gaming.communities.coves.social

     

       120
       120
       -
       		Email:          email,             // community-gaming@communities.coves.social

     

       121
       121
       +
       		Handle:         output.Handle,     // e.g., gaming.community.coves.social

     

       122
       122
       +
       		Email:          email,             // community-gaming@community.coves.social

     

       121
       123
        
       		Password:       password,          // Cleartext - will be encrypted by repository

     

       122
       124
        
       		AccessToken:    output.AccessJwt,  // JWT for making API calls

     

       123
       125
        
       		RefreshToken:   output.RefreshJwt, // For refreshing sessions

+51

internal/db/migrations/011_create_posts_table.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Create posts table for AppView indexing

     

       3
       3
       +
       -- Posts are indexed from the firehose after being written to community repositories

     

       4
       4
       +
       CREATE TABLE posts (

     

       5
       5
       +
           id BIGSERIAL PRIMARY KEY,

     

       6
       6
       +
           uri TEXT UNIQUE NOT NULL,              -- AT-URI (at://community_did/social.coves.post.record/rkey)

     

       7
       7
       +
           cid TEXT NOT NULL,                      -- Content ID

     

       8
       8
       +
           rkey TEXT NOT NULL,                     -- Record key (TID)

     

       9
       9
       +
           author_did TEXT NOT NULL,               -- Author's DID (from record metadata)

     

       10
       10
       +
           community_did TEXT NOT NULL,            -- Community DID (from AT-URI repo field)

     

       11
       11
       +
       

     

       12
       12
       +
           -- Content (all nullable per lexicon)

     

       13
       13
       +
           title TEXT,                             -- Post title

     

       14
       14
       +
           content TEXT,                           -- Post content/body

     

       15
       15
       +
           content_facets JSONB,                   -- Rich text facets (app.bsky.richtext.facet)

     

       16
       16
       +
           embed JSONB,                            -- Embedded content (images, video, external, record)

     

       17
       17
       +
           content_labels TEXT[],                  -- Self-applied labels (nsfw, spoiler, violence)

     

       18
       18
       +
       

     

       19
       19
       +
           -- Timestamps

     

       20
       20
       +
           created_at TIMESTAMPTZ NOT NULL,        -- Author's timestamp from record

     

       21
       21
       +
           edited_at TIMESTAMPTZ,                  -- Last edit timestamp (future)

     

       22
       22
       +
           indexed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When indexed by AppView

     

       23
       23
       +
           deleted_at TIMESTAMPTZ,                 -- Soft delete (for firehose delete events)

     

       24
       24
       +
       

     

       25
       25
       +
           -- Stats (denormalized for performance)

     

       26
       26
       +
           upvote_count INT NOT NULL DEFAULT 0,

     

       27
       27
       +
           downvote_count INT NOT NULL DEFAULT 0,

     

       28
       28
       +
           score INT NOT NULL DEFAULT 0,           -- upvote_count - downvote_count (for sorting)

     

       29
       29
       +
           comment_count INT NOT NULL DEFAULT 0,

     

       30
       30
       +
       

     

       31
       31
       +
           -- Foreign keys

     

       32
       32
       +
           CONSTRAINT fk_author FOREIGN KEY (author_did) REFERENCES users(did) ON DELETE CASCADE,

     

       33
       33
       +
           CONSTRAINT fk_community FOREIGN KEY (community_did) REFERENCES communities(did) ON DELETE CASCADE

     

       34
       34
       +
       );

     

       35
       35
       +
       

     

       36
       36
       +
       -- Indexes for common query patterns

     

       37
       37
       +
       CREATE INDEX idx_posts_community_created ON posts(community_did, created_at DESC) WHERE deleted_at IS NULL;

     

       38
       38
       +
       CREATE INDEX idx_posts_community_score ON posts(community_did, score DESC, created_at DESC) WHERE deleted_at IS NULL;

     

       39
       39
       +
       CREATE INDEX idx_posts_author ON posts(author_did, created_at DESC);

     

       40
       40
       +
       CREATE INDEX idx_posts_uri ON posts(uri);

     

       41
       41
       +
       

     

       42
       42
       +
       -- Index for full-text search on content (future)

     

       43
       43
       +
       -- CREATE INDEX idx_posts_content_search ON posts USING gin(to_tsvector('english', content)) WHERE deleted_at IS NULL;

     

       44
       44
       +
       

     

       45
       45
       +
       -- Comment on table

     

       46
       46
       +
       COMMENT ON TABLE posts IS 'Posts indexed from community repositories via Jetstream firehose consumer';

     

       47
       47
       +
       COMMENT ON COLUMN posts.uri IS 'AT-URI in format: at://community_did/social.coves.post.record/rkey';

     

       48
       48
       +
       COMMENT ON COLUMN posts.score IS 'Computed as upvote_count - downvote_count for ranking algorithms';

     

       49
       49
       +
       

     

       50
       50
       +
       -- +goose Down

     

       51
       51
       +
       DROP TABLE IF EXISTS posts CASCADE;

+125

internal/atproto/jetstream/post_jetstream_connector.go

···

       1
       1
       +
       package jetstream

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"sync"

     

       9
       9
       +
       	"time"

     

       10
       10
       +
       

     

       11
       11
       +
       	"github.com/gorilla/websocket"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // PostJetstreamConnector handles WebSocket connection to Jetstream for post events

     

       15
       15
       +
       type PostJetstreamConnector struct {

     

       16
       16
       +
       	consumer *PostEventConsumer

     

       17
       17
       +
       	wsURL    string

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // NewPostJetstreamConnector creates a new Jetstream WebSocket connector for post events

     

       21
       21
       +
       func NewPostJetstreamConnector(consumer *PostEventConsumer, wsURL string) *PostJetstreamConnector {

     

       22
       22
       +
       	return &PostJetstreamConnector{

     

       23
       23
       +
       		consumer: consumer,

     

       24
       24
       +
       		wsURL:    wsURL,

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // Start begins consuming events from Jetstream

     

       29
       29
       +
       // Runs indefinitely, reconnecting on errors

     

       30
       30
       +
       func (c *PostJetstreamConnector) Start(ctx context.Context) error {

     

       31
       31
       +
       	log.Printf("Starting Jetstream post consumer: %s", c.wsURL)

     

       32
       32
       +
       

     

       33
       33
       +
       	for {

     

       34
       34
       +
       		select {

     

       35
       35
       +
       		case <-ctx.Done():

     

       36
       36
       +
       			log.Println("Jetstream post consumer shutting down")

     

       37
       37
       +
       			return ctx.Err()

     

       38
       38
       +
       		default:

     

       39
       39
       +
       			if err := c.connect(ctx); err != nil {

     

       40
       40
       +
       				log.Printf("Jetstream post connection error: %v. Retrying in 5s...", err)

     

       41
       41
       +
       				time.Sleep(5 * time.Second)

     

       42
       42
       +
       				continue

     

       43
       43
       +
       			}

     

       44
       44
       +
       		}

     

       45
       45
       +
       	}

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       // connect establishes WebSocket connection and processes events

     

       49
       49
       +
       func (c *PostJetstreamConnector) connect(ctx context.Context) error {

     

       50
       50
       +
       	conn, _, err := websocket.DefaultDialer.DialContext(ctx, c.wsURL, nil)

     

       51
       51
       +
       	if err != nil {

     

       52
       52
       +
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       53
       53
       +
       	}

     

       54
       54
       +
       	defer func() {

     

       55
       55
       +
       		if closeErr := conn.Close(); closeErr != nil {

     

       56
       56
       +
       			log.Printf("Failed to close WebSocket connection: %v", closeErr)

     

       57
       57
       +
       		}

     

       58
       58
       +
       	}()

     

       59
       59
       +
       

     

       60
       60
       +
       	log.Println("Connected to Jetstream (post consumer)")

     

       61
       61
       +
       

     

       62
       62
       +
       	// Set read deadline to detect connection issues

     

       63
       63
       +
       	if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       64
       64
       +
       		log.Printf("Failed to set read deadline: %v", err)

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	// Set pong handler to keep connection alive

     

       68
       68
       +
       	conn.SetPongHandler(func(string) error {

     

       69
       69
       +
       		if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       70
       70
       +
       			log.Printf("Failed to set read deadline in pong handler: %v", err)

     

       71
       71
       +
       		}

     

       72
       72
       +
       		return nil

     

       73
       73
       +
       	})

     

       74
       74
       +
       

     

       75
       75
       +
       	// Start ping ticker

     

       76
       76
       +
       	ticker := time.NewTicker(30 * time.Second)

     

       77
       77
       +
       	defer ticker.Stop()

     

       78
       78
       +
       

     

       79
       79
       +
       	done := make(chan struct{})

     

       80
       80
       +
       	var closeOnce sync.Once // Ensure done channel is only closed once

     

       81
       81
       +
       

     

       82
       82
       +
       	// Ping goroutine

     

       83
       83
       +
       	go func() {

     

       84
       84
       +
       		for {

     

       85
       85
       +
       			select {

     

       86
       86
       +
       			case <-ticker.C:

     

       87
       87
       +
       				if err := conn.WriteControl(websocket.PingMessage, []byte{}, time.Now().Add(10*time.Second)); err != nil {

     

       88
       88
       +
       					log.Printf("Failed to send ping: %v", err)

     

       89
       89
       +
       					closeOnce.Do(func() { close(done) })

     

       90
       90
       +
       					return

     

       91
       91
       +
       				}

     

       92
       92
       +
       			case <-done:

     

       93
       93
       +
       				return

     

       94
       94
       +
       			}

     

       95
       95
       +
       		}

     

       96
       96
       +
       	}()

     

       97
       97
       +
       

     

       98
       98
       +
       	// Read loop

     

       99
       99
       +
       	for {

     

       100
       100
       +
       		select {

     

       101
       101
       +
       		case <-done:

     

       102
       102
       +
       			return fmt.Errorf("connection closed by ping failure")

     

       103
       103
       +
       		default:

     

       104
       104
       +
       		}

     

       105
       105
       +
       

     

       106
       106
       +
       		_, message, err := conn.ReadMessage()

     

       107
       107
       +
       		if err != nil {

     

       108
       108
       +
       			closeOnce.Do(func() { close(done) })

     

       109
       109
       +
       			return fmt.Errorf("read error: %w", err)

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       112
       112
       +
       		// Parse Jetstream event

     

       113
       113
       +
       		var event JetstreamEvent

     

       114
       114
       +
       		if err := json.Unmarshal(message, &event); err != nil {

     

       115
       115
       +
       			log.Printf("Failed to parse Jetstream event: %v", err)

     

       116
       116
       +
       			continue

     

       117
       117
       +
       		}

     

       118
       118
       +
       

     

       119
       119
       +
       		// Process event through consumer

     

       120
       120
       +
       		if err := c.consumer.HandleEvent(ctx, &event); err != nil {

     

       121
       121
       +
       			log.Printf("Failed to handle post event: %v", err)

     

       122
       122
       +
       			// Continue processing other events even if one fails

     

       123
       123
       +
       		}

     

       124
       124
       +
       	}

     

       125
       125
       +
       }

+38

internal/core/communityFeeds/errors.go

···

       1
       1
       +
       package communityFeeds

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"errors"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       var (

     

       9
       9
       +
       	// ErrCommunityNotFound is returned when the community doesn't exist

     

       10
       10
       +
       	ErrCommunityNotFound = errors.New("community not found")

     

       11
       11
       +
       

     

       12
       12
       +
       	// ErrInvalidCursor is returned when the pagination cursor is invalid

     

       13
       13
       +
       	ErrInvalidCursor = errors.New("invalid pagination cursor")

     

       14
       14
       +
       )

     

       15
       15
       +
       

     

       16
       16
       +
       // ValidationError represents an input validation error

     

       17
       17
       +
       type ValidationError struct {

     

       18
       18
       +
       	Field   string

     

       19
       19
       +
       	Message string

     

       20
       20
       +
       }

     

       21
       21
       +
       

     

       22
       22
       +
       func (e *ValidationError) Error() string {

     

       23
       23
       +
       	return fmt.Sprintf("validation error: %s: %s", e.Field, e.Message)

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       // NewValidationError creates a new validation error

     

       27
       27
       +
       func NewValidationError(field, message string) error {

     

       28
       28
       +
       	return &ValidationError{

     

       29
       29
       +
       		Field:   field,

     

       30
       30
       +
       		Message: message,

     

       31
       31
       +
       	}

     

       32
       32
       +
       }

     

       33
       33
       +
       

     

       34
       34
       +
       // IsValidationError checks if an error is a validation error

     

       35
       35
       +
       func IsValidationError(err error) bool {

     

       36
       36
       +
       	var ve *ValidationError

     

       37
       37
       +
       	return errors.As(err, &ve)

     

       38
       38
       +
       }

+25

internal/core/communityFeeds/interfaces.go

···

       1
       1
       +
       package communityFeeds

     

       2
       2
       +
       

     

       3
       3
       +
       import "context"

     

       4
       4
       +
       

     

       5
       5
       +
       // Service defines the business logic interface for feeds

     

       6
       6
       +
       type Service interface {

     

       7
       7
       +
       	// GetCommunityFeed returns posts from a specific community with sorting

     

       8
       8
       +
       	// Supports hot/top/new algorithms, pagination, and viewer state

     

       9
       9
       +
       	GetCommunityFeed(ctx context.Context, req GetCommunityFeedRequest) (*FeedResponse, error)

     

       10
       10
       +
       

     

       11
       11
       +
       	// Future methods (Beta):

     

       12
       12
       +
       	// GetTimeline(ctx context.Context, req GetTimelineRequest) (*FeedResponse, error)

     

       13
       13
       +
       	// GetAuthorFeed(ctx context.Context, authorDID string, limit int, cursor *string) (*FeedResponse, error)

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // Repository defines the data access interface for feeds

     

       17
       17
       +
       type Repository interface {

     

       18
       18
       +
       	// GetCommunityFeed retrieves posts from a community with sorting and pagination

     

       19
       19
       +
       	// Returns hydrated PostView objects (single query with JOINs)

     

       20
       20
       +
       	GetCommunityFeed(ctx context.Context, req GetCommunityFeedRequest) ([]*FeedViewPost, *string, error)

     

       21
       21
       +
       

     

       22
       22
       +
       	// Future methods (Beta):

     

       23
       23
       +
       	// GetTimeline(ctx context.Context, userDID string, limit int, cursor *string) ([]*FeedViewPost, *string, error)

     

       24
       24
       +
       	// GetAuthorFeed(ctx context.Context, authorDID string, limit int, cursor *string) ([]*FeedViewPost, *string, error)

     

       25
       25
       +
       }

+23

internal/api/routes/communityFeed.go

···

       1
       1
       +
       package routes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/communityFeed"

     

       5
       5
       +
       	"Coves/internal/core/communityFeeds"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/go-chi/chi/v5"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // RegisterCommunityFeedRoutes registers feed-related XRPC endpoints

     

       11
       11
       +
       func RegisterCommunityFeedRoutes(

     

       12
       12
       +
       	r chi.Router,

     

       13
       13
       +
       	feedService communityFeeds.Service,

     

       14
       14
       +
       ) {

     

       15
       15
       +
       	// Create handlers

     

       16
       16
       +
       	getCommunityHandler := communityFeed.NewGetCommunityHandler(feedService)

     

       17
       17
       +
       

     

       18
       18
       +
       	// GET /xrpc/social.coves.communityFeed.getCommunity

     

       19
       19
       +
       	// Public endpoint - basic community sorting only for Alpha

     

       20
       20
       +
       	// TODO(feed-generator): Add OptionalAuth middleware when implementing viewer-specific state

     

       21
       21
       +
       	//                       (blocks, upvotes, saves, etc.) in feed generator skeleton

     

       22
       22
       +
       	r.Get("/xrpc/social.coves.communityFeed.getCommunity", getCommunityHandler.HandleGetCommunity)

     

       23
       23
       +
       }

+54

internal/atproto/lexicon/social/coves/aggregator/authorization.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.authorization",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "record",

     

       7
       7
       +
             "description": "Authorization for an aggregator to post to a community with specific configuration. Published in the community's repository by moderators. Similar to social.coves.actor.subscription.",

     

       8
       8
       +
             "key": "any",

     

       9
       9
       +
             "record": {

     

       10
       10
       +
               "type": "object",

     

       11
       11
       +
               "required": ["aggregatorDid", "communityDid", "enabled", "createdAt", "createdBy"],

     

       12
       12
       +
               "properties": {

     

       13
       13
       +
                 "aggregatorDid": {

     

       14
       14
       +
                   "type": "string",

     

       15
       15
       +
                   "format": "did",

     

       16
       16
       +
                   "description": "DID of the authorized aggregator"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "communityDid": {

     

       19
       19
       +
                   "type": "string",

     

       20
       20
       +
                   "format": "did",

     

       21
       21
       +
                   "description": "DID of the community granting access (must match repo DID)"

     

       22
       22
       +
                 },

     

       23
       23
       +
                 "enabled": {

     

       24
       24
       +
                   "type": "boolean",

     

       25
       25
       +
                   "description": "Whether this aggregator is currently active. Can be toggled without deleting the record."

     

       26
       26
       +
                 },

     

       27
       27
       +
                 "config": {

     

       28
       28
       +
                   "type": "unknown",

     

       29
       29
       +
                   "description": "Aggregator-specific configuration. Must conform to the aggregator's configSchema."

     

       30
       30
       +
                 },

     

       31
       31
       +
                 "createdAt": {

     

       32
       32
       +
                   "type": "string",

     

       33
       33
       +
                   "format": "datetime"

     

       34
       34
       +
                 },

     

       35
       35
       +
                 "createdBy": {

     

       36
       36
       +
                   "type": "string",

     

       37
       37
       +
                   "format": "did",

     

       38
       38
       +
                   "description": "DID of moderator who authorized this aggregator"

     

       39
       39
       +
                 },

     

       40
       40
       +
                 "disabledAt": {

     

       41
       41
       +
                   "type": "string",

     

       42
       42
       +
                   "format": "datetime",

     

       43
       43
       +
                   "description": "When this authorization was disabled (if enabled=false)"

     

       44
       44
       +
                 },

     

       45
       45
       +
                 "disabledBy": {

     

       46
       46
       +
                   "type": "string",

     

       47
       47
       +
                   "format": "did",

     

       48
       48
       +
                   "description": "DID of moderator who disabled this aggregator"

     

       49
       49
       +
                 }

     

       50
       50
       +
               }

     

       51
       51
       +
             }

     

       52
       52
       +
           }

     

       53
       53
       +
         }

     

       54
       54
       +
       }

+209

internal/atproto/lexicon/social/coves/aggregator/defs.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.defs",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "aggregatorView": {

     

       6
       6
       +
             "type": "object",

     

       7
       7
       +
             "description": "Detailed view of an aggregator service",

     

       8
       8
       +
             "required": ["did", "displayName", "createdAt"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "did": {

     

       11
       11
       +
                 "type": "string",

     

       12
       12
       +
                 "format": "did",

     

       13
       13
       +
                 "description": "DID of the aggregator service"

     

       14
       14
       +
               },

     

       15
       15
       +
               "displayName": {

     

       16
       16
       +
                 "type": "string",

     

       17
       17
       +
                 "maxGraphemes": 64,

     

       18
       18
       +
                 "maxLength": 640,

     

       19
       19
       +
                 "description": "Human-readable name (e.g., 'RSS News Aggregator')"

     

       20
       20
       +
               },

     

       21
       21
       +
               "description": {

     

       22
       22
       +
                 "type": "string",

     

       23
       23
       +
                 "maxGraphemes": 300,

     

       24
       24
       +
                 "maxLength": 3000,

     

       25
       25
       +
                 "description": "Description of what this aggregator does"

     

       26
       26
       +
               },

     

       27
       27
       +
               "avatar": {

     

       28
       28
       +
                 "type": "string",

     

       29
       29
       +
                 "format": "uri",

     

       30
       30
       +
                 "description": "URL to avatar image"

     

       31
       31
       +
               },

     

       32
       32
       +
               "configSchema": {

     

       33
       33
       +
                 "type": "unknown",

     

       34
       34
       +
                 "description": "JSON Schema describing config options for this aggregator"

     

       35
       35
       +
               },

     

       36
       36
       +
               "sourceUrl": {

     

       37
       37
       +
                 "type": "string",

     

       38
       38
       +
                 "format": "uri",

     

       39
       39
       +
                 "description": "URL to aggregator's source code (for transparency)"

     

       40
       40
       +
               },

     

       41
       41
       +
               "maintainer": {

     

       42
       42
       +
                 "type": "string",

     

       43
       43
       +
                 "format": "did",

     

       44
       44
       +
                 "description": "DID of person/organization maintaining this aggregator"

     

       45
       45
       +
               },

     

       46
       46
       +
               "createdAt": {

     

       47
       47
       +
                 "type": "string",

     

       48
       48
       +
                 "format": "datetime"

     

       49
       49
       +
               },

     

       50
       50
       +
               "recordUri": {

     

       51
       51
       +
                 "type": "string",

     

       52
       52
       +
                 "format": "at-uri",

     

       53
       53
       +
                 "description": "AT-URI of the service declaration record"

     

       54
       54
       +
               }

     

       55
       55
       +
             }

     

       56
       56
       +
           },

     

       57
       57
       +
           "aggregatorViewDetailed": {

     

       58
       58
       +
             "type": "object",

     

       59
       59
       +
             "description": "Detailed view of an aggregator with stats",

     

       60
       60
       +
             "required": ["did", "displayName", "createdAt", "stats"],

     

       61
       61
       +
             "properties": {

     

       62
       62
       +
               "did": {

     

       63
       63
       +
                 "type": "string",

     

       64
       64
       +
                 "format": "did"

     

       65
       65
       +
               },

     

       66
       66
       +
               "displayName": {

     

       67
       67
       +
                 "type": "string",

     

       68
       68
       +
                 "maxGraphemes": 64,

     

       69
       69
       +
                 "maxLength": 640

     

       70
       70
       +
               },

     

       71
       71
       +
               "description": {

     

       72
       72
       +
                 "type": "string",

     

       73
       73
       +
                 "maxGraphemes": 300,

     

       74
       74
       +
                 "maxLength": 3000

     

       75
       75
       +
               },

     

       76
       76
       +
               "avatar": {

     

       77
       77
       +
                 "type": "string",

     

       78
       78
       +
                 "format": "uri"

     

       79
       79
       +
               },

     

       80
       80
       +
               "configSchema": {

     

       81
       81
       +
                 "type": "unknown"

     

       82
       82
       +
               },

     

       83
       83
       +
               "sourceUrl": {

     

       84
       84
       +
                 "type": "string",

     

       85
       85
       +
                 "format": "uri"

     

       86
       86
       +
               },

     

       87
       87
       +
               "maintainer": {

     

       88
       88
       +
                 "type": "string",

     

       89
       89
       +
                 "format": "did"

     

       90
       90
       +
               },

     

       91
       91
       +
               "createdAt": {

     

       92
       92
       +
                 "type": "string",

     

       93
       93
       +
                 "format": "datetime"

     

       94
       94
       +
               },

     

       95
       95
       +
               "recordUri": {

     

       96
       96
       +
                 "type": "string",

     

       97
       97
       +
                 "format": "at-uri"

     

       98
       98
       +
               },

     

       99
       99
       +
               "stats": {

     

       100
       100
       +
                 "type": "ref",

     

       101
       101
       +
                 "ref": "#aggregatorStats"

     

       102
       102
       +
               }

     

       103
       103
       +
             }

     

       104
       104
       +
           },

     

       105
       105
       +
           "aggregatorStats": {

     

       106
       106
       +
             "type": "object",

     

       107
       107
       +
             "description": "Statistics about an aggregator's usage",

     

       108
       108
       +
             "required": ["communitiesUsing", "postsCreated"],

     

       109
       109
       +
             "properties": {

     

       110
       110
       +
               "communitiesUsing": {

     

       111
       111
       +
                 "type": "integer",

     

       112
       112
       +
                 "minimum": 0,

     

       113
       113
       +
                 "description": "Number of communities that have authorized this aggregator"

     

       114
       114
       +
               },

     

       115
       115
       +
               "postsCreated": {

     

       116
       116
       +
                 "type": "integer",

     

       117
       117
       +
                 "minimum": 0,

     

       118
       118
       +
                 "description": "Total number of posts created by this aggregator"

     

       119
       119
       +
               }

     

       120
       120
       +
             }

     

       121
       121
       +
           },

     

       122
       122
       +
           "authorizationView": {

     

       123
       123
       +
             "type": "object",

     

       124
       124
       +
             "description": "View of an aggregator authorization for a community",

     

       125
       125
       +
             "required": ["aggregatorDid", "communityDid", "enabled", "createdAt"],

     

       126
       126
       +
             "properties": {

     

       127
       127
       +
               "aggregatorDid": {

     

       128
       128
       +
                 "type": "string",

     

       129
       129
       +
                 "format": "did",

     

       130
       130
       +
                 "description": "DID of the authorized aggregator"

     

       131
       131
       +
               },

     

       132
       132
       +
               "communityDid": {

     

       133
       133
       +
                 "type": "string",

     

       134
       134
       +
                 "format": "did",

     

       135
       135
       +
                 "description": "DID of the community"

     

       136
       136
       +
               },

     

       137
       137
       +
               "communityHandle": {

     

       138
       138
       +
                 "type": "string",

     

       139
       139
       +
                 "format": "handle",

     

       140
       140
       +
                 "description": "Handle of the community"

     

       141
       141
       +
               },

     

       142
       142
       +
               "communityName": {

     

       143
       143
       +
                 "type": "string",

     

       144
       144
       +
                 "description": "Display name of the community"

     

       145
       145
       +
               },

     

       146
       146
       +
               "enabled": {

     

       147
       147
       +
                 "type": "boolean",

     

       148
       148
       +
                 "description": "Whether this aggregator is currently active"

     

       149
       149
       +
               },

     

       150
       150
       +
               "config": {

     

       151
       151
       +
                 "type": "unknown",

     

       152
       152
       +
                 "description": "Aggregator-specific configuration"

     

       153
       153
       +
               },

     

       154
       154
       +
               "createdAt": {

     

       155
       155
       +
                 "type": "string",

     

       156
       156
       +
                 "format": "datetime"

     

       157
       157
       +
               },

     

       158
       158
       +
               "createdBy": {

     

       159
       159
       +
                 "type": "string",

     

       160
       160
       +
                 "format": "did",

     

       161
       161
       +
                 "description": "DID of moderator who authorized this aggregator"

     

       162
       162
       +
               },

     

       163
       163
       +
               "disabledAt": {

     

       164
       164
       +
                 "type": "string",

     

       165
       165
       +
                 "format": "datetime",

     

       166
       166
       +
                 "description": "When this authorization was disabled (if enabled=false)"

     

       167
       167
       +
               },

     

       168
       168
       +
               "disabledBy": {

     

       169
       169
       +
                 "type": "string",

     

       170
       170
       +
                 "format": "did",

     

       171
       171
       +
                 "description": "DID of moderator who disabled this aggregator"

     

       172
       172
       +
               },

     

       173
       173
       +
               "recordUri": {

     

       174
       174
       +
                 "type": "string",

     

       175
       175
       +
                 "format": "at-uri",

     

       176
       176
       +
                 "description": "AT-URI of the authorization record"

     

       177
       177
       +
               }

     

       178
       178
       +
             }

     

       179
       179
       +
           },

     

       180
       180
       +
           "communityAuthView": {

     

       181
       181
       +
             "type": "object",

     

       182
       182
       +
             "description": "Aggregator's view of authorization for a community (used by aggregators querying their authorizations)",

     

       183
       183
       +
             "required": ["aggregator", "enabled", "createdAt"],

     

       184
       184
       +
             "properties": {

     

       185
       185
       +
               "aggregator": {

     

       186
       186
       +
                 "type": "ref",

     

       187
       187
       +
                 "ref": "#aggregatorView",

     

       188
       188
       +
                 "description": "The aggregator service details"

     

       189
       189
       +
               },

     

       190
       190
       +
               "enabled": {

     

       191
       191
       +
                 "type": "boolean",

     

       192
       192
       +
                 "description": "Whether this authorization is currently active"

     

       193
       193
       +
               },

     

       194
       194
       +
               "config": {

     

       195
       195
       +
                 "type": "unknown",

     

       196
       196
       +
                 "description": "Community-specific configuration for this aggregator"

     

       197
       197
       +
               },

     

       198
       198
       +
               "createdAt": {

     

       199
       199
       +
                 "type": "string",

     

       200
       200
       +
                 "format": "datetime"

     

       201
       201
       +
               },

     

       202
       202
       +
               "recordUri": {

     

       203
       203
       +
                 "type": "string",

     

       204
       204
       +
                 "format": "at-uri"

     

       205
       205
       +
               }

     

       206
       206
       +
             }

     

       207
       207
       +
           }

     

       208
       208
       +
         }

     

       209
       209
       +
       }

+67

internal/atproto/lexicon/social/coves/aggregator/disable.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.disable",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Disable an aggregator for a community. Updates the authorization record to set enabled=false. Requires moderator permissions.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["community", "aggregatorDid"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "community": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-identifier",

     

       17
       17
       +
                     "description": "DID or handle of the community"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "aggregatorDid": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "format": "did",

     

       22
       22
       +
                     "description": "DID of the aggregator to disable"

     

       23
       23
       +
                   }

     

       24
       24
       +
                 }

     

       25
       25
       +
               }

     

       26
       26
       +
             },

     

       27
       27
       +
             "output": {

     

       28
       28
       +
               "encoding": "application/json",

     

       29
       29
       +
               "schema": {

     

       30
       30
       +
                 "type": "object",

     

       31
       31
       +
                 "required": ["uri", "cid"],

     

       32
       32
       +
                 "properties": {

     

       33
       33
       +
                   "uri": {

     

       34
       34
       +
                     "type": "string",

     

       35
       35
       +
                     "format": "at-uri",

     

       36
       36
       +
                     "description": "AT-URI of the updated authorization record"

     

       37
       37
       +
                   },

     

       38
       38
       +
                   "cid": {

     

       39
       39
       +
                     "type": "string",

     

       40
       40
       +
                     "format": "cid",

     

       41
       41
       +
                     "description": "CID of the updated authorization record"

     

       42
       42
       +
                   },

     

       43
       43
       +
                   "disabledAt": {

     

       44
       44
       +
                     "type": "string",

     

       45
       45
       +
                     "format": "datetime",

     

       46
       46
       +
                     "description": "When the aggregator was disabled"

     

       47
       47
       +
                   }

     

       48
       48
       +
                 }

     

       49
       49
       +
               }

     

       50
       50
       +
             },

     

       51
       51
       +
             "errors": [

     

       52
       52
       +
               {

     

       53
       53
       +
                 "name": "NotAuthorized",

     

       54
       54
       +
                 "description": "Caller is not a moderator of this community"

     

       55
       55
       +
               },

     

       56
       56
       +
               {

     

       57
       57
       +
                 "name": "AuthorizationNotFound",

     

       58
       58
       +
                 "description": "Aggregator is not enabled for this community"

     

       59
       59
       +
               },

     

       60
       60
       +
               {

     

       61
       61
       +
                 "name": "AlreadyDisabled",

     

       62
       62
       +
                 "description": "Aggregator is already disabled"

     

       63
       63
       +
               }

     

       64
       64
       +
             ]

     

       65
       65
       +
           }

     

       66
       66
       +
         }

     

       67
       67
       +
       }

+75

internal/atproto/lexicon/social/coves/aggregator/enable.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.enable",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Enable an aggregator for a community. Creates an authorization record in the community's repository. Requires moderator permissions.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["community", "aggregatorDid"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "community": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-identifier",

     

       17
       17
       +
                     "description": "DID or handle of the community"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "aggregatorDid": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "format": "did",

     

       22
       22
       +
                     "description": "DID of the aggregator to enable"

     

       23
       23
       +
                   },

     

       24
       24
       +
                   "config": {

     

       25
       25
       +
                     "type": "unknown",

     

       26
       26
       +
                     "description": "Aggregator-specific configuration. Must conform to the aggregator's configSchema."

     

       27
       27
       +
                   }

     

       28
       28
       +
                 }

     

       29
       29
       +
               }

     

       30
       30
       +
             },

     

       31
       31
       +
             "output": {

     

       32
       32
       +
               "encoding": "application/json",

     

       33
       33
       +
               "schema": {

     

       34
       34
       +
                 "type": "object",

     

       35
       35
       +
                 "required": ["uri", "cid", "authorization"],

     

       36
       36
       +
                 "properties": {

     

       37
       37
       +
                   "uri": {

     

       38
       38
       +
                     "type": "string",

     

       39
       39
       +
                     "format": "at-uri",

     

       40
       40
       +
                     "description": "AT-URI of the created authorization record"

     

       41
       41
       +
                   },

     

       42
       42
       +
                   "cid": {

     

       43
       43
       +
                     "type": "string",

     

       44
       44
       +
                     "format": "cid",

     

       45
       45
       +
                     "description": "CID of the created authorization record"

     

       46
       46
       +
                   },

     

       47
       47
       +
                   "authorization": {

     

       48
       48
       +
                     "type": "ref",

     

       49
       49
       +
                     "ref": "social.coves.aggregator.defs#authorizationView",

     

       50
       50
       +
                     "description": "The created authorization details"

     

       51
       51
       +
                   }

     

       52
       52
       +
                 }

     

       53
       53
       +
               }

     

       54
       54
       +
             },

     

       55
       55
       +
             "errors": [

     

       56
       56
       +
               {

     

       57
       57
       +
                 "name": "NotAuthorized",

     

       58
       58
       +
                 "description": "Caller is not a moderator of this community"

     

       59
       59
       +
               },

     

       60
       60
       +
               {

     

       61
       61
       +
                 "name": "AggregatorNotFound",

     

       62
       62
       +
                 "description": "Aggregator DID does not exist or has no service declaration"

     

       63
       63
       +
               },

     

       64
       64
       +
               {

     

       65
       65
       +
                 "name": "InvalidConfig",

     

       66
       66
       +
                 "description": "Config does not match aggregator's configSchema"

     

       67
       67
       +
               },

     

       68
       68
       +
               {

     

       69
       69
       +
                 "name": "AlreadyEnabled",

     

       70
       70
       +
                 "description": "Aggregator is already enabled for this community"

     

       71
       71
       +
               }

     

       72
       72
       +
             ]

     

       73
       73
       +
           }

     

       74
       74
       +
         }

     

       75
       75
       +
       }

+64

internal/atproto/lexicon/social/coves/aggregator/getAuthorizations.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.getAuthorizations",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "query",

     

       7
       7
       +
             "description": "Get list of communities that have authorized a specific aggregator. Used by aggregators to query which communities they can post to. Authentication optional.",

     

       8
       8
       +
             "parameters": {

     

       9
       9
       +
               "type": "params",

     

       10
       10
       +
               "required": ["aggregatorDid"],

     

       11
       11
       +
               "properties": {

     

       12
       12
       +
                 "aggregatorDid": {

     

       13
       13
       +
                   "type": "string",

     

       14
       14
       +
                   "format": "did",

     

       15
       15
       +
                   "description": "DID of the aggregator"

     

       16
       16
       +
                 },

     

       17
       17
       +
                 "enabledOnly": {

     

       18
       18
       +
                   "type": "boolean",

     

       19
       19
       +
                   "default": true,

     

       20
       20
       +
                   "description": "Only return enabled authorizations"

     

       21
       21
       +
                 },

     

       22
       22
       +
                 "limit": {

     

       23
       23
       +
                   "type": "integer",

     

       24
       24
       +
                   "minimum": 1,

     

       25
       25
       +
                   "maximum": 100,

     

       26
       26
       +
                   "default": 50,

     

       27
       27
       +
                   "description": "Maximum number of authorizations to return"

     

       28
       28
       +
                 },

     

       29
       29
       +
                 "cursor": {

     

       30
       30
       +
                   "type": "string",

     

       31
       31
       +
                   "description": "Pagination cursor"

     

       32
       32
       +
                 }

     

       33
       33
       +
               }

     

       34
       34
       +
             },

     

       35
       35
       +
             "output": {

     

       36
       36
       +
               "encoding": "application/json",

     

       37
       37
       +
               "schema": {

     

       38
       38
       +
                 "type": "object",

     

       39
       39
       +
                 "required": ["authorizations"],

     

       40
       40
       +
                 "properties": {

     

       41
       41
       +
                   "authorizations": {

     

       42
       42
       +
                     "type": "array",

     

       43
       43
       +
                     "items": {

     

       44
       44
       +
                       "type": "ref",

     

       45
       45
       +
                       "ref": "social.coves.aggregator.defs#communityAuthView"

     

       46
       46
       +
                     },

     

       47
       47
       +
                     "description": "Array of community authorizations for this aggregator"

     

       48
       48
       +
                   },

     

       49
       49
       +
                   "cursor": {

     

       50
       50
       +
                     "type": "string",

     

       51
       51
       +
                     "description": "Pagination cursor for next page"

     

       52
       52
       +
                   }

     

       53
       53
       +
                 }

     

       54
       54
       +
               }

     

       55
       55
       +
             },

     

       56
       56
       +
             "errors": [

     

       57
       57
       +
               {

     

       58
       58
       +
                 "name": "AggregatorNotFound",

     

       59
       59
       +
                 "description": "Aggregator DID does not exist or has no service declaration"

     

       60
       60
       +
               }

     

       61
       61
       +
             ]

     

       62
       62
       +
           }

     

       63
       63
       +
         }

     

       64
       64
       +
       }

+50

internal/atproto/lexicon/social/coves/aggregator/getServices.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.getServices",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "query",

     

       7
       7
       +
             "description": "Get information about aggregator services. Can fetch one or multiple aggregators by DID. Authentication optional.",

     

       8
       8
       +
             "parameters": {

     

       9
       9
       +
               "type": "params",

     

       10
       10
       +
               "required": ["dids"],

     

       11
       11
       +
               "properties": {

     

       12
       12
       +
                 "dids": {

     

       13
       13
       +
                   "type": "array",

     

       14
       14
       +
                   "items": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "did"

     

       17
       17
       +
                   },

     

       18
       18
       +
                   "maxLength": 25,

     

       19
       19
       +
                   "description": "Array of aggregator DIDs to fetch"

     

       20
       20
       +
                 },

     

       21
       21
       +
                 "detailed": {

     

       22
       22
       +
                   "type": "boolean",

     

       23
       23
       +
                   "default": false,

     

       24
       24
       +
                   "description": "Include usage statistics in response"

     

       25
       25
       +
                 }

     

       26
       26
       +
               }

     

       27
       27
       +
             },

     

       28
       28
       +
             "output": {

     

       29
       29
       +
               "encoding": "application/json",

     

       30
       30
       +
               "schema": {

     

       31
       31
       +
                 "type": "object",

     

       32
       32
       +
                 "required": ["views"],

     

       33
       33
       +
                 "properties": {

     

       34
       34
       +
                   "views": {

     

       35
       35
       +
                     "type": "array",

     

       36
       36
       +
                     "items": {

     

       37
       37
       +
                       "type": "union",

     

       38
       38
       +
                       "refs": [

     

       39
       39
       +
                         "social.coves.aggregator.defs#aggregatorView",

     

       40
       40
       +
                         "social.coves.aggregator.defs#aggregatorViewDetailed"

     

       41
       41
       +
                       ]

     

       42
       42
       +
                     },

     

       43
       43
       +
                     "description": "Array of aggregator views. Returns aggregatorView if detailed=false, aggregatorViewDetailed if detailed=true."

     

       44
       44
       +
                   }

     

       45
       45
       +
                 }

     

       46
       46
       +
               }

     

       47
       47
       +
             }

     

       48
       48
       +
           }

     

       49
       49
       +
         }

     

       50
       50
       +
       }

+64

internal/atproto/lexicon/social/coves/aggregator/listForCommunity.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.listForCommunity",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "query",

     

       7
       7
       +
             "description": "List all aggregators authorized for a specific community. Used by community settings UI to show enabled/disabled aggregators. Authentication optional.",

     

       8
       8
       +
             "parameters": {

     

       9
       9
       +
               "type": "params",

     

       10
       10
       +
               "required": ["community"],

     

       11
       11
       +
               "properties": {

     

       12
       12
       +
                 "community": {

     

       13
       13
       +
                   "type": "string",

     

       14
       14
       +
                   "format": "at-identifier",

     

       15
       15
       +
                   "description": "DID or handle of the community"

     

       16
       16
       +
                 },

     

       17
       17
       +
                 "enabledOnly": {

     

       18
       18
       +
                   "type": "boolean",

     

       19
       19
       +
                   "default": false,

     

       20
       20
       +
                   "description": "Only return enabled aggregators"

     

       21
       21
       +
                 },

     

       22
       22
       +
                 "limit": {

     

       23
       23
       +
                   "type": "integer",

     

       24
       24
       +
                   "minimum": 1,

     

       25
       25
       +
                   "maximum": 100,

     

       26
       26
       +
                   "default": 50,

     

       27
       27
       +
                   "description": "Maximum number of aggregators to return"

     

       28
       28
       +
                 },

     

       29
       29
       +
                 "cursor": {

     

       30
       30
       +
                   "type": "string",

     

       31
       31
       +
                   "description": "Pagination cursor"

     

       32
       32
       +
                 }

     

       33
       33
       +
               }

     

       34
       34
       +
             },

     

       35
       35
       +
             "output": {

     

       36
       36
       +
               "encoding": "application/json",

     

       37
       37
       +
               "schema": {

     

       38
       38
       +
                 "type": "object",

     

       39
       39
       +
                 "required": ["aggregators"],

     

       40
       40
       +
                 "properties": {

     

       41
       41
       +
                   "aggregators": {

     

       42
       42
       +
                     "type": "array",

     

       43
       43
       +
                     "items": {

     

       44
       44
       +
                       "type": "ref",

     

       45
       45
       +
                       "ref": "social.coves.aggregator.defs#authorizationView"

     

       46
       46
       +
                     },

     

       47
       47
       +
                     "description": "Array of aggregator authorizations for this community"

     

       48
       48
       +
                   },

     

       49
       49
       +
                   "cursor": {

     

       50
       50
       +
                     "type": "string",

     

       51
       51
       +
                     "description": "Pagination cursor for next page"

     

       52
       52
       +
                   }

     

       53
       53
       +
                 }

     

       54
       54
       +
               }

     

       55
       55
       +
             },

     

       56
       56
       +
             "errors": [

     

       57
       57
       +
               {

     

       58
       58
       +
                 "name": "CommunityNotFound",

     

       59
       59
       +
                 "description": "Community not found"

     

       60
       60
       +
               }

     

       61
       61
       +
             ]

     

       62
       62
       +
           }

     

       63
       63
       +
         }

     

       64
       64
       +
       }

+58

internal/atproto/lexicon/social/coves/aggregator/service.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.service",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "record",

     

       7
       7
       +
             "description": "Declaration of an aggregator service that can post to communities. Published in the aggregator's own repository. Similar to app.bsky.feed.generator and app.bsky.labeler.service.",

     

       8
       8
       +
             "key": "literal:self",

     

       9
       9
       +
             "record": {

     

       10
       10
       +
               "type": "object",

     

       11
       11
       +
               "required": ["did", "displayName", "createdAt"],

     

       12
       12
       +
               "properties": {

     

       13
       13
       +
                 "did": {

     

       14
       14
       +
                   "type": "string",

     

       15
       15
       +
                   "format": "did",

     

       16
       16
       +
                   "description": "DID of the aggregator service (must match repo DID)"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "displayName": {

     

       19
       19
       +
                   "type": "string",

     

       20
       20
       +
                   "maxGraphemes": 64,

     

       21
       21
       +
                   "maxLength": 640,

     

       22
       22
       +
                   "description": "Human-readable name (e.g., 'RSS News Aggregator')"

     

       23
       23
       +
                 },

     

       24
       24
       +
                 "description": {

     

       25
       25
       +
                   "type": "string",

     

       26
       26
       +
                   "maxGraphemes": 300,

     

       27
       27
       +
                   "maxLength": 3000,

     

       28
       28
       +
                   "description": "Description of what this aggregator does"

     

       29
       29
       +
                 },

     

       30
       30
       +
                 "avatar": {

     

       31
       31
       +
                   "type": "blob",

     

       32
       32
       +
                   "accept": ["image/png", "image/jpeg", "image/webp"],

     

       33
       33
       +
                   "maxSize": 1000000,

     

       34
       34
       +
                   "description": "Avatar image for bot identity"

     

       35
       35
       +
                 },

     

       36
       36
       +
                 "configSchema": {

     

       37
       37
       +
                   "type": "unknown",

     

       38
       38
       +
                   "description": "JSON Schema describing config options for this aggregator. Communities use this to know what configuration fields are available."

     

       39
       39
       +
                 },

     

       40
       40
       +
                 "sourceUrl": {

     

       41
       41
       +
                   "type": "string",

     

       42
       42
       +
                   "format": "uri",

     

       43
       43
       +
                   "description": "URL to aggregator's source code (for transparency)"

     

       44
       44
       +
                 },

     

       45
       45
       +
                 "maintainer": {

     

       46
       46
       +
                   "type": "string",

     

       47
       47
       +
                   "format": "did",

     

       48
       48
       +
                   "description": "DID of person/organization maintaining this aggregator"

     

       49
       49
       +
                 },

     

       50
       50
       +
                 "createdAt": {

     

       51
       51
       +
                   "type": "string",

     

       52
       52
       +
                   "format": "datetime"

     

       53
       53
       +
                 }

     

       54
       54
       +
               }

     

       55
       55
       +
             }

     

       56
       56
       +
           }

     

       57
       57
       +
         }

     

       58
       58
       +
       }

+71

internal/atproto/lexicon/social/coves/aggregator/updateConfig.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.updateConfig",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Update configuration for an enabled aggregator. Updates the authorization record's config field. Requires moderator permissions.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["community", "aggregatorDid", "config"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "community": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-identifier",

     

       17
       17
       +
                     "description": "DID or handle of the community"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "aggregatorDid": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "format": "did",

     

       22
       22
       +
                     "description": "DID of the aggregator"

     

       23
       23
       +
                   },

     

       24
       24
       +
                   "config": {

     

       25
       25
       +
                     "type": "unknown",

     

       26
       26
       +
                     "description": "New aggregator-specific configuration. Must conform to the aggregator's configSchema."

     

       27
       27
       +
                   }

     

       28
       28
       +
                 }

     

       29
       29
       +
               }

     

       30
       30
       +
             },

     

       31
       31
       +
             "output": {

     

       32
       32
       +
               "encoding": "application/json",

     

       33
       33
       +
               "schema": {

     

       34
       34
       +
                 "type": "object",

     

       35
       35
       +
                 "required": ["uri", "cid", "authorization"],

     

       36
       36
       +
                 "properties": {

     

       37
       37
       +
                   "uri": {

     

       38
       38
       +
                     "type": "string",

     

       39
       39
       +
                     "format": "at-uri",

     

       40
       40
       +
                     "description": "AT-URI of the updated authorization record"

     

       41
       41
       +
                   },

     

       42
       42
       +
                   "cid": {

     

       43
       43
       +
                     "type": "string",

     

       44
       44
       +
                     "format": "cid",

     

       45
       45
       +
                     "description": "CID of the updated authorization record"

     

       46
       46
       +
                   },

     

       47
       47
       +
                   "authorization": {

     

       48
       48
       +
                     "type": "ref",

     

       49
       49
       +
                     "ref": "social.coves.aggregator.defs#authorizationView",

     

       50
       50
       +
                     "description": "The updated authorization details"

     

       51
       51
       +
                   }

     

       52
       52
       +
                 }

     

       53
       53
       +
               }

     

       54
       54
       +
             },

     

       55
       55
       +
             "errors": [

     

       56
       56
       +
               {

     

       57
       57
       +
                 "name": "NotAuthorized",

     

       58
       58
       +
                 "description": "Caller is not a moderator of this community"

     

       59
       59
       +
               },

     

       60
       60
       +
               {

     

       61
       61
       +
                 "name": "AuthorizationNotFound",

     

       62
       62
       +
                 "description": "Aggregator is not enabled for this community"

     

       63
       63
       +
               },

     

       64
       64
       +
               {

     

       65
       65
       +
                 "name": "InvalidConfig",

     

       66
       66
       +
                 "description": "Config does not match aggregator's configSchema"

     

       67
       67
       +
               }

     

       68
       68
       +
             ]

     

       69
       69
       +
           }

     

       70
       70
       +
         }

     

       71
       71
       +
       }

+214

internal/db/migrations/012_create_aggregators_tables.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Create aggregators tables for indexing aggregator service declarations and authorizations

     

       3
       3
       +
       -- These records are indexed from Jetstream firehose consumer

     

       4
       4
       +
       

     

       5
       5
       +
       -- ============================================================================

     

       6
       6
       +
       -- Table: aggregators

     

       7
       7
       +
       -- Purpose: Index aggregator service declarations from social.coves.aggregator.service records

     

       8
       8
       +
       -- Source: Aggregator's own repository (at://aggregator_did/social.coves.aggregator.service/self)

     

       9
       9
       +
       -- ============================================================================

     

       10
       10
       +
       CREATE TABLE aggregators (

     

       11
       11
       +
           -- Primary identity

     

       12
       12
       +
           did TEXT PRIMARY KEY,                       -- Aggregator's DID (must match repo DID)

     

       13
       13
       +
       

     

       14
       14
       +
           -- Service metadata (from lexicon)

     

       15
       15
       +
           display_name TEXT NOT NULL,                 -- Human-readable name

     

       16
       16
       +
           description TEXT,                           -- What this aggregator does

     

       17
       17
       +
           config_schema JSONB,                        -- JSON Schema for community config validation

     

       18
       18
       +
           avatar_url TEXT,                            -- Avatar image URL (extracted from blob)

     

       19
       19
       +
           source_url TEXT,                            -- URL to source code (transparency)

     

       20
       20
       +
           maintainer_did TEXT,                        -- DID of maintainer

     

       21
       21
       +
       

     

       22
       22
       +
           -- atProto record metadata

     

       23
       23
       +
           record_uri TEXT NOT NULL UNIQUE,            -- AT-URI of service declaration record

     

       24
       24
       +
           record_cid TEXT NOT NULL,                   -- CID of current record version

     

       25
       25
       +
           created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When the aggregator service was created (from lexicon createdAt field)

     

       26
       26
       +
           indexed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When indexed/updated by AppView

     

       27
       27
       +
       

     

       28
       28
       +
           -- Cached stats (updated by aggregator_posts table triggers/queries)

     

       29
       29
       +
           communities_using INTEGER NOT NULL DEFAULT 0,  -- Count of communities with enabled authorizations

     

       30
       30
       +
           posts_created BIGINT NOT NULL DEFAULT 0        -- Total posts created by this aggregator

     

       31
       31
       +
       );

     

       32
       32
       +
       

     

       33
       33
       +
       -- Indexes for discovery and lookups

     

       34
       34
       +
       CREATE INDEX idx_aggregators_created_at ON aggregators(created_at DESC);

     

       35
       35
       +
       CREATE INDEX idx_aggregators_indexed_at ON aggregators(indexed_at DESC);

     

       36
       36
       +
       CREATE INDEX idx_aggregators_maintainer ON aggregators(maintainer_did);

     

       37
       37
       +
       

     

       38
       38
       +
       -- Comments

     

       39
       39
       +
       COMMENT ON TABLE aggregators IS 'Aggregator service declarations indexed from social.coves.aggregator.service records';

     

       40
       40
       +
       COMMENT ON COLUMN aggregators.did IS 'DID of the aggregator service (matches repo DID)';

     

       41
       41
       +
       COMMENT ON COLUMN aggregators.config_schema IS 'JSON Schema defining what config options communities can set';

     

       42
       42
       +
       COMMENT ON COLUMN aggregators.created_at IS 'When the aggregator service was created (from lexicon record createdAt field)';

     

       43
       43
       +
       COMMENT ON COLUMN aggregators.communities_using IS 'Cached count of communities with enabled=true authorizations';

     

       44
       44
       +
       

     

       45
       45
       +
       

     

       46
       46
       +
       -- ============================================================================

     

       47
       47
       +
       -- Table: aggregator_authorizations

     

       48
       48
       +
       -- Purpose: Index community authorization records for aggregators

     

       49
       49
       +
       -- Source: Community's repository (at://community_did/social.coves.aggregator.authorization/rkey)

     

       50
       50
       +
       -- ============================================================================

     

       51
       51
       +
       CREATE TABLE aggregator_authorizations (

     

       52
       52
       +
           id BIGSERIAL PRIMARY KEY,

     

       53
       53
       +
       

     

       54
       54
       +
           -- Authorization identity

     

       55
       55
       +
           aggregator_did TEXT NOT NULL,               -- DID of authorized aggregator

     

       56
       56
       +
           community_did TEXT NOT NULL,                -- DID of community granting access

     

       57
       57
       +
       

     

       58
       58
       +
           -- Authorization state

     

       59
       59
       +
           enabled BOOLEAN NOT NULL DEFAULT true,      -- Whether aggregator is currently active

     

       60
       60
       +
           config JSONB,                               -- Community-specific config (validated against aggregator's schema)

     

       61
       61
       +
       

     

       62
       62
       +
           -- Audit trail (from lexicon)

     

       63
       63
       +
           created_at TIMESTAMPTZ NOT NULL,            -- When authorization was created

     

       64
       64
       +
           created_by TEXT NOT NULL,                   -- DID of moderator who authorized (set by API, not client)

     

       65
       65
       +
           disabled_at TIMESTAMPTZ,                    -- When authorization was disabled (if enabled=false)

     

       66
       66
       +
           disabled_by TEXT,                           -- DID of moderator who disabled

     

       67
       67
       +
       

     

       68
       68
       +
           -- atProto record metadata

     

       69
       69
       +
           record_uri TEXT NOT NULL UNIQUE,            -- AT-URI of authorization record

     

       70
       70
       +
           record_cid TEXT NOT NULL,                   -- CID of current record version

     

       71
       71
       +
           indexed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When indexed/updated by AppView

     

       72
       72
       +
       

     

       73
       73
       +
           -- Constraints

     

       74
       74
       +
           UNIQUE(aggregator_did, community_did),      -- One authorization per aggregator per community

     

       75
       75
       +
           CONSTRAINT fk_aggregator FOREIGN KEY (aggregator_did) REFERENCES aggregators(did) ON DELETE CASCADE,

     

       76
       76
       +
           CONSTRAINT fk_community FOREIGN KEY (community_did) REFERENCES communities(did) ON DELETE CASCADE

     

       77
       77
       +
       );

     

       78
       78
       +
       

     

       79
       79
       +
       -- Indexes for authorization checks (CRITICAL PATH - used on every aggregator post)

     

       80
       80
       +
       CREATE INDEX idx_aggregator_auth_agg_enabled ON aggregator_authorizations(aggregator_did, enabled) WHERE enabled = true;

     

       81
       81
       +
       CREATE INDEX idx_aggregator_auth_comm_enabled ON aggregator_authorizations(community_did, enabled) WHERE enabled = true;

     

       82
       82
       +
       CREATE INDEX idx_aggregator_auth_lookup ON aggregator_authorizations(aggregator_did, community_did, enabled);

     

       83
       83
       +
       

     

       84
       84
       +
       -- Indexes for listing/discovery

     

       85
       85
       +
       CREATE INDEX idx_aggregator_auth_agg_did ON aggregator_authorizations(aggregator_did, created_at DESC);

     

       86
       86
       +
       CREATE INDEX idx_aggregator_auth_comm_did ON aggregator_authorizations(community_did, created_at DESC);

     

       87
       87
       +
       

     

       88
       88
       +
       -- Comments

     

       89
       89
       +
       COMMENT ON TABLE aggregator_authorizations IS 'Community authorizations for aggregators indexed from social.coves.aggregator.authorization records';

     

       90
       90
       +
       COMMENT ON COLUMN aggregator_authorizations.config IS 'Community-specific config, validated against aggregators.config_schema';

     

       91
       91
       +
       COMMENT ON INDEX idx_aggregator_auth_lookup IS 'CRITICAL: Fast lookup for post creation authorization checks';

     

       92
       92
       +
       

     

       93
       93
       +
       

     

       94
       94
       +
       -- ============================================================================

     

       95
       95
       +
       -- Table: aggregator_posts

     

       96
       96
       +
       -- Purpose: Track posts created by aggregators for rate limiting and stats

     

       97
       97
       +
       -- Note: This is AppView-only data, not from lexicon records

     

       98
       98
       +
       -- ============================================================================

     

       99
       99
       +
       CREATE TABLE aggregator_posts (

     

       100
       100
       +
           id BIGSERIAL PRIMARY KEY,

     

       101
       101
       +
       

     

       102
       102
       +
           -- Post identity

     

       103
       103
       +
           aggregator_did TEXT NOT NULL,               -- DID of aggregator that created the post

     

       104
       104
       +
           community_did TEXT NOT NULL,                -- DID of community post was created in

     

       105
       105
       +
           post_uri TEXT NOT NULL,                     -- AT-URI of the post record

     

       106
       106
       +
           post_cid TEXT NOT NULL,                     -- CID of the post

     

       107
       107
       +
       

     

       108
       108
       +
           -- Timestamp

     

       109
       109
       +
           created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When post was created

     

       110
       110
       +
       

     

       111
       111
       +
           -- Constraints

     

       112
       112
       +
           UNIQUE(post_uri),                           -- Each post tracked once

     

       113
       113
       +
           CONSTRAINT fk_aggregator_posts_agg FOREIGN KEY (aggregator_did) REFERENCES aggregators(did) ON DELETE CASCADE,

     

       114
       114
       +
           CONSTRAINT fk_aggregator_posts_comm FOREIGN KEY (community_did) REFERENCES communities(did) ON DELETE CASCADE

     

       115
       115
       +
       );

     

       116
       116
       +
       

     

       117
       117
       +
       -- Indexes for rate limiting queries (CRITICAL PATH - used on every aggregator post)

     

       118
       118
       +
       CREATE INDEX idx_aggregator_posts_rate_limit ON aggregator_posts(aggregator_did, community_did, created_at DESC);

     

       119
       119
       +
       

     

       120
       120
       +
       -- Indexes for stats

     

       121
       121
       +
       CREATE INDEX idx_aggregator_posts_agg_did ON aggregator_posts(aggregator_did, created_at DESC);

     

       122
       122
       +
       CREATE INDEX idx_aggregator_posts_comm_did ON aggregator_posts(community_did, created_at DESC);

     

       123
       123
       +
       

     

       124
       124
       +
       -- Comments

     

       125
       125
       +
       COMMENT ON TABLE aggregator_posts IS 'AppView-only tracking of posts created by aggregators for rate limiting and stats';

     

       126
       126
       +
       COMMENT ON INDEX idx_aggregator_posts_rate_limit IS 'CRITICAL: Fast rate limit checks (posts in last hour per community)';

     

       127
       127
       +
       

     

       128
       128
       +
       

     

       129
       129
       +
       -- ============================================================================

     

       130
       130
       +
       -- Trigger: Update aggregator stats when authorizations change

     

       131
       131
       +
       -- Purpose: Keep aggregators.communities_using count accurate

     

       132
       132
       +
       -- ============================================================================

     

       133
       133
       +
       -- +goose StatementBegin

     

       134
       134
       +
       CREATE OR REPLACE FUNCTION update_aggregator_communities_count()

     

       135
       135
       +
       RETURNS TRIGGER AS $$

     

       136
       136
       +
       BEGIN

     

       137
       137
       +
           -- Recalculate communities_using count for affected aggregator

     

       138
       138
       +
           IF TG_OP = 'DELETE' THEN

     

       139
       139
       +
               UPDATE aggregators

     

       140
       140
       +
               SET communities_using = (

     

       141
       141
       +
                   SELECT COUNT(*)

     

       142
       142
       +
                   FROM aggregator_authorizations

     

       143
       143
       +
                   WHERE aggregator_did = OLD.aggregator_did

     

       144
       144
       +
                     AND enabled = true

     

       145
       145
       +
               )

     

       146
       146
       +
               WHERE did = OLD.aggregator_did;

     

       147
       147
       +
               RETURN OLD;

     

       148
       148
       +
           ELSE

     

       149
       149
       +
               UPDATE aggregators

     

       150
       150
       +
               SET communities_using = (

     

       151
       151
       +
                   SELECT COUNT(*)

     

       152
       152
       +
                   FROM aggregator_authorizations

     

       153
       153
       +
                   WHERE aggregator_did = NEW.aggregator_did

     

       154
       154
       +
                     AND enabled = true

     

       155
       155
       +
               )

     

       156
       156
       +
               WHERE did = NEW.aggregator_did;

     

       157
       157
       +
               RETURN NEW;

     

       158
       158
       +
           END IF;

     

       159
       159
       +
       END;

     

       160
       160
       +
       $$ LANGUAGE plpgsql;

     

       161
       161
       +
       -- +goose StatementEnd

     

       162
       162
       +
       

     

       163
       163
       +
       CREATE TRIGGER trigger_update_aggregator_communities_count

     

       164
       164
       +
           AFTER INSERT OR UPDATE OR DELETE ON aggregator_authorizations

     

       165
       165
       +
           FOR EACH ROW

     

       166
       166
       +
           EXECUTE FUNCTION update_aggregator_communities_count();

     

       167
       167
       +
       

     

       168
       168
       +
       COMMENT ON FUNCTION update_aggregator_communities_count IS 'Maintains aggregators.communities_using count when authorizations change';

     

       169
       169
       +
       

     

       170
       170
       +
       

     

       171
       171
       +
       -- ============================================================================

     

       172
       172
       +
       -- Trigger: Update aggregator stats when posts are created

     

       173
       173
       +
       -- Purpose: Keep aggregators.posts_created count accurate

     

       174
       174
       +
       -- ============================================================================

     

       175
       175
       +
       -- +goose StatementBegin

     

       176
       176
       +
       CREATE OR REPLACE FUNCTION update_aggregator_posts_count()

     

       177
       177
       +
       RETURNS TRIGGER AS $$

     

       178
       178
       +
       BEGIN

     

       179
       179
       +
           IF TG_OP = 'INSERT' THEN

     

       180
       180
       +
               UPDATE aggregators

     

       181
       181
       +
               SET posts_created = posts_created + 1

     

       182
       182
       +
               WHERE did = NEW.aggregator_did;

     

       183
       183
       +
               RETURN NEW;

     

       184
       184
       +
           ELSIF TG_OP = 'DELETE' THEN

     

       185
       185
       +
               UPDATE aggregators

     

       186
       186
       +
               SET posts_created = posts_created - 1

     

       187
       187
       +
               WHERE did = OLD.aggregator_did;

     

       188
       188
       +
               RETURN OLD;

     

       189
       189
       +
           END IF;

     

       190
       190
       +
       END;

     

       191
       191
       +
       $$ LANGUAGE plpgsql;

     

       192
       192
       +
       -- +goose StatementEnd

     

       193
       193
       +
       

     

       194
       194
       +
       CREATE TRIGGER trigger_update_aggregator_posts_count

     

       195
       195
       +
           AFTER INSERT OR DELETE ON aggregator_posts

     

       196
       196
       +
           FOR EACH ROW

     

       197
       197
       +
           EXECUTE FUNCTION update_aggregator_posts_count();

     

       198
       198
       +
       

     

       199
       199
       +
       COMMENT ON FUNCTION update_aggregator_posts_count IS 'Maintains aggregators.posts_created count when posts are tracked';

     

       200
       200
       +
       

     

       201
       201
       +
       

     

       202
       202
       +
       -- +goose Down

     

       203
       203
       +
       -- Drop triggers first

     

       204
       204
       +
       DROP TRIGGER IF EXISTS trigger_update_aggregator_posts_count ON aggregator_posts;

     

       205
       205
       +
       DROP TRIGGER IF EXISTS trigger_update_aggregator_communities_count ON aggregator_authorizations;

     

       206
       206
       +
       

     

       207
       207
       +
       -- Drop functions

     

       208
       208
       +
       DROP FUNCTION IF EXISTS update_aggregator_posts_count();

     

       209
       209
       +
       DROP FUNCTION IF EXISTS update_aggregator_communities_count();

     

       210
       210
       +
       

     

       211
       211
       +
       -- Drop tables in reverse order (respects foreign keys)

     

       212
       212
       +
       DROP TABLE IF EXISTS aggregator_posts CASCADE;

     

       213
       213
       +
       DROP TABLE IF EXISTS aggregator_authorizations CASCADE;

     

       214
       214
       +
       DROP TABLE IF EXISTS aggregators CASCADE;

+136

internal/atproto/jetstream/aggregator_jetstream_connector.go

···

       1
       1
       +
       package jetstream

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"sync"

     

       9
       9
       +
       	"time"

     

       10
       10
       +
       

     

       11
       11
       +
       	"github.com/gorilla/websocket"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // AggregatorJetstreamConnector handles WebSocket connection to Jetstream for aggregator events

     

       15
       15
       +
       type AggregatorJetstreamConnector struct {

     

       16
       16
       +
       	consumer *AggregatorEventConsumer

     

       17
       17
       +
       	wsURL    string

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // NewAggregatorJetstreamConnector creates a new Jetstream WebSocket connector for aggregator events

     

       21
       21
       +
       func NewAggregatorJetstreamConnector(consumer *AggregatorEventConsumer, wsURL string) *AggregatorJetstreamConnector {

     

       22
       22
       +
       	return &AggregatorJetstreamConnector{

     

       23
       23
       +
       		consumer: consumer,

     

       24
       24
       +
       		wsURL:    wsURL,

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // Start begins consuming events from Jetstream

     

       29
       29
       +
       // Runs indefinitely, reconnecting on errors

     

       30
       30
       +
       func (c *AggregatorJetstreamConnector) Start(ctx context.Context) error {

     

       31
       31
       +
       	log.Printf("Starting Jetstream aggregator consumer: %s", c.wsURL)

     

       32
       32
       +
       

     

       33
       33
       +
       	for {

     

       34
       34
       +
       		select {

     

       35
       35
       +
       		case <-ctx.Done():

     

       36
       36
       +
       			log.Println("Jetstream aggregator consumer shutting down")

     

       37
       37
       +
       			return ctx.Err()

     

       38
       38
       +
       		default:

     

       39
       39
       +
       			if err := c.connect(ctx); err != nil {

     

       40
       40
       +
       				log.Printf("Jetstream aggregator connection error: %v. Retrying in 5s...", err)

     

       41
       41
       +
       				time.Sleep(5 * time.Second)

     

       42
       42
       +
       				continue

     

       43
       43
       +
       			}

     

       44
       44
       +
       		}

     

       45
       45
       +
       	}

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       // connect establishes WebSocket connection and processes events

     

       49
       49
       +
       func (c *AggregatorJetstreamConnector) connect(ctx context.Context) error {

     

       50
       50
       +
       	conn, _, err := websocket.DefaultDialer.DialContext(ctx, c.wsURL, nil)

     

       51
       51
       +
       	if err != nil {

     

       52
       52
       +
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       53
       53
       +
       	}

     

       54
       54
       +
       	defer func() {

     

       55
       55
       +
       		if closeErr := conn.Close(); closeErr != nil {

     

       56
       56
       +
       			log.Printf("Failed to close WebSocket connection: %v", closeErr)

     

       57
       57
       +
       		}

     

       58
       58
       +
       	}()

     

       59
       59
       +
       

     

       60
       60
       +
       	log.Println("Connected to Jetstream (aggregator consumer)")

     

       61
       61
       +
       

     

       62
       62
       +
       	// Set read deadline to detect connection issues

     

       63
       63
       +
       	if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       64
       64
       +
       		log.Printf("Failed to set read deadline: %v", err)

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	// Set pong handler to keep connection alive

     

       68
       68
       +
       	conn.SetPongHandler(func(string) error {

     

       69
       69
       +
       		if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       70
       70
       +
       			log.Printf("Failed to set read deadline in pong handler: %v", err)

     

       71
       71
       +
       		}

     

       72
       72
       +
       		return nil

     

       73
       73
       +
       	})

     

       74
       74
       +
       

     

       75
       75
       +
       	// Start ping ticker

     

       76
       76
       +
       	ticker := time.NewTicker(30 * time.Second)

     

       77
       77
       +
       	defer ticker.Stop()

     

       78
       78
       +
       

     

       79
       79
       +
       	done := make(chan struct{})

     

       80
       80
       +
       	var closeOnce sync.Once // Ensure done channel is only closed once

     

       81
       81
       +
       

     

       82
       82
       +
       	// Goroutine to send pings

     

       83
       83
       +
       	go func() {

     

       84
       84
       +
       		for {

     

       85
       85
       +
       			select {

     

       86
       86
       +
       			case <-ticker.C:

     

       87
       87
       +
       				if err := conn.WriteMessage(websocket.PingMessage, nil); err != nil {

     

       88
       88
       +
       					log.Printf("Ping error: %v", err)

     

       89
       89
       +
       					closeOnce.Do(func() { close(done) })

     

       90
       90
       +
       					return

     

       91
       91
       +
       				}

     

       92
       92
       +
       			case <-done:

     

       93
       93
       +
       				return

     

       94
       94
       +
       			case <-ctx.Done():

     

       95
       95
       +
       				return

     

       96
       96
       +
       			}

     

       97
       97
       +
       		}

     

       98
       98
       +
       	}()

     

       99
       99
       +
       

     

       100
       100
       +
       	// Read messages

     

       101
       101
       +
       	for {

     

       102
       102
       +
       		select {

     

       103
       103
       +
       		case <-ctx.Done():

     

       104
       104
       +
       			return ctx.Err()

     

       105
       105
       +
       		case <-done:

     

       106
       106
       +
       			return fmt.Errorf("connection closed")

     

       107
       107
       +
       		default:

     

       108
       108
       +
       			_, message, err := conn.ReadMessage()

     

       109
       109
       +
       			if err != nil {

     

       110
       110
       +
       				closeOnce.Do(func() { close(done) })

     

       111
       111
       +
       				return fmt.Errorf("read error: %w", err)

     

       112
       112
       +
       			}

     

       113
       113
       +
       

     

       114
       114
       +
       			// Reset read deadline on successful read

     

       115
       115
       +
       			if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       116
       116
       +
       				log.Printf("Failed to set read deadline: %v", err)

     

       117
       117
       +
       			}

     

       118
       118
       +
       

     

       119
       119
       +
       			if err := c.handleEvent(ctx, message); err != nil {

     

       120
       120
       +
       				log.Printf("Error handling aggregator event: %v", err)

     

       121
       121
       +
       				// Continue processing other events

     

       122
       122
       +
       			}

     

       123
       123
       +
       		}

     

       124
       124
       +
       	}

     

       125
       125
       +
       }

     

       126
       126
       +
       

     

       127
       127
       +
       // handleEvent processes a single Jetstream event

     

       128
       128
       +
       func (c *AggregatorJetstreamConnector) handleEvent(ctx context.Context, data []byte) error {

     

       129
       129
       +
       	var event JetstreamEvent

     

       130
       130
       +
       	if err := json.Unmarshal(data, &event); err != nil {

     

       131
       131
       +
       		return fmt.Errorf("failed to parse event: %w", err)

     

       132
       132
       +
       	}

     

       133
       133
       +
       

     

       134
       134
       +
       	// Pass to consumer's HandleEvent method

     

       135
       135
       +
       	return c.consumer.HandleEvent(ctx, &event)

     

       136
       136
       +
       }

+41

aggregators/kagi-news/.gitignore

···

       1
       1
       +
       # Environment and config

     

       2
       2
       +
       .env

     

       3
       3
       +
       config.yaml

     

       4
       4
       +
       venv/

     

       5
       5
       +
       

     

       6
       6
       +
       # State files

     

       7
       7
       +
       data/*.json

     

       8
       8
       +
       data/world.xml

     

       9
       9
       +
       

     

       10
       10
       +
       # Python

     

       11
       11
       +
       __pycache__/

     

       12
       12
       +
       *.py[cod]

     

       13
       13
       +
       *$py.class

     

       14
       14
       +
       *.so

     

       15
       15
       +
       .Python

     

       16
       16
       +
       build/

     

       17
       17
       +
       develop-eggs/

     

       18
       18
       +
       dist/

     

       19
       19
       +
       downloads/

     

       20
       20
       +
       eggs/

     

       21
       21
       +
       .eggs/

     

       22
       22
       +
       lib/

     

       23
       23
       +
       lib64/

     

       24
       24
       +
       parts/

     

       25
       25
       +
       sdist/

     

       26
       26
       +
       var/

     

       27
       27
       +
       wheels/

     

       28
       28
       +
       *.egg-info/

     

       29
       29
       +
       .installed.cfg

     

       30
       30
       +
       *.egg

     

       31
       31
       +
       

     

       32
       32
       +
       # Testing

     

       33
       33
       +
       .pytest_cache/

     

       34
       34
       +
       .coverage

     

       35
       35
       +
       htmlcov/

     

       36
       36
       +
       

     

       37
       37
       +
       # IDE

     

       38
       38
       +
       .vscode/

     

       39
       39
       +
       .idea/

     

       40
       40
       +
       *.swp

     

       41
       41
       +
       *.swo

+3

aggregators/kagi-news/src/__init__.py

···

       1
       1
       +
       """Kagi News RSS Aggregator for Coves."""

     

       2
       2
       +
       

     

       3
       3
       +
       __version__ = "0.1.0"

+165

aggregators/kagi-news/src/config.py

···

       1
       1
       +
       """

     

       2
       2
       +
       Configuration Loader for Kagi News Aggregator.

     

       3
       3
       +
       

     

       4
       4
       +
       Loads and validates configuration from YAML files.

     

       5
       5
       +
       """

     

       6
       6
       +
       import os

     

       7
       7
       +
       import logging

     

       8
       8
       +
       from pathlib import Path

     

       9
       9
       +
       from typing import Dict, Any

     

       10
       10
       +
       import yaml

     

       11
       11
       +
       from urllib.parse import urlparse

     

       12
       12
       +
       

     

       13
       13
       +
       from src.models import AggregatorConfig, FeedConfig

     

       14
       14
       +
       

     

       15
       15
       +
       logger = logging.getLogger(__name__)

     

       16
       16
       +
       

     

       17
       17
       +
       

     

       18
       18
       +
       class ConfigError(Exception):

     

       19
       19
       +
           """Configuration error."""

     

       20
       20
       +
           pass

     

       21
       21
       +
       

     

       22
       22
       +
       

     

       23
       23
       +
       class ConfigLoader:

     

       24
       24
       +
           """

     

       25
       25
       +
           Loads and validates aggregator configuration.

     

       26
       26
       +
       

     

       27
       27
       +
           Supports:

     

       28
       28
       +
           - Loading from YAML file

     

       29
       29
       +
           - Environment variable overrides

     

       30
       30
       +
           - Validation of required fields

     

       31
       31
       +
           - URL validation

     

       32
       32
       +
           """

     

       33
       33
       +
       

     

       34
       34
       +
           def __init__(self, config_path: Path):

     

       35
       35
       +
               """

     

       36
       36
       +
               Initialize config loader.

     

       37
       37
       +
       

     

       38
       38
       +
               Args:

     

       39
       39
       +
                   config_path: Path to config.yaml file

     

       40
       40
       +
               """

     

       41
       41
       +
               self.config_path = Path(config_path)

     

       42
       42
       +
       

     

       43
       43
       +
           def load(self) -> AggregatorConfig:

     

       44
       44
       +
               """

     

       45
       45
       +
               Load and validate configuration.

     

       46
       46
       +
       

     

       47
       47
       +
               Returns:

     

       48
       48
       +
                   AggregatorConfig object

     

       49
       49
       +
       

     

       50
       50
       +
               Raises:

     

       51
       51
       +
                   ConfigError: If config is invalid or missing

     

       52
       52
       +
               """

     

       53
       53
       +
               # Check file exists

     

       54
       54
       +
               if not self.config_path.exists():

     

       55
       55
       +
                   raise ConfigError(f"Configuration file not found: {self.config_path}")

     

       56
       56
       +
       

     

       57
       57
       +
               # Load YAML

     

       58
       58
       +
               try:

     

       59
       59
       +
                   with open(self.config_path, 'r') as f:

     

       60
       60
       +
                       config_data = yaml.safe_load(f)

     

       61
       61
       +
               except yaml.YAMLError as e:

     

       62
       62
       +
                   raise ConfigError(f"Failed to parse YAML: {e}")

     

       63
       63
       +
       

     

       64
       64
       +
               if not config_data:

     

       65
       65
       +
                   raise ConfigError("Configuration file is empty")

     

       66
       66
       +
       

     

       67
       67
       +
               # Validate and parse

     

       68
       68
       +
               try:

     

       69
       69
       +
                   return self._parse_config(config_data)

     

       70
       70
       +
               except Exception as e:

     

       71
       71
       +
                   raise ConfigError(f"Invalid configuration: {e}")

     

       72
       72
       +
       

     

       73
       73
       +
           def _parse_config(self, data: Dict[str, Any]) -> AggregatorConfig:

     

       74
       74
       +
               """

     

       75
       75
       +
               Parse and validate configuration data.

     

       76
       76
       +
       

     

       77
       77
       +
               Args:

     

       78
       78
       +
                   data: Parsed YAML data

     

       79
       79
       +
       

     

       80
       80
       +
               Returns:

     

       81
       81
       +
                   AggregatorConfig object

     

       82
       82
       +
       

     

       83
       83
       +
               Raises:

     

       84
       84
       +
                   ConfigError: If validation fails

     

       85
       85
       +
               """

     

       86
       86
       +
               # Get coves_api_url (with env override)

     

       87
       87
       +
               coves_api_url = os.getenv('COVES_API_URL', data.get('coves_api_url'))

     

       88
       88
       +
               if not coves_api_url:

     

       89
       89
       +
                   raise ConfigError("Missing required field: coves_api_url")

     

       90
       90
       +
       

     

       91
       91
       +
               # Validate URL

     

       92
       92
       +
               if not self._is_valid_url(coves_api_url):

     

       93
       93
       +
                   raise ConfigError(f"Invalid URL for coves_api_url: {coves_api_url}")

     

       94
       94
       +
       

     

       95
       95
       +
               # Get log level (default to info)

     

       96
       96
       +
               log_level = data.get('log_level', 'info')

     

       97
       97
       +
       

     

       98
       98
       +
               # Parse feeds

     

       99
       99
       +
               feeds_data = data.get('feeds', [])

     

       100
       100
       +
               if not feeds_data:

     

       101
       101
       +
                   raise ConfigError("Configuration must include at least one feed")

     

       102
       102
       +
       

     

       103
       103
       +
               feeds = []

     

       104
       104
       +
               for feed_data in feeds_data:

     

       105
       105
       +
                   feed = self._parse_feed(feed_data)

     

       106
       106
       +
                   feeds.append(feed)

     

       107
       107
       +
       

     

       108
       108
       +
               logger.info(f"Loaded configuration with {len(feeds)} feeds ({sum(1 for f in feeds if f.enabled)} enabled)")

     

       109
       109
       +
       

     

       110
       110
       +
               return AggregatorConfig(

     

       111
       111
       +
                   coves_api_url=coves_api_url,

     

       112
       112
       +
                   feeds=feeds,

     

       113
       113
       +
                   log_level=log_level

     

       114
       114
       +
               )

     

       115
       115
       +
       

     

       116
       116
       +
           def _parse_feed(self, data: Dict[str, Any]) -> FeedConfig:

     

       117
       117
       +
               """

     

       118
       118
       +
               Parse and validate a single feed configuration.

     

       119
       119
       +
       

     

       120
       120
       +
               Args:

     

       121
       121
       +
                   data: Feed configuration data

     

       122
       122
       +
       

     

       123
       123
       +
               Returns:

     

       124
       124
       +
                   FeedConfig object

     

       125
       125
       +
       

     

       126
       126
       +
               Raises:

     

       127
       127
       +
                   ConfigError: If validation fails

     

       128
       128
       +
               """

     

       129
       129
       +
               # Required fields

     

       130
       130
       +
               required_fields = ['name', 'url', 'community_handle']

     

       131
       131
       +
               for field in required_fields:

     

       132
       132
       +
                   if field not in data:

     

       133
       133
       +
                       raise ConfigError(f"Missing required field in feed config: {field}")

     

       134
       134
       +
       

     

       135
       135
       +
               name = data['name']

     

       136
       136
       +
               url = data['url']

     

       137
       137
       +
               community_handle = data['community_handle']

     

       138
       138
       +
               enabled = data.get('enabled', True)  # Default to True

     

       139
       139
       +
       

     

       140
       140
       +
               # Validate URL

     

       141
       141
       +
               if not self._is_valid_url(url):

     

       142
       142
       +
                   raise ConfigError(f"Invalid URL for feed '{name}': {url}")

     

       143
       143
       +
       

     

       144
       144
       +
               return FeedConfig(

     

       145
       145
       +
                   name=name,

     

       146
       146
       +
                   url=url,

     

       147
       147
       +
                   community_handle=community_handle,

     

       148
       148
       +
                   enabled=enabled

     

       149
       149
       +
               )

     

       150
       150
       +
       

     

       151
       151
       +
           def _is_valid_url(self, url: str) -> bool:

     

       152
       152
       +
               """

     

       153
       153
       +
               Validate URL format.

     

       154
       154
       +
       

     

       155
       155
       +
               Args:

     

       156
       156
       +
                   url: URL to validate

     

       157
       157
       +
       

     

       158
       158
       +
               Returns:

     

       159
       159
       +
                   True if valid, False otherwise

     

       160
       160
       +
               """

     

       161
       161
       +
               try:

     

       162
       162
       +
                   result = urlparse(url)

     

       163
       163
       +
                   return all([result.scheme, result.netloc])

     

       164
       164
       +
               except Exception:

     

       165
       165
       +
                   return False

+71

aggregators/kagi-news/src/rss_fetcher.py

···

       1
       1
       +
       """

     

       2
       2
       +
       RSS feed fetcher with retry logic and error handling.

     

       3
       3
       +
       """

     

       4
       4
       +
       import time

     

       5
       5
       +
       import logging

     

       6
       6
       +
       import requests

     

       7
       7
       +
       import feedparser

     

       8
       8
       +
       from typing import Optional

     

       9
       9
       +
       

     

       10
       10
       +
       logger = logging.getLogger(__name__)

     

       11
       11
       +
       

     

       12
       12
       +
       

     

       13
       13
       +
       class RSSFetcher:

     

       14
       14
       +
           """Fetches RSS feeds with retry logic."""

     

       15
       15
       +
       

     

       16
       16
       +
           def __init__(self, timeout: int = 30, max_retries: int = 3):

     

       17
       17
       +
               """

     

       18
       18
       +
               Initialize RSS fetcher.

     

       19
       19
       +
       

     

       20
       20
       +
               Args:

     

       21
       21
       +
                   timeout: Request timeout in seconds

     

       22
       22
       +
                   max_retries: Maximum number of retry attempts

     

       23
       23
       +
               """

     

       24
       24
       +
               self.timeout = timeout

     

       25
       25
       +
               self.max_retries = max_retries

     

       26
       26
       +
       

     

       27
       27
       +
           def fetch_feed(self, url: str) -> feedparser.FeedParserDict:

     

       28
       28
       +
               """

     

       29
       29
       +
               Fetch and parse an RSS feed.

     

       30
       30
       +
       

     

       31
       31
       +
               Args:

     

       32
       32
       +
                   url: RSS feed URL

     

       33
       33
       +
       

     

       34
       34
       +
               Returns:

     

       35
       35
       +
                   Parsed feed object

     

       36
       36
       +
       

     

       37
       37
       +
               Raises:

     

       38
       38
       +
                   ValueError: If URL is empty

     

       39
       39
       +
                   requests.RequestException: If all retry attempts fail

     

       40
       40
       +
               """

     

       41
       41
       +
               if not url:

     

       42
       42
       +
                   raise ValueError("URL cannot be empty")

     

       43
       43
       +
       

     

       44
       44
       +
               last_error = None

     

       45
       45
       +
       

     

       46
       46
       +
               for attempt in range(self.max_retries):

     

       47
       47
       +
                   try:

     

       48
       48
       +
                       logger.info(f"Fetching feed from {url} (attempt {attempt + 1}/{self.max_retries})")

     

       49
       49
       +
       

     

       50
       50
       +
                       response = requests.get(url, timeout=self.timeout)

     

       51
       51
       +
                       response.raise_for_status()

     

       52
       52
       +
       

     

       53
       53
       +
                       # Parse with feedparser

     

       54
       54
       +
                       feed = feedparser.parse(response.content)

     

       55
       55
       +
       

     

       56
       56
       +
                       logger.info(f"Successfully fetched feed: {feed.feed.get('title', 'Unknown')}")

     

       57
       57
       +
                       return feed

     

       58
       58
       +
       

     

       59
       59
       +
                   except requests.RequestException as e:

     

       60
       60
       +
                       last_error = e

     

       61
       61
       +
                       logger.warning(f"Fetch attempt {attempt + 1} failed: {e}")

     

       62
       62
       +
       

     

       63
       63
       +
                       if attempt < self.max_retries - 1:

     

       64
       64
       +
                           # Exponential backoff

     

       65
       65
       +
                           sleep_time = 2 ** attempt

     

       66
       66
       +
                           logger.info(f"Retrying in {sleep_time} seconds...")

     

       67
       67
       +
                           time.sleep(sleep_time)

     

       68
       68
       +
       

     

       69
       69
       +
               # All retries exhausted

     

       70
       70
       +
               logger.error(f"Failed to fetch feed after {self.max_retries} attempts")

     

       71
       71
       +
               raise last_error

+213

aggregators/kagi-news/src/state_manager.py

···

       1
       1
       +
       """

     

       2
       2
       +
       State Manager for tracking posted stories.

     

       3
       3
       +
       

     

       4
       4
       +
       Handles deduplication by tracking which stories have already been posted.

     

       5
       5
       +
       Uses JSON file for persistence.

     

       6
       6
       +
       """

     

       7
       7
       +
       import json

     

       8
       8
       +
       import logging

     

       9
       9
       +
       from pathlib import Path

     

       10
       10
       +
       from datetime import datetime, timedelta

     

       11
       11
       +
       from typing import Optional, Dict, List

     

       12
       12
       +
       

     

       13
       13
       +
       logger = logging.getLogger(__name__)

     

       14
       14
       +
       

     

       15
       15
       +
       

     

       16
       16
       +
       class StateManager:

     

       17
       17
       +
           """

     

       18
       18
       +
           Manages aggregator state for deduplication.

     

       19
       19
       +
       

     

       20
       20
       +
           Tracks:

     

       21
       21
       +
           - Posted GUIDs per feed (with timestamps)

     

       22
       22
       +
           - Last successful run timestamp per feed

     

       23
       23
       +
           - Automatic cleanup of old entries

     

       24
       24
       +
           """

     

       25
       25
       +
       

     

       26
       26
       +
           def __init__(self, state_file: Path, max_guids_per_feed: int = 100, max_age_days: int = 30):

     

       27
       27
       +
               """

     

       28
       28
       +
               Initialize state manager.

     

       29
       29
       +
       

     

       30
       30
       +
               Args:

     

       31
       31
       +
                   state_file: Path to JSON state file

     

       32
       32
       +
                   max_guids_per_feed: Maximum GUIDs to keep per feed (default: 100)

     

       33
       33
       +
                   max_age_days: Maximum age in days for GUIDs (default: 30)

     

       34
       34
       +
               """

     

       35
       35
       +
               self.state_file = Path(state_file)

     

       36
       36
       +
               self.max_guids_per_feed = max_guids_per_feed

     

       37
       37
       +
               self.max_age_days = max_age_days

     

       38
       38
       +
               self.state = self._load_state()

     

       39
       39
       +
       

     

       40
       40
       +
           def _load_state(self) -> Dict:

     

       41
       41
       +
               """Load state from file, or create new state if file doesn't exist."""

     

       42
       42
       +
               if not self.state_file.exists():

     

       43
       43
       +
                   logger.info(f"Creating new state file at {self.state_file}")

     

       44
       44
       +
                   state = {'feeds': {}}

     

       45
       45
       +
                   self._save_state(state)

     

       46
       46
       +
                   return state

     

       47
       47
       +
       

     

       48
       48
       +
               try:

     

       49
       49
       +
                   with open(self.state_file, 'r') as f:

     

       50
       50
       +
                       state = json.load(f)

     

       51
       51
       +
                       logger.info(f"Loaded state from {self.state_file}")

     

       52
       52
       +
                       return state

     

       53
       53
       +
               except json.JSONDecodeError as e:

     

       54
       54
       +
                   logger.error(f"Failed to load state file: {e}. Creating new state.")

     

       55
       55
       +
                   state = {'feeds': {}}

     

       56
       56
       +
                   self._save_state(state)

     

       57
       57
       +
                   return state

     

       58
       58
       +
       

     

       59
       59
       +
           def _save_state(self, state: Optional[Dict] = None):

     

       60
       60
       +
               """Save state to file."""

     

       61
       61
       +
               if state is None:

     

       62
       62
       +
                   state = self.state

     

       63
       63
       +
       

     

       64
       64
       +
               # Ensure parent directory exists

     

       65
       65
       +
               self.state_file.parent.mkdir(parents=True, exist_ok=True)

     

       66
       66
       +
       

     

       67
       67
       +
               with open(self.state_file, 'w') as f:

     

       68
       68
       +
                   json.dump(state, f, indent=2)

     

       69
       69
       +
       

     

       70
       70
       +
           def _ensure_feed_exists(self, feed_url: str):

     

       71
       71
       +
               """Ensure feed entry exists in state."""

     

       72
       72
       +
               if feed_url not in self.state['feeds']:

     

       73
       73
       +
                   self.state['feeds'][feed_url] = {

     

       74
       74
       +
                       'posted_guids': [],

     

       75
       75
       +
                       'last_successful_run': None

     

       76
       76
       +
                   }

     

       77
       77
       +
       

     

       78
       78
       +
           def is_posted(self, feed_url: str, guid: str) -> bool:

     

       79
       79
       +
               """

     

       80
       80
       +
               Check if a story has already been posted.

     

       81
       81
       +
       

     

       82
       82
       +
               Args:

     

       83
       83
       +
                   feed_url: RSS feed URL

     

       84
       84
       +
                   guid: Story GUID

     

       85
       85
       +
       

     

       86
       86
       +
               Returns:

     

       87
       87
       +
                   True if already posted, False otherwise

     

       88
       88
       +
               """

     

       89
       89
       +
               self._ensure_feed_exists(feed_url)

     

       90
       90
       +
       

     

       91
       91
       +
               posted_guids = self.state['feeds'][feed_url]['posted_guids']

     

       92
       92
       +
               return any(entry['guid'] == guid for entry in posted_guids)

     

       93
       93
       +
       

     

       94
       94
       +
           def mark_posted(self, feed_url: str, guid: str, post_uri: str):

     

       95
       95
       +
               """

     

       96
       96
       +
               Mark a story as posted.

     

       97
       97
       +
       

     

       98
       98
       +
               Args:

     

       99
       99
       +
                   feed_url: RSS feed URL

     

       100
       100
       +
                   guid: Story GUID

     

       101
       101
       +
                   post_uri: AT Proto URI of created post

     

       102
       102
       +
               """

     

       103
       103
       +
               self._ensure_feed_exists(feed_url)

     

       104
       104
       +
       

     

       105
       105
       +
               # Add to posted list

     

       106
       106
       +
               entry = {

     

       107
       107
       +
                   'guid': guid,

     

       108
       108
       +
                   'post_uri': post_uri,

     

       109
       109
       +
                   'posted_at': datetime.now().isoformat()

     

       110
       110
       +
               }

     

       111
       111
       +
               self.state['feeds'][feed_url]['posted_guids'].append(entry)

     

       112
       112
       +
       

     

       113
       113
       +
               # Auto-cleanup to keep state file manageable

     

       114
       114
       +
               self.cleanup_old_entries(feed_url)

     

       115
       115
       +
       

     

       116
       116
       +
               # Save state

     

       117
       117
       +
               self._save_state()

     

       118
       118
       +
       

     

       119
       119
       +
               logger.info(f"Marked as posted: {guid} -> {post_uri}")

     

       120
       120
       +
       

     

       121
       121
       +
           def get_last_run(self, feed_url: str) -> Optional[datetime]:

     

       122
       122
       +
               """

     

       123
       123
       +
               Get last successful run timestamp for a feed.

     

       124
       124
       +
       

     

       125
       125
       +
               Args:

     

       126
       126
       +
                   feed_url: RSS feed URL

     

       127
       127
       +
       

     

       128
       128
       +
               Returns:

     

       129
       129
       +
                   Datetime of last run, or None if never run

     

       130
       130
       +
               """

     

       131
       131
       +
               self._ensure_feed_exists(feed_url)

     

       132
       132
       +
       

     

       133
       133
       +
               timestamp_str = self.state['feeds'][feed_url]['last_successful_run']

     

       134
       134
       +
               if timestamp_str is None:

     

       135
       135
       +
                   return None

     

       136
       136
       +
       

     

       137
       137
       +
               return datetime.fromisoformat(timestamp_str)

     

       138
       138
       +
       

     

       139
       139
       +
           def update_last_run(self, feed_url: str, timestamp: datetime):

     

       140
       140
       +
               """

     

       141
       141
       +
               Update last successful run timestamp.

     

       142
       142
       +
       

     

       143
       143
       +
               Args:

     

       144
       144
       +
                   feed_url: RSS feed URL

     

       145
       145
       +
                   timestamp: Timestamp of successful run

     

       146
       146
       +
               """

     

       147
       147
       +
               self._ensure_feed_exists(feed_url)

     

       148
       148
       +
       

     

       149
       149
       +
               self.state['feeds'][feed_url]['last_successful_run'] = timestamp.isoformat()

     

       150
       150
       +
               self._save_state()

     

       151
       151
       +
       

     

       152
       152
       +
               logger.info(f"Updated last run for {feed_url}: {timestamp}")

     

       153
       153
       +
       

     

       154
       154
       +
           def cleanup_old_entries(self, feed_url: str):

     

       155
       155
       +
               """

     

       156
       156
       +
               Remove old entries from state.

     

       157
       157
       +
       

     

       158
       158
       +
               Removes entries that are:

     

       159
       159
       +
               - Older than max_age_days

     

       160
       160
       +
               - Beyond max_guids_per_feed limit (keeps most recent)

     

       161
       161
       +
       

     

       162
       162
       +
               Args:

     

       163
       163
       +
                   feed_url: RSS feed URL

     

       164
       164
       +
               """

     

       165
       165
       +
               self._ensure_feed_exists(feed_url)

     

       166
       166
       +
       

     

       167
       167
       +
               posted_guids = self.state['feeds'][feed_url]['posted_guids']

     

       168
       168
       +
       

     

       169
       169
       +
               # Filter out entries older than max_age_days

     

       170
       170
       +
               cutoff_date = datetime.now() - timedelta(days=self.max_age_days)

     

       171
       171
       +
               filtered = [

     

       172
       172
       +
                   entry for entry in posted_guids

     

       173
       173
       +
                   if datetime.fromisoformat(entry['posted_at']) > cutoff_date

     

       174
       174
       +
               ]

     

       175
       175
       +
       

     

       176
       176
       +
               # Keep only most recent max_guids_per_feed entries

     

       177
       177
       +
               # Sort by posted_at (most recent first)

     

       178
       178
       +
               filtered.sort(key=lambda x: x['posted_at'], reverse=True)

     

       179
       179
       +
               filtered = filtered[:self.max_guids_per_feed]

     

       180
       180
       +
       

     

       181
       181
       +
               # Update state

     

       182
       182
       +
               old_count = len(posted_guids)

     

       183
       183
       +
               new_count = len(filtered)

     

       184
       184
       +
               self.state['feeds'][feed_url]['posted_guids'] = filtered

     

       185
       185
       +
       

     

       186
       186
       +
               if old_count != new_count:

     

       187
       187
       +
                   logger.info(f"Cleaned up {old_count - new_count} old entries for {feed_url}")

     

       188
       188
       +
       

     

       189
       189
       +
           def get_posted_count(self, feed_url: str) -> int:

     

       190
       190
       +
               """

     

       191
       191
       +
               Get count of posted items for a feed.

     

       192
       192
       +
       

     

       193
       193
       +
               Args:

     

       194
       194
       +
                   feed_url: RSS feed URL

     

       195
       195
       +
       

     

       196
       196
       +
               Returns:

     

       197
       197
       +
                   Number of posted items

     

       198
       198
       +
               """

     

       199
       199
       +
               self._ensure_feed_exists(feed_url)

     

       200
       200
       +
               return len(self.state['feeds'][feed_url]['posted_guids'])

     

       201
       201
       +
       

     

       202
       202
       +
           def get_all_posted_guids(self, feed_url: str) -> List[str]:

     

       203
       203
       +
               """

     

       204
       204
       +
               Get all posted GUIDs for a feed.

     

       205
       205
       +
       

     

       206
       206
       +
               Args:

     

       207
       207
       +
                   feed_url: RSS feed URL

     

       208
       208
       +
       

     

       209
       209
       +
               Returns:

     

       210
       210
       +
                   List of GUIDs

     

       211
       211
       +
               """

     

       212
       212
       +
               self._ensure_feed_exists(feed_url)

     

       213
       213
       +
               return [entry['guid'] for entry in self.state['feeds'][feed_url]['posted_guids']]

+1

aggregators/kagi-news/tests/__init__.py

···

       1
       1
       +
       """Test suite for Kagi News aggregator."""

+12

aggregators/kagi-news/tests/fixtures/sample_rss_item.xml

···

       1
       1
       +
       <?xml version='1.0' encoding='UTF-8'?>

     

       2
       2
       +
       <!-- Sample RSS item from Kagi News - includes quote, highlights, perspectives, sources -->

     

       3
       3
       +
       <item>

     

       4
       4
       +
         <title>Trump to meet Xi in South Korea on Oct 30</title>

     

       5
       5
       +
         <link>https://kite.kagi.com/96cf948f-8a1b-4281-9ba4-8a9e1ad7b3c6/world/10</link>

     

       6
       6
       +
         <description>&lt;p&gt;The White House confirmed President Trump will hold a bilateral meeting with Chinese President Xi Jinping in South Korea on October 30, at the end of an Asia trip that includes Malaysia and Japan . The administration said the meeting will take place Thursday morning local time, and Mr Trump indicated his first question to Xi would concern fentanyl and other bilateral issues . The talks come amid heightened trade tensions after Beijing expanded export curbs on rare-earth minerals and following Mr Trump's recent threat of additional tariffs on Chinese goods, making the meeting a focal point for discussions on trade, technology supply chains and energy .&lt;/p&gt;&lt;img src='https://kagiproxy.com/img/Q2SRXQtwTYBIiQeI0FG-X6taF_wHSJaXDiFUzju2kbCWGuOYIFUX--8L0BqE4VKxpbOJY3ylFPJkDpfSnyQYZ1qdOLXbphHTnsOK4jb7gqC4KCn5nf3ANbWCuaFD5ZUSijiK0k7wOLP2fyX6tynu2mPtXlCbotLo2lTrEswZl4-No2AI4mI4lkResfnRdp-YjpoEfCOHkNfbN1-0cNcHt9T2dmgBSXrQ2w' alt='News image associated with coverage of President Trump&amp;#x27;s Asia trip and planned meeting with President Xi' /&gt;&lt;br /&gt;&lt;h3&gt;Highlights:&lt;/h3&gt;&lt;ul&gt;&lt;li&gt;Itinerary details: The Asia swing begins in Malaysia, continues to Japan and ends with the bilateral meeting in South Korea on Thursday morning local time, White House press secretary Karoline Leavitt said at a briefing .&lt;/li&gt;&lt;li&gt;APEC context: US officials indicated the leaders will meet on the sidelines of the Asia-Pacific Economic Cooperation gathering, shaping expectations for short, high-level talks rather than a lengthy summit .&lt;/li&gt;&lt;li&gt;Tariff escalation: President Trump recently threatened an additional 100% tariff on Chinese goods starting in November, a step he has described as unsustainable but that has heightened urgency for talks .&lt;/li&gt;&lt;li&gt;Rare-earth impact: Beijing's expanded curbs on rare-earth exports have exposed supply vulnerabilities because US high-tech firms rely heavily on those materials, raising strategic and economic stakes for the meeting .&lt;/li&gt;&lt;/ul&gt;&lt;blockquote&gt;Work out a lot of our doubts and questions - President Trump&lt;/blockquote&gt;&lt;h3&gt;Perspectives:&lt;/h3&gt;&lt;ul&gt;&lt;li&gt;President Trump: He said his first question to President Xi would be about fentanyl and indicated he hoped to resolve bilateral doubts and questions in the talks. (&lt;a href='https://www.straitstimes.com/world/united-states/trump-to-meet-xi-in-south-korea-on-oct-30-as-part-of-asia-swing'&gt;The Straits Times&lt;/a&gt;)&lt;/li&gt;&lt;li&gt;White House (press secretary): Karoline Leavitt confirmed the bilateral meeting will occur Thursday morning local time during a White House briefing. (&lt;a href='https://www.scmp.com/news/us/diplomacy/article/3330131/donald-trump-meet-chinas-xi-jinping-next-thursday-south-korea-crunch-talks'&gt;South China Morning Post&lt;/a&gt;)&lt;/li&gt;&lt;li&gt;Beijing/Chinese authorities: Officials have defended tighter export controls on rare-earths, a move described in reporting as not explicitly targeting the US though it has raised tensions. (&lt;a href='https://www.rt.com/news/626890-white-house-announces-trump-xi-meeting/'&gt;RT&lt;/a&gt;)&lt;/li&gt;&lt;/ul&gt;&lt;h3&gt;Sources:&lt;/h3&gt;&lt;ul&gt;&lt;li&gt;&lt;a href='https://www.straitstimes.com/world/united-states/trump-to-meet-xi-in-south-korea-on-oct-30-as-part-of-asia-swing'&gt;Trump to meet Xi in South Korea on Oct 30 as part of Asia swing&lt;/a&gt; - straitstimes.com&lt;/li&gt;&lt;li&gt;&lt;a href='https://www.scmp.com/news/us/diplomacy/article/3330131/donald-trump-meet-chinas-xi-jinping-next-thursday-south-korea-crunch-talks'&gt;Trump to meet Xi in South Korea next Thursday as part of key Asia trip&lt;/a&gt; - scmp.com&lt;/li&gt;&lt;li&gt;&lt;a href='https://www.rt.com/news/626890-white-house-announces-trump-xi-meeting/'&gt;White House announces Trump-Xi meeting&lt;/a&gt; - rt.com&lt;/li&gt;&lt;li&gt;&lt;a href='https://www.thehindu.com/news/international/trump-to-meet-xi-in-south-korea-as-part-of-asia-swing/article70195667.ece'&gt;Trump to meet Xi in South Korea as part of Asia swing&lt;/a&gt; - thehindu.com&lt;/li&gt;&lt;li&gt;&lt;a href='https://www.aljazeera.com/news/2025/10/24/white-house-confirms-trump-to-meet-xi-in-south-korea-as-part-of-asia-tour'&gt;White House confirms Trump to meet Xi in South Korea as part of Asia tour&lt;/a&gt; - aljazeera.com&lt;/li&gt;&lt;/ul&gt;</description>

     

       7
       7
       +
         <guid isPermaLink="true">https://kite.kagi.com/96cf948f-8a1b-4281-9ba4-8a9e1ad7b3c6/world/10</guid>

     

       8
       8
       +
         <category>World</category>

     

       9
       9
       +
         <category>World/Diplomacy</category>

     

       10
       10
       +
         <category>Diplomacy</category>

     

       11
       11
       +
         <pubDate>Thu, 23 Oct 2025 20:56:00 +0000</pubDate>

     

       12
       12
       +
       </item>

+246

aggregators/kagi-news/tests/test_config.py

···

       1
       1
       +
       """

     

       2
       2
       +
       Tests for Configuration Loader.

     

       3
       3
       +
       

     

       4
       4
       +
       Tests loading and validating aggregator configuration.

     

       5
       5
       +
       """

     

       6
       6
       +
       import pytest

     

       7
       7
       +
       import tempfile

     

       8
       8
       +
       from pathlib import Path

     

       9
       9
       +
       

     

       10
       10
       +
       from src.config import ConfigLoader, ConfigError

     

       11
       11
       +
       from src.models import AggregatorConfig, FeedConfig

     

       12
       12
       +
       

     

       13
       13
       +
       

     

       14
       14
       +
       @pytest.fixture

     

       15
       15
       +
       def valid_config_yaml():

     

       16
       16
       +
           """Valid configuration YAML."""

     

       17
       17
       +
           return """

     

       18
       18
       +
       coves_api_url: "https://api.coves.social"

     

       19
       19
       +
       

     

       20
       20
       +
       feeds:

     

       21
       21
       +
         - name: "World News"

     

       22
       22
       +
           url: "https://news.kagi.com/world.xml"

     

       23
       23
       +
           community_handle: "world-news.coves.social"

     

       24
       24
       +
           enabled: true

     

       25
       25
       +
       

     

       26
       26
       +
         - name: "Tech News"

     

       27
       27
       +
           url: "https://news.kagi.com/tech.xml"

     

       28
       28
       +
           community_handle: "tech.coves.social"

     

       29
       29
       +
           enabled: true

     

       30
       30
       +
       

     

       31
       31
       +
         - name: "Science News"

     

       32
       32
       +
           url: "https://news.kagi.com/science.xml"

     

       33
       33
       +
           community_handle: "science.coves.social"

     

       34
       34
       +
           enabled: false

     

       35
       35
       +
       

     

       36
       36
       +
       log_level: "info"

     

       37
       37
       +
       """

     

       38
       38
       +
       

     

       39
       39
       +
       

     

       40
       40
       +
       @pytest.fixture

     

       41
       41
       +
       def temp_config_file(valid_config_yaml):

     

       42
       42
       +
           """Create a temporary config file."""

     

       43
       43
       +
           with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       44
       44
       +
               f.write(valid_config_yaml)

     

       45
       45
       +
               temp_path = Path(f.name)

     

       46
       46
       +
           yield temp_path

     

       47
       47
       +
           # Cleanup

     

       48
       48
       +
           if temp_path.exists():

     

       49
       49
       +
               temp_path.unlink()

     

       50
       50
       +
       

     

       51
       51
       +
       

     

       52
       52
       +
       class TestConfigLoader:

     

       53
       53
       +
           """Test suite for ConfigLoader."""

     

       54
       54
       +
       

     

       55
       55
       +
           def test_load_valid_config(self, temp_config_file):

     

       56
       56
       +
               """Test loading valid configuration."""

     

       57
       57
       +
               loader = ConfigLoader(temp_config_file)

     

       58
       58
       +
               config = loader.load()

     

       59
       59
       +
       

     

       60
       60
       +
               assert isinstance(config, AggregatorConfig)

     

       61
       61
       +
               assert config.coves_api_url == "https://api.coves.social"

     

       62
       62
       +
               assert config.log_level == "info"

     

       63
       63
       +
               assert len(config.feeds) == 3

     

       64
       64
       +
       

     

       65
       65
       +
           def test_parse_feed_configs(self, temp_config_file):

     

       66
       66
       +
               """Test parsing feed configurations."""

     

       67
       67
       +
               loader = ConfigLoader(temp_config_file)

     

       68
       68
       +
               config = loader.load()

     

       69
       69
       +
       

     

       70
       70
       +
               # Check first feed

     

       71
       71
       +
               feed1 = config.feeds[0]

     

       72
       72
       +
               assert isinstance(feed1, FeedConfig)

     

       73
       73
       +
               assert feed1.name == "World News"

     

       74
       74
       +
               assert feed1.url == "https://news.kagi.com/world.xml"

     

       75
       75
       +
               assert feed1.community_handle == "world-news.coves.social"

     

       76
       76
       +
               assert feed1.enabled is True

     

       77
       77
       +
       

     

       78
       78
       +
               # Check disabled feed

     

       79
       79
       +
               feed3 = config.feeds[2]

     

       80
       80
       +
               assert feed3.name == "Science News"

     

       81
       81
       +
               assert feed3.enabled is False

     

       82
       82
       +
       

     

       83
       83
       +
           def test_get_enabled_feeds_only(self, temp_config_file):

     

       84
       84
       +
               """Test getting only enabled feeds."""

     

       85
       85
       +
               loader = ConfigLoader(temp_config_file)

     

       86
       86
       +
               config = loader.load()

     

       87
       87
       +
       

     

       88
       88
       +
               enabled_feeds = [f for f in config.feeds if f.enabled]

     

       89
       89
       +
               assert len(enabled_feeds) == 2

     

       90
       90
       +
               assert all(f.enabled for f in enabled_feeds)

     

       91
       91
       +
       

     

       92
       92
       +
           def test_missing_config_file_raises_error(self):

     

       93
       93
       +
               """Test that missing config file raises error."""

     

       94
       94
       +
               with pytest.raises(ConfigError, match="not found"):

     

       95
       95
       +
                   loader = ConfigLoader(Path("nonexistent.yaml"))

     

       96
       96
       +
                   loader.load()

     

       97
       97
       +
       

     

       98
       98
       +
           def test_invalid_yaml_raises_error(self):

     

       99
       99
       +
               """Test that invalid YAML raises error."""

     

       100
       100
       +
               with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       101
       101
       +
                   f.write("invalid: yaml: content: [[[")

     

       102
       102
       +
                   temp_path = Path(f.name)

     

       103
       103
       +
       

     

       104
       104
       +
               try:

     

       105
       105
       +
                   with pytest.raises(ConfigError, match="Failed to parse"):

     

       106
       106
       +
                       loader = ConfigLoader(temp_path)

     

       107
       107
       +
                       loader.load()

     

       108
       108
       +
               finally:

     

       109
       109
       +
                   temp_path.unlink()

     

       110
       110
       +
       

     

       111
       111
       +
           def test_missing_required_field_raises_error(self):

     

       112
       112
       +
               """Test that missing required fields raise error."""

     

       113
       113
       +
               invalid_yaml = """

     

       114
       114
       +
       feeds:

     

       115
       115
       +
         - name: "Test"

     

       116
       116
       +
           url: "https://test.xml"

     

       117
       117
       +
           # Missing community_handle!

     

       118
       118
       +
       """

     

       119
       119
       +
               with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       120
       120
       +
                   f.write(invalid_yaml)

     

       121
       121
       +
                   temp_path = Path(f.name)

     

       122
       122
       +
       

     

       123
       123
       +
               try:

     

       124
       124
       +
                   with pytest.raises(ConfigError, match="Missing required field"):

     

       125
       125
       +
                       loader = ConfigLoader(temp_path)

     

       126
       126
       +
                       loader.load()

     

       127
       127
       +
               finally:

     

       128
       128
       +
                   temp_path.unlink()

     

       129
       129
       +
       

     

       130
       130
       +
           def test_missing_coves_api_url_raises_error(self):

     

       131
       131
       +
               """Test that missing coves_api_url raises error."""

     

       132
       132
       +
               invalid_yaml = """

     

       133
       133
       +
       feeds:

     

       134
       134
       +
         - name: "Test"

     

       135
       135
       +
           url: "https://test.xml"

     

       136
       136
       +
           community_handle: "test.coves.social"

     

       137
       137
       +
       """

     

       138
       138
       +
               with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       139
       139
       +
                   f.write(invalid_yaml)

     

       140
       140
       +
                   temp_path = Path(f.name)

     

       141
       141
       +
       

     

       142
       142
       +
               try:

     

       143
       143
       +
                   with pytest.raises(ConfigError, match="coves_api_url"):

     

       144
       144
       +
                       loader = ConfigLoader(temp_path)

     

       145
       145
       +
                       loader.load()

     

       146
       146
       +
               finally:

     

       147
       147
       +
                   temp_path.unlink()

     

       148
       148
       +
       

     

       149
       149
       +
           def test_default_log_level(self):

     

       150
       150
       +
               """Test that log_level defaults to 'info' if not specified."""

     

       151
       151
       +
               minimal_yaml = """

     

       152
       152
       +
       coves_api_url: "https://api.coves.social"

     

       153
       153
       +
       feeds:

     

       154
       154
       +
         - name: "Test"

     

       155
       155
       +
           url: "https://test.xml"

     

       156
       156
       +
           community_handle: "test.coves.social"

     

       157
       157
       +
       """

     

       158
       158
       +
               with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       159
       159
       +
                   f.write(minimal_yaml)

     

       160
       160
       +
                   temp_path = Path(f.name)

     

       161
       161
       +
       

     

       162
       162
       +
               try:

     

       163
       163
       +
                   loader = ConfigLoader(temp_path)

     

       164
       164
       +
                   config = loader.load()

     

       165
       165
       +
                   assert config.log_level == "info"

     

       166
       166
       +
               finally:

     

       167
       167
       +
                   temp_path.unlink()

     

       168
       168
       +
       

     

       169
       169
       +
           def test_default_enabled_true(self):

     

       170
       170
       +
               """Test that feed enabled defaults to True if not specified."""

     

       171
       171
       +
               yaml_content = """

     

       172
       172
       +
       coves_api_url: "https://api.coves.social"

     

       173
       173
       +
       feeds:

     

       174
       174
       +
         - name: "Test"

     

       175
       175
       +
           url: "https://test.xml"

     

       176
       176
       +
           community_handle: "test.coves.social"

     

       177
       177
       +
           # No 'enabled' field

     

       178
       178
       +
       """

     

       179
       179
       +
               with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       180
       180
       +
                   f.write(yaml_content)

     

       181
       181
       +
                   temp_path = Path(f.name)

     

       182
       182
       +
       

     

       183
       183
       +
               try:

     

       184
       184
       +
                   loader = ConfigLoader(temp_path)

     

       185
       185
       +
                   config = loader.load()

     

       186
       186
       +
                   assert config.feeds[0].enabled is True

     

       187
       187
       +
               finally:

     

       188
       188
       +
                   temp_path.unlink()

     

       189
       189
       +
       

     

       190
       190
       +
           def test_invalid_url_format_raises_error(self):

     

       191
       191
       +
               """Test that invalid URLs raise error."""

     

       192
       192
       +
               invalid_yaml = """

     

       193
       193
       +
       coves_api_url: "https://api.coves.social"

     

       194
       194
       +
       feeds:

     

       195
       195
       +
         - name: "Test"

     

       196
       196
       +
           url: "not-a-valid-url"

     

       197
       197
       +
           community_handle: "test.coves.social"

     

       198
       198
       +
       """

     

       199
       199
       +
               with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       200
       200
       +
                   f.write(invalid_yaml)

     

       201
       201
       +
                   temp_path = Path(f.name)

     

       202
       202
       +
       

     

       203
       203
       +
               try:

     

       204
       204
       +
                   with pytest.raises(ConfigError, match="Invalid URL"):

     

       205
       205
       +
                       loader = ConfigLoader(temp_path)

     

       206
       206
       +
                       loader.load()

     

       207
       207
       +
               finally:

     

       208
       208
       +
                   temp_path.unlink()

     

       209
       209
       +
       

     

       210
       210
       +
           def test_empty_feeds_list_raises_error(self):

     

       211
       211
       +
               """Test that empty feeds list raises error."""

     

       212
       212
       +
               invalid_yaml = """

     

       213
       213
       +
       coves_api_url: "https://api.coves.social"

     

       214
       214
       +
       feeds: []

     

       215
       215
       +
       """

     

       216
       216
       +
               with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.yaml') as f:

     

       217
       217
       +
                   f.write(invalid_yaml)

     

       218
       218
       +
                   temp_path = Path(f.name)

     

       219
       219
       +
       

     

       220
       220
       +
               try:

     

       221
       221
       +
                   with pytest.raises(ConfigError, match="at least one feed"):

     

       222
       222
       +
                       loader = ConfigLoader(temp_path)

     

       223
       223
       +
                       loader.load()

     

       224
       224
       +
               finally:

     

       225
       225
       +
                   temp_path.unlink()

     

       226
       226
       +
       

     

       227
       227
       +
           def test_load_from_env_override(self, temp_config_file, monkeypatch):

     

       228
       228
       +
               """Test that environment variables can override config values."""

     

       229
       229
       +
               # Set environment variable

     

       230
       230
       +
               monkeypatch.setenv("COVES_API_URL", "https://test.coves.social")

     

       231
       231
       +
       

     

       232
       232
       +
               loader = ConfigLoader(temp_config_file)

     

       233
       233
       +
               config = loader.load()

     

       234
       234
       +
       

     

       235
       235
       +
               # Should use env var instead of config file

     

       236
       236
       +
               assert config.coves_api_url == "https://test.coves.social"

     

       237
       237
       +
       

     

       238
       238
       +
           def test_get_feed_by_url(self, temp_config_file):

     

       239
       239
       +
               """Test helper to get feed config by URL."""

     

       240
       240
       +
               loader = ConfigLoader(temp_config_file)

     

       241
       241
       +
               config = loader.load()

     

       242
       242
       +
       

     

       243
       243
       +
               feed = next((f for f in config.feeds if f.url == "https://news.kagi.com/tech.xml"), None)

     

       244
       244
       +
               assert feed is not None

     

       245
       245
       +
               assert feed.name == "Tech News"

     

       246
       246
       +
               assert feed.community_handle == "tech.coves.social"

+122

aggregators/kagi-news/tests/test_html_parser.py

···

       1
       1
       +
       """

     

       2
       2
       +
       Tests for Kagi HTML description parser.

     

       3
       3
       +
       """

     

       4
       4
       +
       import pytest

     

       5
       5
       +
       from pathlib import Path

     

       6
       6
       +
       from datetime import datetime

     

       7
       7
       +
       import html

     

       8
       8
       +
       

     

       9
       9
       +
       from src.html_parser import KagiHTMLParser

     

       10
       10
       +
       from src.models import KagiStory, Perspective, Quote, Source

     

       11
       11
       +
       

     

       12
       12
       +
       

     

       13
       13
       +
       @pytest.fixture

     

       14
       14
       +
       def sample_html_description():

     

       15
       15
       +
           """Load sample HTML from RSS item fixture."""

     

       16
       16
       +
           # This is the escaped HTML from the RSS description field

     

       17
       17
       +
           html_content = """<p>The White House confirmed President Trump will hold a bilateral meeting with Chinese President Xi Jinping in South Korea on October 30, at the end of an Asia trip that includes Malaysia and Japan . The administration said the meeting will take place Thursday morning local time, and Mr Trump indicated his first question to Xi would concern fentanyl and other bilateral issues . The talks come amid heightened trade tensions after Beijing expanded export curbs on rare-earth minerals and following Mr Trump's recent threat of additional tariffs on Chinese goods, making the meeting a focal point for discussions on trade, technology supply chains and energy .</p><img src='https://kagiproxy.com/img/Q2SRXQtwTYBIiQeI0FG-X6taF_wHSJaXDiFUzju2kbCWGuOYIFUX--8L0BqE4VKxpbOJY3ylFPJkDpfSnyQYZ1qdOLXbphHTnsOK4jb7gqC4KCn5nf3ANbWCuaFD5ZUSijiK0k7wOLP2fyX6tynu2mPtXlCbotLo2lTrEswZl4-No2AI4mI4lkResfnRdp-YjpoEfCOHkNfbN1-0cNcHt9T2dmgBSXrQ2w' alt='News image associated with coverage of President Trump&#x27;s Asia trip and planned meeting with President Xi' /><br /><h3>Highlights:</h3><ul><li>Itinerary details: The Asia swing begins in Malaysia, continues to Japan and ends with the bilateral meeting in South Korea on Thursday morning local time, White House press secretary Karoline Leavitt said at a briefing .</li><li>APEC context: US officials indicated the leaders will meet on the sidelines of the Asia-Pacific Economic Cooperation gathering, shaping expectations for short, high-level talks rather than a lengthy summit .</li></ul><blockquote>Work out a lot of our doubts and questions - President Trump</blockquote><h3>Perspectives:</h3><ul><li>President Trump: He said his first question to President Xi would be about fentanyl and indicated he hoped to resolve bilateral doubts and questions in the talks. (<a href='https://www.straitstimes.com/world/united-states/trump-to-meet-xi-in-south-korea-on-oct-30-as-part-of-asia-swing'>The Straits Times</a>)</li><li>White House (press secretary): Karoline Leavitt confirmed the bilateral meeting will occur Thursday morning local time during a White House briefing. (<a href='https://www.scmp.com/news/us/diplomacy/article/3330131/donald-trump-meet-chinas-xi-jinping-next-thursday-south-korea-crunch-talks'>South China Morning Post</a>)</li></ul><h3>Sources:</h3><ul><li><a href='https://www.straitstimes.com/world/united-states/trump-to-meet-xi-in-south-korea-on-oct-30-as-part-of-asia-swing'>Trump to meet Xi in South Korea on Oct 30 as part of Asia swing</a> - straitstimes.com</li><li><a href='https://www.scmp.com/news/us/diplomacy/article/3330131/donald-trump-meet-chinas-xi-jinping-next-thursday-south-korea-crunch-talks'>Trump to meet Xi in South Korea next Thursday as part of key Asia trip</a> - scmp.com</li></ul>"""

     

       18
       18
       +
           return html_content

     

       19
       19
       +
       

     

       20
       20
       +
       

     

       21
       21
       +
       class TestKagiHTMLParser:

     

       22
       22
       +
           """Test suite for Kagi HTML parser."""

     

       23
       23
       +
       

     

       24
       24
       +
           def test_parse_summary(self, sample_html_description):

     

       25
       25
       +
               """Test extracting summary paragraph."""

     

       26
       26
       +
               parser = KagiHTMLParser()

     

       27
       27
       +
               result = parser.parse(sample_html_description)

     

       28
       28
       +
       

     

       29
       29
       +
               assert result['summary'].startswith("The White House confirmed President Trump")

     

       30
       30
       +
               assert "bilateral meeting with Chinese President Xi Jinping" in result['summary']

     

       31
       31
       +
       

     

       32
       32
       +
           def test_parse_image_url(self, sample_html_description):

     

       33
       33
       +
               """Test extracting image URL and alt text."""

     

       34
       34
       +
               parser = KagiHTMLParser()

     

       35
       35
       +
               result = parser.parse(sample_html_description)

     

       36
       36
       +
       

     

       37
       37
       +
               assert result['image_url'] is not None

     

       38
       38
       +
               assert result['image_url'].startswith("https://kagiproxy.com/img/")

     

       39
       39
       +
               assert result['image_alt'] is not None

     

       40
       40
       +
               assert "Trump" in result['image_alt']

     

       41
       41
       +
       

     

       42
       42
       +
           def test_parse_highlights(self, sample_html_description):

     

       43
       43
       +
               """Test extracting highlights list."""

     

       44
       44
       +
               parser = KagiHTMLParser()

     

       45
       45
       +
               result = parser.parse(sample_html_description)

     

       46
       46
       +
       

     

       47
       47
       +
               assert len(result['highlights']) == 2

     

       48
       48
       +
               assert "Itinerary details" in result['highlights'][0]

     

       49
       49
       +
               assert "APEC context" in result['highlights'][1]

     

       50
       50
       +
       

     

       51
       51
       +
           def test_parse_quote(self, sample_html_description):

     

       52
       52
       +
               """Test extracting blockquote."""

     

       53
       53
       +
               parser = KagiHTMLParser()

     

       54
       54
       +
               result = parser.parse(sample_html_description)

     

       55
       55
       +
       

     

       56
       56
       +
               assert result['quote'] is not None

     

       57
       57
       +
               assert result['quote']['text'] == "Work out a lot of our doubts and questions"

     

       58
       58
       +
               assert result['quote']['attribution'] == "President Trump"

     

       59
       59
       +
       

     

       60
       60
       +
           def test_parse_perspectives(self, sample_html_description):

     

       61
       61
       +
               """Test extracting perspectives list."""

     

       62
       62
       +
               parser = KagiHTMLParser()

     

       63
       63
       +
               result = parser.parse(sample_html_description)

     

       64
       64
       +
       

     

       65
       65
       +
               assert len(result['perspectives']) == 2

     

       66
       66
       +
       

     

       67
       67
       +
               # First perspective

     

       68
       68
       +
               assert result['perspectives'][0]['actor'] == "President Trump"

     

       69
       69
       +
               assert "fentanyl" in result['perspectives'][0]['description']

     

       70
       70
       +
               assert result['perspectives'][0]['source_url'] == "https://www.straitstimes.com/world/united-states/trump-to-meet-xi-in-south-korea-on-oct-30-as-part-of-asia-swing"

     

       71
       71
       +
       

     

       72
       72
       +
               # Second perspective

     

       73
       73
       +
               assert "White House" in result['perspectives'][1]['actor']

     

       74
       74
       +
       

     

       75
       75
       +
           def test_parse_sources(self, sample_html_description):

     

       76
       76
       +
               """Test extracting sources list."""

     

       77
       77
       +
               parser = KagiHTMLParser()

     

       78
       78
       +
               result = parser.parse(sample_html_description)

     

       79
       79
       +
       

     

       80
       80
       +
               assert len(result['sources']) >= 2

     

       81
       81
       +
       

     

       82
       82
       +
               # Check first source

     

       83
       83
       +
               assert result['sources'][0]['title'] == "Trump to meet Xi in South Korea on Oct 30 as part of Asia swing"

     

       84
       84
       +
               assert result['sources'][0]['url'].startswith("https://www.straitstimes.com")

     

       85
       85
       +
               assert result['sources'][0]['domain'] == "straitstimes.com"

     

       86
       86
       +
       

     

       87
       87
       +
           def test_parse_missing_sections(self):

     

       88
       88
       +
               """Test parsing HTML with missing sections."""

     

       89
       89
       +
               html_minimal = "<p>Just a summary, no other sections.</p>"

     

       90
       90
       +
       

     

       91
       91
       +
               parser = KagiHTMLParser()

     

       92
       92
       +
               result = parser.parse(html_minimal)

     

       93
       93
       +
       

     

       94
       94
       +
               assert result['summary'] == "Just a summary, no other sections."

     

       95
       95
       +
               assert result['highlights'] == []

     

       96
       96
       +
               assert result['perspectives'] == []

     

       97
       97
       +
               assert result['sources'] == []

     

       98
       98
       +
               assert result['quote'] is None

     

       99
       99
       +
               assert result['image_url'] is None

     

       100
       100
       +
       

     

       101
       101
       +
           def test_parse_to_kagi_story(self, sample_html_description):

     

       102
       102
       +
               """Test converting parsed HTML to KagiStory object."""

     

       103
       103
       +
               parser = KagiHTMLParser()

     

       104
       104
       +
       

     

       105
       105
       +
               # Simulate full RSS item data

     

       106
       106
       +
               story = parser.parse_to_story(

     

       107
       107
       +
                   title="Trump to meet Xi in South Korea on Oct 30",

     

       108
       108
       +
                   link="https://kite.kagi.com/test/world/10",

     

       109
       109
       +
                   guid="https://kite.kagi.com/test/world/10",

     

       110
       110
       +
                   pub_date=datetime(2025, 10, 23, 20, 56, 0),

     

       111
       111
       +
                   categories=["World", "World/Diplomacy"],

     

       112
       112
       +
                   html_description=sample_html_description

     

       113
       113
       +
               )

     

       114
       114
       +
       

     

       115
       115
       +
               assert isinstance(story, KagiStory)

     

       116
       116
       +
               assert story.title == "Trump to meet Xi in South Korea on Oct 30"

     

       117
       117
       +
               assert story.link == "https://kite.kagi.com/test/world/10"

     

       118
       118
       +
               assert len(story.highlights) == 2

     

       119
       119
       +
               assert len(story.perspectives) == 2

     

       120
       120
       +
               assert len(story.sources) >= 2

     

       121
       121
       +
               assert story.quote is not None

     

       122
       122
       +
               assert story.image_url is not None

+299

aggregators/kagi-news/tests/test_richtext_formatter.py

···

       1
       1
       +
       """

     

       2
       2
       +
       Tests for Rich Text Formatter.

     

       3
       3
       +
       

     

       4
       4
       +
       Tests conversion of KagiStory to Coves rich text format with facets.

     

       5
       5
       +
       """

     

       6
       6
       +
       import pytest

     

       7
       7
       +
       from datetime import datetime

     

       8
       8
       +
       

     

       9
       9
       +
       from src.richtext_formatter import RichTextFormatter

     

       10
       10
       +
       from src.models import KagiStory, Perspective, Quote, Source

     

       11
       11
       +
       

     

       12
       12
       +
       

     

       13
       13
       +
       @pytest.fixture

     

       14
       14
       +
       def sample_story():

     

       15
       15
       +
           """Create a sample KagiStory for testing."""

     

       16
       16
       +
           return KagiStory(

     

       17
       17
       +
               title="Trump to meet Xi in South Korea",

     

       18
       18
       +
               link="https://kite.kagi.com/test/world/10",

     

       19
       19
       +
               guid="https://kite.kagi.com/test/world/10",

     

       20
       20
       +
               pub_date=datetime(2025, 10, 23, 20, 56, 0),

     

       21
       21
       +
               categories=["World", "World/Diplomacy"],

     

       22
       22
       +
               summary="The White House confirmed President Trump will hold a bilateral meeting with Chinese President Xi Jinping in South Korea on October 30.",

     

       23
       23
       +
               highlights=[

     

       24
       24
       +
                   "Itinerary details: The Asia swing begins in Malaysia, continues to Japan.",

     

       25
       25
       +
                   "APEC context: US officials indicated the leaders will meet on the sidelines."

     

       26
       26
       +
               ],

     

       27
       27
       +
               perspectives=[

     

       28
       28
       +
                   Perspective(

     

       29
       29
       +
                       actor="President Trump",

     

       30
       30
       +
                       description="He said his first question to President Xi would be about fentanyl.",

     

       31
       31
       +
                       source_url="https://www.straitstimes.com/world/test"

     

       32
       32
       +
                   ),

     

       33
       33
       +
                   Perspective(

     

       34
       34
       +
                       actor="White House (press secretary)",

     

       35
       35
       +
                       description="Karoline Leavitt confirmed the bilateral meeting.",

     

       36
       36
       +
                       source_url="https://www.scmp.com/news/test"

     

       37
       37
       +
                   )

     

       38
       38
       +
               ],

     

       39
       39
       +
               quote=Quote(

     

       40
       40
       +
                   text="Work out a lot of our doubts and questions",

     

       41
       41
       +
                   attribution="President Trump"

     

       42
       42
       +
               ),

     

       43
       43
       +
               sources=[

     

       44
       44
       +
                   Source(

     

       45
       45
       +
                       title="Trump to meet Xi in South Korea",

     

       46
       46
       +
                       url="https://www.straitstimes.com/world/test",

     

       47
       47
       +
                       domain="straitstimes.com"

     

       48
       48
       +
                   ),

     

       49
       49
       +
                   Source(

     

       50
       50
       +
                       title="Trump meeting Xi next Thursday",

     

       51
       51
       +
                       url="https://www.scmp.com/news/test",

     

       52
       52
       +
                       domain="scmp.com"

     

       53
       53
       +
                   )

     

       54
       54
       +
               ],

     

       55
       55
       +
               image_url="https://kagiproxy.com/img/test123",

     

       56
       56
       +
               image_alt="Test image"

     

       57
       57
       +
           )

     

       58
       58
       +
       

     

       59
       59
       +
       

     

       60
       60
       +
       class TestRichTextFormatter:

     

       61
       61
       +
           """Test suite for RichTextFormatter."""

     

       62
       62
       +
       

     

       63
       63
       +
           def test_format_full_returns_content_and_facets(self, sample_story):

     

       64
       64
       +
               """Test that format_full returns content and facets."""

     

       65
       65
       +
               formatter = RichTextFormatter()

     

       66
       66
       +
               result = formatter.format_full(sample_story)

     

       67
       67
       +
       

     

       68
       68
       +
               assert 'content' in result

     

       69
       69
       +
               assert 'facets' in result

     

       70
       70
       +
               assert isinstance(result['content'], str)

     

       71
       71
       +
               assert isinstance(result['facets'], list)

     

       72
       72
       +
       

     

       73
       73
       +
           def test_content_structure(self, sample_story):

     

       74
       74
       +
               """Test that content has correct structure."""

     

       75
       75
       +
               formatter = RichTextFormatter()

     

       76
       76
       +
               result = formatter.format_full(sample_story)

     

       77
       77
       +
               content = result['content']

     

       78
       78
       +
       

     

       79
       79
       +
               # Check all sections are present

     

       80
       80
       +
               assert sample_story.summary in content

     

       81
       81
       +
               assert "Highlights:" in content

     

       82
       82
       +
               assert "Perspectives:" in content

     

       83
       83
       +
               assert "Sources:" in content

     

       84
       84
       +
               assert sample_story.quote.text in content

     

       85
       85
       +
               assert "📰 Story aggregated by Kagi News" in content

     

       86
       86
       +
       

     

       87
       87
       +
           def test_facets_for_bold_headers(self, sample_story):

     

       88
       88
       +
               """Test that section headers have bold facets."""

     

       89
       89
       +
               formatter = RichTextFormatter()

     

       90
       90
       +
               result = formatter.format_full(sample_story)

     

       91
       91
       +
       

     

       92
       92
       +
               # Find bold facets

     

       93
       93
       +
               bold_facets = [

     

       94
       94
       +
                   f for f in result['facets']

     

       95
       95
       +
                   if any(feat.get('$type') == 'social.coves.richtext.facet#bold'

     

       96
       96
       +
                          for feat in f['features'])

     

       97
       97
       +
               ]

     

       98
       98
       +
       

     

       99
       99
       +
               assert len(bold_facets) > 0

     

       100
       100
       +
       

     

       101
       101
       +
               # Check that "Highlights:" is bolded

     

       102
       102
       +
               content = result['content']

     

       103
       103
       +
               highlights_pos = content.find("Highlights:")

     

       104
       104
       +
       

     

       105
       105
       +
               # Should have a bold facet covering "Highlights:"

     

       106
       106
       +
               has_highlights_bold = any(

     

       107
       107
       +
                   f['index']['byteStart'] <= highlights_pos and

     

       108
       108
       +
                   f['index']['byteEnd'] >= highlights_pos + len("Highlights:")

     

       109
       109
       +
                   for f in bold_facets

     

       110
       110
       +
               )

     

       111
       111
       +
               assert has_highlights_bold

     

       112
       112
       +
       

     

       113
       113
       +
           def test_facets_for_italic_quote(self, sample_story):

     

       114
       114
       +
               """Test that quotes have italic facets."""

     

       115
       115
       +
               formatter = RichTextFormatter()

     

       116
       116
       +
               result = formatter.format_full(sample_story)

     

       117
       117
       +
       

     

       118
       118
       +
               # Find italic facets

     

       119
       119
       +
               italic_facets = [

     

       120
       120
       +
                   f for f in result['facets']

     

       121
       121
       +
                   if any(feat.get('$type') == 'social.coves.richtext.facet#italic'

     

       122
       122
       +
                          for feat in f['features'])

     

       123
       123
       +
               ]

     

       124
       124
       +
       

     

       125
       125
       +
               assert len(italic_facets) > 0

     

       126
       126
       +
       

     

       127
       127
       +
               # The quote text is wrapped with quotes, so search for that

     

       128
       128
       +
               content = result['content']

     

       129
       129
       +
               quote_with_quotes = f'"{sample_story.quote.text}"'

     

       130
       130
       +
               quote_char_pos = content.find(quote_with_quotes)

     

       131
       131
       +
       

     

       132
       132
       +
               # Convert character position to byte position

     

       133
       133
       +
               quote_byte_start = len(content[:quote_char_pos].encode('utf-8'))

     

       134
       134
       +
               quote_byte_end = len(content[:quote_char_pos + len(quote_with_quotes)].encode('utf-8'))

     

       135
       135
       +
       

     

       136
       136
       +
               has_quote_italic = any(

     

       137
       137
       +
                   f['index']['byteStart'] <= quote_byte_start and

     

       138
       138
       +
                   f['index']['byteEnd'] >= quote_byte_end

     

       139
       139
       +
                   for f in italic_facets

     

       140
       140
       +
               )

     

       141
       141
       +
               assert has_quote_italic

     

       142
       142
       +
       

     

       143
       143
       +
           def test_facets_for_links(self, sample_story):

     

       144
       144
       +
               """Test that URLs have link facets."""

     

       145
       145
       +
               formatter = RichTextFormatter()

     

       146
       146
       +
               result = formatter.format_full(sample_story)

     

       147
       147
       +
       

     

       148
       148
       +
               # Find link facets

     

       149
       149
       +
               link_facets = [

     

       150
       150
       +
                   f for f in result['facets']

     

       151
       151
       +
                   if any(feat.get('$type') == 'social.coves.richtext.facet#link'

     

       152
       152
       +
                          for feat in f['features'])

     

       153
       153
       +
               ]

     

       154
       154
       +
       

     

       155
       155
       +
               # Should have links for: 2 sources + 2 perspectives + 1 Kagi News link = 5 minimum

     

       156
       156
       +
               assert len(link_facets) >= 5

     

       157
       157
       +
       

     

       158
       158
       +
               # Check that first source URL has a link facet

     

       159
       159
       +
               source_urls = [s.url for s in sample_story.sources]

     

       160
       160
       +
               for url in source_urls:

     

       161
       161
       +
                   has_link = any(

     

       162
       162
       +
                       any(feat.get('uri') == url for feat in f['features'])

     

       163
       163
       +
                       for f in link_facets

     

       164
       164
       +
                   )

     

       165
       165
       +
                   assert has_link, f"Missing link facet for {url}"

     

       166
       166
       +
       

     

       167
       167
       +
           def test_utf8_byte_positions(self):

     

       168
       168
       +
               """Test UTF-8 byte position calculation with multi-byte characters."""

     

       169
       169
       +
               # Create story with emoji and non-ASCII characters

     

       170
       170
       +
               story = KagiStory(

     

       171
       171
       +
                   title="Test 👋 Story",

     

       172
       172
       +
                   link="https://test.com",

     

       173
       173
       +
                   guid="https://test.com",

     

       174
       174
       +
                   pub_date=datetime.now(),

     

       175
       175
       +
                   categories=["Test"],

     

       176
       176
       +
                   summary="Hello 世界 this is a test with emoji 🎉",

     

       177
       177
       +
                   highlights=["Test highlight"],

     

       178
       178
       +
                   perspectives=[],

     

       179
       179
       +
                   quote=None,

     

       180
       180
       +
                   sources=[],

     

       181
       181
       +
               )

     

       182
       182
       +
       

     

       183
       183
       +
               formatter = RichTextFormatter()

     

       184
       184
       +
               result = formatter.format_full(story)

     

       185
       185
       +
       

     

       186
       186
       +
               # Verify content contains the emoji

     

       187
       187
       +
               assert "👋" in result['content'] or "🎉" in result['content']

     

       188
       188
       +
       

     

       189
       189
       +
               # Verify all facet byte positions are valid

     

       190
       190
       +
               content_bytes = result['content'].encode('utf-8')

     

       191
       191
       +
               for facet in result['facets']:

     

       192
       192
       +
                   start = facet['index']['byteStart']

     

       193
       193
       +
                   end = facet['index']['byteEnd']

     

       194
       194
       +
       

     

       195
       195
       +
                   # Positions should be within bounds

     

       196
       196
       +
                   assert 0 <= start < len(content_bytes)

     

       197
       197
       +
                   assert start < end <= len(content_bytes)

     

       198
       198
       +
       

     

       199
       199
       +
           def test_format_story_without_optional_fields(self):

     

       200
       200
       +
               """Test formatting story with missing optional fields."""

     

       201
       201
       +
               minimal_story = KagiStory(

     

       202
       202
       +
                   title="Minimal Story",

     

       203
       203
       +
                   link="https://test.com",

     

       204
       204
       +
                   guid="https://test.com",

     

       205
       205
       +
                   pub_date=datetime.now(),

     

       206
       206
       +
                   categories=["Test"],

     

       207
       207
       +
                   summary="Just a summary.",

     

       208
       208
       +
                   highlights=[],  # Empty

     

       209
       209
       +
                   perspectives=[],  # Empty

     

       210
       210
       +
                   quote=None,  # Missing

     

       211
       211
       +
                   sources=[],  # Empty

     

       212
       212
       +
               )

     

       213
       213
       +
       

     

       214
       214
       +
               formatter = RichTextFormatter()

     

       215
       215
       +
               result = formatter.format_full(minimal_story)

     

       216
       216
       +
       

     

       217
       217
       +
               # Should still have content and facets

     

       218
       218
       +
               assert result['content']

     

       219
       219
       +
               assert result['facets']

     

       220
       220
       +
       

     

       221
       221
       +
               # Should have summary

     

       222
       222
       +
               assert "Just a summary." in result['content']

     

       223
       223
       +
       

     

       224
       224
       +
               # Should NOT have empty sections

     

       225
       225
       +
               assert "Highlights:" not in result['content']

     

       226
       226
       +
               assert "Perspectives:" not in result['content']

     

       227
       227
       +
       

     

       228
       228
       +
           def test_perspective_actor_is_bolded(self, sample_story):

     

       229
       229
       +
               """Test that perspective actor names are bolded."""

     

       230
       230
       +
               formatter = RichTextFormatter()

     

       231
       231
       +
               result = formatter.format_full(sample_story)

     

       232
       232
       +
       

     

       233
       233
       +
               content = result['content']

     

       234
       234
       +
               bold_facets = [

     

       235
       235
       +
                   f for f in result['facets']

     

       236
       236
       +
                   if any(feat.get('$type') == 'social.coves.richtext.facet#bold'

     

       237
       237
       +
                          for feat in f['features'])

     

       238
       238
       +
               ]

     

       239
       239
       +
       

     

       240
       240
       +
               # Find "President Trump:" in perspectives section

     

       241
       241
       +
               actor = "President Trump:"

     

       242
       242
       +
               perspectives_start = content.find("Perspectives:")

     

       243
       243
       +
               actor_char_pos = content.find(actor, perspectives_start)

     

       244
       244
       +
       

     

       245
       245
       +
               if actor_char_pos != -1:  # If found in perspectives

     

       246
       246
       +
                   # Convert character position to byte position

     

       247
       247
       +
                   actor_byte_start = len(content[:actor_char_pos].encode('utf-8'))

     

       248
       248
       +
                   actor_byte_end = len(content[:actor_char_pos + len(actor)].encode('utf-8'))

     

       249
       249
       +
       

     

       250
       250
       +
                   has_actor_bold = any(

     

       251
       251
       +
                       f['index']['byteStart'] <= actor_byte_start and

     

       252
       252
       +
                       f['index']['byteEnd'] >= actor_byte_end

     

       253
       253
       +
                       for f in bold_facets

     

       254
       254
       +
                   )

     

       255
       255
       +
                   assert has_actor_bold

     

       256
       256
       +
       

     

       257
       257
       +
           def test_kagi_attribution_link(self, sample_story):

     

       258
       258
       +
               """Test that Kagi News attribution has a link to the story."""

     

       259
       259
       +
               formatter = RichTextFormatter()

     

       260
       260
       +
               result = formatter.format_full(sample_story)

     

       261
       261
       +
       

     

       262
       262
       +
               # Should have link to Kagi story

     

       263
       263
       +
               link_facets = [

     

       264
       264
       +
                   f for f in result['facets']

     

       265
       265
       +
                   if any(feat.get('$type') == 'social.coves.richtext.facet#link'

     

       266
       266
       +
                          for feat in f['features'])

     

       267
       267
       +
               ]

     

       268
       268
       +
       

     

       269
       269
       +
               # Find link to the Kagi story URL

     

       270
       270
       +
               kagi_link = any(

     

       271
       271
       +
                   any(feat.get('uri') == sample_story.link for feat in f['features'])

     

       272
       272
       +
                   for f in link_facets

     

       273
       273
       +
               )

     

       274
       274
       +
               assert kagi_link, "Missing link to Kagi story in attribution"

     

       275
       275
       +
       

     

       276
       276
       +
           def test_facets_do_not_overlap(self, sample_story):

     

       277
       277
       +
               """Test that facets with same feature type don't overlap."""

     

       278
       278
       +
               formatter = RichTextFormatter()

     

       279
       279
       +
               result = formatter.format_full(sample_story)

     

       280
       280
       +
       

     

       281
       281
       +
               # Group facets by type

     

       282
       282
       +
               facets_by_type = {}

     

       283
       283
       +
               for facet in result['facets']:

     

       284
       284
       +
                   for feature in facet['features']:

     

       285
       285
       +
                       ftype = feature['$type']

     

       286
       286
       +
                       if ftype not in facets_by_type:

     

       287
       287
       +
                           facets_by_type[ftype] = []

     

       288
       288
       +
                       facets_by_type[ftype].append(facet)

     

       289
       289
       +
       

     

       290
       290
       +
               # Check for overlaps within each type

     

       291
       291
       +
               for ftype, facets in facets_by_type.items():

     

       292
       292
       +
                   for i, f1 in enumerate(facets):

     

       293
       293
       +
                       for f2 in facets[i+1:]:

     

       294
       294
       +
                           start1, end1 = f1['index']['byteStart'], f1['index']['byteEnd']

     

       295
       295
       +
                           start2, end2 = f2['index']['byteStart'], f2['index']['byteEnd']

     

       296
       296
       +
       

     

       297
       297
       +
                           # Check if they overlap

     

       298
       298
       +
                           overlaps = (start1 < end2 and start2 < end1)

     

       299
       299
       +
                           assert not overlaps, f"Overlapping facets of type {ftype}: {f1} and {f2}"

+91

aggregators/kagi-news/tests/test_rss_fetcher.py

···

       1
       1
       +
       """

     

       2
       2
       +
       Tests for RSS feed fetching functionality.

     

       3
       3
       +
       """

     

       4
       4
       +
       import pytest

     

       5
       5
       +
       import responses

     

       6
       6
       +
       from pathlib import Path

     

       7
       7
       +
       

     

       8
       8
       +
       from src.rss_fetcher import RSSFetcher

     

       9
       9
       +
       

     

       10
       10
       +
       

     

       11
       11
       +
       @pytest.fixture

     

       12
       12
       +
       def sample_rss_feed():

     

       13
       13
       +
           """Load sample RSS feed from fixtures."""

     

       14
       14
       +
           fixture_path = Path(__file__).parent / "fixtures" / "world.xml"

     

       15
       15
       +
           # For now, use a minimal test feed

     

       16
       16
       +
           return """<?xml version='1.0' encoding='UTF-8'?>

     

       17
       17
       +
       <rss version="2.0">

     

       18
       18
       +
         <channel>

     

       19
       19
       +
           <title>Kagi News - World</title>

     

       20
       20
       +
           <item>

     

       21
       21
       +
             <title>Test Story</title>

     

       22
       22
       +
             <link>https://kite.kagi.com/test/world/1</link>

     

       23
       23
       +
             <guid>https://kite.kagi.com/test/world/1</guid>

     

       24
       24
       +
             <pubDate>Fri, 24 Oct 2025 12:00:00 +0000</pubDate>

     

       25
       25
       +
             <category>World</category>

     

       26
       26
       +
           </item>

     

       27
       27
       +
         </channel>

     

       28
       28
       +
       </rss>"""

     

       29
       29
       +
       

     

       30
       30
       +
       

     

       31
       31
       +
       class TestRSSFetcher:

     

       32
       32
       +
           """Test suite for RSSFetcher."""

     

       33
       33
       +
       

     

       34
       34
       +
           @responses.activate

     

       35
       35
       +
           def test_fetch_feed_success(self, sample_rss_feed):

     

       36
       36
       +
               """Test successful RSS feed fetch."""

     

       37
       37
       +
               url = "https://news.kagi.com/world.xml"

     

       38
       38
       +
               responses.add(responses.GET, url, body=sample_rss_feed, status=200)

     

       39
       39
       +
       

     

       40
       40
       +
               fetcher = RSSFetcher()

     

       41
       41
       +
               feed = fetcher.fetch_feed(url)

     

       42
       42
       +
       

     

       43
       43
       +
               assert feed is not None

     

       44
       44
       +
               assert feed.feed.title == "Kagi News - World"

     

       45
       45
       +
               assert len(feed.entries) == 1

     

       46
       46
       +
               assert feed.entries[0].title == "Test Story"

     

       47
       47
       +
       

     

       48
       48
       +
           @responses.activate

     

       49
       49
       +
           def test_fetch_feed_timeout(self):

     

       50
       50
       +
               """Test fetch with timeout."""

     

       51
       51
       +
               url = "https://news.kagi.com/world.xml"

     

       52
       52
       +
               responses.add(responses.GET, url, body="timeout", status=408)

     

       53
       53
       +
       

     

       54
       54
       +
               fetcher = RSSFetcher(timeout=5)

     

       55
       55
       +
       

     

       56
       56
       +
               with pytest.raises(Exception):  # Should raise on timeout

     

       57
       57
       +
                   fetcher.fetch_feed(url)

     

       58
       58
       +
       

     

       59
       59
       +
           @responses.activate

     

       60
       60
       +
           def test_fetch_feed_with_retry(self, sample_rss_feed):

     

       61
       61
       +
               """Test fetch with retry on failure then success."""

     

       62
       62
       +
               url = "https://news.kagi.com/world.xml"

     

       63
       63
       +
       

     

       64
       64
       +
               # First call fails, second succeeds

     

       65
       65
       +
               responses.add(responses.GET, url, body="error", status=500)

     

       66
       66
       +
               responses.add(responses.GET, url, body=sample_rss_feed, status=200)

     

       67
       67
       +
       

     

       68
       68
       +
               fetcher = RSSFetcher(max_retries=2)

     

       69
       69
       +
               feed = fetcher.fetch_feed(url)

     

       70
       70
       +
       

     

       71
       71
       +
               assert feed is not None

     

       72
       72
       +
               assert len(feed.entries) == 1

     

       73
       73
       +
       

     

       74
       74
       +
           @responses.activate

     

       75
       75
       +
           def test_fetch_feed_invalid_xml(self):

     

       76
       76
       +
               """Test handling of invalid XML."""

     

       77
       77
       +
               url = "https://news.kagi.com/world.xml"

     

       78
       78
       +
               responses.add(responses.GET, url, body="Not valid XML!", status=200)

     

       79
       79
       +
       

     

       80
       80
       +
               fetcher = RSSFetcher()

     

       81
       81
       +
               feed = fetcher.fetch_feed(url)

     

       82
       82
       +
       

     

       83
       83
       +
               # feedparser is lenient, but should have bozo flag set

     

       84
       84
       +
               assert feed.bozo == 1  # feedparser uses 1 for True

     

       85
       85
       +
       

     

       86
       86
       +
           def test_fetch_feed_requires_url(self):

     

       87
       87
       +
               """Test that fetch_feed requires a URL."""

     

       88
       88
       +
               fetcher = RSSFetcher()

     

       89
       89
       +
       

     

       90
       90
       +
               with pytest.raises((ValueError, TypeError)):

     

       91
       91
       +
                   fetcher.fetch_feed("")

+227

aggregators/kagi-news/tests/test_state_manager.py

···

       1
       1
       +
       """

     

       2
       2
       +
       Tests for State Manager.

     

       3
       3
       +
       

     

       4
       4
       +
       Tests deduplication state tracking and persistence.

     

       5
       5
       +
       """

     

       6
       6
       +
       import pytest

     

       7
       7
       +
       import json

     

       8
       8
       +
       import tempfile

     

       9
       9
       +
       from pathlib import Path

     

       10
       10
       +
       from datetime import datetime, timedelta

     

       11
       11
       +
       

     

       12
       12
       +
       from src.state_manager import StateManager

     

       13
       13
       +
       

     

       14
       14
       +
       

     

       15
       15
       +
       @pytest.fixture

     

       16
       16
       +
       def temp_state_file():

     

       17
       17
       +
           """Create a temporary state file for testing."""

     

       18
       18
       +
           with tempfile.NamedTemporaryFile(mode='w', delete=False, suffix='.json') as f:

     

       19
       19
       +
               temp_path = Path(f.name)

     

       20
       20
       +
           yield temp_path

     

       21
       21
       +
           # Cleanup

     

       22
       22
       +
           if temp_path.exists():

     

       23
       23
       +
               temp_path.unlink()

     

       24
       24
       +
       

     

       25
       25
       +
       

     

       26
       26
       +
       class TestStateManager:

     

       27
       27
       +
           """Test suite for StateManager."""

     

       28
       28
       +
       

     

       29
       29
       +
           def test_initialize_new_state_file(self, temp_state_file):

     

       30
       30
       +
               """Test initializing a new state file."""

     

       31
       31
       +
               manager = StateManager(temp_state_file)

     

       32
       32
       +
       

     

       33
       33
       +
               # Should create an empty state

     

       34
       34
       +
               assert temp_state_file.exists()

     

       35
       35
       +
               state = json.loads(temp_state_file.read_text())

     

       36
       36
       +
               assert 'feeds' in state

     

       37
       37
       +
               assert state['feeds'] == {}

     

       38
       38
       +
       

     

       39
       39
       +
           def test_is_posted_returns_false_for_new_guid(self, temp_state_file):

     

       40
       40
       +
               """Test that is_posted returns False for new GUIDs."""

     

       41
       41
       +
               manager = StateManager(temp_state_file)

     

       42
       42
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       43
       43
       +
               guid = "https://kite.kagi.com/test/world/1"

     

       44
       44
       +
       

     

       45
       45
       +
               assert not manager.is_posted(feed_url, guid)

     

       46
       46
       +
       

     

       47
       47
       +
           def test_mark_posted_stores_guid(self, temp_state_file):

     

       48
       48
       +
               """Test that mark_posted stores GUIDs."""

     

       49
       49
       +
               manager = StateManager(temp_state_file)

     

       50
       50
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       51
       51
       +
               guid = "https://kite.kagi.com/test/world/1"

     

       52
       52
       +
               post_uri = "at://did:plc:test/social.coves.post/abc123"

     

       53
       53
       +
       

     

       54
       54
       +
               manager.mark_posted(feed_url, guid, post_uri)

     

       55
       55
       +
       

     

       56
       56
       +
               # Should now return True

     

       57
       57
       +
               assert manager.is_posted(feed_url, guid)

     

       58
       58
       +
       

     

       59
       59
       +
           def test_state_persists_across_instances(self, temp_state_file):

     

       60
       60
       +
               """Test that state persists when creating new instances."""

     

       61
       61
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       62
       62
       +
               guid = "https://kite.kagi.com/test/world/1"

     

       63
       63
       +
               post_uri = "at://did:plc:test/social.coves.post/abc123"

     

       64
       64
       +
       

     

       65
       65
       +
               # First instance marks as posted

     

       66
       66
       +
               manager1 = StateManager(temp_state_file)

     

       67
       67
       +
               manager1.mark_posted(feed_url, guid, post_uri)

     

       68
       68
       +
       

     

       69
       69
       +
               # Second instance should see the same state

     

       70
       70
       +
               manager2 = StateManager(temp_state_file)

     

       71
       71
       +
               assert manager2.is_posted(feed_url, guid)

     

       72
       72
       +
       

     

       73
       73
       +
           def test_track_last_run_timestamp(self, temp_state_file):

     

       74
       74
       +
               """Test tracking last successful run timestamp."""

     

       75
       75
       +
               manager = StateManager(temp_state_file)

     

       76
       76
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       77
       77
       +
               timestamp = datetime.now()

     

       78
       78
       +
       

     

       79
       79
       +
               manager.update_last_run(feed_url, timestamp)

     

       80
       80
       +
       

     

       81
       81
       +
               retrieved = manager.get_last_run(feed_url)

     

       82
       82
       +
               assert retrieved is not None

     

       83
       83
       +
               # Compare timestamps (allow small difference due to serialization)

     

       84
       84
       +
               assert abs((retrieved - timestamp).total_seconds()) < 1

     

       85
       85
       +
       

     

       86
       86
       +
           def test_get_last_run_returns_none_for_new_feed(self, temp_state_file):

     

       87
       87
       +
               """Test that get_last_run returns None for new feeds."""

     

       88
       88
       +
               manager = StateManager(temp_state_file)

     

       89
       89
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       90
       90
       +
       

     

       91
       91
       +
               assert manager.get_last_run(feed_url) is None

     

       92
       92
       +
       

     

       93
       93
       +
           def test_cleanup_old_guids(self, temp_state_file):

     

       94
       94
       +
               """Test cleanup of old GUIDs (> 30 days)."""

     

       95
       95
       +
               manager = StateManager(temp_state_file)

     

       96
       96
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       97
       97
       +
       

     

       98
       98
       +
               # Add recent GUID

     

       99
       99
       +
               recent_guid = "https://kite.kagi.com/test/world/1"

     

       100
       100
       +
               manager.mark_posted(feed_url, recent_guid, "at://test/1")

     

       101
       101
       +
       

     

       102
       102
       +
               # Manually add old GUID (> 30 days)

     

       103
       103
       +
               old_timestamp = (datetime.now() - timedelta(days=31)).isoformat()

     

       104
       104
       +
               state_data = json.loads(temp_state_file.read_text())

     

       105
       105
       +
               state_data['feeds'][feed_url]['posted_guids'].append({

     

       106
       106
       +
                   'guid': 'https://kite.kagi.com/test/world/old',

     

       107
       107
       +
                   'post_uri': 'at://test/old',

     

       108
       108
       +
                   'posted_at': old_timestamp

     

       109
       109
       +
               })

     

       110
       110
       +
               temp_state_file.write_text(json.dumps(state_data, indent=2))

     

       111
       111
       +
       

     

       112
       112
       +
               # Reload and cleanup

     

       113
       113
       +
               manager = StateManager(temp_state_file)

     

       114
       114
       +
               manager.cleanup_old_entries(feed_url)

     

       115
       115
       +
       

     

       116
       116
       +
               # Recent GUID should still be there

     

       117
       117
       +
               assert manager.is_posted(feed_url, recent_guid)

     

       118
       118
       +
       

     

       119
       119
       +
               # Old GUID should be removed

     

       120
       120
       +
               assert not manager.is_posted(feed_url, 'https://kite.kagi.com/test/world/old')

     

       121
       121
       +
       

     

       122
       122
       +
           def test_limit_guids_to_100_per_feed(self, temp_state_file):

     

       123
       123
       +
               """Test that only last 100 GUIDs are kept per feed."""

     

       124
       124
       +
               manager = StateManager(temp_state_file)

     

       125
       125
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       126
       126
       +
       

     

       127
       127
       +
               # Add 150 GUIDs

     

       128
       128
       +
               for i in range(150):

     

       129
       129
       +
                   guid = f"https://kite.kagi.com/test/world/{i}"

     

       130
       130
       +
                   manager.mark_posted(feed_url, guid, f"at://test/{i}")

     

       131
       131
       +
       

     

       132
       132
       +
               # Cleanup (should limit to 100)

     

       133
       133
       +
               manager.cleanup_old_entries(feed_url)

     

       134
       134
       +
       

     

       135
       135
       +
               # Reload state

     

       136
       136
       +
               manager = StateManager(temp_state_file)

     

       137
       137
       +
       

     

       138
       138
       +
               # Should have exactly 100 entries (most recent)

     

       139
       139
       +
               state_data = json.loads(temp_state_file.read_text())

     

       140
       140
       +
               assert len(state_data['feeds'][feed_url]['posted_guids']) == 100

     

       141
       141
       +
       

     

       142
       142
       +
               # Oldest entries should be removed

     

       143
       143
       +
               assert not manager.is_posted(feed_url, "https://kite.kagi.com/test/world/0")

     

       144
       144
       +
               assert not manager.is_posted(feed_url, "https://kite.kagi.com/test/world/49")

     

       145
       145
       +
       

     

       146
       146
       +
               # Recent entries should still be there

     

       147
       147
       +
               assert manager.is_posted(feed_url, "https://kite.kagi.com/test/world/149")

     

       148
       148
       +
               assert manager.is_posted(feed_url, "https://kite.kagi.com/test/world/100")

     

       149
       149
       +
       

     

       150
       150
       +
           def test_multiple_feeds_tracked_separately(self, temp_state_file):

     

       151
       151
       +
               """Test that multiple feeds are tracked independently."""

     

       152
       152
       +
               manager = StateManager(temp_state_file)

     

       153
       153
       +
       

     

       154
       154
       +
               feed1 = "https://news.kagi.com/world.xml"

     

       155
       155
       +
               feed2 = "https://news.kagi.com/tech.xml"

     

       156
       156
       +
               guid1 = "https://kite.kagi.com/test/world/1"

     

       157
       157
       +
               guid2 = "https://kite.kagi.com/test/tech/1"

     

       158
       158
       +
       

     

       159
       159
       +
               manager.mark_posted(feed1, guid1, "at://test/1")

     

       160
       160
       +
               manager.mark_posted(feed2, guid2, "at://test/2")

     

       161
       161
       +
       

     

       162
       162
       +
               # Each feed should only know about its own GUIDs

     

       163
       163
       +
               assert manager.is_posted(feed1, guid1)

     

       164
       164
       +
               assert not manager.is_posted(feed1, guid2)

     

       165
       165
       +
       

     

       166
       166
       +
               assert manager.is_posted(feed2, guid2)

     

       167
       167
       +
               assert not manager.is_posted(feed2, guid1)

     

       168
       168
       +
       

     

       169
       169
       +
           def test_get_posted_count(self, temp_state_file):

     

       170
       170
       +
               """Test getting count of posted items per feed."""

     

       171
       171
       +
               manager = StateManager(temp_state_file)

     

       172
       172
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       173
       173
       +
       

     

       174
       174
       +
               # Initially 0

     

       175
       175
       +
               assert manager.get_posted_count(feed_url) == 0

     

       176
       176
       +
       

     

       177
       177
       +
               # Add 5 items

     

       178
       178
       +
               for i in range(5):

     

       179
       179
       +
                   manager.mark_posted(feed_url, f"guid-{i}", f"post-{i}")

     

       180
       180
       +
       

     

       181
       181
       +
               assert manager.get_posted_count(feed_url) == 5

     

       182
       182
       +
       

     

       183
       183
       +
           def test_state_file_format_is_valid_json(self, temp_state_file):

     

       184
       184
       +
               """Test that state file is always valid JSON."""

     

       185
       185
       +
               manager = StateManager(temp_state_file)

     

       186
       186
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       187
       187
       +
       

     

       188
       188
       +
               manager.mark_posted(feed_url, "test-guid", "test-post-uri")

     

       189
       189
       +
               manager.update_last_run(feed_url, datetime.now())

     

       190
       190
       +
       

     

       191
       191
       +
               # Should be valid JSON

     

       192
       192
       +
               with open(temp_state_file) as f:

     

       193
       193
       +
                   state = json.load(f)

     

       194
       194
       +
       

     

       195
       195
       +
               assert 'feeds' in state

     

       196
       196
       +
               assert feed_url in state['feeds']

     

       197
       197
       +
               assert 'posted_guids' in state['feeds'][feed_url]

     

       198
       198
       +
               assert 'last_successful_run' in state['feeds'][feed_url]

     

       199
       199
       +
       

     

       200
       200
       +
           def test_automatic_cleanup_on_mark_posted(self, temp_state_file):

     

       201
       201
       +
               """Test that cleanup happens automatically when marking posted."""

     

       202
       202
       +
               manager = StateManager(temp_state_file)

     

       203
       203
       +
               feed_url = "https://news.kagi.com/world.xml"

     

       204
       204
       +
       

     

       205
       205
       +
               # Add old entry manually

     

       206
       206
       +
               old_timestamp = (datetime.now() - timedelta(days=31)).isoformat()

     

       207
       207
       +
               state_data = {

     

       208
       208
       +
                   'feeds': {

     

       209
       209
       +
                       feed_url: {

     

       210
       210
       +
                           'posted_guids': [{

     

       211
       211
       +
                               'guid': 'old-guid',

     

       212
       212
       +
                               'post_uri': 'old-uri',

     

       213
       213
       +
                               'posted_at': old_timestamp

     

       214
       214
       +
                           }],

     

       215
       215
       +
                           'last_successful_run': None

     

       216
       216
       +
                       }

     

       217
       217
       +
                   }

     

       218
       218
       +
               }

     

       219
       219
       +
               temp_state_file.write_text(json.dumps(state_data, indent=2))

     

       220
       220
       +
       

     

       221
       221
       +
               # Reload and add new entry (should trigger cleanup)

     

       222
       222
       +
               manager = StateManager(temp_state_file)

     

       223
       223
       +
               manager.mark_posted(feed_url, "new-guid", "new-uri")

     

       224
       224
       +
       

     

       225
       225
       +
               # Old entry should be gone

     

       226
       226
       +
               assert not manager.is_posted(feed_url, "old-guid")

     

       227
       227
       +
               assert manager.is_posted(feed_url, "new-guid")

+6

aggregators/kagi-news/.env.example

···

       1
       1
       +
       # Aggregator Identity (pre-created account credentials)

     

       2
       2
       +
       AGGREGATOR_HANDLE=kagi-news.local.coves.dev

     

       3
       3
       +
       AGGREGATOR_PASSWORD=your-secure-password-here

     

       4
       4
       +
       

     

       5
       5
       +
       # Optional: Override Coves API URL (defaults to config.yaml)

     

       6
       6
       +
       # COVES_API_URL=http://localhost:3001

+29

aggregators/kagi-news/config.example.yaml

···

       1
       1
       +
       # Kagi News RSS Aggregator Configuration

     

       2
       2
       +
       

     

       3
       3
       +
       # Coves API endpoint

     

       4
       4
       +
       coves_api_url: "https://api.coves.social"

     

       5
       5
       +
       

     

       6
       6
       +
       # Feed-to-community mappings

     

       7
       7
       +
       feeds:

     

       8
       8
       +
         - name: "World News"

     

       9
       9
       +
           url: "https://news.kagi.com/world.xml"

     

       10
       10
       +
           community_handle: "world-news.coves.social"

     

       11
       11
       +
           enabled: true

     

       12
       12
       +
       

     

       13
       13
       +
         - name: "Tech News"

     

       14
       14
       +
           url: "https://news.kagi.com/tech.xml"

     

       15
       15
       +
           community_handle: "tech.coves.social"

     

       16
       16
       +
           enabled: true

     

       17
       17
       +
       

     

       18
       18
       +
         - name: "Business News"

     

       19
       19
       +
           url: "https://news.kagi.com/business.xml"

     

       20
       20
       +
           community_handle: "business.coves.social"

     

       21
       21
       +
           enabled: false

     

       22
       22
       +
       

     

       23
       23
       +
         - name: "Science News"

     

       24
       24
       +
           url: "https://news.kagi.com/science.xml"

     

       25
       25
       +
           community_handle: "science.coves.social"

     

       26
       26
       +
           enabled: false

     

       27
       27
       +
       

     

       28
       28
       +
       # Logging configuration

     

       29
       29
       +
       log_level: "info"  # debug, info, warning, error

+5

aggregators/kagi-news/crontab

···

       1
       1
       +
       # Run Kagi News aggregator daily at 1 PM UTC (after Kagi updates around noon)

     

       2
       2
       +
       0 13 * * * cd /app && /usr/local/bin/python -m src.main >> /var/log/cron.log 2>&1

     

       3
       3
       +
       

     

       4
       4
       +
       # Blank line required at end of crontab

     

       5
       5
       +

+12

aggregators/kagi-news/pytest.ini

···

       1
       1
       +
       [pytest]

     

       2
       2
       +
       testpaths = tests

     

       3
       3
       +
       python_files = test_*.py

     

       4
       4
       +
       python_classes = Test*

     

       5
       5
       +
       python_functions = test_*

     

       6
       6
       +
       addopts =

     

       7
       7
       +
           -v

     

       8
       8
       +
           --strict-markers

     

       9
       9
       +
           --tb=short

     

       10
       10
       +
           --cov=src

     

       11
       11
       +
           --cov-report=term-missing

     

       12
       12
       +
           --cov-report=html

+17

aggregators/kagi-news/requirements.txt

···

       1
       1
       +
       # Core dependencies

     

       2
       2
       +
       feedparser==6.0.11

     

       3
       3
       +
       beautifulsoup4==4.12.3

     

       4
       4
       +
       requests==2.31.0

     

       5
       5
       +
       atproto==0.0.55

     

       6
       6
       +
       pyyaml==6.0.1

     

       7
       7
       +
       

     

       8
       8
       +
       # Testing

     

       9
       9
       +
       pytest==8.1.1

     

       10
       10
       +
       pytest-cov==5.0.0

     

       11
       11
       +
       responses==0.25.0

     

       12
       12
       +
       

     

       13
       13
       +
       # Development

     

       14
       14
       +
       black==24.3.0

     

       15
       15
       +
       mypy==1.9.0

     

       16
       16
       +
       types-PyYAML==6.0.12.12

     

       17
       17
       +
       types-requests==2.31.0.20240311

+30

internal/api/routes/discover.go

···

       1
       1
       +
       package routes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/discover"

     

       5
       5
       +
       	discoverCore "Coves/internal/core/discover"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/go-chi/chi/v5"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // RegisterDiscoverRoutes registers discover-related XRPC endpoints

     

       11
       11
       +
       //

     

       12
       12
       +
       // SECURITY & RATE LIMITING:

     

       13
       13
       +
       // - Discover feed is PUBLIC (no authentication required)

     

       14
       14
       +
       // - Protected by global rate limiter: 100 requests/minute per IP (main.go:84)

     

       15
       15
       +
       // - Query timeout enforced via context (prevents long-running queries)

     

       16
       16
       +
       // - Result limit capped at 50 posts per request (validated in service layer)

     

       17
       17
       +
       // - No caching currently implemented (future: 30-60s cache for hot feed)

     

       18
       18
       +
       func RegisterDiscoverRoutes(

     

       19
       19
       +
       	r chi.Router,

     

       20
       20
       +
       	discoverService discoverCore.Service,

     

       21
       21
       +
       ) {

     

       22
       22
       +
       	// Create handlers

     

       23
       23
       +
       	getDiscoverHandler := discover.NewGetDiscoverHandler(discoverService)

     

       24
       24
       +
       

     

       25
       25
       +
       	// GET /xrpc/social.coves.feed.getDiscover

     

       26
       26
       +
       	// Public endpoint - no authentication required

     

       27
       27
       +
       	// Shows posts from ALL communities (not personalized)

     

       28
       28
       +
       	// Rate limited: 100 req/min per IP via global middleware

     

       29
       29
       +
       	r.Get("/xrpc/social.coves.feed.getDiscover", getDiscoverHandler.HandleGetDiscover)

     

       30
       30
       +
       }

+71

internal/core/discover/service.go

···

       1
       1
       +
       package discover

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       type discoverService struct {

     

       9
       9
       +
       	repo Repository

     

       10
       10
       +
       }

     

       11
       11
       +
       

     

       12
       12
       +
       // NewDiscoverService creates a new discover service

     

       13
       13
       +
       func NewDiscoverService(repo Repository) Service {

     

       14
       14
       +
       	return &discoverService{

     

       15
       15
       +
       		repo: repo,

     

       16
       16
       +
       	}

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       // GetDiscover retrieves posts from all communities (public feed)

     

       20
       20
       +
       func (s *discoverService) GetDiscover(ctx context.Context, req GetDiscoverRequest) (*DiscoverResponse, error) {

     

       21
       21
       +
       	// Validate request

     

       22
       22
       +
       	if err := s.validateRequest(&req); err != nil {

     

       23
       23
       +
       		return nil, err

     

       24
       24
       +
       	}

     

       25
       25
       +
       

     

       26
       26
       +
       	// Fetch discover feed from repository (all posts from all communities)

     

       27
       27
       +
       	feedPosts, cursor, err := s.repo.GetDiscover(ctx, req)

     

       28
       28
       +
       	if err != nil {

     

       29
       29
       +
       		return nil, fmt.Errorf("failed to get discover feed: %w", err)

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	// Return discover response

     

       33
       33
       +
       	return &DiscoverResponse{

     

       34
       34
       +
       		Feed:   feedPosts,

     

       35
       35
       +
       		Cursor: cursor,

     

       36
       36
       +
       	}, nil

     

       37
       37
       +
       }

     

       38
       38
       +
       

     

       39
       39
       +
       // validateRequest validates the discover request parameters

     

       40
       40
       +
       func (s *discoverService) validateRequest(req *GetDiscoverRequest) error {

     

       41
       41
       +
       	// Validate and set defaults for sort

     

       42
       42
       +
       	if req.Sort == "" {

     

       43
       43
       +
       		req.Sort = "hot"

     

       44
       44
       +
       	}

     

       45
       45
       +
       	validSorts := map[string]bool{"hot": true, "top": true, "new": true}

     

       46
       46
       +
       	if !validSorts[req.Sort] {

     

       47
       47
       +
       		return NewValidationError("sort", "sort must be one of: hot, top, new")

     

       48
       48
       +
       	}

     

       49
       49
       +
       

     

       50
       50
       +
       	// Validate and set defaults for limit

     

       51
       51
       +
       	if req.Limit <= 0 {

     

       52
       52
       +
       		req.Limit = 15

     

       53
       53
       +
       	}

     

       54
       54
       +
       	if req.Limit > 50 {

     

       55
       55
       +
       		return NewValidationError("limit", "limit must not exceed 50")

     

       56
       56
       +
       	}

     

       57
       57
       +
       

     

       58
       58
       +
       	// Validate and set defaults for timeframe (only used with top sort)

     

       59
       59
       +
       	if req.Sort == "top" && req.Timeframe == "" {

     

       60
       60
       +
       		req.Timeframe = "day"

     

       61
       61
       +
       	}

     

       62
       62
       +
       	validTimeframes := map[string]bool{

     

       63
       63
       +
       		"hour": true, "day": true, "week": true,

     

       64
       64
       +
       		"month": true, "year": true, "all": true,

     

       65
       65
       +
       	}

     

       66
       66
       +
       	if req.Timeframe != "" && !validTimeframes[req.Timeframe] {

     

       67
       67
       +
       		return NewValidationError("timeframe", "timeframe must be one of: hour, day, week, month, year, all")

     

       68
       68
       +
       	}

     

       69
       69
       +
       

     

       70
       70
       +
       	return nil

     

       71
       71
       +
       }

+76

internal/core/timeline/service.go

···

       1
       1
       +
       package timeline

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       type timelineService struct {

     

       9
       9
       +
       	repo Repository

     

       10
       10
       +
       }

     

       11
       11
       +
       

     

       12
       12
       +
       // NewTimelineService creates a new timeline service

     

       13
       13
       +
       func NewTimelineService(repo Repository) Service {

     

       14
       14
       +
       	return &timelineService{

     

       15
       15
       +
       		repo: repo,

     

       16
       16
       +
       	}

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       // GetTimeline retrieves posts from all communities the user subscribes to

     

       20
       20
       +
       func (s *timelineService) GetTimeline(ctx context.Context, req GetTimelineRequest) (*TimelineResponse, error) {

     

       21
       21
       +
       	// 1. Validate request

     

       22
       22
       +
       	if err := s.validateRequest(&req); err != nil {

     

       23
       23
       +
       		return nil, err

     

       24
       24
       +
       	}

     

       25
       25
       +
       

     

       26
       26
       +
       	// 2. UserDID must be set (from auth middleware)

     

       27
       27
       +
       	if req.UserDID == "" {

     

       28
       28
       +
       		return nil, ErrUnauthorized

     

       29
       29
       +
       	}

     

       30
       30
       +
       

     

       31
       31
       +
       	// 3. Fetch timeline from repository (hydrated posts from subscribed communities)

     

       32
       32
       +
       	feedPosts, cursor, err := s.repo.GetTimeline(ctx, req)

     

       33
       33
       +
       	if err != nil {

     

       34
       34
       +
       		return nil, fmt.Errorf("failed to get timeline: %w", err)

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	// 4. Return timeline response

     

       38
       38
       +
       	return &TimelineResponse{

     

       39
       39
       +
       		Feed:   feedPosts,

     

       40
       40
       +
       		Cursor: cursor,

     

       41
       41
       +
       	}, nil

     

       42
       42
       +
       }

     

       43
       43
       +
       

     

       44
       44
       +
       // validateRequest validates the timeline request parameters

     

       45
       45
       +
       func (s *timelineService) validateRequest(req *GetTimelineRequest) error {

     

       46
       46
       +
       	// Validate and set defaults for sort

     

       47
       47
       +
       	if req.Sort == "" {

     

       48
       48
       +
       		req.Sort = "hot"

     

       49
       49
       +
       	}

     

       50
       50
       +
       	validSorts := map[string]bool{"hot": true, "top": true, "new": true}

     

       51
       51
       +
       	if !validSorts[req.Sort] {

     

       52
       52
       +
       		return NewValidationError("sort", "sort must be one of: hot, top, new")

     

       53
       53
       +
       	}

     

       54
       54
       +
       

     

       55
       55
       +
       	// Validate and set defaults for limit

     

       56
       56
       +
       	if req.Limit <= 0 {

     

       57
       57
       +
       		req.Limit = 15

     

       58
       58
       +
       	}

     

       59
       59
       +
       	if req.Limit > 50 {

     

       60
       60
       +
       		return NewValidationError("limit", "limit must not exceed 50")

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Validate and set defaults for timeframe (only used with top sort)

     

       64
       64
       +
       	if req.Sort == "top" && req.Timeframe == "" {

     

       65
       65
       +
       		req.Timeframe = "day"

     

       66
       66
       +
       	}

     

       67
       67
       +
       	validTimeframes := map[string]bool{

     

       68
       68
       +
       		"hour": true, "day": true, "week": true,

     

       69
       69
       +
       		"month": true, "year": true, "all": true,

     

       70
       70
       +
       	}

     

       71
       71
       +
       	if req.Timeframe != "" && !validTimeframes[req.Timeframe] {

     

       72
       72
       +
       		return NewValidationError("timeframe", "timeframe must be one of: hour, day, week, month, year, all")

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	return nil

     

       76
       76
       +
       }

+19

internal/api/handlers/errors.go

···

       1
       1
       +
       package handlers

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"encoding/json"

     

       5
       5
       +
       	"log"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       // WriteError writes a standardized JSON error response

     

       10
       10
       +
       func WriteError(w http.ResponseWriter, statusCode int, errorType, message string) {

     

       11
       11
       +
       	w.Header().Set("Content-Type", "application/json")

     

       12
       12
       +
       	w.WriteHeader(statusCode)

     

       13
       13
       +
       	if err := json.NewEncoder(w).Encode(map[string]interface{}{

     

       14
       14
       +
       		"error":   errorType,

     

       15
       15
       +
       		"message": message,

     

       16
       16
       +
       	}); err != nil {

     

       17
       17
       +
       		log.Printf("Failed to encode error response: %v", err)

     

       18
       18
       +
       	}

     

       19
       19
       +
       }

+125

internal/atproto/jetstream/vote_jetstream_connector.go

···

       1
       1
       +
       package jetstream

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"sync"

     

       9
       9
       +
       	"time"

     

       10
       10
       +
       

     

       11
       11
       +
       	"github.com/gorilla/websocket"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // VoteJetstreamConnector handles WebSocket connection to Jetstream for vote events

     

       15
       15
       +
       type VoteJetstreamConnector struct {

     

       16
       16
       +
       	consumer *VoteEventConsumer

     

       17
       17
       +
       	wsURL    string

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // NewVoteJetstreamConnector creates a new Jetstream WebSocket connector for vote events

     

       21
       21
       +
       func NewVoteJetstreamConnector(consumer *VoteEventConsumer, wsURL string) *VoteJetstreamConnector {

     

       22
       22
       +
       	return &VoteJetstreamConnector{

     

       23
       23
       +
       		consumer: consumer,

     

       24
       24
       +
       		wsURL:    wsURL,

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // Start begins consuming events from Jetstream

     

       29
       29
       +
       // Runs indefinitely, reconnecting on errors

     

       30
       30
       +
       func (c *VoteJetstreamConnector) Start(ctx context.Context) error {

     

       31
       31
       +
       	log.Printf("Starting Jetstream vote consumer: %s", c.wsURL)

     

       32
       32
       +
       

     

       33
       33
       +
       	for {

     

       34
       34
       +
       		select {

     

       35
       35
       +
       		case <-ctx.Done():

     

       36
       36
       +
       			log.Println("Jetstream vote consumer shutting down")

     

       37
       37
       +
       			return ctx.Err()

     

       38
       38
       +
       		default:

     

       39
       39
       +
       			if err := c.connect(ctx); err != nil {

     

       40
       40
       +
       				log.Printf("Jetstream vote connection error: %v. Retrying in 5s...", err)

     

       41
       41
       +
       				time.Sleep(5 * time.Second)

     

       42
       42
       +
       				continue

     

       43
       43
       +
       			}

     

       44
       44
       +
       		}

     

       45
       45
       +
       	}

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       // connect establishes WebSocket connection and processes events

     

       49
       49
       +
       func (c *VoteJetstreamConnector) connect(ctx context.Context) error {

     

       50
       50
       +
       	conn, _, err := websocket.DefaultDialer.DialContext(ctx, c.wsURL, nil)

     

       51
       51
       +
       	if err != nil {

     

       52
       52
       +
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       53
       53
       +
       	}

     

       54
       54
       +
       	defer func() {

     

       55
       55
       +
       		if closeErr := conn.Close(); closeErr != nil {

     

       56
       56
       +
       			log.Printf("Failed to close WebSocket connection: %v", closeErr)

     

       57
       57
       +
       		}

     

       58
       58
       +
       	}()

     

       59
       59
       +
       

     

       60
       60
       +
       	log.Println("Connected to Jetstream (vote consumer)")

     

       61
       61
       +
       

     

       62
       62
       +
       	// Set read deadline to detect connection issues

     

       63
       63
       +
       	if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       64
       64
       +
       		log.Printf("Failed to set read deadline: %v", err)

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	// Set pong handler to keep connection alive

     

       68
       68
       +
       	conn.SetPongHandler(func(string) error {

     

       69
       69
       +
       		if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       70
       70
       +
       			log.Printf("Failed to set read deadline in pong handler: %v", err)

     

       71
       71
       +
       		}

     

       72
       72
       +
       		return nil

     

       73
       73
       +
       	})

     

       74
       74
       +
       

     

       75
       75
       +
       	// Start ping ticker

     

       76
       76
       +
       	ticker := time.NewTicker(30 * time.Second)

     

       77
       77
       +
       	defer ticker.Stop()

     

       78
       78
       +
       

     

       79
       79
       +
       	done := make(chan struct{})

     

       80
       80
       +
       	var closeOnce sync.Once // Ensure done channel is only closed once

     

       81
       81
       +
       

     

       82
       82
       +
       	// Ping goroutine

     

       83
       83
       +
       	go func() {

     

       84
       84
       +
       		for {

     

       85
       85
       +
       			select {

     

       86
       86
       +
       			case <-ticker.C:

     

       87
       87
       +
       				if err := conn.WriteControl(websocket.PingMessage, []byte{}, time.Now().Add(10*time.Second)); err != nil {

     

       88
       88
       +
       					log.Printf("Failed to send ping: %v", err)

     

       89
       89
       +
       					closeOnce.Do(func() { close(done) })

     

       90
       90
       +
       					return

     

       91
       91
       +
       				}

     

       92
       92
       +
       			case <-done:

     

       93
       93
       +
       				return

     

       94
       94
       +
       			}

     

       95
       95
       +
       		}

     

       96
       96
       +
       	}()

     

       97
       97
       +
       

     

       98
       98
       +
       	// Read loop

     

       99
       99
       +
       	for {

     

       100
       100
       +
       		select {

     

       101
       101
       +
       		case <-done:

     

       102
       102
       +
       			return fmt.Errorf("connection closed by ping failure")

     

       103
       103
       +
       		default:

     

       104
       104
       +
       		}

     

       105
       105
       +
       

     

       106
       106
       +
       		_, message, err := conn.ReadMessage()

     

       107
       107
       +
       		if err != nil {

     

       108
       108
       +
       			closeOnce.Do(func() { close(done) })

     

       109
       109
       +
       			return fmt.Errorf("read error: %w", err)

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       112
       112
       +
       		// Parse Jetstream event

     

       113
       113
       +
       		var event JetstreamEvent

     

       114
       114
       +
       		if err := json.Unmarshal(message, &event); err != nil {

     

       115
       115
       +
       			log.Printf("Failed to parse Jetstream event: %v", err)

     

       116
       116
       +
       			continue

     

       117
       117
       +
       		}

     

       118
       118
       +
       

     

       119
       119
       +
       		// Process event through consumer

     

       120
       120
       +
       		if err := c.consumer.HandleEvent(ctx, &event); err != nil {

     

       121
       121
       +
       			log.Printf("Failed to handle vote event: %v", err)

     

       122
       122
       +
       			// Continue processing other events even if one fails

     

       123
       123
       +
       		}

     

       124
       124
       +
       	}

     

       125
       125
       +
       }

+28 -5

internal/atproto/lexicon/social/coves/interaction/vote.json

···

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "record",

     

       7
       7
       -
             "description": "An upvote on a post or comment",

     

       7
       7
       +
             "description": "A vote (upvote or downvote) on a post or comment",

     

       8
       8
        
             "key": "tid",

     

       9
       9
        
             "record": {

     

       10
       10
        
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "createdAt"],

     

       11
       11
       +
               "required": ["subject", "direction", "createdAt"],

     

       12
       12
        
               "properties": {

     

       13
       13
        
                 "subject": {

     

       14
       14
       +
                   "type": "ref",

     

       15
       15
       +
                   "ref": "#strongRef",

     

       16
       16
       +
                   "description": "Strong reference to the post or comment being voted on"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "direction": {

     

       14
       19
        
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the post or comment being voted on"

     

       20
       20
       +
                   "enum": ["up", "down"],

     

       21
       21
       +
                   "description": "Vote direction: up for upvote, down for downvote"

     

       17
       22
        
                 },

     

       18
       23
        
                 "createdAt": {

     

       19
       24
        
                   "type": "string",

     

       20
       20
       -
                   "format": "datetime"

     

       25
       25
       +
                   "format": "datetime",

     

       26
       26
       +
                   "description": "Timestamp when the vote was created"

     

       21
       27
        
                 }

     

       22
       28
        
               }

     

       23
       29
        
             }

     

       30
       30
       +
           },

     

       31
       31
       +
           "strongRef": {

     

       32
       32
       +
             "type": "object",

     

       33
       33
       +
             "description": "Strong reference to a record (AT-URI + CID)",

     

       34
       34
       +
             "required": ["uri", "cid"],

     

       35
       35
       +
             "properties": {

     

       36
       36
       +
               "uri": {

     

       37
       37
       +
                 "type": "string",

     

       38
       38
       +
                 "format": "at-uri",

     

       39
       39
       +
                 "description": "AT-URI of the record"

     

       40
       40
       +
               },

     

       41
       41
       +
               "cid": {

     

       42
       42
       +
                 "type": "string",

     

       43
       43
       +
                 "format": "cid",

     

       44
       44
       +
                 "description": "CID of the record content"

     

       45
       45
       +
               }

     

       46
       46
       +
             }

     

       24
       47
        
           }

     

       25
       48
        
         }

     

       26
       49
        
       }

+22

internal/db/migrations/014_remove_votes_voter_fk.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Remove foreign key constraint on votes.voter_did to prevent race conditions

     

       3
       3
       +
       -- between user and vote Jetstream consumers.

     

       4
       4
       +
       --

     

       5
       5
       +
       -- Rationale:

     

       6
       6
       +
       -- - Vote events can arrive before user events in Jetstream

     

       7
       7
       +
       -- - Creating votes should not fail if user hasn't been indexed yet

     

       8
       8
       +
       -- - Users are validated at the PDS level (votes come from user repos)

     

       9
       9
       +
       -- - Orphaned votes (from deleted users) are harmless and can be ignored in queries

     

       10
       10
       +
       

     

       11
       11
       +
       ALTER TABLE votes DROP CONSTRAINT IF EXISTS fk_voter;

     

       12
       12
       +
       

     

       13
       13
       +
       -- Add check constraint to ensure voter_did is a valid DID format

     

       14
       14
       +
       ALTER TABLE votes ADD CONSTRAINT chk_voter_did_format

     

       15
       15
       +
       CHECK (voter_did ~ '^did:(plc|web|key):');

     

       16
       16
       +
       

     

       17
       17
       +
       -- +goose Down

     

       18
       18
       +
       -- Restore foreign key constraint (note: this may fail if orphaned votes exist)

     

       19
       19
       +
       ALTER TABLE votes DROP CONSTRAINT IF EXISTS chk_voter_did_format;

     

       20
       20
       +
       

     

       21
       21
       +
       ALTER TABLE votes ADD CONSTRAINT fk_voter

     

       22
       22
       +
       FOREIGN KEY (voter_did) REFERENCES users(did) ON DELETE CASCADE;

+20 -3

Makefile

···

       191
       191
        
       	@go build -o server ./cmd/server

     

       192
       192
        
       	@echo "$(GREEN)✓ Build complete: ./server$(RESET)"

     

       193
       193
        
       

     

       194
       194
       -
       run: ## Run the Coves server (requires database running)

     

       195
       195
       -
       	@echo "$(GREEN)Starting Coves server...$(RESET)"

     

       196
       196
       -
       	@go run ./cmd/server

     

       194
       194
       +
       run: ## Run the Coves server with dev environment (requires database running)

     

       195
       195
       +
       	@./scripts/dev-run.sh

     

       197
       196
        
       

     

       198
       197
        
       ##@ Cleanup

     

       199
       198
        
       

     
···

       226
       225
        
       	@make dev-down

     

       227
       226
        
       	@make dev-up

     

       228
       227
        
       

     

       228
       228
       +
       ##@ Mobile Testing

     

       229
       229
       +
       

     

       230
       230
       +
       mobile-setup: ## Setup Android port forwarding for USB-connected devices (recommended)

     

       231
       231
       +
       	@echo "$(CYAN)Setting up Android mobile testing environment...$(RESET)"

     

       232
       232
       +
       	@./scripts/setup-mobile-ports.sh

     

       233
       233
       +
       

     

       234
       234
       +
       mobile-reset: ## Remove all Android port forwarding

     

       235
       235
       +
       	@echo "$(YELLOW)Removing Android port forwarding...$(RESET)"

     

       236
       236
       +
       	@adb reverse --remove-all || echo "$(YELLOW)No device connected$(RESET)"

     

       237
       237
       +
       	@echo "$(GREEN)✓ Port forwarding removed$(RESET)"

     

       238
       238
       +
       

     

       239
       239
       +
       ngrok-up: ## Start ngrok tunnels (for iOS or WiFi testing - requires paid plan for 3 tunnels)

     

       240
       240
       +
       	@echo "$(GREEN)Starting ngrok tunnels for mobile testing...$(RESET)"

     

       241
       241
       +
       	@./scripts/start-ngrok.sh

     

       242
       242
       +
       

     

       243
       243
       +
       ngrok-down: ## Stop all ngrok tunnels

     

       244
       244
       +
       	@./scripts/stop-ngrok.sh

     

       245
       245
       +
       

     

       229
       246
        
       ##@ Utilities

     

       230
       247
        
       

     

       231
       248
        
       validate-lexicon: ## Validate all Lexicon schemas

+14

scripts/dev-run.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Development server runner - loads .env.dev before starting

     

       3
       3
       +
       

     

       4
       4
       +
       set -a  # automatically export all variables

     

       5
       5
       +
       source .env.dev

     

       6
       6
       +
       set +a

     

       7
       7
       +
       

     

       8
       8
       +
       echo "🚀 Starting Coves server in DEV mode..."

     

       9
       9
       +
       echo "   IS_DEV_ENV: $IS_DEV_ENV"

     

       10
       10
       +
       echo "   PLC_DIRECTORY_URL: $PLC_DIRECTORY_URL"

     

       11
       11
       +
       echo "   JETSTREAM_URL: $JETSTREAM_URL"

     

       12
       12
       +
       echo ""

     

       13
       13
       +
       

     

       14
       14
       +
       go run ./cmd/server

+68

scripts/setup-mobile-ports.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Setup adb reverse port forwarding for mobile testing

     

       3
       3
       +
       # This allows the mobile app to access localhost services on the dev machine

     

       4
       4
       +
       

     

       5
       5
       +
       set -e

     

       6
       6
       +
       

     

       7
       7
       +
       # Colors

     

       8
       8
       +
       GREEN='\033[0;32m'

     

       9
       9
       +
       CYAN='\033[0;36m'

     

       10
       10
       +
       YELLOW='\033[1;33m'

     

       11
       11
       +
       RED='\033[0;31m'

     

       12
       12
       +
       NC='\033[0m' # No Color

     

       13
       13
       +
       

     

       14
       14
       +
       echo -e "${CYAN}📱 Setting up Android port forwarding for Coves mobile testing...${NC}"

     

       15
       15
       +
       echo ""

     

       16
       16
       +
       

     

       17
       17
       +
       # Check if adb is available

     

       18
       18
       +
       if ! command -v adb &> /dev/null; then

     

       19
       19
       +
           echo -e "${RED}✗ adb not found${NC}"

     

       20
       20
       +
           echo "Install Android SDK Platform Tools: https://developer.android.com/studio/releases/platform-tools"

     

       21
       21
       +
           exit 1

     

       22
       22
       +
       fi

     

       23
       23
       +
       

     

       24
       24
       +
       # Check if device is connected

     

       25
       25
       +
       DEVICES=$(adb devices | grep -v "List" | grep "device$" | wc -l)

     

       26
       26
       +
       if [ "$DEVICES" -eq 0 ]; then

     

       27
       27
       +
           echo -e "${RED}✗ No Android devices connected${NC}"

     

       28
       28
       +
           echo "Connect a device via USB or start an emulator"

     

       29
       29
       +
           exit 1

     

       30
       30
       +
       fi

     

       31
       31
       +
       

     

       32
       32
       +
       echo -e "${YELLOW}Setting up port forwarding...${NC}"

     

       33
       33
       +
       

     

       34
       34
       +
       # Forward ports from Android device to localhost

     

       35
       35
       +
       adb reverse tcp:3000 tcp:3001  # PDS (internal port in DID document)

     

       36
       36
       +
       adb reverse tcp:3001 tcp:3001  # PDS (external port)

     

       37
       37
       +
       adb reverse tcp:3002 tcp:3002  # PLC Directory

     

       38
       38
       +
       adb reverse tcp:8081 tcp:8081  # AppView

     

       39
       39
       +
       

     

       40
       40
       +
       echo ""

     

       41
       41
       +
       echo -e "${GREEN}✅ Port forwarding configured successfully!${NC}"

     

       42
       42
       +
       echo ""

     

       43
       43
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       44
       44
       +
       echo -e "${CYAN}                   PORT FORWARDING                         ${NC}"

     

       45
       45
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       46
       46
       +
       echo ""

     

       47
       47
       +
       echo -e "${GREEN}PDS (3000):${NC}      localhost:3001 → device:3000 ${YELLOW}(DID document port)${NC}"

     

       48
       48
       +
       echo -e "${GREEN}PDS (3001):${NC}      localhost:3001 → device:3001"

     

       49
       49
       +
       echo -e "${GREEN}PLC (3002):${NC}      localhost:3002 → device:3002"

     

       50
       50
       +
       echo -e "${GREEN}AppView (8081):${NC}  localhost:8081 → device:8081"

     

       51
       51
       +
       echo ""

     

       52
       52
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       53
       53
       +
       echo ""

     

       54
       54
       +
       echo -e "${CYAN}📱 Next Steps:${NC}"

     

       55
       55
       +
       echo ""

     

       56
       56
       +
       echo -e "1. Mobile app is already configured for localhost (environment_config.dart)"

     

       57
       57
       +
       echo ""

     

       58
       58
       +
       echo -e "2. Run mobile app:"

     

       59
       59
       +
       echo -e "   ${YELLOW}cd /home/bretton/Code/coves-mobile${NC}"

     

       60
       60
       +
       echo -e "   ${YELLOW}flutter run --dart-define=ENVIRONMENT=local${NC}"

     

       61
       61
       +
       echo ""

     

       62
       62
       +
       echo -e "3. Login with:"

     

       63
       63
       +
       echo -e "   Handle:   ${CYAN}charlie.local.coves.dev${NC}"

     

       64
       64
       +
       echo -e "   Password: ${CYAN}charliepass123${NC}"

     

       65
       65
       +
       echo ""

     

       66
       66
       +
       echo -e "${YELLOW}💡 Note: Port forwarding persists until device disconnects or you run:${NC}"

     

       67
       67
       +
       echo -e "${YELLOW}    adb reverse --remove-all${NC}"

     

       68
       68
       +
       echo ""

+116

scripts/start-ngrok.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Automated ngrok tunnel starter for mobile testing

     

       3
       3
       +
       # Starts 3 ngrok tunnels and captures their HTTPS URLs

     

       4
       4
       +
       

     

       5
       5
       +
       set -e

     

       6
       6
       +
       

     

       7
       7
       +
       # Colors

     

       8
       8
       +
       GREEN='\033[0;32m'

     

       9
       9
       +
       CYAN='\033[0;36m'

     

       10
       10
       +
       YELLOW='\033[1;33m'

     

       11
       11
       +
       NC='\033[0m' # No Color

     

       12
       12
       +
       

     

       13
       13
       +
       echo -e "${CYAN}🚀 Starting ngrok tunnels for Coves mobile testing...${NC}"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Kill any existing ngrok processes

     

       17
       17
       +
       pkill -f "ngrok http" || true

     

       18
       18
       +
       sleep 2

     

       19
       19
       +
       

     

       20
       20
       +
       # Start ngrok tunnels using separate processes (simpler, works with any config version)

     

       21
       21
       +
       echo -e "${YELLOW}Starting PDS tunnel (port 3001)...${NC}"

     

       22
       22
       +
       ngrok http 3001 --log=stdout > /tmp/ngrok-pds.log 2>&1 &

     

       23
       23
       +
       sleep 1

     

       24
       24
       +
       

     

       25
       25
       +
       echo -e "${YELLOW}Starting PLC tunnel (port 3002)...${NC}"

     

       26
       26
       +
       ngrok http 3002 --log=stdout > /tmp/ngrok-plc.log 2>&1 &

     

       27
       27
       +
       sleep 1

     

       28
       28
       +
       

     

       29
       29
       +
       echo -e "${YELLOW}Starting AppView tunnel (port 8081)...${NC}"

     

       30
       30
       +
       ngrok http 8081 --log=stdout > /tmp/ngrok-appview.log 2>&1 &

     

       31
       31
       +
       

     

       32
       32
       +
       # Get all PIDs

     

       33
       33
       +
       PIDS=$(pgrep -f "ngrok http")

     

       34
       34
       +
       NGROK_PID=$PIDS

     

       35
       35
       +
       

     

       36
       36
       +
       # Save PID for cleanup

     

       37
       37
       +
       echo "$NGROK_PID" > /tmp/ngrok-pids.txt

     

       38
       38
       +
       

     

       39
       39
       +
       # Wait for ngrok to initialize

     

       40
       40
       +
       echo ""

     

       41
       41
       +
       echo -e "${YELLOW}Waiting for tunnels to initialize...${NC}"

     

       42
       42
       +
       sleep 7

     

       43
       43
       +
       

     

       44
       44
       +
       # Fetch URLs from ngrok API (single API at port 4040)

     

       45
       45
       +
       echo ""

     

       46
       46
       +
       echo -e "${GREEN}✅ Tunnels started successfully!${NC}"

     

       47
       47
       +
       echo ""

     

       48
       48
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       49
       49
       +
       echo -e "${CYAN}                   NGROK TUNNEL URLS                       ${NC}"

     

       50
       50
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       51
       51
       +
       echo ""

     

       52
       52
       +
       

     

       53
       53
       +
       # Get all tunnel info

     

       54
       54
       +
       TUNNELS=$(curl -s http://localhost:4040/api/tunnels 2>/dev/null || echo "")

     

       55
       55
       +
       

     

       56
       56
       +
       # Extract URLs by matching port in config.addr

     

       57
       57
       +
       PDS_URL=$(echo "$TUNNELS" | jq -r '.tunnels[] | select(.config.addr | contains("3001")) | select(.proto=="https") | .public_url' 2>/dev/null | head -1)

     

       58
       58
       +
       PLC_URL=$(echo "$TUNNELS" | jq -r '.tunnels[] | select(.config.addr | contains("3002")) | select(.proto=="https") | .public_url' 2>/dev/null | head -1)

     

       59
       59
       +
       APPVIEW_URL=$(echo "$TUNNELS" | jq -r '.tunnels[] | select(.config.addr | contains("8081")) | select(.proto=="https") | .public_url' 2>/dev/null | head -1)

     

       60
       60
       +
       

     

       61
       61
       +
       # Fallback if jq filtering fails - just get first 3 HTTPS URLs

     

       62
       62
       +
       if [ -z "$PDS_URL" ] || [ -z "$PLC_URL" ] || [ -z "$APPVIEW_URL" ]; then

     

       63
       63
       +
           echo -e "${YELLOW}⚠️  Port-based matching failed, using fallback...${NC}"

     

       64
       64
       +
           URLS=($(echo "$TUNNELS" | jq -r '.tunnels[] | select(.proto=="https") | .public_url' 2>/dev/null))

     

       65
       65
       +
           PDS_URL=${URLS[0]:-ERROR}

     

       66
       66
       +
           PLC_URL=${URLS[1]:-ERROR}

     

       67
       67
       +
           APPVIEW_URL=${URLS[2]:-ERROR}

     

       68
       68
       +
       fi

     

       69
       69
       +
       

     

       70
       70
       +
       echo -e "${GREEN}PDS (3001):${NC}      $PDS_URL"

     

       71
       71
       +
       echo -e "${GREEN}PLC (3002):${NC}      $PLC_URL"

     

       72
       72
       +
       echo -e "${GREEN}AppView (8081):${NC}  $APPVIEW_URL"

     

       73
       73
       +
       

     

       74
       74
       +
       echo ""

     

       75
       75
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       76
       76
       +
       echo ""

     

       77
       77
       +
       

     

       78
       78
       +
       # Check if any URLs failed

     

       79
       79
       +
       if [[ "$PDS_URL" == "ERROR" ]] || [[ "$PLC_URL" == "ERROR" ]] || [[ "$APPVIEW_URL" == "ERROR" ]]; then

     

       80
       80
       +
           echo -e "${YELLOW}⚠️  Some tunnels failed to start. Check logs:${NC}"

     

       81
       81
       +
           echo "  tail -f /tmp/ngrok-pds.log"

     

       82
       82
       +
           echo "  tail -f /tmp/ngrok-plc.log"

     

       83
       83
       +
           echo "  tail -f /tmp/ngrok-appview.log"

     

       84
       84
       +
           exit 1

     

       85
       85
       +
       fi

     

       86
       86
       +
       

     

       87
       87
       +
       # Extract clean URLs (remove https://)

     

       88
       88
       +
       PDS_CLEAN=$(echo $PDS_URL | sed 's|https://||')

     

       89
       89
       +
       PLC_CLEAN=$(echo $PLC_URL | sed 's|https://||')

     

       90
       90
       +
       APPVIEW_CLEAN=$(echo $APPVIEW_URL | sed 's|https://||')

     

       91
       91
       +
       

     

       92
       92
       +
       echo -e "${CYAN}📱 Next Steps:${NC}"

     

       93
       93
       +
       echo ""

     

       94
       94
       +
       echo -e "1. Update ${YELLOW}coves-mobile/lib/config/environment_config.dart${NC}:"

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       echo -e "${GREEN}static const local = EnvironmentConfig(${NC}"

     

       97
       97
       +
       echo -e "${GREEN}  environment: Environment.local,${NC}"

     

       98
       98
       +
       echo -e "${GREEN}  apiUrl: '$APPVIEW_URL',${NC}"

     

       99
       99
       +
       echo -e "${GREEN}  handleResolverUrl: '$PDS_URL/xrpc/com.atproto.identity.resolveHandle',${NC}"

     

       100
       100
       +
       echo -e "${GREEN}  plcDirectoryUrl: '$PLC_URL',${NC}"

     

       101
       101
       +
       echo -e "${GREEN});${NC}"

     

       102
       102
       +
       echo ""

     

       103
       103
       +
       echo -e "2. Run mobile app:"

     

       104
       104
       +
       echo -e "   ${YELLOW}cd /home/bretton/Code/coves-mobile${NC}"

     

       105
       105
       +
       echo -e "   ${YELLOW}flutter run --dart-define=ENVIRONMENT=local${NC}"

     

       106
       106
       +
       echo ""

     

       107
       107
       +
       echo -e "3. Login with:"

     

       108
       108
       +
       echo -e "   Handle:   ${CYAN}bob.local.coves.dev${NC}"

     

       109
       109
       +
       echo -e "   Password: ${CYAN}bobpass123${NC}"

     

       110
       110
       +
       echo ""

     

       111
       111
       +
       echo -e "${YELLOW}💡 Tip: Leave this terminal open. Press Ctrl+C to stop tunnels.${NC}"

     

       112
       112
       +
       echo -e "${YELLOW}    Or run: make ngrok-down${NC}"

     

       113
       113
       +
       echo ""

     

       114
       114
       +
       

     

       115
       115
       +
       # Keep script running (can be killed with Ctrl+C or make ngrok-down)

     

       116
       116
       +
       wait

+26

scripts/stop-ngrok.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Stop all ngrok tunnels

     

       3
       3
       +
       

     

       4
       4
       +
       # Colors

     

       5
       5
       +
       GREEN='\033[0;32m'

     

       6
       6
       +
       YELLOW='\033[1;33m'

     

       7
       7
       +
       NC='\033[0m'

     

       8
       8
       +
       

     

       9
       9
       +
       echo -e "${YELLOW}Stopping ngrok tunnels...${NC}"

     

       10
       10
       +
       

     

       11
       11
       +
       # Kill processes by PID if available

     

       12
       12
       +
       if [ -f /tmp/ngrok-pids.txt ]; then

     

       13
       13
       +
           PIDS=$(cat /tmp/ngrok-pids.txt)

     

       14
       14
       +
           for pid in $PIDS; do

     

       15
       15
       +
               kill $pid 2>/dev/null || true

     

       16
       16
       +
           done

     

       17
       17
       +
           rm /tmp/ngrok-pids.txt

     

       18
       18
       +
       fi

     

       19
       19
       +
       

     

       20
       20
       +
       # Fallback: kill all ngrok processes

     

       21
       21
       +
       pkill -f "ngrok http" || true

     

       22
       22
       +
       

     

       23
       23
       +
       # Clean up logs

     

       24
       24
       +
       rm -f /tmp/ngrok-*.log

     

       25
       25
       +
       

     

       26
       26
       +
       echo -e "${GREEN}✓ ngrok tunnels stopped${NC}"

-67

internal/atproto/lexicon/social/coves/interaction/createVote.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.createVote",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Vote on a post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject", "direction"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to vote on"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "direction": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "enum": ["up", "down"],

     

       22
       22
       -
                     "description": "Vote direction"

     

       23
       23
       -
                   }

     

       24
       24
       -
                 }

     

       25
       25
       -
               }

     

       26
       26
       -
             },

     

       27
       27
       -
             "output": {

     

       28
       28
       -
               "encoding": "application/json",

     

       29
       29
       -
               "schema": {

     

       30
       30
       -
                 "type": "object",

     

       31
       31
       -
                 "required": ["uri", "cid"],

     

       32
       32
       -
                 "properties": {

     

       33
       33
       -
                   "uri": {

     

       34
       34
       -
                     "type": "string",

     

       35
       35
       -
                     "format": "at-uri",

     

       36
       36
       -
                     "description": "AT-URI of the created vote record"

     

       37
       37
       -
                   },

     

       38
       38
       -
                   "cid": {

     

       39
       39
       -
                     "type": "string",

     

       40
       40
       -
                     "format": "cid",

     

       41
       41
       -
                     "description": "CID of the created vote record"

     

       42
       42
       -
                   },

     

       43
       43
       -
                   "existing": {

     

       44
       44
       -
                     "type": "string",

     

       45
       45
       -
                     "format": "at-uri",

     

       46
       46
       -
                     "description": "AT-URI of existing vote if updating"

     

       47
       47
       -
                   }

     

       48
       48
       -
                 }

     

       49
       49
       -
               }

     

       50
       50
       -
             },

     

       51
       51
       -
             "errors": [

     

       52
       52
       -
               {

     

       53
       53
       -
                 "name": "SubjectNotFound",

     

       54
       54
       -
                 "description": "Post or comment not found"

     

       55
       55
       -
               },

     

       56
       56
       -
               {

     

       57
       57
       -
                 "name": "NotAuthorized",

     

       58
       58
       -
                 "description": "User is not authorized to vote"

     

       59
       59
       -
               },

     

       60
       60
       -
               {

     

       61
       61
       -
                 "name": "Banned",

     

       62
       62
       -
                 "description": "User is banned from this community"

     

       63
       63
       -
               }

     

       64
       64
       -
             ]

     

       65
       65
       -
           }

     

       66
       66
       -
         }

     

       67
       67
       -
       }

-37

internal/atproto/lexicon/social/coves/interaction/deleteVote.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.deleteVote",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Remove a vote from a post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to remove vote from"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "VoteNotFound",

     

       32
       32
       -
                 "description": "No vote found on this subject"

     

       33
       33
       -
               }

     

       34
       34
       -
             ]

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

+27 -27

internal/core/aggregators/aggregator.go

···

       6
       6
        
       // Aggregators are autonomous services that can post content to communities after authorization

     

       7
       7
        
       // Following Bluesky's pattern: app.bsky.feed.generator and app.bsky.labeler.service

     

       8
       8
        
       type Aggregator struct {

     

       9
       9
       -
       	DID              string    `json:"did" db:"did"`                                // Aggregator's DID (primary key)

     

       10
       10
       -
       	DisplayName      string    `json:"displayName" db:"display_name"`               // Human-readable name

     

       11
       11
       -
       	Description      string    `json:"description,omitempty" db:"description"`      // What the aggregator does

     

       12
       12
       -
       	AvatarURL        string    `json:"avatarUrl,omitempty" db:"avatar_url"`         // Optional avatar image URL

     

       13
       13
       -
       	ConfigSchema     []byte    `json:"configSchema,omitempty" db:"config_schema"`   // JSON Schema for configuration (JSONB)

     

       14
       14
       -
       	MaintainerDID    string    `json:"maintainerDid,omitempty" db:"maintainer_did"` // Contact for support/issues

     

       15
       15
       -
       	SourceURL        string    `json:"sourceUrl,omitempty" db:"source_url"`         // Source code URL (transparency)

     

       16
       16
       -
       	CommunitiesUsing int       `json:"communitiesUsing" db:"communities_using"`     // Auto-updated by trigger

     

       17
       17
       -
       	PostsCreated     int       `json:"postsCreated" db:"posts_created"`             // Auto-updated by trigger

     

       18
       18
       -
       	CreatedAt        time.Time `json:"createdAt" db:"created_at"`                   // When aggregator was created (from lexicon)

     

       19
       19
       -
       	IndexedAt        time.Time `json:"indexedAt" db:"indexed_at"`                   // When we indexed this record

     

       20
       20
       -
       	RecordURI        string    `json:"recordUri,omitempty" db:"record_uri"`         // at://did/social.coves.aggregator.service/self

     

       21
       21
       -
       	RecordCID        string    `json:"recordCid,omitempty" db:"record_cid"`         // Content hash

     

       9
       9
       +
       	CreatedAt        time.Time `json:"createdAt" db:"created_at"`

     

       10
       10
       +
       	IndexedAt        time.Time `json:"indexedAt" db:"indexed_at"`

     

       11
       11
       +
       	AvatarURL        string    `json:"avatarUrl,omitempty" db:"avatar_url"`

     

       12
       12
       +
       	DID              string    `json:"did" db:"did"`

     

       13
       13
       +
       	MaintainerDID    string    `json:"maintainerDid,omitempty" db:"maintainer_did"`

     

       14
       14
       +
       	SourceURL        string    `json:"sourceUrl,omitempty" db:"source_url"`

     

       15
       15
       +
       	Description      string    `json:"description,omitempty" db:"description"`

     

       16
       16
       +
       	DisplayName      string    `json:"displayName" db:"display_name"`

     

       17
       17
       +
       	RecordURI        string    `json:"recordUri,omitempty" db:"record_uri"`

     

       18
       18
       +
       	RecordCID        string    `json:"recordCid,omitempty" db:"record_cid"`

     

       19
       19
       +
       	ConfigSchema     []byte    `json:"configSchema,omitempty" db:"config_schema"`

     

       20
       20
       +
       	CommunitiesUsing int       `json:"communitiesUsing" db:"communities_using"`

     

       21
       21
       +
       	PostsCreated     int       `json:"postsCreated" db:"posts_created"`

     

       22
       22
        
       }

     

       23
       23
        
       

     

       24
       24
        
       // Authorization represents a community's authorization for an aggregator

     

       25
       25
        
       // Stored in community's repository: at://community_did/social.coves.aggregator.authorization/{rkey}

     

       26
       26
        
       type Authorization struct {

     

       27
       27
       -
       	ID            int        `json:"id" db:"id"`                            // Database ID

     

       28
       28
       -
       	AggregatorDID string     `json:"aggregatorDid" db:"aggregator_did"`     // Which aggregator

     

       29
       29
       -
       	CommunityDID  string     `json:"communityDid" db:"community_did"`       // Which community

     

       30
       30
       -
       	Enabled       bool       `json:"enabled" db:"enabled"`                  // Current status

     

       31
       31
       -
       	Config        []byte     `json:"config,omitempty" db:"config"`          // Aggregator-specific config (JSONB)

     

       32
       32
       -
       	CreatedBy     string     `json:"createdBy,omitempty" db:"created_by"`   // Moderator DID who enabled it

     

       33
       33
       -
       	DisabledBy    string     `json:"disabledBy,omitempty" db:"disabled_by"` // Moderator DID who disabled it

     

       34
       34
       -
       	CreatedAt     time.Time  `json:"createdAt" db:"created_at"`             // When authorization was created

     

       35
       35
       -
       	DisabledAt    *time.Time `json:"disabledAt,omitempty" db:"disabled_at"` // When authorization was disabled (for modlog/audit)

     

       36
       36
       -
       	IndexedAt     time.Time  `json:"indexedAt" db:"indexed_at"`             // When we indexed this record

     

       37
       37
       -
       	RecordURI     string     `json:"recordUri,omitempty" db:"record_uri"`   // at://community_did/social.coves.aggregator.authorization/{rkey}

     

       38
       38
       -
       	RecordCID     string     `json:"recordCid,omitempty" db:"record_cid"`   // Content hash

     

       27
       27
       +
       	CreatedAt     time.Time  `json:"createdAt" db:"created_at"`

     

       28
       28
       +
       	IndexedAt     time.Time  `json:"indexedAt" db:"indexed_at"`

     

       29
       29
       +
       	DisabledAt    *time.Time `json:"disabledAt,omitempty" db:"disabled_at"`

     

       30
       30
       +
       	AggregatorDID string     `json:"aggregatorDid" db:"aggregator_did"`

     

       31
       31
       +
       	CommunityDID  string     `json:"communityDid" db:"community_did"`

     

       32
       32
       +
       	CreatedBy     string     `json:"createdBy,omitempty" db:"created_by"`

     

       33
       33
       +
       	DisabledBy    string     `json:"disabledBy,omitempty" db:"disabled_by"`

     

       34
       34
       +
       	RecordURI     string     `json:"recordUri,omitempty" db:"record_uri"`

     

       35
       35
       +
       	RecordCID     string     `json:"recordCid,omitempty" db:"record_cid"`

     

       36
       36
       +
       	Config        []byte     `json:"config,omitempty" db:"config"`

     

       37
       37
       +
       	ID            int        `json:"id" db:"id"`

     

       38
       38
       +
       	Enabled       bool       `json:"enabled" db:"enabled"`

     

       39
       39
        
       }

     

       40
       40
        
       

     

       41
       41
        
       // AggregatorPost represents tracking of posts created by aggregators

     

       42
       42
        
       // AppView-only table for rate limiting and statistics

     

       43
       43
        
       type AggregatorPost struct {

     

       44
       44
       -
       	ID            int       `json:"id" db:"id"`

     

       44
       44
       +
       	CreatedAt     time.Time `json:"createdAt" db:"created_at"`

     

       45
       45
        
       	AggregatorDID string    `json:"aggregatorDid" db:"aggregator_did"`

     

       46
       46
        
       	CommunityDID  string    `json:"communityDid" db:"community_did"`

     

       47
       47
        
       	PostURI       string    `json:"postUri" db:"post_uri"`

     

       48
       48
        
       	PostCID       string    `json:"postCid" db:"post_cid"`

     

       49
       49
       -
       	CreatedAt     time.Time `json:"createdAt" db:"created_at"`

     

       49
       49
       +
       	ID            int       `json:"id" db:"id"`

     

       50
       50
        
       }

     

       51
       51
        
       

     

       52
       52
        
       // EnableAggregatorRequest represents input for enabling an aggregator in a community

+100

internal/atproto/lexicon/social/coves/community/post.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.post",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "record",

     

       7
       7
       +
             "description": "A post in a Coves community. Posts live in community repositories and persist independently of the author.",

     

       8
       8
       +
             "key": "tid",

     

       9
       9
       +
             "record": {

     

       10
       10
       +
               "type": "object",

     

       11
       11
       +
               "required": ["community", "author", "createdAt"],

     

       12
       12
       +
               "properties": {

     

       13
       13
       +
                 "community": {

     

       14
       14
       +
                   "type": "string",

     

       15
       15
       +
                   "format": "at-identifier",

     

       16
       16
       +
                   "description": "DID or handle of the community this was posted to"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "author": {

     

       19
       19
       +
                   "type": "string",

     

       20
       20
       +
                   "format": "did",

     

       21
       21
       +
                   "description": "DID of the user who created this post"

     

       22
       22
       +
                 },

     

       23
       23
       +
                 "title": {

     

       24
       24
       +
                   "type": "string",

     

       25
       25
       +
                   "maxGraphemes": 300,

     

       26
       26
       +
                   "maxLength": 3000,

     

       27
       27
       +
                   "description": "Post title (optional for media-only posts)"

     

       28
       28
       +
                 },

     

       29
       29
       +
                 "content": {

     

       30
       30
       +
                   "type": "string",

     

       31
       31
       +
                   "maxGraphemes": 10000,

     

       32
       32
       +
                   "maxLength": 100000,

     

       33
       33
       +
                   "description": "Post content - supports rich text via facets"

     

       34
       34
       +
                 },

     

       35
       35
       +
                 "facets": {

     

       36
       36
       +
                   "type": "array",

     

       37
       37
       +
                   "description": "Annotations for rich text (mentions, links, tags)",

     

       38
       38
       +
                   "items": {

     

       39
       39
       +
                     "type": "ref",

     

       40
       40
       +
                     "ref": "social.coves.richtext.facet"

     

       41
       41
       +
                   }

     

       42
       42
       +
                 },

     

       43
       43
       +
                 "embed": {

     

       44
       44
       +
                   "type": "union",

     

       45
       45
       +
                   "description": "Embedded media, external links, or quoted posts",

     

       46
       46
       +
                   "refs": [

     

       47
       47
       +
                     "social.coves.embed.images",

     

       48
       48
       +
                     "social.coves.embed.video",

     

       49
       49
       +
                     "social.coves.embed.external",

     

       50
       50
       +
                     "social.coves.embed.post"

     

       51
       51
       +
                   ]

     

       52
       52
       +
                 },

     

       53
       53
       +
                 "langs": {

     

       54
       54
       +
                   "type": "array",

     

       55
       55
       +
                   "description": "Languages used in the post content (ISO 639-1)",

     

       56
       56
       +
                   "maxLength": 3,

     

       57
       57
       +
                   "items": {

     

       58
       58
       +
                     "type": "string",

     

       59
       59
       +
                     "format": "language"

     

       60
       60
       +
                   }

     

       61
       61
       +
                 },

     

       62
       62
       +
                 "labels": {

     

       63
       63
       +
                   "type": "ref",

     

       64
       64
       +
                   "ref": "com.atproto.label.defs#selfLabels",

     

       65
       65
       +
                   "description": "Self-applied content labels (NSFW, spoilers, etc.)"

     

       66
       66
       +
                 },

     

       67
       67
       +
                 "tags": {

     

       68
       68
       +
                   "type": "array",

     

       69
       69
       +
                   "description": "User-applied topic tags",

     

       70
       70
       +
                   "maxLength": 8,

     

       71
       71
       +
                   "items": {

     

       72
       72
       +
                     "type": "string",

     

       73
       73
       +
                     "maxLength": 64,

     

       74
       74
       +
                     "maxGraphemes": 64

     

       75
       75
       +
                   }

     

       76
       76
       +
                 },

     

       77
       77
       +
                 "crosspostOf": {

     

       78
       78
       +
                   "type": "ref",

     

       79
       79
       +
                   "ref": "com.atproto.repo.strongRef",

     

       80
       80
       +
                   "description": "If this is a crosspost, strong reference to the immediate parent post"

     

       81
       81
       +
                 },

     

       82
       82
       +
                 "crosspostChain": {

     

       83
       83
       +
                   "type": "array",

     

       84
       84
       +
                   "description": "Full chain of crossposts with version pinning. First element is original, last is immediate parent.",

     

       85
       85
       +
                   "maxLength": 25,

     

       86
       86
       +
                   "items": {

     

       87
       87
       +
                     "type": "ref",

     

       88
       88
       +
                     "ref": "com.atproto.repo.strongRef"

     

       89
       89
       +
                   }

     

       90
       90
       +
                 },

     

       91
       91
       +
                 "createdAt": {

     

       92
       92
       +
                   "type": "string",

     

       93
       93
       +
                   "format": "datetime",

     

       94
       94
       +
                   "description": "Timestamp of post creation"

     

       95
       95
       +
                 }

     

       96
       96
       +
               }

     

       97
       97
       +
             }

     

       98
       98
       +
           }

     

       99
       99
       +
         }

     

       100
       100
       +
       }

+119

internal/atproto/lexicon/social/coves/community/post/create.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.post.create",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Create a new post in a community",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["community"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "community": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-identifier",

     

       17
       17
       +
                     "description": "DID or handle of the community to post in"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "title": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "maxGraphemes": 300,

     

       22
       22
       +
                     "maxLength": 3000,

     

       23
       23
       +
                     "description": "Post title (optional for media-only posts)"

     

       24
       24
       +
                   },

     

       25
       25
       +
                   "content": {

     

       26
       26
       +
                     "type": "string",

     

       27
       27
       +
                     "maxGraphemes": 10000,

     

       28
       28
       +
                     "maxLength": 100000,

     

       29
       29
       +
                     "description": "Post content - supports rich text via facets"

     

       30
       30
       +
                   },

     

       31
       31
       +
                   "facets": {

     

       32
       32
       +
                     "type": "array",

     

       33
       33
       +
                     "description": "Annotations for rich text (mentions, links, tags)",

     

       34
       34
       +
                     "items": {

     

       35
       35
       +
                       "type": "ref",

     

       36
       36
       +
                       "ref": "social.coves.richtext.facet"

     

       37
       37
       +
                     }

     

       38
       38
       +
                   },

     

       39
       39
       +
                   "embed": {

     

       40
       40
       +
                     "type": "union",

     

       41
       41
       +
                     "description": "Embedded media, external links, or quoted posts",

     

       42
       42
       +
                     "refs": [

     

       43
       43
       +
                       "social.coves.embed.images",

     

       44
       44
       +
                       "social.coves.embed.video",

     

       45
       45
       +
                       "social.coves.embed.external",

     

       46
       46
       +
                       "social.coves.embed.post"

     

       47
       47
       +
                     ]

     

       48
       48
       +
                   },

     

       49
       49
       +
                   "langs": {

     

       50
       50
       +
                     "type": "array",

     

       51
       51
       +
                     "description": "Languages used in the post content (ISO 639-1)",

     

       52
       52
       +
                     "maxLength": 3,

     

       53
       53
       +
                     "items": {

     

       54
       54
       +
                       "type": "string",

     

       55
       55
       +
                       "format": "language"

     

       56
       56
       +
                     }

     

       57
       57
       +
                   },

     

       58
       58
       +
                   "labels": {

     

       59
       59
       +
                     "type": "ref",

     

       60
       60
       +
                     "ref": "com.atproto.label.defs#selfLabels",

     

       61
       61
       +
                     "description": "Self-applied content labels (NSFW, spoilers, etc.)"

     

       62
       62
       +
                   },

     

       63
       63
       +
                   "tags": {

     

       64
       64
       +
                     "type": "array",

     

       65
       65
       +
                     "description": "User-applied topic tags",

     

       66
       66
       +
                     "maxLength": 8,

     

       67
       67
       +
                     "items": {

     

       68
       68
       +
                       "type": "string",

     

       69
       69
       +
                       "maxLength": 64,

     

       70
       70
       +
                       "maxGraphemes": 64

     

       71
       71
       +
                     }

     

       72
       72
       +
                   }

     

       73
       73
       +
                 }

     

       74
       74
       +
               }

     

       75
       75
       +
             },

     

       76
       76
       +
             "output": {

     

       77
       77
       +
               "encoding": "application/json",

     

       78
       78
       +
               "schema": {

     

       79
       79
       +
                 "type": "object",

     

       80
       80
       +
                 "required": ["uri", "cid"],

     

       81
       81
       +
                 "properties": {

     

       82
       82
       +
                   "uri": {

     

       83
       83
       +
                     "type": "string",

     

       84
       84
       +
                     "format": "at-uri",

     

       85
       85
       +
                     "description": "AT-URI of the created post"

     

       86
       86
       +
                   },

     

       87
       87
       +
                   "cid": {

     

       88
       88
       +
                     "type": "string",

     

       89
       89
       +
                     "format": "cid",

     

       90
       90
       +
                     "description": "CID of the created post"

     

       91
       91
       +
                   }

     

       92
       92
       +
                 }

     

       93
       93
       +
               }

     

       94
       94
       +
             },

     

       95
       95
       +
             "errors": [

     

       96
       96
       +
               {

     

       97
       97
       +
                 "name": "CommunityNotFound",

     

       98
       98
       +
                 "description": "Community not found"

     

       99
       99
       +
               },

     

       100
       100
       +
               {

     

       101
       101
       +
                 "name": "NotAuthorized",

     

       102
       102
       +
                 "description": "User is not authorized to post in this community"

     

       103
       103
       +
               },

     

       104
       104
       +
               {

     

       105
       105
       +
                 "name": "Banned",

     

       106
       106
       +
                 "description": "User is banned from this community"

     

       107
       107
       +
               },

     

       108
       108
       +
               {

     

       109
       109
       +
                 "name": "InvalidContent",

     

       110
       110
       +
                 "description": "Post content violates community rules"

     

       111
       111
       +
               },

     

       112
       112
       +
               {

     

       113
       113
       +
                 "name": "ContentRuleViolation",

     

       114
       114
       +
                 "description": "Post violates community content rules (e.g., embeds not allowed, text too short)"

     

       115
       115
       +
               }

     

       116
       116
       +
             ]

     

       117
       117
       +
           }

     

       118
       118
       +
         }

     

       119
       119
       +
       }

+41

internal/atproto/lexicon/social/coves/community/post/delete.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.post.delete",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Delete a post",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["uri"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "uri": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-uri",

     

       17
       17
       +
                     "description": "AT-URI of the post to delete"

     

       18
       18
       +
                   }

     

       19
       19
       +
                 }

     

       20
       20
       +
               }

     

       21
       21
       +
             },

     

       22
       22
       +
             "output": {

     

       23
       23
       +
               "encoding": "application/json",

     

       24
       24
       +
               "schema": {

     

       25
       25
       +
                 "type": "object",

     

       26
       26
       +
                 "properties": {}

     

       27
       27
       +
               }

     

       28
       28
       +
             },

     

       29
       29
       +
             "errors": [

     

       30
       30
       +
               {

     

       31
       31
       +
                 "name": "PostNotFound",

     

       32
       32
       +
                 "description": "Post not found"

     

       33
       33
       +
               },

     

       34
       34
       +
               {

     

       35
       35
       +
                 "name": "NotAuthorized",

     

       36
       36
       +
                 "description": "User is not authorized to delete this post"

     

       37
       37
       +
               }

     

       38
       38
       +
             ]

     

       39
       39
       +
           }

     

       40
       40
       +
         }

     

       41
       41
       +
       }

+6 -6

internal/atproto/lexicon/social/coves/embed/post.json

···

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "object",

     

       7
       7
       -
             "description": "Embedded reference to another post",

     

       8
       8
       -
             "required": ["uri"],

     

       7
       7
       +
             "description": "Embedded reference to another post (quoted post)",

     

       8
       8
       +
             "required": ["post"],

     

       9
       9
        
             "properties": {

     

       10
       10
       -
               "uri": {

     

       11
       11
       -
                 "type": "string",

     

       12
       12
       -
                 "format": "at-uri",

     

       13
       13
       -
                 "description": "AT-URI of the post being embedded"

     

       10
       10
       +
               "post": {

     

       11
       11
       +
                 "type": "ref",

     

       12
       12
       +
                 "ref": "com.atproto.repo.strongRef",

     

       13
       13
       +
                 "description": "Strong reference to the embedded post (includes URI and CID)"

     

       14
       14
        
               }

     

       15
       15
        
             }

     

       16
       16
        
           }

+47

internal/db/migrations/015_alter_content_labels_to_jsonb.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Change content_labels from TEXT[] to JSONB to preserve full com.atproto.label.defs#selfLabels structure

     

       3
       3
       +
       -- This allows storing the optional 'neg' field and future extensions

     

       4
       4
       +
       

     

       5
       5
       +
       -- Create temporary function to convert TEXT[] to selfLabels JSONB

     

       6
       6
       +
       -- +goose StatementBegin

     

       7
       7
       +
       CREATE OR REPLACE FUNCTION convert_labels_to_jsonb(labels TEXT[])

     

       8
       8
       +
       RETURNS JSONB AS $$

     

       9
       9
       +
       BEGIN

     

       10
       10
       +
         IF labels IS NULL OR array_length(labels, 1) = 0 THEN

     

       11
       11
       +
           RETURN NULL;

     

       12
       12
       +
         END IF;

     

       13
       13
       +
       

     

       14
       14
       +
         RETURN jsonb_build_object(

     

       15
       15
       +
           'values',

     

       16
       16
       +
           (SELECT jsonb_agg(jsonb_build_object('val', label))

     

       17
       17
       +
            FROM unnest(labels) AS label)

     

       18
       18
       +
         );

     

       19
       19
       +
       END;

     

       20
       20
       +
       $$ LANGUAGE plpgsql IMMUTABLE;

     

       21
       21
       +
       -- +goose StatementEnd

     

       22
       22
       +
       

     

       23
       23
       +
       -- Convert column type using the function

     

       24
       24
       +
       ALTER TABLE posts

     

       25
       25
       +
         ALTER COLUMN content_labels TYPE JSONB

     

       26
       26
       +
         USING convert_labels_to_jsonb(content_labels);

     

       27
       27
       +
       

     

       28
       28
       +
       -- Drop the temporary function

     

       29
       29
       +
       DROP FUNCTION convert_labels_to_jsonb(TEXT[]);

     

       30
       30
       +
       

     

       31
       31
       +
       -- Update column comment

     

       32
       32
       +
       COMMENT ON COLUMN posts.content_labels IS 'Self-applied labels per com.atproto.label.defs#selfLabels (JSONB: {"values":[{"val":"nsfw","neg":false}]})';

     

       33
       33
       +
       

     

       34
       34
       +
       -- +goose Down

     

       35
       35
       +
       -- Revert JSONB back to TEXT[] (lossy - drops 'neg' field)

     

       36
       36
       +
       ALTER TABLE posts

     

       37
       37
       +
         ALTER COLUMN content_labels TYPE TEXT[]

     

       38
       38
       +
         USING CASE

     

       39
       39
       +
           WHEN content_labels IS NULL THEN NULL

     

       40
       40
       +
           ELSE ARRAY(

     

       41
       41
       +
             SELECT value->>'val'

     

       42
       42
       +
             FROM jsonb_array_elements(content_labels->'values') AS value

     

       43
       43
       +
           )

     

       44
       44
       +
         END;

     

       45
       45
       +
       

     

       46
       46
       +
       -- Restore original comment

     

       47
       47
       +
       COMMENT ON COLUMN posts.content_labels IS 'Self-applied labels (nsfw, spoiler, violence)';

+1 -1

tests/lexicon-test-data/moderation/tribunal-vote-invalid-decision.json

···

       1
       1
        
       {

     

       2
       2
        
         "$type": "social.coves.moderation.tribunalVote",

     

       3
       3
        
         "tribunal": "at://did:plc:community123/social.coves.moderation.tribunal/3k7a3dmb5bk2c",

     

       4
       4
       -
         "subject": "at://did:plc:user123/social.coves.post.record/3k7a2clb4bj2b",

     

       4
       4
       +
         "subject": "at://$1/social.coves.community.post/3k7a2clb4bj2b",

     

       5
       5
        
         "decision": "maybe",

     

       6
       6
        
         "createdAt": "2025-01-09T18:00:00Z"

     

       7
       7
        
       }

+5 -6

tests/lexicon-test-data/post/post-invalid-missing-community.json

···

       1
       1
        
       {

     

       2
       2
       -
         "$type": "social.coves.post.record",

     

       3
       3
       -
         "postType": "text",

     

       2
       2
       +
         "$type": "social.coves.community.post",

     

       3
       3
       +
         "author": "did:plc:testauthor123",

     

       4
       4
        
         "title": "Test Post",

     

       5
       5
       -
         "text": "This post is missing the required community field",

     

       5
       5
       +
         "content": "This post is missing the required community field",

     

       6
       6
        
         "tags": ["test"],

     

       7
       7
       -
         "language": "en",

     

       8
       8
       -
         "contentWarnings": [],

     

       7
       7
       +
         "langs": ["en"],

     

       9
       8
        
         "createdAt": "2025-01-09T14:30:00Z"

     

       10
       10
       -
       }
     

       9
       9
       +
       }

+6 -7

tests/lexicon-test-data/post/post-valid-text.json

···

       1
       1
        
       {

     

       2
       2
       -
         "$type": "social.coves.post.record",

     

       2
       2
       +
         "$type": "social.coves.community.post",

     

       3
       3
        
         "community": "did:plc:programming123",

     

       4
       4
       -
         "postType": "text",

     

       4
       4
       +
         "author": "did:plc:testauthor123",

     

       5
       5
        
         "title": "Best practices for error handling in Go",

     

       6
       6
       -
         "text": "I've been working with Go for a while now and wanted to share some thoughts on error handling patterns...",

     

       7
       7
       -
         "textFacets": [

     

       6
       6
       +
         "content": "I've been working with Go for a while now and wanted to share some thoughts on error handling patterns...",

     

       7
       7
       +
         "facets": [

     

       8
       8
        
           {

     

       9
       9
        
             "index": {

     

       10
       10
        
               "byteStart": 20,

     
···

       18
       18
        
           }

     

       19
       19
        
         ],

     

       20
       20
        
         "tags": ["golang", "error-handling", "best-practices"],

     

       21
       21
       -
         "language": "en",

     

       22
       22
       -
         "contentWarnings": [],

     

       21
       21
       +
         "langs": ["en"],

     

       23
       22
        
         "createdAt": "2025-01-09T14:30:00Z"

     

       24
       24
       -
       }
     

       23
       23
       +
       }

+17 -17

docs/PRD_POSTS.md

···

       45
       45
        
       

     

       46
       46
        
       **Repository Structure:**

     

       47
       47
        
       ```

     

       48
       48
       -
       Repository:  at://did:plc:community789/social.coves.post.record/3k2a4b5c6d7e

     

       48
       48
       +
       Repository:  at://did:plc:community789/social.coves.community.post.record/3k2a4b5c6d7e

     

       49
       49
        
       Owner:       did:plc:community789 (community owns the post)

     

       50
       50
        
       Author:      did:plc:user123 (tracked in record metadata)

     

       51
       51
        
       Hosted By:   did:web:coves.social (instance manages community credentials)

     
···

       77
       77
        
       

     

       78
       78
        
       **Implementation checklist:**

     

       79
       79
        
       - [x] Lexicon: `contentRules` in `social.coves.community.profile` ✅

     

       80
       80
       -
       - [x] Lexicon: `postType` removed from `social.coves.post.create` ✅

     

       80
       80
       +
       - [x] Lexicon: `postType` removed from `social.coves.community.post.create` ✅

     

       81
       81
        
       - [ ] Validation: `ValidatePostAgainstRules()` service function

     

       82
       82
        
       - [ ] Handler: Integrate validation in post creation endpoint

     

       83
       83
        
       - [ ] AppView: Index derived characteristics (embed_type, text_length, etc.)

     
···

       90
       90
        
       **Priority:** CRITICAL - Posts are the foundation of the platform

     

       91
       91
        
       

     

       92
       92
        
       #### Create Post

     

       93
       93
       -
       - [x] Lexicon: `social.coves.post.record` ✅

     

       94
       94
       -
       - [x] Lexicon: `social.coves.post.create` ✅

     

       93
       93
       +
       - [x] Lexicon: `social.coves.community.post.record` ✅

     

       94
       94
       +
       - [x] Lexicon: `social.coves.community.post.create` ✅

     

       95
       95
        
       - [x] Removed `postType` enum in favor of content rules ✅ (2025-10-18)

     

       96
       96
        
       - [x] Removed `postType` from record and get lexicons ✅ (2025-10-18)

     

       97
       97
       -
       - [x] **Handler:** `POST /xrpc/social.coves.post.create` ✅ (Alpha - see IMPLEMENTATION_POST_CREATION.md)

     

       97
       97
       +
       - [x] **Handler:** `POST /xrpc/social.coves.community.post.create` ✅ (Alpha - see IMPLEMENTATION_POST_CREATION.md)

     

       98
       98
        
         - ✅ Accept: community (DID/handle), title (optional), content, facets, embed, contentLabels

     

       99
       99
        
         - ✅ Validate: User is authenticated, community exists, content within limits

     

       100
       100
        
         - ✅ Write: Create record in **community's PDS repository**

     
···

       124
       124
        
       - [x] **E2E Test:** Create text post → Write to **community's PDS** → Index via Jetstream → Verify in AppView ✅

     

       125
       125
        
       

     

       126
       126
        
       #### Get Post

     

       127
       127
       -
       - [x] Lexicon: `social.coves.post.get` ✅

     

       128
       128
       -
       - [ ] **Handler:** `GET /xrpc/social.coves.post.get?uri=at://...`

     

       127
       127
       +
       - [x] Lexicon: `social.coves.community.post.get` ✅

     

       128
       128
       +
       - [ ] **Handler:** `GET /xrpc/social.coves.community.post.get?uri=at://...`

     

       129
       129
        
         - Accept: AT-URI of post

     

       130
       130
        
         - Return: Full post view with author, community, stats, viewer state

     

       131
       131
        
       - [ ] **Service Layer:** `PostService.Get(uri, viewerDID)`

     
···

       139
       139
        
       - [ ] **E2E Test:** Get post by URI → Verify all fields populated

     

       140
       140
        
       

     

       141
       141
        
       #### Update Post

     

       142
       142
       -
       - [x] Lexicon: `social.coves.post.update` ✅

     

       143
       143
       -
       - [ ] **Handler:** `POST /xrpc/social.coves.post.update`

     

       142
       142
       +
       - [x] Lexicon: `social.coves.community.post.update` ✅

     

       143
       143
       +
       - [ ] **Handler:** `POST /xrpc/social.coves.community.post.update`

     

       144
       144
        
         - Accept: uri, title, content, facets, embed, contentLabels, editNote

     

       145
       145
        
         - Validate: User is post author, within 24-hour edit window

     

       146
       146
        
         - Write: Update record in **community's PDS**

     
···

       157
       157
        
       - [ ] **E2E Test:** Update post → Verify edit reflected in AppView

     

       158
       158
        
       

     

       159
       159
        
       #### Delete Post

     

       160
       160
       -
       - [x] Lexicon: `social.coves.post.delete` ✅

     

       161
       161
       -
       - [ ] **Handler:** `POST /xrpc/social.coves.post.delete`

     

       160
       160
       +
       - [x] Lexicon: `social.coves.community.post.delete` ✅

     

       161
       161
       +
       - [ ] **Handler:** `POST /xrpc/social.coves.community.post.delete`

     

       162
       162
        
         - Accept: uri

     

       163
       163
        
         - Validate: User is post author OR community moderator

     

       164
       164
        
         - Write: Delete record from **community's PDS**

     
···

       251
       251
        
       

     

       252
       252
        
       #### Post Event Handling

     

       253
       253
        
       - [x] **Consumer:** `PostConsumer.HandlePostEvent()` ✅ (2025-10-19)

     

       254
       254
       -
         - ✅ Listen for `social.coves.post.record` CREATE from **community repositories**

     

       254
       254
       +
         - ✅ Listen for `social.coves.community.post.record` CREATE from **community repositories**

     

       255
       255
        
         - ✅ Parse post record, extract author DID and community DID (from AT-URI owner)

     

       256
       256
        
         - ⚠️ **Derive post characteristics:** DEFERRED (embed_type, text_length, has_title, has_embed for content rules filtering)

     

       257
       257
        
         - ✅ Insert in AppView PostgreSQL (CREATE only - UPDATE/DELETE deferred)

     
···

       447
       447
        
       - [ ] **Tag Storage:** Tags live in **user's repository** (users own their tags)

     

       448
       448
        
       

     

       449
       449
        
       #### Crossposting

     

       450
       450
       -
       - [x] Lexicon: `social.coves.post.crosspost` ✅

     

       450
       450
       +
       - [x] Lexicon: `social.coves.community.post.crosspost` ✅

     

       451
       451
        
       - [ ] **Crosspost Tracking:** Share post to multiple communities

     

       452
       452
        
       - [ ] **Implementation:** Create new post record in each community's repository

     

       453
       453
        
       - [ ] **Crosspost Chain:** Track all crosspost relationships

     
···

       461
       461
        
       - [ ] **AppView Query:** Endpoint to fetch user's saved posts

     

       462
       462
        
       

     

       463
       463
        
       ### Post Search

     

       464
       464
       -
       - [x] Lexicon: `social.coves.post.search` ✅

     

       464
       464
       +
       - [x] Lexicon: `social.coves.community.post.search` ✅

     

       465
       465
        
       - [ ] **Search Parameters:**

     

       466
       466
        
         - Query string (q)

     

       467
       467
        
         - Filter by community

     
···

       583
       583
        
       - **Reuses Token Refresh:** Can leverage existing community credential management

     

       584
       584
        
       

     

       585
       585
        
       **Implementation Details:**

     

       586
       586
       -
       - Post AT-URI: `at://community_did/social.coves.post.record/tid`

     

       586
       586
       +
       - Post AT-URI: `at://community_did/social.coves.community.post.record/tid`

     

       587
       587
        
       - Write operations use community's PDS credentials (encrypted, stored in AppView)

     

       588
       588
        
       - Author tracked in post record's `author` field (DID)

     

       589
       589
        
       - Moderators can delete any post in their community

     
···

       756
       756
        
       

     

       757
       757
        
       ## Lexicon Summary

     

       758
       758
        
       

     

       759
       759
       -
       ### `social.coves.post.record`

     

       759
       759
       +
       ### `social.coves.community.post.record`

     

       760
       760
        
       **Status:** ✅ Defined, implementation TODO

     

       761
       761
        
       **Last Updated:** 2025-10-18 (removed `postType` enum)

     

       762
       762
        
       

     
···

       781
       781
        
       - Post "type" is derived from structure (has embed? what embed type? has title? text length?)

     

       782
       782
        
       - Community's `contentRules` validate post structure at creation time

     

       783
       783
        
       

     

       784
       784
       -
       ### `social.coves.post.create` (Procedure)

     

       784
       784
       +
       ### `social.coves.community.post.create` (Procedure)

     

       785
       785
        
       **Status:** ✅ Defined, implementation TODO

     

       786
       786
        
       **Last Updated:** 2025-10-18 (removed `postType` parameter)

     

       787
       787

+3 -3

docs/aggregators/PRD_KAGI_NEWS_RSS.md

···

       172
       172
        
       │  3. Deduplication: Tracks posted items via JSON state file  │

     

       173
       173
        
       │  4. Feed Mapper: Maps feed URLs to community handles        │

     

       174
       174
        
       │  5. Post Formatter: Converts to Coves post format           │

     

       175
       175
       -
       │  6. Post Publisher: Calls social.coves.post.create via XRPC │

     

       175
       175
       +
       │  6. Post Publisher: Calls social.coves.community.post.create via XRPC │

     

       176
       176
        
       │  7. Blob Uploader: Handles image upload to ATProto          │

     

       177
       177
        
       └─────────────────────────────────────────────────────────────┘

     

       178
       178
        
                                   │

     

       179
       179
        
                                   │ Authenticated XRPC calls

     

       180
       180
        
                                   ▼

     

       181
       181
        
       ┌─────────────────────────────────────────────────────────────┐

     

       182
       182
       -
       │  Coves AppView (social.coves.post.create)                   │

     

       182
       182
       +
       │  Coves AppView (social.coves.community.post.create)                   │

     

       183
       183
        
       │  - Validates aggregator authorization                        │

     

       184
       184
        
       │  - Creates post with author = did:plc:[aggregator-did]      │

     

       185
       185
        
       │  - Indexes to community feeds                                │

     
···

       271
       271
        
       

     

       272
       272
        
       ```json

     

       273
       273
        
       {

     

       274
       274
       -
         "$type": "social.coves.post.record",

     

       274
       274
       +
         "$type": "social.coves.community.post.record",

     

       275
       275
        
         "author": "did:plc:[aggregator-did]",

     

       276
       276
        
         "community": "world-news.coves.social",

     

       277
       277
        
         "title": "{Kagi story title}",

+80

internal/atproto/lexicon/social/coves/feed/comment.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.feed.comment",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "record",

     

       7
       7
       +
             "description": "A comment on a post or another comment. Comments live in user repositories and support nested threading.",

     

       8
       8
       +
             "key": "tid",

     

       9
       9
       +
             "record": {

     

       10
       10
       +
               "type": "object",

     

       11
       11
       +
               "required": ["reply", "content", "createdAt"],

     

       12
       12
       +
               "properties": {

     

       13
       13
       +
                 "reply": {

     

       14
       14
       +
                   "type": "ref",

     

       15
       15
       +
                   "ref": "#replyRef",

     

       16
       16
       +
                   "description": "Reference to the post and parent being replied to"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "content": {

     

       19
       19
       +
                   "type": "string",

     

       20
       20
       +
                   "maxGraphemes": 3000,

     

       21
       21
       +
                   "maxLength": 30000,

     

       22
       22
       +
                   "description": "Comment text content"

     

       23
       23
       +
                 },

     

       24
       24
       +
                 "facets": {

     

       25
       25
       +
                   "type": "array",

     

       26
       26
       +
                   "description": "Annotations for rich text (mentions, links, etc.)",

     

       27
       27
       +
                   "items": {

     

       28
       28
       +
                     "type": "ref",

     

       29
       29
       +
                     "ref": "social.coves.richtext.facet"

     

       30
       30
       +
                   }

     

       31
       31
       +
                 },

     

       32
       32
       +
                 "embed": {

     

       33
       33
       +
                   "type": "union",

     

       34
       34
       +
                   "description": "Embedded media or quoted posts",

     

       35
       35
       +
                   "refs": [

     

       36
       36
       +
                     "social.coves.embed.images",

     

       37
       37
       +
                     "social.coves.embed.post"

     

       38
       38
       +
                   ]

     

       39
       39
       +
                 },

     

       40
       40
       +
                 "langs": {

     

       41
       41
       +
                   "type": "array",

     

       42
       42
       +
                   "description": "Languages used in the comment content (ISO 639-1)",

     

       43
       43
       +
                   "maxLength": 3,

     

       44
       44
       +
                   "items": {

     

       45
       45
       +
                     "type": "string",

     

       46
       46
       +
                     "format": "language"

     

       47
       47
       +
                   }

     

       48
       48
       +
                 },

     

       49
       49
       +
                 "labels": {

     

       50
       50
       +
                   "type": "ref",

     

       51
       51
       +
                   "ref": "com.atproto.label.defs#selfLabels",

     

       52
       52
       +
                   "description": "Self-applied content labels"

     

       53
       53
       +
                 },

     

       54
       54
       +
                 "createdAt": {

     

       55
       55
       +
                   "type": "string",

     

       56
       56
       +
                   "format": "datetime",

     

       57
       57
       +
                   "description": "Timestamp of comment creation"

     

       58
       58
       +
                 }

     

       59
       59
       +
               }

     

       60
       60
       +
             }

     

       61
       61
       +
           },

     

       62
       62
       +
           "replyRef": {

     

       63
       63
       +
             "type": "object",

     

       64
       64
       +
             "description": "References for maintaining thread structure. Root always points to the original post, parent points to the immediate parent (post or comment).",

     

       65
       65
       +
             "required": ["root", "parent"],

     

       66
       66
       +
             "properties": {

     

       67
       67
       +
               "root": {

     

       68
       68
       +
                 "type": "ref",

     

       69
       69
       +
                 "ref": "com.atproto.repo.strongRef",

     

       70
       70
       +
                 "description": "Strong reference to the original post that started the thread"

     

       71
       71
       +
               },

     

       72
       72
       +
               "parent": {

     

       73
       73
       +
                 "type": "ref",

     

       74
       74
       +
                 "ref": "com.atproto.repo.strongRef",

     

       75
       75
       +
                 "description": "Strong reference to the immediate parent (post or comment) being replied to"

     

       76
       76
       +
               }

     

       77
       77
       +
             }

     

       78
       78
       +
           }

     

       79
       79
       +
         }

     

       80
       80
       +
       }

-86

internal/atproto/lexicon/social/coves/interaction/comment.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.comment",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A comment on a post or another comment",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "content", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of post or comment being replied to"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "content": {

     

       19
       19
       -
                   "type": "union",

     

       20
       20
       -
                   "refs": ["#textContent", "#imageContent", "#stickerContent"]

     

       21
       21
       -
                 },

     

       22
       22
       -
                 "location": {

     

       23
       23
       -
                   "type": "ref",

     

       24
       24
       -
                   "ref": "social.coves.actor.profile#geoLocation"

     

       25
       25
       -
                 },

     

       26
       26
       -
                 "translatedFrom": {

     

       27
       27
       -
                   "type": "string",

     

       28
       28
       -
                   "maxLength": 10,

     

       29
       29
       -
                   "description": "Language code if auto-translated (ISO 639-1)"

     

       30
       30
       -
                 },

     

       31
       31
       -
                 "createdAt": {

     

       32
       32
       -
                   "type": "string",

     

       33
       33
       -
                   "format": "datetime"

     

       34
       34
       -
                 }

     

       35
       35
       -
               }

     

       36
       36
       -
             }

     

       37
       37
       -
           },

     

       38
       38
       -
           "textContent": {

     

       39
       39
       -
             "type": "object",

     

       40
       40
       -
             "required": ["text"],

     

       41
       41
       -
             "properties": {

     

       42
       42
       -
               "text": {

     

       43
       43
       -
                 "type": "string",

     

       44
       44
       -
                 "maxLength": 10000,

     

       45
       45
       -
                 "description": "Comment text"

     

       46
       46
       -
               },

     

       47
       47
       -
               "facets": {

     

       48
       48
       -
                 "type": "array",

     

       49
       49
       -
                 "description": "Rich text annotations",

     

       50
       50
       -
                 "items": {

     

       51
       51
       -
                   "type": "ref",

     

       52
       52
       -
                   "ref": "social.coves.richtext.facet"

     

       53
       53
       -
                 }

     

       54
       54
       -
               }

     

       55
       55
       -
             }

     

       56
       56
       -
           },

     

       57
       57
       -
           "imageContent": {

     

       58
       58
       -
             "type": "object",

     

       59
       59
       -
             "required": ["image"],

     

       60
       60
       -
             "properties": {

     

       61
       61
       -
               "image": {

     

       62
       62
       -
                 "type": "ref",

     

       63
       63
       -
                 "ref": "social.coves.embed.images#image"

     

       64
       64
       -
               },

     

       65
       65
       -
               "caption": {

     

       66
       66
       -
                 "type": "string",

     

       67
       67
       -
                 "maxLength": 1000

     

       68
       68
       -
               }

     

       69
       69
       -
             }

     

       70
       70
       -
           },

     

       71
       71
       -
           "stickerContent": {

     

       72
       72
       -
             "type": "object",

     

       73
       73
       -
             "required": ["stickerId"],

     

       74
       74
       -
             "properties": {

     

       75
       75
       -
               "stickerId": {

     

       76
       76
       -
                 "type": "string",

     

       77
       77
       -
                 "description": "Reference to a sticker in a sticker pack"

     

       78
       78
       -
               },

     

       79
       79
       -
               "stickerPackId": {

     

       80
       80
       -
                 "type": "string",

     

       81
       81
       -
                 "description": "Reference to the sticker pack"

     

       82
       82
       -
               }

     

       83
       83
       -
             }

     

       84
       84
       -
           }

     

       85
       85
       -
         }

     

       86
       86
       -
       }

-75

internal/atproto/lexicon/social/coves/interaction/createComment.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.createComment",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Create a comment on a post or another comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["parent", "text"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "parent": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment being replied to"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "text": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "maxGraphemes": 3000,

     

       22
       22
       -
                     "maxLength": 30000,

     

       23
       23
       -
                     "description": "Comment text"

     

       24
       24
       -
                   },

     

       25
       25
       -
                   "textFacets": {

     

       26
       26
       -
                     "type": "array",

     

       27
       27
       -
                     "description": "Rich text annotations",

     

       28
       28
       -
                     "items": {

     

       29
       29
       -
                       "type": "ref",

     

       30
       30
       -
                       "ref": "social.coves.richtext.facet"

     

       31
       31
       -
                     }

     

       32
       32
       -
                   }

     

       33
       33
       -
                 }

     

       34
       34
       -
               }

     

       35
       35
       -
             },

     

       36
       36
       -
             "output": {

     

       37
       37
       -
               "encoding": "application/json",

     

       38
       38
       -
               "schema": {

     

       39
       39
       -
                 "type": "object",

     

       40
       40
       -
                 "required": ["uri", "cid"],

     

       41
       41
       -
                 "properties": {

     

       42
       42
       -
                   "uri": {

     

       43
       43
       -
                     "type": "string",

     

       44
       44
       -
                     "format": "at-uri",

     

       45
       45
       -
                     "description": "AT-URI of the created comment"

     

       46
       46
       -
                   },

     

       47
       47
       -
                   "cid": {

     

       48
       48
       -
                     "type": "string",

     

       49
       49
       -
                     "format": "cid",

     

       50
       50
       -
                     "description": "CID of the created comment"

     

       51
       51
       -
                   }

     

       52
       52
       -
                 }

     

       53
       53
       -
               }

     

       54
       54
       -
             },

     

       55
       55
       -
             "errors": [

     

       56
       56
       -
               {

     

       57
       57
       -
                 "name": "ParentNotFound",

     

       58
       58
       -
                 "description": "Parent post or comment not found"

     

       59
       59
       -
               },

     

       60
       60
       -
               {

     

       61
       61
       -
                 "name": "NotAuthorized",

     

       62
       62
       -
                 "description": "User is not authorized to comment"

     

       63
       63
       -
               },

     

       64
       64
       -
               {

     

       65
       65
       -
                 "name": "ThreadLocked",

     

       66
       66
       -
                 "description": "Comment thread is locked"

     

       67
       67
       -
               },

     

       68
       68
       -
               {

     

       69
       69
       -
                 "name": "Banned",

     

       70
       70
       -
                 "description": "User is banned from this community"

     

       71
       71
       -
               }

     

       72
       72
       -
             ]

     

       73
       73
       -
           }

     

       74
       74
       -
         }

     

       75
       75
       -
       }

-41

internal/atproto/lexicon/social/coves/interaction/deleteComment.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.deleteComment",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Delete a comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the comment to delete"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "CommentNotFound",

     

       32
       32
       -
                 "description": "Comment not found"

     

       33
       33
       -
               },

     

       34
       34
       -
               {

     

       35
       35
       -
                 "name": "NotAuthorized",

     

       36
       36
       -
                 "description": "User is not authorized to delete this comment"

     

       37
       37
       -
               }

     

       38
       38
       -
             ]

     

       39
       39
       -
           }

     

       40
       40
       -
         }

     

       41
       41
       -
       }

-39

internal/atproto/lexicon/social/coves/post/crosspost.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.crosspost",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A record tracking crosspost relationships between posts",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["originalPost", "crosspostOf", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "originalPost": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the original post in the crosspost chain"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "crosspostOf": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "at-uri",

     

       21
       21
       -
                   "description": "AT-URI of the immediate parent this is a crosspost of"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "allCrossposts": {

     

       24
       24
       -
                   "type": "array",

     

       25
       25
       -
                   "description": "Array of AT-URIs of all posts in the crosspost chain",

     

       26
       26
       -
                   "items": {

     

       27
       27
       -
                     "type": "string",

     

       28
       28
       -
                     "format": "at-uri"

     

       29
       29
       -
                   }

     

       30
       30
       -
                 },

     

       31
       31
       -
                 "createdAt": {

     

       32
       32
       -
                   "type": "string",

     

       33
       33
       -
                   "format": "datetime"

     

       34
       34
       -
                 }

     

       35
       35
       -
               }

     

       36
       36
       -
             }

     

       37
       37
       -
           }

     

       38
       38
       -
         }

     

       39
       39
       -
       }

-41

internal/atproto/lexicon/social/coves/post/delete.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.delete",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Delete a post",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post to delete"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "PostNotFound",

     

       32
       32
       -
                 "description": "Post not found"

     

       33
       33
       -
               },

     

       34
       34
       -
               {

     

       35
       35
       -
                 "name": "NotAuthorized",

     

       36
       36
       -
                 "description": "User is not authorized to delete this post"

     

       37
       37
       -
               }

     

       38
       38
       -
             ]

     

       39
       39
       -
           }

     

       40
       40
       -
         }

     

       41
       41
       -
       }

-294

internal/atproto/lexicon/social/coves/post/get.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.get",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "query",

     

       7
       7
       -
             "description": "Get posts by AT-URI. Supports batch fetching for feed hydration. Returns posts in same order as input URIs.",

     

       8
       8
       -
             "parameters": {

     

       9
       9
       -
               "type": "params",

     

       10
       10
       -
               "required": ["uris"],

     

       11
       11
       -
               "properties": {

     

       12
       12
       -
                 "uris": {

     

       13
       13
       -
                   "type": "array",

     

       14
       14
       -
                   "description": "List of post AT-URIs to fetch (max 25)",

     

       15
       15
       -
                   "items": {

     

       16
       16
       -
                     "type": "string",

     

       17
       17
       -
                     "format": "at-uri"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "maxLength": 25,

     

       20
       20
       -
                   "minLength": 1

     

       21
       21
       -
                 }

     

       22
       22
       -
               }

     

       23
       23
       -
             },

     

       24
       24
       -
             "output": {

     

       25
       25
       -
               "encoding": "application/json",

     

       26
       26
       -
               "schema": {

     

       27
       27
       -
                 "type": "object",

     

       28
       28
       -
                 "required": ["posts"],

     

       29
       29
       -
                 "properties": {

     

       30
       30
       -
                   "posts": {

     

       31
       31
       -
                     "type": "array",

     

       32
       32
       -
                     "description": "Array of post views. May include notFound/blocked entries for missing posts.",

     

       33
       33
       -
                     "items": {

     

       34
       34
       -
                       "type": "union",

     

       35
       35
       -
                       "refs": ["#postView", "#notFoundPost", "#blockedPost"]

     

       36
       36
       -
                     }

     

       37
       37
       -
                   }

     

       38
       38
       -
                 }

     

       39
       39
       -
               }

     

       40
       40
       -
             },

     

       41
       41
       -
             "errors": [

     

       42
       42
       -
               {"name": "InvalidRequest", "description": "Invalid URI format or empty array"}

     

       43
       43
       -
             ]

     

       44
       44
       -
           },

     

       45
       45
       -
           "postView": {

     

       46
       46
       -
             "type": "object",

     

       47
       47
       -
             "required": ["uri", "cid", "author", "record", "community", "createdAt", "indexedAt"],

     

       48
       48
       -
             "properties": {

     

       49
       49
       -
               "uri": {

     

       50
       50
       -
                 "type": "string",

     

       51
       51
       -
                 "format": "at-uri"

     

       52
       52
       -
               },

     

       53
       53
       -
               "cid": {

     

       54
       54
       -
                 "type": "string",

     

       55
       55
       -
                 "format": "cid"

     

       56
       56
       -
               },

     

       57
       57
       -
               "author": {

     

       58
       58
       -
                 "type": "ref",

     

       59
       59
       -
                 "ref": "#authorView"

     

       60
       60
       -
               },

     

       61
       61
       -
               "record": {

     

       62
       62
       -
                 "type": "unknown",

     

       63
       63
       -
                 "description": "The actual post record (text, image, video, etc.)"

     

       64
       64
       -
               },

     

       65
       65
       -
               "community": {

     

       66
       66
       -
                 "type": "ref",

     

       67
       67
       -
                 "ref": "#communityRef"

     

       68
       68
       -
               },

     

       69
       69
       -
               "title": {

     

       70
       70
       -
                 "type": "string"

     

       71
       71
       -
               },

     

       72
       72
       -
               "text": {

     

       73
       73
       -
                 "type": "string"

     

       74
       74
       -
               },

     

       75
       75
       -
               "textFacets": {

     

       76
       76
       -
                 "type": "array",

     

       77
       77
       -
                 "items": {

     

       78
       78
       -
                   "type": "ref",

     

       79
       79
       -
                   "ref": "social.coves.richtext.facet"

     

       80
       80
       -
                 }

     

       81
       81
       -
               },

     

       82
       82
       -
               "embed": {

     

       83
       83
       -
                 "type": "union",

     

       84
       84
       -
                 "description": "Embedded content (images, video, link preview, or quoted post)",

     

       85
       85
       -
                 "refs": [

     

       86
       86
       -
                   "social.coves.embed.images#view",

     

       87
       87
       -
                   "social.coves.embed.video#view",

     

       88
       88
       -
                   "social.coves.embed.external#view",

     

       89
       89
       -
                   "social.coves.embed.record#view",

     

       90
       90
       -
                   "social.coves.embed.recordWithMedia#view"

     

       91
       91
       -
                 ]

     

       92
       92
       -
               },

     

       93
       93
       -
               "language": {

     

       94
       94
       -
                 "type": "string",

     

       95
       95
       -
                 "format": "language"

     

       96
       96
       -
               },

     

       97
       97
       -
               "createdAt": {

     

       98
       98
       -
                 "type": "string",

     

       99
       99
       -
                 "format": "datetime"

     

       100
       100
       -
               },

     

       101
       101
       -
               "editedAt": {

     

       102
       102
       -
                 "type": "string",

     

       103
       103
       -
                 "format": "datetime"

     

       104
       104
       -
               },

     

       105
       105
       -
               "indexedAt": {

     

       106
       106
       -
                 "type": "string",

     

       107
       107
       -
                 "format": "datetime",

     

       108
       108
       -
                 "description": "When this post was indexed by the AppView"

     

       109
       109
       -
               },

     

       110
       110
       -
               "stats": {

     

       111
       111
       -
                 "type": "ref",

     

       112
       112
       -
                 "ref": "#postStats"

     

       113
       113
       -
               },

     

       114
       114
       -
               "viewer": {

     

       115
       115
       -
                 "type": "ref",

     

       116
       116
       -
                 "ref": "#viewerState"

     

       117
       117
       -
               }

     

       118
       118
       -
             }

     

       119
       119
       -
           },

     

       120
       120
       -
           "authorView": {

     

       121
       121
       -
             "type": "object",

     

       122
       122
       -
             "required": ["did", "handle"],

     

       123
       123
       -
             "properties": {

     

       124
       124
       -
               "did": {

     

       125
       125
       -
                 "type": "string",

     

       126
       126
       -
                 "format": "did"

     

       127
       127
       -
               },

     

       128
       128
       -
               "handle": {

     

       129
       129
       -
                 "type": "string",

     

       130
       130
       -
                 "format": "handle"

     

       131
       131
       -
               },

     

       132
       132
       -
               "displayName": {

     

       133
       133
       -
                 "type": "string"

     

       134
       134
       -
               },

     

       135
       135
       -
               "avatar": {

     

       136
       136
       -
                 "type": "string",

     

       137
       137
       -
                 "format": "uri"

     

       138
       138
       -
               },

     

       139
       139
       -
               "reputation": {

     

       140
       140
       -
                 "type": "integer",

     

       141
       141
       -
                 "description": "Author's reputation in the community"

     

       142
       142
       -
               }

     

       143
       143
       -
             }

     

       144
       144
       -
           },

     

       145
       145
       -
           "communityRef": {

     

       146
       146
       -
             "type": "object",

     

       147
       147
       -
             "required": ["did", "name"],

     

       148
       148
       -
             "properties": {

     

       149
       149
       -
               "did": {

     

       150
       150
       -
                 "type": "string",

     

       151
       151
       -
                 "format": "did"

     

       152
       152
       -
               },

     

       153
       153
       -
               "name": {

     

       154
       154
       -
                 "type": "string"

     

       155
       155
       -
               },

     

       156
       156
       -
               "avatar": {

     

       157
       157
       -
                 "type": "string",

     

       158
       158
       -
                 "format": "uri"

     

       159
       159
       -
               }

     

       160
       160
       -
             }

     

       161
       161
       -
           },

     

       162
       162
       -
           "notFoundPost": {

     

       163
       163
       -
             "type": "object",

     

       164
       164
       -
             "description": "Post was not found (deleted, never indexed, or invalid URI)",

     

       165
       165
       -
             "required": ["uri", "notFound"],

     

       166
       166
       -
             "properties": {

     

       167
       167
       -
               "uri": {

     

       168
       168
       -
                 "type": "string",

     

       169
       169
       -
                 "format": "at-uri"

     

       170
       170
       -
               },

     

       171
       171
       -
               "notFound": {

     

       172
       172
       -
                 "type": "boolean",

     

       173
       173
       -
                 "const": true

     

       174
       174
       -
               }

     

       175
       175
       -
             }

     

       176
       176
       -
           },

     

       177
       177
       -
           "blockedPost": {

     

       178
       178
       -
             "type": "object",

     

       179
       179
       -
             "description": "Post is blocked due to viewer blocking author/community, or community moderation",

     

       180
       180
       -
             "required": ["uri", "blocked"],

     

       181
       181
       -
             "properties": {

     

       182
       182
       -
               "uri": {

     

       183
       183
       -
                 "type": "string",

     

       184
       184
       -
                 "format": "at-uri"

     

       185
       185
       -
               },

     

       186
       186
       -
               "blocked": {

     

       187
       187
       -
                 "type": "boolean",

     

       188
       188
       -
                 "const": true

     

       189
       189
       -
               },

     

       190
       190
       -
               "blockedBy": {

     

       191
       191
       -
                 "type": "string",

     

       192
       192
       -
                 "enum": ["author", "community", "moderator"],

     

       193
       193
       -
                 "description": "What caused the block: viewer blocked author, viewer blocked community, or post was removed by moderators"

     

       194
       194
       -
               },

     

       195
       195
       -
               "author": {

     

       196
       196
       -
                 "type": "ref",

     

       197
       197
       -
                 "ref": "#blockedAuthor"

     

       198
       198
       -
               },

     

       199
       199
       -
               "community": {

     

       200
       200
       -
                 "type": "ref",

     

       201
       201
       -
                 "ref": "#blockedCommunity"

     

       202
       202
       -
               }

     

       203
       203
       -
             }

     

       204
       204
       -
           },

     

       205
       205
       -
           "blockedAuthor": {

     

       206
       206
       -
             "type": "object",

     

       207
       207
       -
             "description": "Minimal author info for blocked posts",

     

       208
       208
       -
             "required": ["did"],

     

       209
       209
       -
             "properties": {

     

       210
       210
       -
               "did": {

     

       211
       211
       -
                 "type": "string",

     

       212
       212
       -
                 "format": "did"

     

       213
       213
       -
               }

     

       214
       214
       -
             }

     

       215
       215
       -
           },

     

       216
       216
       -
           "blockedCommunity": {

     

       217
       217
       -
             "type": "object",

     

       218
       218
       -
             "description": "Minimal community info for blocked posts",

     

       219
       219
       -
             "required": ["did"],

     

       220
       220
       -
             "properties": {

     

       221
       221
       -
               "did": {

     

       222
       222
       -
                 "type": "string",

     

       223
       223
       -
                 "format": "did"

     

       224
       224
       -
               },

     

       225
       225
       -
               "name": {

     

       226
       226
       -
                 "type": "string"

     

       227
       227
       -
               }

     

       228
       228
       -
             }

     

       229
       229
       -
           },

     

       230
       230
       -
           "postStats": {

     

       231
       231
       -
             "type": "object",

     

       232
       232
       -
             "required": ["upvotes", "downvotes", "score", "commentCount"],

     

       233
       233
       -
             "properties": {

     

       234
       234
       -
               "upvotes": {

     

       235
       235
       -
                 "type": "integer",

     

       236
       236
       -
                 "minimum": 0

     

       237
       237
       -
               },

     

       238
       238
       -
               "downvotes": {

     

       239
       239
       -
                 "type": "integer",

     

       240
       240
       -
                 "minimum": 0

     

       241
       241
       -
               },

     

       242
       242
       -
               "score": {

     

       243
       243
       -
                 "type": "integer",

     

       244
       244
       -
                 "description": "Calculated score (upvotes - downvotes)"

     

       245
       245
       -
               },

     

       246
       246
       -
               "commentCount": {

     

       247
       247
       -
                 "type": "integer",

     

       248
       248
       -
                 "minimum": 0

     

       249
       249
       -
               },

     

       250
       250
       -
               "shareCount": {

     

       251
       251
       -
                 "type": "integer",

     

       252
       252
       -
                 "minimum": 0

     

       253
       253
       -
               },

     

       254
       254
       -
               "tagCounts": {

     

       255
       255
       -
                 "type": "object",

     

       256
       256
       -
                 "description": "Aggregate counts of tags applied by community members",

     

       257
       257
       -
                 "additionalProperties": {

     

       258
       258
       -
                   "type": "integer",

     

       259
       259
       -
                   "minimum": 0

     

       260
       260
       -
                 }

     

       261
       261
       -
               }

     

       262
       262
       -
             }

     

       263
       263
       -
           },

     

       264
       264
       -
           "viewerState": {

     

       265
       265
       -
             "type": "object",

     

       266
       266
       -
             "properties": {

     

       267
       267
       -
               "vote": {

     

       268
       268
       -
                 "type": "string",

     

       269
       269
       -
                 "enum": ["up", "down"],

     

       270
       270
       -
                 "description": "Viewer's vote on this post"

     

       271
       271
       -
               },

     

       272
       272
       -
               "voteUri": {

     

       273
       273
       -
                 "type": "string",

     

       274
       274
       -
                 "format": "at-uri"

     

       275
       275
       -
               },

     

       276
       276
       -
               "saved": {

     

       277
       277
       -
                 "type": "boolean"

     

       278
       278
       -
               },

     

       279
       279
       -
               "savedUri": {

     

       280
       280
       -
                 "type": "string",

     

       281
       281
       -
                 "format": "at-uri"

     

       282
       282
       -
               },

     

       283
       283
       -
               "tags": {

     

       284
       284
       -
                 "type": "array",

     

       285
       285
       -
                 "description": "Tags applied by the viewer to this post",

     

       286
       286
       -
                 "items": {

     

       287
       287
       -
                   "type": "string",

     

       288
       288
       -
                   "maxLength": 32

     

       289
       289
       -
                 }

     

       290
       290
       -
               }

     

       291
       291
       -
             }

     

       292
       292
       -
           }

     

       293
       293
       -
         }

     

       294
       294
       -
       }

-99

internal/atproto/lexicon/social/coves/post/getCrosspostChain.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.getCrosspostChain",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Get all crossposts in a crosspost chain for a given post",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of any post in the crosspost chain"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "required": ["crossposts"],

     

       27
       27
       -
                 "properties": {

     

       28
       28
       -
                   "crossposts": {

     

       29
       29
       -
                     "type": "array",

     

       30
       30
       -
                     "description": "All posts in the crosspost chain",

     

       31
       31
       -
                     "items": {

     

       32
       32
       -
                       "type": "ref",

     

       33
       33
       -
                       "ref": "#crosspostView"

     

       34
       34
       -
                     }

     

       35
       35
       -
                   }

     

       36
       36
       -
                 }

     

       37
       37
       -
               }

     

       38
       38
       -
             }

     

       39
       39
       -
           },

     

       40
       40
       -
           "crosspostView": {

     

       41
       41
       -
             "type": "object",

     

       42
       42
       -
             "required": ["uri", "community", "author", "createdAt"],

     

       43
       43
       -
             "properties": {

     

       44
       44
       -
               "uri": {

     

       45
       45
       -
                 "type": "string",

     

       46
       46
       -
                 "format": "at-uri",

     

       47
       47
       -
                 "description": "AT-URI of the post"

     

       48
       48
       -
               },

     

       49
       49
       -
               "community": {

     

       50
       50
       -
                 "type": "object",

     

       51
       51
       -
                 "required": ["uri", "name"],

     

       52
       52
       -
                 "properties": {

     

       53
       53
       -
                   "uri": {

     

       54
       54
       -
                     "type": "string",

     

       55
       55
       -
                     "format": "at-uri",

     

       56
       56
       -
                     "description": "AT-URI of the community"

     

       57
       57
       -
                   },

     

       58
       58
       -
                   "name": {

     

       59
       59
       -
                     "type": "string",

     

       60
       60
       -
                     "description": "Display name of the community"

     

       61
       61
       -
                   },

     

       62
       62
       -
                   "handle": {

     

       63
       63
       -
                     "type": "string",

     

       64
       64
       -
                     "description": "Handle of the community"

     

       65
       65
       -
                   }

     

       66
       66
       -
                 }

     

       67
       67
       -
               },

     

       68
       68
       -
               "author": {

     

       69
       69
       -
                 "type": "object",

     

       70
       70
       -
                 "required": ["did", "handle"],

     

       71
       71
       -
                 "properties": {

     

       72
       72
       -
                   "did": {

     

       73
       73
       -
                     "type": "string",

     

       74
       74
       -
                     "format": "did"

     

       75
       75
       -
                   },

     

       76
       76
       -
                   "handle": {

     

       77
       77
       -
                     "type": "string"

     

       78
       78
       -
                   },

     

       79
       79
       -
                   "displayName": {

     

       80
       80
       -
                     "type": "string"

     

       81
       81
       -
                   },

     

       82
       82
       -
                   "avatar": {

     

       83
       83
       -
                     "type": "string",

     

       84
       84
       -
                     "format": "uri"

     

       85
       85
       -
                   }

     

       86
       86
       -
                 }

     

       87
       87
       -
               },

     

       88
       88
       -
               "isOriginal": {

     

       89
       89
       -
                 "type": "boolean",

     

       90
       90
       -
                 "description": "Whether this is the original post in the chain"

     

       91
       91
       -
               },

     

       92
       92
       -
               "createdAt": {

     

       93
       93
       -
                 "type": "string",

     

       94
       94
       -
                 "format": "datetime"

     

       95
       95
       -
               }

     

       96
       96
       -
             }

     

       97
       97
       -
           }

     

       98
       98
       -
         }

     

       99
       99
       -
       }

-80

internal/atproto/lexicon/social/coves/post/search.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.search",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "query",

     

       7
       7
       -
             "description": "Search for posts",

     

       8
       8
       -
             "parameters": {

     

       9
       9
       -
               "type": "params",

     

       10
       10
       -
               "required": ["q"],

     

       11
       11
       -
               "properties": {

     

       12
       12
       -
                 "q": {

     

       13
       13
       -
                   "type": "string",

     

       14
       14
       -
                   "description": "Search query"

     

       15
       15
       -
                 },

     

       16
       16
       -
                 "community": {

     

       17
       17
       -
                   "type": "string",

     

       18
       18
       -
                   "format": "at-identifier",

     

       19
       19
       -
                   "description": "Filter by specific community"

     

       20
       20
       -
                 },

     

       21
       21
       -
                 "author": {

     

       22
       22
       -
                   "type": "string",

     

       23
       23
       -
                   "format": "at-identifier",

     

       24
       24
       -
                   "description": "Filter by author"

     

       25
       25
       -
                 },

     

       26
       26
       -
                 "type": {

     

       27
       27
       -
                   "type": "string",

     

       28
       28
       -
                   "enum": ["text", "image", "video", "article", "microblog"],

     

       29
       29
       -
                   "description": "Filter by post type"

     

       30
       30
       -
                 },

     

       31
       31
       -
                 "tags": {

     

       32
       32
       -
                   "type": "array",

     

       33
       33
       -
                   "items": {

     

       34
       34
       -
                     "type": "string"

     

       35
       35
       -
                   },

     

       36
       36
       -
                   "description": "Filter by tags"

     

       37
       37
       -
                 },

     

       38
       38
       -
                 "sort": {

     

       39
       39
       -
                   "type": "string",

     

       40
       40
       -
                   "enum": ["relevance", "new", "top"],

     

       41
       41
       -
                   "default": "relevance"

     

       42
       42
       -
                 },

     

       43
       43
       -
                 "timeframe": {

     

       44
       44
       -
                   "type": "string",

     

       45
       45
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       46
       46
       -
                   "default": "all"

     

       47
       47
       -
                 },

     

       48
       48
       -
                 "limit": {

     

       49
       49
       -
                   "type": "integer",

     

       50
       50
       -
                   "minimum": 1,

     

       51
       51
       -
                   "maximum": 100,

     

       52
       52
       -
                   "default": 50

     

       53
       53
       -
                 },

     

       54
       54
       -
                 "cursor": {

     

       55
       55
       -
                   "type": "string"

     

       56
       56
       -
                 }

     

       57
       57
       -
               }

     

       58
       58
       -
             },

     

       59
       59
       -
             "output": {

     

       60
       60
       -
               "encoding": "application/json",

     

       61
       61
       -
               "schema": {

     

       62
       62
       -
                 "type": "object",

     

       63
       63
       -
                 "required": ["posts"],

     

       64
       64
       -
                 "properties": {

     

       65
       65
       -
                   "posts": {

     

       66
       66
       -
                     "type": "array",

     

       67
       67
       -
                     "items": {

     

       68
       68
       -
                       "type": "ref",

     

       69
       69
       -
                       "ref": "social.coves.post.getFeed#feedPost"

     

       70
       70
       -
                     }

     

       71
       71
       -
                   },

     

       72
       72
       -
                   "cursor": {

     

       73
       73
       -
                     "type": "string"

     

       74
       74
       -
                   }

     

       75
       75
       -
                 }

     

       76
       76
       -
               }

     

       77
       77
       -
             }

     

       78
       78
       -
           }

     

       79
       79
       -
         }

     

       80
       80
       -
       }

-104

internal/atproto/lexicon/social/coves/post/update.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.update",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Update an existing post",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post to update"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "title": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "maxGraphemes": 300,

     

       22
       22
       -
                     "maxLength": 3000,

     

       23
       23
       -
                     "description": "Updated title"

     

       24
       24
       -
                   },

     

       25
       25
       -
                   "content": {

     

       26
       26
       -
                     "type": "string",

     

       27
       27
       -
                     "maxLength": 50000,

     

       28
       28
       -
                     "description": "Updated content - main text for text posts, description for media, etc."

     

       29
       29
       -
                   },

     

       30
       30
       -
                   "facets": {

     

       31
       31
       -
                     "type": "array",

     

       32
       32
       -
                     "description": "Updated rich text annotations for content",

     

       33
       33
       -
                     "items": {

     

       34
       34
       -
                       "type": "ref",

     

       35
       35
       -
                       "ref": "social.coves.richtext.facet"

     

       36
       36
       -
                     }

     

       37
       37
       -
                   },

     

       38
       38
       -
                   "embed": {

     

       39
       39
       -
                     "type": "union",

     

       40
       40
       -
                     "description": "Updated embedded content (note: changing embed type may be restricted)",

     

       41
       41
       -
                     "refs": [

     

       42
       42
       -
                       "social.coves.embed.images",

     

       43
       43
       -
                       "social.coves.embed.video",

     

       44
       44
       -
                       "social.coves.embed.external",

     

       45
       45
       -
                       "social.coves.embed.post"

     

       46
       46
       -
                     ]

     

       47
       47
       -
                   },

     

       48
       48
       -
                   "contentLabels": {

     

       49
       49
       -
                     "type": "array",

     

       50
       50
       -
                     "description": "Updated content labels",

     

       51
       51
       -
                     "items": {

     

       52
       52
       -
                       "type": "string",

     

       53
       53
       -
                       "knownValues": ["nsfw", "spoiler", "violence"],

     

       54
       54
       -
                       "maxLength": 32

     

       55
       55
       -
                     }

     

       56
       56
       -
                   },

     

       57
       57
       -
                   "editNote": {

     

       58
       58
       -
                     "type": "string",

     

       59
       59
       -
                     "maxLength": 300,

     

       60
       60
       -
                     "description": "Optional note explaining the edit"

     

       61
       61
       -
                   }

     

       62
       62
       -
                 }

     

       63
       63
       -
               }

     

       64
       64
       -
             },

     

       65
       65
       -
             "output": {

     

       66
       66
       -
               "encoding": "application/json",

     

       67
       67
       -
               "schema": {

     

       68
       68
       -
                 "type": "object",

     

       69
       69
       -
                 "required": ["uri", "cid"],

     

       70
       70
       -
                 "properties": {

     

       71
       71
       -
                   "uri": {

     

       72
       72
       -
                     "type": "string",

     

       73
       73
       -
                     "format": "at-uri",

     

       74
       74
       -
                     "description": "AT-URI of the updated post"

     

       75
       75
       -
                   },

     

       76
       76
       -
                   "cid": {

     

       77
       77
       -
                     "type": "string",

     

       78
       78
       -
                     "format": "cid",

     

       79
       79
       -
                     "description": "New CID of the updated post"

     

       80
       80
       -
                   }

     

       81
       81
       -
                 }

     

       82
       82
       -
               }

     

       83
       83
       -
             },

     

       84
       84
       -
             "errors": [

     

       85
       85
       -
               {

     

       86
       86
       -
                 "name": "PostNotFound",

     

       87
       87
       -
                 "description": "Post not found"

     

       88
       88
       -
               },

     

       89
       89
       -
               {

     

       90
       90
       -
                 "name": "NotAuthorized",

     

       91
       91
       -
                 "description": "User is not authorized to edit this post"

     

       92
       92
       -
               },

     

       93
       93
       -
               {

     

       94
       94
       -
                 "name": "EditWindowExpired",

     

       95
       95
       -
                 "description": "Edit window has expired (posts can only be edited within 24 hours)"

     

       96
       96
       -
               },

     

       97
       97
       -
               {

     

       98
       98
       -
                 "name": "InvalidUpdate",

     

       99
       99
       -
                 "description": "Invalid update operation (e.g., changing post type)"

     

       100
       100
       -
               }

     

       101
       101
       -
             ]

     

       102
       102
       -
           }

     

       103
       103
       -
         }

     

       104
       104
       -
       }

+156

internal/atproto/lexicon/com/atproto/label/defs.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "com.atproto.label.defs",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "label": {

     

       6
       6
       +
             "type": "object",

     

       7
       7
       +
             "description": "Metadata tag on an atproto resource (eg, repo or record).",

     

       8
       8
       +
             "required": ["src", "uri", "val", "cts"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "ver": {

     

       11
       11
       +
                 "type": "integer",

     

       12
       12
       +
                 "description": "The AT Protocol version of the label object."

     

       13
       13
       +
               },

     

       14
       14
       +
               "src": {

     

       15
       15
       +
                 "type": "string",

     

       16
       16
       +
                 "format": "did",

     

       17
       17
       +
                 "description": "DID of the actor who created this label."

     

       18
       18
       +
               },

     

       19
       19
       +
               "uri": {

     

       20
       20
       +
                 "type": "string",

     

       21
       21
       +
                 "format": "uri",

     

       22
       22
       +
                 "description": "AT URI of the record, repository (account), or other resource that this label applies to."

     

       23
       23
       +
               },

     

       24
       24
       +
               "cid": {

     

       25
       25
       +
                 "type": "string",

     

       26
       26
       +
                 "format": "cid",

     

       27
       27
       +
                 "description": "Optionally, CID specifying the specific version of 'uri' resource this label applies to."

     

       28
       28
       +
               },

     

       29
       29
       +
               "val": {

     

       30
       30
       +
                 "type": "string",

     

       31
       31
       +
                 "maxLength": 128,

     

       32
       32
       +
                 "description": "The short string name of the value or type of this label."

     

       33
       33
       +
               },

     

       34
       34
       +
               "neg": {

     

       35
       35
       +
                 "type": "boolean",

     

       36
       36
       +
                 "description": "If true, this is a negation label, overwriting a previous label."

     

       37
       37
       +
               },

     

       38
       38
       +
               "cts": {

     

       39
       39
       +
                 "type": "string",

     

       40
       40
       +
                 "format": "datetime",

     

       41
       41
       +
                 "description": "Timestamp when this label was created."

     

       42
       42
       +
               },

     

       43
       43
       +
               "exp": {

     

       44
       44
       +
                 "type": "string",

     

       45
       45
       +
                 "format": "datetime",

     

       46
       46
       +
                 "description": "Timestamp at which this label expires (no longer applies)."

     

       47
       47
       +
               },

     

       48
       48
       +
               "sig": {

     

       49
       49
       +
                 "type": "bytes",

     

       50
       50
       +
                 "description": "Signature of dag-cbor encoded label."

     

       51
       51
       +
               }

     

       52
       52
       +
             }

     

       53
       53
       +
           },

     

       54
       54
       +
           "selfLabels": {

     

       55
       55
       +
             "type": "object",

     

       56
       56
       +
             "description": "Metadata tags on an atproto record, published by the author within the record.",

     

       57
       57
       +
             "required": ["values"],

     

       58
       58
       +
             "properties": {

     

       59
       59
       +
               "values": {

     

       60
       60
       +
                 "type": "array",

     

       61
       61
       +
                 "items": { "type": "ref", "ref": "#selfLabel" },

     

       62
       62
       +
                 "maxLength": 10

     

       63
       63
       +
               }

     

       64
       64
       +
             }

     

       65
       65
       +
           },

     

       66
       66
       +
           "selfLabel": {

     

       67
       67
       +
             "type": "object",

     

       68
       68
       +
             "description": "Metadata tag on an atproto record, published by the author within the record. Note that schemas should use #selfLabels, not #selfLabel.",

     

       69
       69
       +
             "required": ["val"],

     

       70
       70
       +
             "properties": {

     

       71
       71
       +
               "val": {

     

       72
       72
       +
                 "type": "string",

     

       73
       73
       +
                 "maxLength": 128,

     

       74
       74
       +
                 "description": "The short string name of the value or type of this label."

     

       75
       75
       +
               }

     

       76
       76
       +
             }

     

       77
       77
       +
           },

     

       78
       78
       +
           "labelValueDefinition": {

     

       79
       79
       +
             "type": "object",

     

       80
       80
       +
             "description": "Declares a label value and its expected interpretations and behaviors.",

     

       81
       81
       +
             "required": ["identifier", "severity", "blurs", "locales"],

     

       82
       82
       +
             "properties": {

     

       83
       83
       +
               "identifier": {

     

       84
       84
       +
                 "type": "string",

     

       85
       85
       +
                 "description": "The value of the label being defined. Must only include lowercase ascii and the '-' character ([a-z-]+).",

     

       86
       86
       +
                 "maxLength": 100,

     

       87
       87
       +
                 "maxGraphemes": 100

     

       88
       88
       +
               },

     

       89
       89
       +
               "severity": {

     

       90
       90
       +
                 "type": "string",

     

       91
       91
       +
                 "description": "How should a client visually convey this label? 'inform' means neutral and informational; 'alert' means negative and warning; 'none' means show nothing.",

     

       92
       92
       +
                 "knownValues": ["inform", "alert", "none"]

     

       93
       93
       +
               },

     

       94
       94
       +
               "blurs": {

     

       95
       95
       +
                 "type": "string",

     

       96
       96
       +
                 "description": "What should this label hide in the UI, if applied? 'content' hides all of the target; 'media' hides the images/video/audio; 'none' hides nothing.",

     

       97
       97
       +
                 "knownValues": ["content", "media", "none"]

     

       98
       98
       +
               },

     

       99
       99
       +
               "defaultSetting": {

     

       100
       100
       +
                 "type": "string",

     

       101
       101
       +
                 "description": "The default setting for this label.",

     

       102
       102
       +
                 "knownValues": ["ignore", "warn", "hide"],

     

       103
       103
       +
                 "default": "warn"

     

       104
       104
       +
               },

     

       105
       105
       +
               "adultOnly": {

     

       106
       106
       +
                 "type": "boolean",

     

       107
       107
       +
                 "description": "Does the user need to have adult content enabled in order to configure this label?"

     

       108
       108
       +
               },

     

       109
       109
       +
               "locales": {

     

       110
       110
       +
                 "type": "array",

     

       111
       111
       +
                 "items": { "type": "ref", "ref": "#labelValueDefinitionStrings" }

     

       112
       112
       +
               }

     

       113
       113
       +
             }

     

       114
       114
       +
           },

     

       115
       115
       +
           "labelValueDefinitionStrings": {

     

       116
       116
       +
             "type": "object",

     

       117
       117
       +
             "description": "Strings which describe the label in the UI, localized into a specific language.",

     

       118
       118
       +
             "required": ["lang", "name", "description"],

     

       119
       119
       +
             "properties": {

     

       120
       120
       +
               "lang": {

     

       121
       121
       +
                 "type": "string",

     

       122
       122
       +
                 "description": "The code of the language these strings are written in.",

     

       123
       123
       +
                 "format": "language"

     

       124
       124
       +
               },

     

       125
       125
       +
               "name": {

     

       126
       126
       +
                 "type": "string",

     

       127
       127
       +
                 "description": "A short human-readable name for the label.",

     

       128
       128
       +
                 "maxGraphemes": 64,

     

       129
       129
       +
                 "maxLength": 640

     

       130
       130
       +
               },

     

       131
       131
       +
               "description": {

     

       132
       132
       +
                 "type": "string",

     

       133
       133
       +
                 "description": "A longer description of what the label means and why it might be applied.",

     

       134
       134
       +
                 "maxGraphemes": 10000,

     

       135
       135
       +
                 "maxLength": 100000

     

       136
       136
       +
               }

     

       137
       137
       +
             }

     

       138
       138
       +
           },

     

       139
       139
       +
           "labelValue": {

     

       140
       140
       +
             "type": "string",

     

       141
       141
       +
             "knownValues": [

     

       142
       142
       +
               "!hide",

     

       143
       143
       +
               "!no-promote",

     

       144
       144
       +
               "!warn",

     

       145
       145
       +
               "!no-unauthenticated",

     

       146
       146
       +
               "dmca-violation",

     

       147
       147
       +
               "doxxing",

     

       148
       148
       +
               "porn",

     

       149
       149
       +
               "sexual",

     

       150
       150
       +
               "nudity",

     

       151
       151
       +
               "nsfl",

     

       152
       152
       +
               "gore"

     

       153
       153
       +
             ]

     

       154
       154
       +
           }

     

       155
       155
       +
         }

     

       156
       156
       +
       }

+15

internal/atproto/lexicon/com/atproto/repo/strongRef.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "com.atproto.repo.strongRef",

     

       4
       4
       +
         "description": "A URI with a content-hash fingerprint.",

     

       5
       5
       +
         "defs": {

     

       6
       6
       +
           "main": {

     

       7
       7
       +
             "type": "object",

     

       8
       8
       +
             "required": ["uri", "cid"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "uri": { "type": "string", "format": "at-uri" },

     

       11
       11
       +
               "cid": { "type": "string", "format": "cid" }

     

       12
       12
       +
             }

     

       13
       13
       +
           }

     

       14
       14
       +
         }

     

       15
       15
       +
       }

+4 -21

internal/atproto/lexicon/social/coves/interaction/vote.json internal/atproto/lexicon/social/coves/feed/vote.json

···

       1
       1
        
       {

     

       2
       2
        
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.vote",

     

       3
       3
       +
         "id": "social.coves.feed.vote",

     

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "record",

     

       7
       7
       -
             "description": "A vote (upvote or downvote) on a post or comment",

     

       7
       7
       +
             "description": "Record declaring a vote (upvote or downvote) on a post or comment. Requires authentication.",

     

       8
       8
        
             "key": "tid",

     

       9
       9
        
             "record": {

     

       10
       10
        
               "type": "object",

     
···

       12
       12
        
               "properties": {

     

       13
       13
        
                 "subject": {

     

       14
       14
        
                   "type": "ref",

     

       15
       15
       -
                   "ref": "#strongRef",

     

       15
       15
       +
                   "ref": "com.atproto.repo.strongRef",

     

       16
       16
        
                   "description": "Strong reference to the post or comment being voted on"

     

       17
       17
        
                 },

     

       18
       18
        
                 "direction": {

     

       19
       19
        
                   "type": "string",

     

       20
       20
       -
                   "enum": ["up", "down"],

     

       20
       20
       +
                   "knownValues": ["up", "down"],

     

       21
       21
        
                   "description": "Vote direction: up for upvote, down for downvote"

     

       22
       22
        
                 },

     

       23
       23
        
                 "createdAt": {

     
···

       27
       27
        
                 }

     

       28
       28
        
               }

     

       29
       29
        
             }

     

       30
       30
       -
           },

     

       31
       31
       -
           "strongRef": {

     

       32
       32
       -
             "type": "object",

     

       33
       33
       -
             "description": "Strong reference to a record (AT-URI + CID)",

     

       34
       34
       -
             "required": ["uri", "cid"],

     

       35
       35
       -
             "properties": {

     

       36
       36
       -
               "uri": {

     

       37
       37
       -
                 "type": "string",

     

       38
       38
       -
                 "format": "at-uri",

     

       39
       39
       -
                 "description": "AT-URI of the record"

     

       40
       40
       -
               },

     

       41
       41
       -
               "cid": {

     

       42
       42
       -
                 "type": "string",

     

       43
       43
       -
                 "format": "cid",

     

       44
       44
       -
                 "description": "CID of the record content"

     

       45
       45
       -
               }

     

       46
       46
       -
             }

     

       47
       30
        
           }

     

       48
       31
        
         }

     

       49
       32
        
       }

+9

tests/lexicon-test-data/feed/vote-valid.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "$type": "social.coves.feed.vote",

     

       3
       3
       +
         "subject": {

     

       4
       4
       +
           "uri": "at://did:plc:alice123/social.coves.community.post/3kbx2n5p",

     

       5
       5
       +
           "cid": "bafyreigj3fwnwjuzr35k2kuzmb5dixxczrzjhqkr5srlqplsh6gq3bj3si"

     

       6
       6
       +
         },

     

       7
       7
       +
         "direction": "up",

     

       8
       8
       +
         "createdAt": "2025-01-09T15:00:00Z"

     

       9
       9
       +
       }

-5

tests/lexicon-test-data/interaction/vote-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.vote",

     

       3
       3
       -
         "subject": "at://did:plc:alice123/social.coves.post.text/3kbx2n5p",

     

       4
       4
       -
         "createdAt": "2025-01-09T15:00:00Z"

     

       5
       5
       -
       }

+3 -2

internal/atproto/lexicon/social/coves/community/getMembers.json

···

       25
       25
        
                 },

     

       26
       26
        
                 "sort": {

     

       27
       27
        
                   "type": "string",

     

       28
       28
       -
                   "enum": ["reputation", "recent", "alphabetical"],

     

       29
       29
       -
                   "default": "reputation"

     

       28
       28
       +
                   "knownValues": ["reputation", "recent", "alphabetical"],

     

       29
       29
       +
                   "default": "reputation",

     

       30
       30
       +
                   "maxLength": 64

     

       30
       31
        
                 }

     

       31
       32
        
               }

     

       32
       33
        
             },

-33

internal/atproto/lexicon/social/coves/actor/block.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.block",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A block relationship where one user blocks another",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "did",

     

       16
       16
       -
                   "description": "DID of the user being blocked"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "createdAt": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "datetime",

     

       21
       21
       -
                   "description": "When the block was created"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "reason": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "maxGraphemes": 300,

     

       26
       26
       -
                   "maxLength": 3000,

     

       27
       27
       -
                   "description": "Optional reason for blocking"

     

       28
       28
       -
                 }

     

       29
       29
       -
               }

     

       30
       30
       -
             }

     

       31
       31
       -
           }

     

       32
       32
       -
         }

     

       33
       33
       -
       }

-59

internal/atproto/lexicon/social/coves/actor/blockUser.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.blockUser",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Block another user",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "did",

     

       17
       17
       -
                     "description": "DID of the user to block"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "reason": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "maxGraphemes": 300,

     

       22
       22
       -
                     "maxLength": 3000,

     

       23
       23
       -
                     "description": "Optional reason for blocking"

     

       24
       24
       -
                   }

     

       25
       25
       -
                 }

     

       26
       26
       -
               }

     

       27
       27
       -
             },

     

       28
       28
       -
             "output": {

     

       29
       29
       -
               "encoding": "application/json",

     

       30
       30
       -
               "schema": {

     

       31
       31
       -
                 "type": "object",

     

       32
       32
       -
                 "required": ["uri", "cid"],

     

       33
       33
       -
                 "properties": {

     

       34
       34
       -
                   "uri": {

     

       35
       35
       -
                     "type": "string",

     

       36
       36
       -
                     "format": "at-uri",

     

       37
       37
       -
                     "description": "AT-URI of the created block record"

     

       38
       38
       -
                   },

     

       39
       39
       -
                   "cid": {

     

       40
       40
       -
                     "type": "string",

     

       41
       41
       -
                     "format": "cid",

     

       42
       42
       -
                     "description": "CID of the created block record"

     

       43
       43
       -
                   },

     

       44
       44
       -
                   "existing": {

     

       45
       45
       -
                     "type": "boolean",

     

       46
       46
       -
                     "description": "True if user was already blocked"

     

       47
       47
       -
                   }

     

       48
       48
       -
                 }

     

       49
       49
       -
               }

     

       50
       50
       -
             },

     

       51
       51
       -
             "errors": [

     

       52
       52
       -
               {

     

       53
       53
       -
                 "name": "SubjectNotFound",

     

       54
       54
       -
                 "description": "Subject user not found"

     

       55
       55
       -
               }

     

       56
       56
       -
             ]

     

       57
       57
       -
           }

     

       58
       58
       -
         }

     

       59
       59
       -
       }

+139

internal/atproto/lexicon/social/coves/actor/defs.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.actor.defs",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "profileView": {

     

       6
       6
       +
             "type": "object",

     

       7
       7
       +
             "description": "Basic profile view with essential information",

     

       8
       8
       +
             "required": ["did"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "did": {

     

       11
       11
       +
                 "type": "string",

     

       12
       12
       +
                 "format": "did"

     

       13
       13
       +
               },

     

       14
       14
       +
               "handle": {

     

       15
       15
       +
                 "type": "string",

     

       16
       16
       +
                 "format": "handle",

     

       17
       17
       +
                 "description": "Current handle resolved from DID"

     

       18
       18
       +
               },

     

       19
       19
       +
               "displayName": {

     

       20
       20
       +
                 "type": "string",

     

       21
       21
       +
                 "maxGraphemes": 64,

     

       22
       22
       +
                 "maxLength": 640

     

       23
       23
       +
               },

     

       24
       24
       +
               "avatar": {

     

       25
       25
       +
                 "type": "string",

     

       26
       26
       +
                 "format": "uri",

     

       27
       27
       +
                 "description": "URL to avatar image"

     

       28
       28
       +
               }

     

       29
       29
       +
             }

     

       30
       30
       +
           },

     

       31
       31
       +
           "profileViewDetailed": {

     

       32
       32
       +
             "type": "object",

     

       33
       33
       +
             "description": "Detailed profile view with stats and viewer state",

     

       34
       34
       +
             "required": ["did"],

     

       35
       35
       +
             "properties": {

     

       36
       36
       +
               "did": {

     

       37
       37
       +
                 "type": "string",

     

       38
       38
       +
                 "format": "did"

     

       39
       39
       +
               },

     

       40
       40
       +
               "handle": {

     

       41
       41
       +
                 "type": "string",

     

       42
       42
       +
                 "format": "handle",

     

       43
       43
       +
                 "description": "Current handle resolved from DID"

     

       44
       44
       +
               },

     

       45
       45
       +
               "displayName": {

     

       46
       46
       +
                 "type": "string",

     

       47
       47
       +
                 "maxGraphemes": 64,

     

       48
       48
       +
                 "maxLength": 640

     

       49
       49
       +
               },

     

       50
       50
       +
               "bio": {

     

       51
       51
       +
                 "type": "string",

     

       52
       52
       +
                 "maxGraphemes": 256,

     

       53
       53
       +
                 "maxLength": 2560

     

       54
       54
       +
               },

     

       55
       55
       +
               "bioFacets": {

     

       56
       56
       +
                 "type": "array",

     

       57
       57
       +
                 "description": "Rich text annotations for bio",

     

       58
       58
       +
                 "items": {

     

       59
       59
       +
                   "type": "ref",

     

       60
       60
       +
                   "ref": "social.coves.richtext.facet"

     

       61
       61
       +
                 }

     

       62
       62
       +
               },

     

       63
       63
       +
               "avatar": {

     

       64
       64
       +
                 "type": "string",

     

       65
       65
       +
                 "format": "uri",

     

       66
       66
       +
                 "description": "URL to avatar image"

     

       67
       67
       +
               },

     

       68
       68
       +
               "banner": {

     

       69
       69
       +
                 "type": "string",

     

       70
       70
       +
                 "format": "uri",

     

       71
       71
       +
                 "description": "URL to banner image"

     

       72
       72
       +
               },

     

       73
       73
       +
               "createdAt": {

     

       74
       74
       +
                 "type": "string",

     

       75
       75
       +
                 "format": "datetime"

     

       76
       76
       +
               },

     

       77
       77
       +
               "stats": {

     

       78
       78
       +
                 "type": "ref",

     

       79
       79
       +
                 "ref": "#profileStats",

     

       80
       80
       +
                 "description": "Aggregated statistics"

     

       81
       81
       +
               },

     

       82
       82
       +
               "viewer": {

     

       83
       83
       +
                 "type": "ref",

     

       84
       84
       +
                 "ref": "#viewerState",

     

       85
       85
       +
                 "description": "Viewer's relationship to this profile"

     

       86
       86
       +
               }

     

       87
       87
       +
             }

     

       88
       88
       +
           },

     

       89
       89
       +
           "profileStats": {

     

       90
       90
       +
             "type": "object",

     

       91
       91
       +
             "description": "Aggregated statistics for a user profile",

     

       92
       92
       +
             "properties": {

     

       93
       93
       +
               "postCount": {

     

       94
       94
       +
                 "type": "integer",

     

       95
       95
       +
                 "minimum": 0,

     

       96
       96
       +
                 "description": "Total number of posts created"

     

       97
       97
       +
               },

     

       98
       98
       +
               "commentCount": {

     

       99
       99
       +
                 "type": "integer",

     

       100
       100
       +
                 "minimum": 0,

     

       101
       101
       +
                 "description": "Total number of comments made"

     

       102
       102
       +
               },

     

       103
       103
       +
               "communityCount": {

     

       104
       104
       +
                 "type": "integer",

     

       105
       105
       +
                 "minimum": 0,

     

       106
       106
       +
                 "description": "Number of communities subscribed to"

     

       107
       107
       +
               },

     

       108
       108
       +
               "reputation": {

     

       109
       109
       +
                 "type": "integer",

     

       110
       110
       +
                 "description": "Global reputation score"

     

       111
       111
       +
               },

     

       112
       112
       +
               "membershipCount": {

     

       113
       113
       +
                 "type": "integer",

     

       114
       114
       +
                 "minimum": 0,

     

       115
       115
       +
                 "description": "Number of communities with membership status"

     

       116
       116
       +
               }

     

       117
       117
       +
             }

     

       118
       118
       +
           },

     

       119
       119
       +
           "viewerState": {

     

       120
       120
       +
             "type": "object",

     

       121
       121
       +
             "description": "The viewing user's relationship to this profile",

     

       122
       122
       +
             "properties": {

     

       123
       123
       +
               "blocked": {

     

       124
       124
       +
                 "type": "boolean",

     

       125
       125
       +
                 "description": "Whether the viewer has blocked this user"

     

       126
       126
       +
               },

     

       127
       127
       +
               "blockedBy": {

     

       128
       128
       +
                 "type": "boolean",

     

       129
       129
       +
                 "description": "Whether the viewer is blocked by this user"

     

       130
       130
       +
               },

     

       131
       131
       +
               "blockUri": {

     

       132
       132
       +
                 "type": "string",

     

       133
       133
       +
                 "format": "at-uri",

     

       134
       134
       +
                 "description": "AT-URI of the block record if viewer blocked this user"

     

       135
       135
       +
               }

     

       136
       136
       +
             }

     

       137
       137
       +
           }

     

       138
       138
       +
         }

     

       139
       139
       +
       }

-85

internal/atproto/lexicon/social/coves/actor/getSaved.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.getSaved",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "query",

     

       7
       7
       -
             "description": "Get all saved posts and comments for the authenticated user",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "properties": {

     

       13
       13
       -
                   "limit": {

     

       14
       14
       -
                     "type": "integer",

     

       15
       15
       -
                     "minimum": 1,

     

       16
       16
       -
                     "maximum": 100,

     

       17
       17
       -
                     "default": 50,

     

       18
       18
       -
                     "description": "Number of items to return"

     

       19
       19
       -
                   },

     

       20
       20
       -
                   "cursor": {

     

       21
       21
       -
                     "type": "string",

     

       22
       22
       -
                     "description": "Cursor for pagination"

     

       23
       23
       -
                   },

     

       24
       24
       -
                   "type": {

     

       25
       25
       -
                     "type": "string",

     

       26
       26
       -
                     "enum": ["post", "comment"],

     

       27
       27
       -
                     "description": "Filter by content type (optional)"

     

       28
       28
       -
                   }

     

       29
       29
       -
                 }

     

       30
       30
       -
               }

     

       31
       31
       -
             },

     

       32
       32
       -
             "output": {

     

       33
       33
       -
               "encoding": "application/json",

     

       34
       34
       -
               "schema": {

     

       35
       35
       -
                 "type": "object",

     

       36
       36
       -
                 "required": ["savedItems"],

     

       37
       37
       -
                 "properties": {

     

       38
       38
       -
                   "savedItems": {

     

       39
       39
       -
                     "type": "array",

     

       40
       40
       -
                     "description": "All saved items for the user",

     

       41
       41
       -
                     "items": {

     

       42
       42
       -
                       "type": "ref",

     

       43
       43
       -
                       "ref": "#savedItemView"

     

       44
       44
       -
                     }

     

       45
       45
       -
                   },

     

       46
       46
       -
                   "cursor": {

     

       47
       47
       -
                     "type": "string",

     

       48
       48
       -
                     "description": "Cursor for next page"

     

       49
       49
       -
                   }

     

       50
       50
       -
                 }

     

       51
       51
       -
               }

     

       52
       52
       -
             }

     

       53
       53
       -
           },

     

       54
       54
       -
           "savedItemView": {

     

       55
       55
       -
             "type": "object",

     

       56
       56
       -
             "required": ["uri", "subject", "type", "savedAt"],

     

       57
       57
       -
             "properties": {

     

       58
       58
       -
               "uri": {

     

       59
       59
       -
                 "type": "string",

     

       60
       60
       -
                 "format": "at-uri",

     

       61
       61
       -
                 "description": "AT-URI of the saved record"

     

       62
       62
       -
               },

     

       63
       63
       -
               "subject": {

     

       64
       64
       -
                 "type": "string",

     

       65
       65
       -
                 "format": "at-uri",

     

       66
       66
       -
                 "description": "AT-URI of the saved post or comment"

     

       67
       67
       -
               },

     

       68
       68
       -
               "type": {

     

       69
       69
       -
                 "type": "string",

     

       70
       70
       -
                 "enum": ["post", "comment"],

     

       71
       71
       -
                 "description": "Type of content that was saved"

     

       72
       72
       -
               },

     

       73
       73
       -
               "savedAt": {

     

       74
       74
       -
                 "type": "string",

     

       75
       75
       -
                 "format": "datetime",

     

       76
       76
       -
                 "description": "When the item was saved"

     

       77
       77
       -
               },

     

       78
       78
       -
               "note": {

     

       79
       79
       -
                 "type": "string",

     

       80
       80
       -
                 "description": "Optional note about why this was saved"

     

       81
       81
       -
               }

     

       82
       82
       -
             }

     

       83
       83
       -
           }

     

       84
       84
       -
         }

     

       85
       85
       -
       }

-198

internal/atproto/lexicon/social/coves/actor/preferences.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.preferences",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "User preferences and settings",

     

       8
       8
       -
             "key": "literal:self",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "properties": {

     

       12
       12
       -
                 "feedPreferences": {

     

       13
       13
       -
                   "type": "ref",

     

       14
       14
       -
                   "ref": "#feedPreferences"

     

       15
       15
       -
                 },

     

       16
       16
       -
                 "contentFiltering": {

     

       17
       17
       -
                   "type": "ref",

     

       18
       18
       -
                   "ref": "#contentFiltering"

     

       19
       19
       -
                 },

     

       20
       20
       -
                 "notificationSettings": {

     

       21
       21
       -
                   "type": "ref",

     

       22
       22
       -
                   "ref": "#notificationSettings"

     

       23
       23
       -
                 },

     

       24
       24
       -
                 "privacySettings": {

     

       25
       25
       -
                   "type": "ref",

     

       26
       26
       -
                   "ref": "#privacySettings"

     

       27
       27
       -
                 },

     

       28
       28
       -
                 "displayPreferences": {

     

       29
       29
       -
                   "type": "ref",

     

       30
       30
       -
                   "ref": "#displayPreferences"

     

       31
       31
       -
                 }

     

       32
       32
       -
               }

     

       33
       33
       -
             }

     

       34
       34
       -
           },

     

       35
       35
       -
           "feedPreferences": {

     

       36
       36
       -
             "type": "object",

     

       37
       37
       -
             "description": "Feed and content preferences",

     

       38
       38
       -
             "properties": {

     

       39
       39
       -
               "defaultFeed": {

     

       40
       40
       -
                 "type": "string",

     

       41
       41
       -
                 "enum": ["home", "all"],

     

       42
       42
       -
                 "default": "home"

     

       43
       43
       -
               },

     

       44
       44
       -
               "defaultSort": {

     

       45
       45
       -
                 "type": "string",

     

       46
       46
       -
                 "enum": ["hot", "new", "top"],

     

       47
       47
       -
                 "default": "hot",

     

       48
       48
       -
                 "description": "Default sort order for community feeds"

     

       49
       49
       -
               },

     

       50
       50
       -
               "showNSFW": {

     

       51
       51
       -
                 "type": "boolean",

     

       52
       52
       -
                 "default": false

     

       53
       53
       -
               },

     

       54
       54
       -
               "blurNSFW": {

     

       55
       55
       -
                 "type": "boolean",

     

       56
       56
       -
                 "default": true,

     

       57
       57
       -
                 "description": "Blur NSFW content until clicked"

     

       58
       58
       -
               },

     

       59
       59
       -
               "autoplayVideos": {

     

       60
       60
       -
                 "type": "boolean",

     

       61
       61
       -
                 "default": false

     

       62
       62
       -
               },

     

       63
       63
       -
               "infiniteScroll": {

     

       64
       64
       -
                 "type": "boolean",

     

       65
       65
       -
                 "default": true

     

       66
       66
       -
               }

     

       67
       67
       -
             }

     

       68
       68
       -
           },

     

       69
       69
       -
           "contentFiltering": {

     

       70
       70
       -
             "type": "object",

     

       71
       71
       -
             "description": "Content filtering preferences",

     

       72
       72
       -
             "properties": {

     

       73
       73
       -
               "blockedTags": {

     

       74
       74
       -
                 "type": "array",

     

       75
       75
       -
                 "items": {

     

       76
       76
       -
                   "type": "string"

     

       77
       77
       -
                 },

     

       78
       78
       -
                 "description": "Tags to filter out from feeds"

     

       79
       79
       -
               },

     

       80
       80
       -
               "blockedCommunities": {

     

       81
       81
       -
                 "type": "array",

     

       82
       82
       -
                 "items": {

     

       83
       83
       -
                   "type": "string",

     

       84
       84
       -
                   "format": "did"

     

       85
       85
       -
                 },

     

       86
       86
       -
                 "description": "Communities to filter out from /all feeds"

     

       87
       87
       -
               },

     

       88
       88
       -
               "mutedWords": {

     

       89
       89
       -
                 "type": "array",

     

       90
       90
       -
                 "items": {

     

       91
       91
       -
                   "type": "string"

     

       92
       92
       -
                 },

     

       93
       93
       -
                 "description": "Words to filter out from content"

     

       94
       94
       -
               },

     

       95
       95
       -
               "languageFilter": {

     

       96
       96
       -
                 "type": "array",

     

       97
       97
       -
                 "items": {

     

       98
       98
       -
                   "type": "string",

     

       99
       99
       -
                   "format": "language"

     

       100
       100
       -
                 },

     

       101
       101
       -
                 "description": "Only show content in these languages"

     

       102
       102
       -
               }

     

       103
       103
       -
             }

     

       104
       104
       -
           },

     

       105
       105
       -
           "notificationSettings": {

     

       106
       106
       -
             "type": "object",

     

       107
       107
       -
             "description": "Notification preferences",

     

       108
       108
       -
             "properties": {

     

       109
       109
       -
               "postReplies": {

     

       110
       110
       -
                 "type": "boolean",

     

       111
       111
       -
                 "default": true

     

       112
       112
       -
               },

     

       113
       113
       -
               "commentReplies": {

     

       114
       114
       -
                 "type": "boolean",

     

       115
       115
       -
                 "default": true

     

       116
       116
       -
               },

     

       117
       117
       -
               "mentions": {

     

       118
       118
       -
                 "type": "boolean",

     

       119
       119
       -
                 "default": true

     

       120
       120
       -
               },

     

       121
       121
       -
               "upvotes": {

     

       122
       122
       -
                 "type": "boolean",

     

       123
       123
       -
                 "default": false

     

       124
       124
       -
               },

     

       125
       125
       -
               "newFollowers": {

     

       126
       126
       -
                 "type": "boolean",

     

       127
       127
       -
                 "default": true

     

       128
       128
       -
               },

     

       129
       129
       -
               "communityInvites": {

     

       130
       130
       -
                 "type": "boolean",

     

       131
       131
       -
                 "default": true

     

       132
       132
       -
               },

     

       133
       133
       -
               "moderatorNotifications": {

     

       134
       134
       -
                 "type": "boolean",

     

       135
       135
       -
                 "default": true,

     

       136
       136
       -
                 "description": "Notifications for moderator actions in your communities"

     

       137
       137
       -
               }

     

       138
       138
       -
             }

     

       139
       139
       -
           },

     

       140
       140
       -
           "privacySettings": {

     

       141
       141
       -
             "type": "object",

     

       142
       142
       -
             "description": "Privacy preferences",

     

       143
       143
       -
             "properties": {

     

       144
       144
       -
               "profileVisibility": {

     

       145
       145
       -
                 "type": "string",

     

       146
       146
       -
                 "enum": ["public", "authenticated", "followers"],

     

       147
       147
       -
                 "default": "public"

     

       148
       148
       -
               },

     

       149
       149
       -
               "showSubscriptions": {

     

       150
       150
       -
                 "type": "boolean",

     

       151
       151
       -
                 "default": true

     

       152
       152
       -
               },

     

       153
       153
       -
               "showSavedPosts": {

     

       154
       154
       -
                 "type": "boolean",

     

       155
       155
       -
                 "default": false

     

       156
       156
       -
               },

     

       157
       157
       -
               "showVoteHistory": {

     

       158
       158
       -
                 "type": "boolean",

     

       159
       159
       -
                 "default": false

     

       160
       160
       -
               },

     

       161
       161
       -
               "allowDMs": {

     

       162
       162
       -
                 "type": "string",

     

       163
       163
       -
                 "enum": ["everyone", "followers", "none"],

     

       164
       164
       -
                 "default": "everyone"

     

       165
       165
       -
               }

     

       166
       166
       -
             }

     

       167
       167
       -
           },

     

       168
       168
       -
           "displayPreferences": {

     

       169
       169
       -
             "type": "object",

     

       170
       170
       -
             "description": "Display and UI preferences",

     

       171
       171
       -
             "properties": {

     

       172
       172
       -
               "theme": {

     

       173
       173
       -
                 "type": "string",

     

       174
       174
       -
                 "enum": ["light", "dark", "auto"],

     

       175
       175
       -
                 "default": "auto"

     

       176
       176
       -
               },

     

       177
       177
       -
               "compactView": {

     

       178
       178
       -
                 "type": "boolean",

     

       179
       179
       -
                 "default": false

     

       180
       180
       -
               },

     

       181
       181
       -
               "showAvatars": {

     

       182
       182
       -
                 "type": "boolean",

     

       183
       183
       -
                 "default": true

     

       184
       184
       -
               },

     

       185
       185
       -
               "showThumbnails": {

     

       186
       186
       -
                 "type": "boolean",

     

       187
       187
       -
                 "default": true

     

       188
       188
       -
               },

     

       189
       189
       -
               "postsPerPage": {

     

       190
       190
       -
                 "type": "integer",

     

       191
       191
       -
                 "minimum": 10,

     

       192
       192
       -
                 "maximum": 100,

     

       193
       193
       -
                 "default": 25

     

       194
       194
       -
               }

     

       195
       195
       -
             }

     

       196
       196
       -
           }

     

       197
       197
       -
         }

     

       198
       198
       -
       }

-63

internal/atproto/lexicon/social/coves/actor/saveItem.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.saveItem",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Save a post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject", "type"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to save"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "type": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "enum": ["post", "comment"],

     

       22
       22
       -
                     "description": "Type of content being saved"

     

       23
       23
       -
                   },

     

       24
       24
       -
                   "note": {

     

       25
       25
       -
                     "type": "string",

     

       26
       26
       -
                     "maxLength": 300,

     

       27
       27
       -
                     "description": "Optional note about why this was saved"

     

       28
       28
       -
                   }

     

       29
       29
       -
                 }

     

       30
       30
       -
               }

     

       31
       31
       -
             },

     

       32
       32
       -
             "output": {

     

       33
       33
       -
               "encoding": "application/json",

     

       34
       34
       -
               "schema": {

     

       35
       35
       -
                 "type": "object",

     

       36
       36
       -
                 "required": ["uri", "cid"],

     

       37
       37
       -
                 "properties": {

     

       38
       38
       -
                   "uri": {

     

       39
       39
       -
                     "type": "string",

     

       40
       40
       -
                     "format": "at-uri",

     

       41
       41
       -
                     "description": "AT-URI of the created saved record"

     

       42
       42
       -
                   },

     

       43
       43
       -
                   "cid": {

     

       44
       44
       -
                     "type": "string",

     

       45
       45
       -
                     "format": "cid",

     

       46
       46
       -
                     "description": "CID of the created saved record"

     

       47
       47
       -
                   },

     

       48
       48
       -
                   "existing": {

     

       49
       49
       -
                     "type": "boolean",

     

       50
       50
       -
                     "description": "True if item was already saved"

     

       51
       51
       -
                   }

     

       52
       52
       -
                 }

     

       53
       53
       -
               }

     

       54
       54
       -
             },

     

       55
       55
       -
             "errors": [

     

       56
       56
       -
               {

     

       57
       57
       -
                 "name": "SubjectNotFound",

     

       58
       58
       -
                 "description": "The post or comment to save was not found"

     

       59
       59
       -
               }

     

       60
       60
       -
             ]

     

       61
       61
       -
           }

     

       62
       62
       -
         }

     

       63
       63
       -
       }

-37

internal/atproto/lexicon/social/coves/actor/saved.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.saved",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A saved post or comment",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "type", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the post or comment being saved"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "type": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "enum": ["post", "comment"],

     

       21
       21
       -
                   "description": "Type of content being saved"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "createdAt": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "format": "datetime",

     

       26
       26
       -
                   "description": "When the item was saved"

     

       27
       27
       -
                 },

     

       28
       28
       -
                 "note": {

     

       29
       29
       -
                   "type": "string",

     

       30
       30
       -
                   "maxLength": 300,

     

       31
       31
       -
                   "description": "Optional note about why this was saved"

     

       32
       32
       -
                 }

     

       33
       33
       -
               }

     

       34
       34
       -
             }

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

-39

internal/atproto/lexicon/social/coves/actor/subscription.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.subscription",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A subscription to a community",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["community", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "community": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-identifier",

     

       16
       16
       -
                   "description": "DID or handle of the community"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "createdAt": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "datetime",

     

       21
       21
       -
                   "description": "When the subscription started"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "endedAt": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "format": "datetime",

     

       26
       26
       -
                   "description": "When the subscription ended (null if current)"

     

       27
       27
       -
                 },

     

       28
       28
       -
                 "contentVisibility": {

     

       29
       29
       -
                   "type": "integer",

     

       30
       30
       -
                   "minimum": 1,

     

       31
       31
       -
                   "maximum": 5,

     

       32
       32
       -
                   "default": 3,

     

       33
       33
       -
                   "description": "Content visibility level (1=only best content, 5=all content)"

     

       34
       34
       -
                 }

     

       35
       35
       -
               }

     

       36
       36
       -
             }

     

       37
       37
       -
           }

     

       38
       38
       -
         }

     

       39
       39
       -
       }

-37

internal/atproto/lexicon/social/coves/actor/unblockUser.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.unblockUser",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Unblock a previously blocked user",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "did",

     

       17
       17
       -
                     "description": "DID of the user to unblock"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "NotBlocked",

     

       32
       32
       -
                 "description": "User is not currently blocked"

     

       33
       33
       -
               }

     

       34
       34
       -
             ]

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

-37

internal/atproto/lexicon/social/coves/actor/unsaveItem.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.unsaveItem",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Unsave a previously saved post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to unsave"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "NotSaved",

     

       32
       32
       -
                 "description": "Item is not currently saved"

     

       33
       33
       -
               }

     

       34
       34
       -
             ]

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

+1 -172

internal/atproto/lexicon/social/coves/actor/profile.json

···

       8
       8
        
             "key": "literal:self",

     

       9
       9
        
             "record": {

     

       10
       10
        
               "type": "object",

     

       11
       11
       -
               "required": ["handle", "createdAt"],

     

       11
       11
       +
               "required": ["createdAt"],

     

       12
       12
        
               "properties": {

     

       13
       13
       -
                 "handle": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "handle",

     

       16
       16
       -
                   "maxLength": 253,

     

       17
       17
       -
                   "description": "User's handle"

     

       18
       18
       -
                 },

     

       19
       13
        
                 "displayName": {

     

       20
       14
        
                   "type": "string",

     

       21
       15
        
                   "maxGraphemes": 64,

     
···

       46
       40
        
                   "accept": ["image/png", "image/jpeg", "image/webp"],

     

       47
       41
        
                   "maxSize": 2000000

     

       48
       42
        
                 },

     

       49
       49
       -
                 "verified": {

     

       50
       50
       -
                   "type": "boolean",

     

       51
       51
       -
                   "default": false,

     

       52
       52
       -
                   "description": "Whether the user has completed phone verification"

     

       53
       53
       -
                 },

     

       54
       54
       -
                 "verifiedAt": {

     

       55
       55
       -
                   "type": "string",

     

       56
       56
       -
                   "format": "datetime",

     

       57
       57
       -
                   "description": "When the user was verified"

     

       58
       58
       -
                 },

     

       59
       59
       -
                 "verificationExpiresAt": {

     

       60
       60
       -
                   "type": "string",

     

       61
       61
       -
                   "format": "datetime",

     

       62
       62
       -
                   "description": "When verification expires"

     

       63
       63
       -
                 },

     

       64
       64
       -
                 "federatedFrom": {

     

       65
       65
       -
                   "type": "string",

     

       66
       66
       -
                   "knownValues": ["bluesky", "lemmy", "mastodon", "coves"],

     

       67
       67
       -
                   "description": "Platform user federated from"

     

       68
       68
       -
                 },

     

       69
       69
       -
                 "federatedIdentity": {

     

       70
       70
       -
                   "type": "ref",

     

       71
       71
       -
                   "ref": "#federatedIdentity",

     

       72
       72
       -
                   "description": "Identity information from federated platform"

     

       73
       73
       -
                 },

     

       74
       74
       -
                 "location": {

     

       75
       75
       -
                   "type": "ref",

     

       76
       76
       -
                   "ref": "#geoLocation"

     

       77
       77
       -
                 },

     

       78
       43
        
                 "createdAt": {

     

       79
       44
        
                   "type": "string",

     

       80
       45
        
                   "format": "datetime"

     

       81
       81
       -
                 },

     

       82
       82
       -
                 "moderatedCommunities": {

     

       83
       83
       -
                   "type": "array",

     

       84
       84
       -
                   "description": "Communities the user currently moderates",

     

       85
       85
       -
                   "items": {

     

       86
       86
       -
                     "type": "string",

     

       87
       87
       -
                     "format": "did"

     

       88
       88
       -
                   }

     

       89
       89
       -
                 },

     

       90
       90
       -
                 "moderationHistory": {

     

       91
       91
       -
                   "type": "array",

     

       92
       92
       -
                   "description": "Historical record of all moderation roles",

     

       93
       93
       -
                   "items": {

     

       94
       94
       -
                     "type": "ref",

     

       95
       95
       -
                     "ref": "#moderationRole"

     

       96
       96
       -
                   }

     

       97
       97
       -
                 },

     

       98
       98
       -
                 "violations": {

     

       99
       99
       -
                   "type": "array",

     

       100
       100
       -
                   "description": "Record of rule violations across communities",

     

       101
       101
       -
                   "items": {

     

       102
       102
       -
                     "type": "ref",

     

       103
       103
       -
                     "ref": "#violation"

     

       104
       104
       -
                   }

     

       105
       46
        
                 }

     

       106
       47
        
               }

     

       107
       48
        
             }

     

       108
       108
       -
           },

     

       109
       109
       -
           "moderationRole": {

     

       110
       110
       -
             "type": "object",

     

       111
       111
       -
             "required": ["communityDid", "role", "startedAt"],

     

       112
       112
       -
             "properties": {

     

       113
       113
       -
               "communityDid": {

     

       114
       114
       -
                 "type": "string",

     

       115
       115
       -
                 "format": "did",

     

       116
       116
       -
                 "description": "Community where moderation role was held"

     

       117
       117
       -
               },

     

       118
       118
       -
               "role": {

     

       119
       119
       -
                 "type": "string",

     

       120
       120
       -
                 "knownValues": ["moderator", "admin"],

     

       121
       121
       -
                 "description": "Type of moderation role"

     

       122
       122
       -
               },

     

       123
       123
       -
               "startedAt": {

     

       124
       124
       -
                 "type": "string",

     

       125
       125
       -
                 "format": "datetime",

     

       126
       126
       -
                 "description": "When the role began"

     

       127
       127
       -
               },

     

       128
       128
       -
               "endedAt": {

     

       129
       129
       -
                 "type": "string",

     

       130
       130
       -
                 "format": "datetime",

     

       131
       131
       -
                 "description": "When the role ended (null if current)"

     

       132
       132
       -
               }

     

       133
       133
       -
             }

     

       134
       134
       -
           },

     

       135
       135
       -
           "violation": {

     

       136
       136
       -
             "type": "object",

     

       137
       137
       -
             "required": ["communityDid", "ruleViolated", "timestamp", "severity"],

     

       138
       138
       -
             "properties": {

     

       139
       139
       -
               "communityDid": {

     

       140
       140
       -
                 "type": "string",

     

       141
       141
       -
                 "format": "did",

     

       142
       142
       -
                 "description": "Community where violation occurred"

     

       143
       143
       -
               },

     

       144
       144
       -
               "ruleViolated": {

     

       145
       145
       -
                 "type": "string",

     

       146
       146
       -
                 "description": "Description of the rule that was violated"

     

       147
       147
       -
               },

     

       148
       148
       -
               "timestamp": {

     

       149
       149
       -
                 "type": "string",

     

       150
       150
       -
                 "format": "datetime",

     

       151
       151
       -
                 "description": "When the violation occurred"

     

       152
       152
       -
               },

     

       153
       153
       -
               "severity": {

     

       154
       154
       -
                 "type": "string",

     

       155
       155
       -
                 "knownValues": ["minor", "moderate", "major", "severe"],

     

       156
       156
       -
                 "description": "Severity level of the violation"

     

       157
       157
       -
               },

     

       158
       158
       -
               "resolution": {

     

       159
       159
       -
                 "type": "string",

     

       160
       160
       -
                 "description": "How the violation was resolved"

     

       161
       161
       -
               },

     

       162
       162
       -
               "postUri": {

     

       163
       163
       -
                 "type": "string",

     

       164
       164
       -
                 "format": "at-uri",

     

       165
       165
       -
                 "description": "Optional reference to the violating content"

     

       166
       166
       -
               }

     

       167
       167
       -
             }

     

       168
       168
       -
           },

     

       169
       169
       -
           "federatedIdentity": {

     

       170
       170
       -
             "type": "object",

     

       171
       171
       -
             "description": "Verified identity from a federated platform",

     

       172
       172
       -
             "required": ["did", "handle", "verifiedAt"],

     

       173
       173
       -
             "properties": {

     

       174
       174
       -
               "did": {

     

       175
       175
       -
                 "type": "string",

     

       176
       176
       -
                 "format": "did",

     

       177
       177
       -
                 "description": "Original DID from the federated platform"

     

       178
       178
       -
               },

     

       179
       179
       -
               "handle": {

     

       180
       180
       -
                 "type": "string",

     

       181
       181
       -
                 "maxLength": 253,

     

       182
       182
       -
                 "description": "Original handle from the federated platform"

     

       183
       183
       -
               },

     

       184
       184
       -
               "verifiedAt": {

     

       185
       185
       -
                 "type": "string",

     

       186
       186
       -
                 "format": "datetime",

     

       187
       187
       -
                 "description": "When the federated identity was verified via OAuth"

     

       188
       188
       -
               },

     

       189
       189
       -
               "lastSyncedAt": {

     

       190
       190
       -
                 "type": "string",

     

       191
       191
       -
                 "format": "datetime",

     

       192
       192
       -
                 "description": "Last time profile data was synced from the federated platform"

     

       193
       193
       -
               },

     

       194
       194
       -
               "homePDS": {

     

       195
       195
       -
                 "type": "string",

     

       196
       196
       -
                 "description": "Home PDS server URL for the federated account"

     

       197
       197
       -
               }

     

       198
       198
       -
             }

     

       199
       199
       -
           },

     

       200
       200
       -
           "geoLocation": {

     

       201
       201
       -
             "type": "object",

     

       202
       202
       -
             "description": "Geographic location information",

     

       203
       203
       -
             "properties": {

     

       204
       204
       -
               "country": {

     

       205
       205
       -
                 "type": "string",

     

       206
       206
       -
                 "maxLength": 2,

     

       207
       207
       -
                 "description": "ISO 3166-1 alpha-2 country code"

     

       208
       208
       -
               },

     

       209
       209
       -
               "region": {

     

       210
       210
       -
                 "type": "string",

     

       211
       211
       -
                 "maxLength": 128,

     

       212
       212
       -
                 "description": "State/province/region name"

     

       213
       213
       -
               },

     

       214
       214
       -
               "displayName": {

     

       215
       215
       -
                 "type": "string",

     

       216
       216
       -
                 "maxLength": 256,

     

       217
       217
       -
                 "description": "Human-readable location name"

     

       218
       218
       -
               }

     

       219
       219
       -
             }

     

       220
       49
        
           }

     

       221
       50
        
         }

     

       222
       51
        
       }

+8 -1

cmd/validate-lexicon/main.go

···

       435
       435
        
       		// Post record types (removed - no longer exists in new structure)

     

       436
       436
        
       

     

       437
       437
        
       		// Actor definitions

     

       438
       438
       -
       		"social.coves.actor.profile#geoLocation",

     

       438
       438
       +
       		"social.coves.actor.defs#profileView",

     

       439
       439
       +
       		"social.coves.actor.defs#profileViewDetailed",

     

       440
       440
       +
       		"social.coves.actor.defs#profileStats",

     

       441
       441
       +
       		"social.coves.actor.defs#viewerState",

     

       439
       442
        
       

     

       440
       443
        
       		// Community definitions

     

       444
       444
       +
       		"social.coves.community.defs#communityView",

     

       445
       445
       +
       		"social.coves.community.defs#communityViewDetailed",

     

       446
       446
       +
       		"social.coves.community.defs#communityStats",

     

       447
       447
       +
       		"social.coves.community.defs#viewerState",

     

       441
       448
        
       		"social.coves.community.rules#rule",

     

       442
       449
        
       	}

     

       443
       450

-5

tests/lexicon-test-data/actor/block-invalid-did.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.block",

     

       3
       3
       -
         "subject": "not-a-valid-did",

     

       4
       4
       -
         "createdAt": "2025-01-05T09:15:00Z"

     

       5
       5
       -
       }

-6

tests/lexicon-test-data/actor/block-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.block",

     

       3
       3
       -
         "subject": "did:plc:blockeduser123",

     

       4
       4
       -
         "createdAt": "2025-01-05T09:15:00Z",

     

       5
       5
       -
         "reason": "Repeated harassment and spam"

     

       6
       6
       -
       }

-7

tests/lexicon-test-data/actor/preferences-invalid-enum.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.preferences",

     

       3
       3
       -
         "feedPreferences": {

     

       4
       4
       -
           "defaultFeed": "invalid-feed-type",

     

       5
       5
       -
           "defaultSort": "hot"

     

       6
       6
       -
         }

     

       7
       7
       -
       }

-40

tests/lexicon-test-data/actor/preferences-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.preferences",

     

       3
       3
       -
         "feedPreferences": {

     

       4
       4
       -
           "defaultFeed": "home",

     

       5
       5
       -
           "defaultSort": "hot",

     

       6
       6
       -
           "showNSFW": false,

     

       7
       7
       -
           "blurNSFW": true,

     

       8
       8
       -
           "autoplayVideos": true,

     

       9
       9
       -
           "infiniteScroll": true

     

       10
       10
       -
         },

     

       11
       11
       -
         "contentFiltering": {

     

       12
       12
       -
           "blockedTags": ["politics", "spoilers"],

     

       13
       13
       -
           "blockedCommunities": ["did:plc:controversialcommunity"],

     

       14
       14
       -
           "mutedWords": ["spam", "scam"],

     

       15
       15
       -
           "languageFilter": ["en", "es"]

     

       16
       16
       -
         },

     

       17
       17
       -
         "notificationSettings": {

     

       18
       18
       -
           "postReplies": true,

     

       19
       19
       -
           "commentReplies": true,

     

       20
       20
       -
           "mentions": true,

     

       21
       21
       -
           "upvotes": false,

     

       22
       22
       -
           "newFollowers": true,

     

       23
       23
       -
           "communityInvites": true,

     

       24
       24
       -
           "moderatorNotifications": true

     

       25
       25
       -
         },

     

       26
       26
       -
         "privacySettings": {

     

       27
       27
       -
           "profileVisibility": "public",

     

       28
       28
       -
           "showSubscriptions": true,

     

       29
       29
       -
           "showSavedPosts": false,

     

       30
       30
       -
           "showVoteHistory": false,

     

       31
       31
       -
           "allowDMs": "followers"

     

       32
       32
       -
         },

     

       33
       33
       -
         "displayPreferences": {

     

       34
       34
       -
           "theme": "dark",

     

       35
       35
       -
           "compactView": false,

     

       36
       36
       -
           "showAvatars": true,

     

       37
       37
       -
           "showThumbnails": true,

     

       38
       38
       -
           "postsPerPage": 25

     

       39
       39
       -
         }

     

       40
       40
       -
       }

-6

tests/lexicon-test-data/actor/profile-invalid-handle-format.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.profile",

     

       3
       3
       -
         "handle": "invalid handle with spaces",

     

       4
       4
       -
         "displayName": "Test User",

     

       5
       5
       -
         "createdAt": "2024-01-01T00:00:00Z"

     

       6
       6
       -
       }

-4

tests/lexicon-test-data/actor/profile-invalid-missing-handle.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.profile",

     

       3
       3
       -
         "displayName": "Missing Required Fields"

     

       4
       4
       -
       }

-1

tests/lexicon-test-data/actor/profile-valid.json

···

       1
       1
        
       {

     

       2
       2
        
         "$type": "social.coves.actor.profile",

     

       3
       3
       -
         "handle": "alice.example.com",

     

       4
       3
        
         "displayName": "Alice Johnson",

     

       5
       4
        
         "bio": "Software developer passionate about open-source",

     

       6
       5
        
         "createdAt": "2024-01-15T10:30:00Z"

+9 -46

internal/atproto/lexicon/social/coves/richtext/facet.json

···

       47
       47
        
           },

     

       48
       48
        
           "mention": {

     

       49
       49
        
             "type": "object",

     

       50
       50
       -
             "description": "Facet feature for user or community mentions",

     

       51
       51
       -
             "required": ["$type", "did"],

     

       50
       50
       +
             "description": "Facet feature for mention of a user or community. The text is usually a handle with '@' (user) or '!' (community) prefix, but the facet reference is a DID.",

     

       51
       51
       +
             "required": ["did"],

     

       52
       52
        
             "properties": {

     

       53
       53
       -
               "$type": {

     

       54
       54
       -
                 "type": "string",

     

       55
       55
       -
                 "const": "social.coves.richtext.facet#mention"

     

       56
       56
       -
               },

     

       57
       53
        
               "did": {

     

       58
       54
        
                 "type": "string",

     

       59
       55
        
                 "format": "did",

     

       60
       60
       -
                 "description": "DID of the mentioned user (@) or community (!)"

     

       61
       61
       -
               },

     

       62
       62
       -
               "handle": {

     

       63
       63
       -
                 "type": "string",

     

       64
       64
       -
                 "description": "Handle at time of mention (may change)"

     

       56
       56
       +
                 "description": "DID of the mentioned user or community"

     

       65
       57
        
               }

     

       66
       58
        
             }

     

       67
       59
        
           },

     

       68
       60
        
           "link": {

     

       69
       61
        
             "type": "object",

     

       70
       70
       -
             "description": "Facet feature for hyperlinks",

     

       71
       71
       -
             "required": ["$type", "uri"],

     

       62
       62
       +
             "description": "Facet feature for a URL. The text URL may have been simplified or truncated, but the facet reference should be a complete URL.",

     

       63
       63
       +
             "required": ["uri"],

     

       72
       64
        
             "properties": {

     

       73
       73
       -
               "$type": {

     

       74
       74
       -
                 "type": "string",

     

       75
       75
       -
                 "const": "social.coves.richtext.facet#link"

     

       76
       76
       -
               },

     

       77
       65
        
               "uri": {

     

       78
       66
        
                 "type": "string",

     

       79
       67
        
                 "format": "uri",

     
···

       83
       71
        
           },

     

       84
       72
        
           "bold": {

     

       85
       73
        
             "type": "object",

     

       86
       86
       -
             "description": "Bold text formatting",

     

       87
       87
       -
             "required": ["$type"],

     

       88
       88
       -
             "properties": {

     

       89
       89
       -
               "$type": {

     

       90
       90
       -
                 "type": "string",

     

       91
       91
       -
                 "const": "social.coves.richtext.facet#bold"

     

       92
       92
       -
               }

     

       93
       93
       -
             }

     

       74
       74
       +
             "description": "Bold text formatting"

     

       94
       75
        
           },

     

       95
       76
        
           "italic": {

     

       96
       77
        
             "type": "object",

     

       97
       97
       -
             "description": "Italic text formatting",

     

       98
       98
       -
             "required": ["$type"],

     

       99
       99
       -
             "properties": {

     

       100
       100
       -
               "$type": {

     

       101
       101
       -
                 "type": "string",

     

       102
       102
       -
                 "const": "social.coves.richtext.facet#italic"

     

       103
       103
       -
               }

     

       104
       104
       -
             }

     

       78
       78
       +
             "description": "Italic text formatting"

     

       105
       79
        
           },

     

       106
       80
        
           "strikethrough": {

     

       107
       81
        
             "type": "object",

     

       108
       108
       -
             "description": "Strikethrough text formatting",

     

       109
       109
       -
             "required": ["$type"],

     

       110
       110
       -
             "properties": {

     

       111
       111
       -
               "$type": {

     

       112
       112
       -
                 "type": "string",

     

       113
       113
       -
                 "const": "social.coves.richtext.facet#strikethrough"

     

       114
       114
       -
               }

     

       115
       115
       -
             }

     

       82
       82
       +
             "description": "Strikethrough text formatting"

     

       116
       83
        
           },

     

       117
       84
        
           "spoiler": {

     

       118
       85
        
             "type": "object",

     

       119
       86
        
             "description": "Hidden/spoiler text that requires user interaction to reveal",

     

       120
       120
       -
             "required": ["$type"],

     

       121
       87
        
             "properties": {

     

       122
       122
       -
               "$type": {

     

       123
       123
       -
                 "type": "string",

     

       124
       124
       -
                 "const": "social.coves.richtext.facet#spoiler"

     

       125
       125
       -
               },

     

       126
       88
        
               "reason": {

     

       127
       89
        
                 "type": "string",

     

       128
       90
        
                 "maxLength": 128,

     

       91
       91
       +
                 "maxGraphemes": 32,

     

       129
       92
        
                 "description": "Optional explanation of what's hidden"

     

       130
       93
        
               }

     

       131
       94
        
             }

+1

internal/atproto/lexicon/social/coves/community/profile.json

···

       13
       13
        
                 "name": {

     

       14
       14
        
                   "type": "string",

     

       15
       15
        
                   "maxLength": 64,

     

       16
       16
       +
                   "maxGraphemes": 64,

     

       16
       17
        
                   "description": "Short community name (local part of handle)"

     

       17
       18
        
                 },

     

       18
       19
        
                 "displayName": {

+1 -1

internal/atproto/lexicon/social/coves/community/search.json

···

       43
       43
        
                     "type": "array",

     

       44
       44
        
                     "items": {

     

       45
       45
        
                       "type": "ref",

     

       46
       46
       -
                       "ref": "social.coves.community.list#communityView"

     

       46
       46
       +
                       "ref": "social.coves.community.defs#communityView"

     

       47
       47
        
                     }

     

       48
       48
        
                   },

     

       49
       49
        
                   "cursor": {

+1

internal/atproto/lexicon/social/coves/embed/images.json

···

       33
       33
        
               "alt": {

     

       34
       34
        
                 "type": "string",

     

       35
       35
        
                 "maxLength": 1000,

     

       36
       36
       +
                 "maxGraphemes": 1000,

     

       36
       37
        
                 "description": "Alt text for accessibility"

     

       37
       38
        
               },

     

       38
       39
        
               "aspectRatio": {

+1 -4

internal/atproto/lexicon/social/coves/embed/video.json

···

       22
       22
        
               "alt": {

     

       23
       23
        
                 "type": "string",

     

       24
       24
        
                 "maxLength": 1000,

     

       25
       25
       +
                 "maxGraphemes": 1000,

     

       25
       26
        
                 "description": "Alt text describing video content"

     

       26
       27
        
               },

     

       27
       28
        
               "duration": {

     

       28
       29
        
                 "type": "integer",

     

       29
       30
        
                 "minimum": 0,

     

       30
       31
        
                 "description": "Duration in seconds"

     

       31
       31
       -
               },

     

       32
       32
       -
               "aspectRatio": {

     

       33
       33
       -
                 "type": "ref",

     

       34
       34
       -
                 "ref": "social.coves.embed.image#aspectRatio"

     

       35
       32
        
               }

     

       36
       33
        
             }

     

       37
       34
        
           }

-32

internal/atproto/lexicon/social/coves/federation/post.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.federation.post",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "object",

     

       7
       7
       -
             "description": "Reference to original federated post",

     

       8
       8
       -
             "required": ["platform", "uri"],

     

       9
       9
       -
             "properties": {

     

       10
       10
       -
               "platform": {

     

       11
       11
       -
                 "type": "string",

     

       12
       12
       -
                 "knownValues": ["bluesky", "lemmy", "atproto"],

     

       13
       13
       -
                 "description": "Platform the post originated from"

     

       14
       14
       -
               },

     

       15
       15
       -
               "uri": {

     

       16
       16
       -
                 "type": "string",

     

       17
       17
       -
                 "format": "uri",

     

       18
       18
       -
                 "description": "Original URI of the post (at:// URI for atproto platforms)"

     

       19
       19
       -
               },

     

       20
       20
       -
               "id": {

     

       21
       21
       -
                 "type": "string",

     

       22
       22
       -
                 "description": "Platform-specific post ID"

     

       23
       23
       -
               },

     

       24
       24
       -
               "originalCreatedAt": {

     

       25
       25
       -
                 "type": "string",

     

       26
       26
       -
                 "format": "datetime",

     

       27
       27
       -
                 "description": "Timestamp when originally posted on source platform"

     

       28
       28
       -
               }

     

       29
       29
       -
             }

     

       30
       30
       -
           }

     

       31
       31
       -
         }

     

       32
       32
       -
       }

+3 -3

internal/atproto/lexicon/social/coves/feed/getCommunity.json

···

       16
       16
        
                 },

     

       17
       17
        
                 "sort": {

     

       18
       18
        
                   "type": "string",

     

       19
       19
       -
                   "enum": ["hot", "top", "new"],

     

       19
       19
       +
                   "knownValues": ["hot", "top", "new"],

     

       20
       20
        
                   "default": "hot",

     

       21
       21
        
                   "description": "Sort order for community feed"

     

       22
       22
        
                 },

     

       23
       23
        
                 "timeframe": {

     

       24
       24
        
                   "type": "string",

     

       25
       25
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       25
       25
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       26
       26
        
                   "default": "day",

     

       27
       27
        
                   "description": "Timeframe for top sorting (only applies when sort=top)"

     

       28
       28
        
                 },

     
···

       47
       47
        
                     "type": "array",

     

       48
       48
        
                     "items": {

     

       49
       49
        
                       "type": "ref",

     

       50
       50
       -
                       "ref": "social.coves.feed.getTimeline#feedViewPost"

     

       50
       50
       +
                       "ref": "social.coves.feed.defs#feedViewPost"

     

       51
       51
        
                     }

     

       52
       52
        
                   },

     

       53
       53
        
                   "cursor": {

+2 -2

internal/atproto/lexicon/social/coves/feed/getTimeline.json

···

       10
       10
        
               "properties": {

     

       11
       11
        
                 "sort": {

     

       12
       12
        
                   "type": "string",

     

       13
       13
       -
                   "enum": ["hot", "top", "new"],

     

       13
       13
       +
                   "knownValues": ["hot", "top", "new"],

     

       14
       14
        
                   "default": "hot",

     

       15
       15
        
                   "description": "Sort order for timeline feed"

     

       16
       16
        
                 },

     

       17
       17
        
                 "timeframe": {

     

       18
       18
        
                   "type": "string",

     

       19
       19
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       19
       19
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       20
       20
        
                   "default": "day",

     

       21
       21
        
                   "description": "Timeframe for top sorting (only applies when sort=top)"

     

       22
       22
        
                 },

-31

internal/atproto/lexicon/social/coves/interaction/share.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.share",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "Sharing a post to another community or platform",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the post being shared"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "toCommunity": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "at-uri",

     

       21
       21
       -
                   "description": "Community being shared to (if applicable)"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "createdAt": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "format": "datetime"

     

       26
       26
       -
                 }

     

       27
       27
       -
               }

     

       28
       28
       -
             }

     

       29
       29
       -
           }

     

       30
       30
       -
         }

     

       31
       31
       -
       }

-33

internal/atproto/lexicon/social/coves/interaction/tag.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.tag",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A tag applied to a post or comment",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "tag", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the post or comment being tagged"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "tag": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "minLength": 1,

     

       21
       21
       -
                   "maxLength": 50,

     

       22
       22
       -
                   "knownValues": ["helpful", "insightful", "spam", "hostile", "offtopic", "misleading"],

     

       23
       23
       -
                   "description": "Predefined tag or custom community tag"

     

       24
       24
       -
                 },

     

       25
       25
       -
                 "createdAt": {

     

       26
       26
       -
                   "type": "string",

     

       27
       27
       -
                   "format": "datetime"

     

       28
       28
       -
                 }

     

       29
       29
       -
               }

     

       30
       30
       -
             }

     

       31
       31
       -
           }

     

       32
       32
       -
         }

     

       33
       33
       -
       }

-9

tests/lexicon-test-data/community/moderator-invalid-permissions.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.community.moderator",

     

       3
       3
       -
         "user": "did:plc:moderator123",

     

       4
       4
       -
         "community": "did:plc:community123",

     

       5
       5
       -
         "role": "moderator",

     

       6
       6
       -
         "permissions": ["remove_posts", "invalid-permission"],

     

       7
       7
       -
         "createdAt": "2024-06-15T10:00:00Z",

     

       8
       8
       -
         "createdBy": "did:plc:owner123"

     

       9
       9
       -
       }

-5

tests/lexicon-test-data/interaction/share-valid-no-community.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.share",

     

       3
       3
       -
         "subject": "at://did:plc:originalauthor/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "createdAt": "2025-01-09T17:00:00Z"

     

       5
       5
       -
       }

-6

tests/lexicon-test-data/interaction/share-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.share",

     

       3
       3
       -
         "subject": "at://did:plc:originalauthor/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "community": "did:plc:targetcommunity",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:00:00Z"

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/interaction/tag-invalid-empty.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.tag",

     

       3
       3
       -
         "subject": "at://did:plc:author123/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "tag": "",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:15:00Z"

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/interaction/tag-valid-custom.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.tag",

     

       3
       3
       -
         "subject": "at://did:plc:author123/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "tag": "beginner-friendly",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:15:00Z"

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/interaction/tag-valid-known.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.tag",

     

       3
       3
       -
         "subject": "at://did:plc:author123/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "tag": "nsfw",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:15:00Z"

     

       6
       6
       -
       }

+13

scripts/validate-schemas.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Validate all lexicon schemas and test data

     

       3
       3
       +
       

     

       4
       4
       +
       set -e

     

       5
       5
       +
       

     

       6
       6
       +
       echo "🔍 Validating Coves lexicon schemas..."

     

       7
       7
       +
       echo ""

     

       8
       8
       +
       

     

       9
       9
       +
       # Run the Go validation tool

     

       10
       10
       +
       go run ./cmd/validate-lexicon/main.go

     

       11
       11
       +
       

     

       12
       12
       +
       echo ""

     

       13
       13
       +
       echo "✅ Schema validation complete!"

+63

internal/db/migrations/016_create_comments_table.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Create comments table for AppView indexing

     

       3
       3
       +
       -- Comments are indexed from the firehose after being written to user repositories

     

       4
       4
       +
       CREATE TABLE comments (

     

       5
       5
       +
           id BIGSERIAL PRIMARY KEY,

     

       6
       6
       +
           uri TEXT UNIQUE NOT NULL,               -- AT-URI (at://commenter_did/social.coves.feed.comment/rkey)

     

       7
       7
       +
           cid TEXT NOT NULL,                      -- Content ID

     

       8
       8
       +
           rkey TEXT NOT NULL,                     -- Record key (TID)

     

       9
       9
       +
           commenter_did TEXT NOT NULL,            -- User who commented (from AT-URI repo field)

     

       10
       10
       +
       

     

       11
       11
       +
           -- Threading structure (reply references)

     

       12
       12
       +
           root_uri TEXT NOT NULL,                 -- Strong reference to original post (at://...)

     

       13
       13
       +
           root_cid TEXT NOT NULL,                 -- CID of root post (version pinning)

     

       14
       14
       +
           parent_uri TEXT NOT NULL,               -- Strong reference to immediate parent (post or comment)

     

       15
       15
       +
           parent_cid TEXT NOT NULL,               -- CID of parent (version pinning)

     

       16
       16
       +
       

     

       17
       17
       +
           -- Content (content is required per lexicon, others optional)

     

       18
       18
       +
           content TEXT NOT NULL,                  -- Comment text (max 3000 graphemes, 30000 bytes)

     

       19
       19
       +
           content_facets JSONB,                   -- Rich text facets (social.coves.richtext.facet)

     

       20
       20
       +
           embed JSONB,                            -- Embedded content (images, quoted posts)

     

       21
       21
       +
           content_labels JSONB,                   -- Self-applied labels (com.atproto.label.defs#selfLabels)

     

       22
       22
       +
           langs TEXT[],                           -- Languages (ISO 639-1, max 3)

     

       23
       23
       +
       

     

       24
       24
       +
           -- Timestamps

     

       25
       25
       +
           created_at TIMESTAMPTZ NOT NULL,        -- Commenter's timestamp from record

     

       26
       26
       +
           indexed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When indexed by AppView

     

       27
       27
       +
           deleted_at TIMESTAMPTZ,                 -- Soft delete (for firehose delete events)

     

       28
       28
       +
       

     

       29
       29
       +
           -- Stats (denormalized for performance)

     

       30
       30
       +
           upvote_count INT NOT NULL DEFAULT 0,    -- Comments can be voted on (per vote lexicon)

     

       31
       31
       +
           downvote_count INT NOT NULL DEFAULT 0,

     

       32
       32
       +
           score INT NOT NULL DEFAULT 0,           -- upvote_count - downvote_count (for sorting)

     

       33
       33
       +
           reply_count INT NOT NULL DEFAULT 0      -- Number of direct replies to this comment

     

       34
       34
       +
       

     

       35
       35
       +
           -- NO foreign key constraint on commenter_did to allow out-of-order indexing from Jetstream

     

       36
       36
       +
           -- Comment events may arrive before user events, which is acceptable since:

     

       37
       37
       +
           -- 1. Comments are authenticated by the user's PDS (security maintained)

     

       38
       38
       +
           -- 2. Orphaned comments from never-indexed users are harmless

     

       39
       39
       +
           -- 3. This prevents race conditions in the firehose consumer

     

       40
       40
       +
       );

     

       41
       41
       +
       

     

       42
       42
       +
       -- Indexes for threading queries (most important for comment UX)

     

       43
       43
       +
       CREATE INDEX idx_comments_root ON comments(root_uri, created_at DESC) WHERE deleted_at IS NULL;

     

       44
       44
       +
       CREATE INDEX idx_comments_parent ON comments(parent_uri, created_at DESC) WHERE deleted_at IS NULL;

     

       45
       45
       +
       CREATE INDEX idx_comments_parent_score ON comments(parent_uri, score DESC, created_at DESC) WHERE deleted_at IS NULL;

     

       46
       46
       +
       

     

       47
       47
       +
       -- Indexes for user queries

     

       48
       48
       +
       CREATE INDEX idx_comments_commenter ON comments(commenter_did, created_at DESC);

     

       49
       49
       +
       CREATE INDEX idx_comments_uri ON comments(uri);

     

       50
       50
       +
       

     

       51
       51
       +
       -- Index for vote targeting (when votes target comments)

     

       52
       52
       +
       CREATE INDEX idx_comments_uri_active ON comments(uri) WHERE deleted_at IS NULL;

     

       53
       53
       +
       

     

       54
       54
       +
       -- Comment on table

     

       55
       55
       +
       COMMENT ON TABLE comments IS 'Comments indexed from user repositories via Jetstream firehose consumer';

     

       56
       56
       +
       COMMENT ON COLUMN comments.uri IS 'AT-URI in format: at://commenter_did/social.coves.feed.comment/rkey';

     

       57
       57
       +
       COMMENT ON COLUMN comments.root_uri IS 'Strong reference to the original post that started the thread';

     

       58
       58
       +
       COMMENT ON COLUMN comments.parent_uri IS 'Strong reference to immediate parent (post or comment)';

     

       59
       59
       +
       COMMENT ON COLUMN comments.score IS 'Computed as upvote_count - downvote_count for ranking replies';

     

       60
       60
       +
       COMMENT ON COLUMN comments.content_labels IS 'Self-applied labels per com.atproto.label.defs#selfLabels (JSONB: {"values":[{"val":"nsfw","neg":false}]})';

     

       61
       61
       +
       

     

       62
       62
       +
       -- +goose Down

     

       63
       63
       +
       DROP TABLE IF EXISTS comments CASCADE;

+125

internal/atproto/jetstream/comment_jetstream_connector.go

···

       1
       1
       +
       package jetstream

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"sync"

     

       9
       9
       +
       	"time"

     

       10
       10
       +
       

     

       11
       11
       +
       	"github.com/gorilla/websocket"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // CommentJetstreamConnector handles WebSocket connection to Jetstream for comment events

     

       15
       15
       +
       type CommentJetstreamConnector struct {

     

       16
       16
       +
       	consumer *CommentEventConsumer

     

       17
       17
       +
       	wsURL    string

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // NewCommentJetstreamConnector creates a new Jetstream WebSocket connector for comment events

     

       21
       21
       +
       func NewCommentJetstreamConnector(consumer *CommentEventConsumer, wsURL string) *CommentJetstreamConnector {

     

       22
       22
       +
       	return &CommentJetstreamConnector{

     

       23
       23
       +
       		consumer: consumer,

     

       24
       24
       +
       		wsURL:    wsURL,

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // Start begins consuming events from Jetstream

     

       29
       29
       +
       // Runs indefinitely, reconnecting on errors

     

       30
       30
       +
       func (c *CommentJetstreamConnector) Start(ctx context.Context) error {

     

       31
       31
       +
       	log.Printf("Starting Jetstream comment consumer: %s", c.wsURL)

     

       32
       32
       +
       

     

       33
       33
       +
       	for {

     

       34
       34
       +
       		select {

     

       35
       35
       +
       		case <-ctx.Done():

     

       36
       36
       +
       			log.Println("Jetstream comment consumer shutting down")

     

       37
       37
       +
       			return ctx.Err()

     

       38
       38
       +
       		default:

     

       39
       39
       +
       			if err := c.connect(ctx); err != nil {

     

       40
       40
       +
       				log.Printf("Jetstream comment connection error: %v. Retrying in 5s...", err)

     

       41
       41
       +
       				time.Sleep(5 * time.Second)

     

       42
       42
       +
       				continue

     

       43
       43
       +
       			}

     

       44
       44
       +
       		}

     

       45
       45
       +
       	}

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       // connect establishes WebSocket connection and processes events

     

       49
       49
       +
       func (c *CommentJetstreamConnector) connect(ctx context.Context) error {

     

       50
       50
       +
       	conn, _, err := websocket.DefaultDialer.DialContext(ctx, c.wsURL, nil)

     

       51
       51
       +
       	if err != nil {

     

       52
       52
       +
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       53
       53
       +
       	}

     

       54
       54
       +
       	defer func() {

     

       55
       55
       +
       		if closeErr := conn.Close(); closeErr != nil {

     

       56
       56
       +
       			log.Printf("Failed to close WebSocket connection: %v", closeErr)

     

       57
       57
       +
       		}

     

       58
       58
       +
       	}()

     

       59
       59
       +
       

     

       60
       60
       +
       	log.Println("Connected to Jetstream (comment consumer)")

     

       61
       61
       +
       

     

       62
       62
       +
       	// Set read deadline to detect connection issues

     

       63
       63
       +
       	if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       64
       64
       +
       		log.Printf("Failed to set read deadline: %v", err)

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	// Set pong handler to keep connection alive

     

       68
       68
       +
       	conn.SetPongHandler(func(string) error {

     

       69
       69
       +
       		if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       70
       70
       +
       			log.Printf("Failed to set read deadline in pong handler: %v", err)

     

       71
       71
       +
       		}

     

       72
       72
       +
       		return nil

     

       73
       73
       +
       	})

     

       74
       74
       +
       

     

       75
       75
       +
       	// Start ping ticker

     

       76
       76
       +
       	ticker := time.NewTicker(30 * time.Second)

     

       77
       77
       +
       	defer ticker.Stop()

     

       78
       78
       +
       

     

       79
       79
       +
       	done := make(chan struct{})

     

       80
       80
       +
       	var closeOnce sync.Once // Ensure done channel is only closed once

     

       81
       81
       +
       

     

       82
       82
       +
       	// Ping goroutine

     

       83
       83
       +
       	go func() {

     

       84
       84
       +
       		for {

     

       85
       85
       +
       			select {

     

       86
       86
       +
       			case <-ticker.C:

     

       87
       87
       +
       				if err := conn.WriteControl(websocket.PingMessage, []byte{}, time.Now().Add(10*time.Second)); err != nil {

     

       88
       88
       +
       					log.Printf("Failed to send ping: %v", err)

     

       89
       89
       +
       					closeOnce.Do(func() { close(done) })

     

       90
       90
       +
       					return

     

       91
       91
       +
       				}

     

       92
       92
       +
       			case <-done:

     

       93
       93
       +
       				return

     

       94
       94
       +
       			}

     

       95
       95
       +
       		}

     

       96
       96
       +
       	}()

     

       97
       97
       +
       

     

       98
       98
       +
       	// Read loop

     

       99
       99
       +
       	for {

     

       100
       100
       +
       		select {

     

       101
       101
       +
       		case <-done:

     

       102
       102
       +
       			return fmt.Errorf("connection closed by ping failure")

     

       103
       103
       +
       		default:

     

       104
       104
       +
       		}

     

       105
       105
       +
       

     

       106
       106
       +
       		_, message, err := conn.ReadMessage()

     

       107
       107
       +
       		if err != nil {

     

       108
       108
       +
       			closeOnce.Do(func() { close(done) })

     

       109
       109
       +
       			return fmt.Errorf("read error: %w", err)

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       112
       112
       +
       		// Parse Jetstream event

     

       113
       113
       +
       		var event JetstreamEvent

     

       114
       114
       +
       		if err := json.Unmarshal(message, &event); err != nil {

     

       115
       115
       +
       			log.Printf("Failed to parse Jetstream event: %v", err)

     

       116
       116
       +
       			continue

     

       117
       117
       +
       		}

     

       118
       118
       +
       

     

       119
       119
       +
       		// Process event through consumer

     

       120
       120
       +
       		if err := c.consumer.HandleEvent(ctx, &event); err != nil {

     

       121
       121
       +
       			log.Printf("Failed to handle comment event: %v", err)

     

       122
       122
       +
       			// Continue processing other events even if one fails

     

       123
       123
       +
       		}

     

       124
       124
       +
       	}

     

       125
       125
       +
       }

+221

internal/atproto/lexicon/social/coves/community/comment/defs.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.comment.defs",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "commentView": {

     

       6
       6
       +
             "type": "object",

     

       7
       7
       +
             "description": "Base view for a single comment with voting, stats, and viewer state",

     

       8
       8
       +
             "required": ["uri", "cid", "author", "record", "post", "content", "createdAt", "indexedAt", "stats"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "uri": {

     

       11
       11
       +
                 "type": "string",

     

       12
       12
       +
                 "format": "at-uri",

     

       13
       13
       +
                 "description": "AT-URI of the comment record"

     

       14
       14
       +
               },

     

       15
       15
       +
               "cid": {

     

       16
       16
       +
                 "type": "string",

     

       17
       17
       +
                 "format": "cid",

     

       18
       18
       +
                 "description": "CID of the comment record"

     

       19
       19
       +
               },

     

       20
       20
       +
               "author": {

     

       21
       21
       +
                 "type": "ref",

     

       22
       22
       +
                 "ref": "social.coves.community.post.get#authorView",

     

       23
       23
       +
                 "description": "Comment author information"

     

       24
       24
       +
               },

     

       25
       25
       +
               "record": {

     

       26
       26
       +
                 "type": "unknown",

     

       27
       27
       +
                 "description": "The actual comment record verbatim"

     

       28
       28
       +
               },

     

       29
       29
       +
               "post": {

     

       30
       30
       +
                 "type": "ref",

     

       31
       31
       +
                 "ref": "#postRef",

     

       32
       32
       +
                 "description": "Reference to the parent post"

     

       33
       33
       +
               },

     

       34
       34
       +
               "parent": {

     

       35
       35
       +
                 "type": "ref",

     

       36
       36
       +
                 "ref": "#commentRef",

     

       37
       37
       +
                 "description": "Reference to parent comment if this is a nested reply"

     

       38
       38
       +
               },

     

       39
       39
       +
               "content": {

     

       40
       40
       +
                 "type": "string",

     

       41
       41
       +
                 "description": "Comment text content"

     

       42
       42
       +
               },

     

       43
       43
       +
               "contentFacets": {

     

       44
       44
       +
                 "type": "array",

     

       45
       45
       +
                 "description": "Rich text annotations for mentions, links, formatting",

     

       46
       46
       +
                 "items": {

     

       47
       47
       +
                   "type": "ref",

     

       48
       48
       +
                   "ref": "social.coves.richtext.facet"

     

       49
       49
       +
                 }

     

       50
       50
       +
               },

     

       51
       51
       +
               "embed": {

     

       52
       52
       +
                 "type": "union",

     

       53
       53
       +
                 "description": "Embedded content in the comment (images or quoted post)",

     

       54
       54
       +
                 "refs": [

     

       55
       55
       +
                   "social.coves.embed.images#view",

     

       56
       56
       +
                   "social.coves.embed.post#view"

     

       57
       57
       +
                 ]

     

       58
       58
       +
               },

     

       59
       59
       +
               "createdAt": {

     

       60
       60
       +
                 "type": "string",

     

       61
       61
       +
                 "format": "datetime",

     

       62
       62
       +
                 "description": "When the comment was created"

     

       63
       63
       +
               },

     

       64
       64
       +
               "indexedAt": {

     

       65
       65
       +
                 "type": "string",

     

       66
       66
       +
                 "format": "datetime",

     

       67
       67
       +
                 "description": "When this comment was indexed by the AppView"

     

       68
       68
       +
               },

     

       69
       69
       +
               "stats": {

     

       70
       70
       +
                 "type": "ref",

     

       71
       71
       +
                 "ref": "#commentStats",

     

       72
       72
       +
                 "description": "Comment statistics (votes, replies)"

     

       73
       73
       +
               },

     

       74
       74
       +
               "viewer": {

     

       75
       75
       +
                 "type": "ref",

     

       76
       76
       +
                 "ref": "#commentViewerState",

     

       77
       77
       +
                 "description": "Viewer-specific state (vote, saved, etc.)"

     

       78
       78
       +
               }

     

       79
       79
       +
             }

     

       80
       80
       +
           },

     

       81
       81
       +
           "threadViewComment": {

     

       82
       82
       +
             "type": "object",

     

       83
       83
       +
             "description": "Wrapper for threaded comment structure, similar to Bluesky's threadViewPost pattern",

     

       84
       84
       +
             "required": ["comment"],

     

       85
       85
       +
             "properties": {

     

       86
       86
       +
               "comment": {

     

       87
       87
       +
                 "type": "ref",

     

       88
       88
       +
                 "ref": "#commentView",

     

       89
       89
       +
                 "description": "The comment itself"

     

       90
       90
       +
               },

     

       91
       91
       +
               "replies": {

     

       92
       92
       +
                 "type": "array",

     

       93
       93
       +
                 "description": "Nested replies to this comment",

     

       94
       94
       +
                 "items": {

     

       95
       95
       +
                   "type": "union",

     

       96
       96
       +
                   "refs": ["#threadViewComment", "#notFoundComment", "#blockedComment"]

     

       97
       97
       +
                 }

     

       98
       98
       +
               },

     

       99
       99
       +
               "hasMore": {

     

       100
       100
       +
                 "type": "boolean",

     

       101
       101
       +
                 "description": "True if more replies exist but are not included in this response"

     

       102
       102
       +
               }

     

       103
       103
       +
             }

     

       104
       104
       +
           },

     

       105
       105
       +
           "commentRef": {

     

       106
       106
       +
             "type": "object",

     

       107
       107
       +
             "description": "Reference to a comment record",

     

       108
       108
       +
             "required": ["uri", "cid"],

     

       109
       109
       +
             "properties": {

     

       110
       110
       +
               "uri": {

     

       111
       111
       +
                 "type": "string",

     

       112
       112
       +
                 "format": "at-uri",

     

       113
       113
       +
                 "description": "AT-URI of the comment"

     

       114
       114
       +
               },

     

       115
       115
       +
               "cid": {

     

       116
       116
       +
                 "type": "string",

     

       117
       117
       +
                 "format": "cid",

     

       118
       118
       +
                 "description": "CID of the comment record"

     

       119
       119
       +
               }

     

       120
       120
       +
             }

     

       121
       121
       +
           },

     

       122
       122
       +
           "postRef": {

     

       123
       123
       +
             "type": "object",

     

       124
       124
       +
             "description": "Reference to a post record",

     

       125
       125
       +
             "required": ["uri", "cid"],

     

       126
       126
       +
             "properties": {

     

       127
       127
       +
               "uri": {

     

       128
       128
       +
                 "type": "string",

     

       129
       129
       +
                 "format": "at-uri",

     

       130
       130
       +
                 "description": "AT-URI of the post"

     

       131
       131
       +
               },

     

       132
       132
       +
               "cid": {

     

       133
       133
       +
                 "type": "string",

     

       134
       134
       +
                 "format": "cid",

     

       135
       135
       +
                 "description": "CID of the post record"

     

       136
       136
       +
               }

     

       137
       137
       +
             }

     

       138
       138
       +
           },

     

       139
       139
       +
           "notFoundComment": {

     

       140
       140
       +
             "type": "object",

     

       141
       141
       +
             "description": "Comment was not found (deleted, never indexed, or invalid URI)",

     

       142
       142
       +
             "required": ["uri", "notFound"],

     

       143
       143
       +
             "properties": {

     

       144
       144
       +
               "uri": {

     

       145
       145
       +
                 "type": "string",

     

       146
       146
       +
                 "format": "at-uri",

     

       147
       147
       +
                 "description": "AT-URI of the missing comment"

     

       148
       148
       +
               },

     

       149
       149
       +
               "notFound": {

     

       150
       150
       +
                 "type": "boolean",

     

       151
       151
       +
                 "const": true,

     

       152
       152
       +
                 "description": "Always true for not found comments"

     

       153
       153
       +
               }

     

       154
       154
       +
             }

     

       155
       155
       +
           },

     

       156
       156
       +
           "blockedComment": {

     

       157
       157
       +
             "type": "object",

     

       158
       158
       +
             "description": "Comment is blocked due to viewer blocking author or moderation action",

     

       159
       159
       +
             "required": ["uri", "blocked"],

     

       160
       160
       +
             "properties": {

     

       161
       161
       +
               "uri": {

     

       162
       162
       +
                 "type": "string",

     

       163
       163
       +
                 "format": "at-uri",

     

       164
       164
       +
                 "description": "AT-URI of the blocked comment"

     

       165
       165
       +
               },

     

       166
       166
       +
               "blocked": {

     

       167
       167
       +
                 "type": "boolean",

     

       168
       168
       +
                 "const": true,

     

       169
       169
       +
                 "description": "Always true for blocked comments"

     

       170
       170
       +
               },

     

       171
       171
       +
               "blockedBy": {

     

       172
       172
       +
                 "type": "string",

     

       173
       173
       +
                 "knownValues": ["author", "moderator"],

     

       174
       174
       +
                 "description": "What caused the block: viewer blocked author, or comment was removed by moderators"

     

       175
       175
       +
               }

     

       176
       176
       +
             }

     

       177
       177
       +
           },

     

       178
       178
       +
           "commentStats": {

     

       179
       179
       +
             "type": "object",

     

       180
       180
       +
             "description": "Statistics for a comment",

     

       181
       181
       +
             "required": ["upvotes", "downvotes", "score", "replyCount"],

     

       182
       182
       +
             "properties": {

     

       183
       183
       +
               "upvotes": {

     

       184
       184
       +
                 "type": "integer",

     

       185
       185
       +
                 "minimum": 0,

     

       186
       186
       +
                 "description": "Number of upvotes"

     

       187
       187
       +
               },

     

       188
       188
       +
               "downvotes": {

     

       189
       189
       +
                 "type": "integer",

     

       190
       190
       +
                 "minimum": 0,

     

       191
       191
       +
                 "description": "Number of downvotes"

     

       192
       192
       +
               },

     

       193
       193
       +
               "score": {

     

       194
       194
       +
                 "type": "integer",

     

       195
       195
       +
                 "description": "Calculated score (upvotes - downvotes)"

     

       196
       196
       +
               },

     

       197
       197
       +
               "replyCount": {

     

       198
       198
       +
                 "type": "integer",

     

       199
       199
       +
                 "minimum": 0,

     

       200
       200
       +
                 "description": "Number of direct replies to this comment"

     

       201
       201
       +
               }

     

       202
       202
       +
             }

     

       203
       203
       +
           },

     

       204
       204
       +
           "commentViewerState": {

     

       205
       205
       +
             "type": "object",

     

       206
       206
       +
             "description": "Viewer-specific state for a comment",

     

       207
       207
       +
             "properties": {

     

       208
       208
       +
               "vote": {

     

       209
       209
       +
                 "type": "string",

     

       210
       210
       +
                 "knownValues": ["up", "down"],

     

       211
       211
       +
                 "description": "Viewer's vote on this comment"

     

       212
       212
       +
               },

     

       213
       213
       +
               "voteUri": {

     

       214
       214
       +
                 "type": "string",

     

       215
       215
       +
                 "format": "at-uri",

     

       216
       216
       +
                 "description": "AT-URI of the viewer's vote record"

     

       217
       217
       +
               }

     

       218
       218
       +
             }

     

       219
       219
       +
           }

     

       220
       220
       +
         }

     

       221
       221
       +
       }

+86

internal/atproto/lexicon/social/coves/community/comment/getComments.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.comment.getComments",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "query",

     

       7
       7
       +
             "description": "Get comments for a post with threading and sorting support. Supports hot/top/new sorting, configurable nesting depth, and pagination.",

     

       8
       8
       +
             "parameters": {

     

       9
       9
       +
               "type": "params",

     

       10
       10
       +
               "required": ["post"],

     

       11
       11
       +
               "properties": {

     

       12
       12
       +
                 "post": {

     

       13
       13
       +
                   "type": "string",

     

       14
       14
       +
                   "format": "at-uri",

     

       15
       15
       +
                   "description": "AT-URI of the post to get comments for"

     

       16
       16
       +
                 },

     

       17
       17
       +
                 "sort": {

     

       18
       18
       +
                   "type": "string",

     

       19
       19
       +
                   "default": "hot",

     

       20
       20
       +
                   "knownValues": ["hot", "top", "new"],

     

       21
       21
       +
                   "description": "Sort order: hot (trending), top (highest score), new (most recent)"

     

       22
       22
       +
                 },

     

       23
       23
       +
                 "timeframe": {

     

       24
       24
       +
                   "type": "string",

     

       25
       25
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       26
       26
       +
                   "description": "Timeframe for 'top' sort. Ignored for other sort types."

     

       27
       27
       +
                 },

     

       28
       28
       +
                 "depth": {

     

       29
       29
       +
                   "type": "integer",

     

       30
       30
       +
                   "default": 10,

     

       31
       31
       +
                   "minimum": 0,

     

       32
       32
       +
                   "maximum": 100,

     

       33
       33
       +
                   "description": "Maximum reply nesting depth to return. 0 returns only top-level comments."

     

       34
       34
       +
                 },

     

       35
       35
       +
                 "limit": {

     

       36
       36
       +
                   "type": "integer",

     

       37
       37
       +
                   "default": 50,

     

       38
       38
       +
                   "minimum": 1,

     

       39
       39
       +
                   "maximum": 100,

     

       40
       40
       +
                   "description": "Maximum number of top-level comments to return per page"

     

       41
       41
       +
                 },

     

       42
       42
       +
                 "cursor": {

     

       43
       43
       +
                   "type": "string",

     

       44
       44
       +
                   "description": "Pagination cursor from previous response"

     

       45
       45
       +
                 }

     

       46
       46
       +
               }

     

       47
       47
       +
             },

     

       48
       48
       +
             "output": {

     

       49
       49
       +
               "encoding": "application/json",

     

       50
       50
       +
               "schema": {

     

       51
       51
       +
                 "type": "object",

     

       52
       52
       +
                 "required": ["comments", "post"],

     

       53
       53
       +
                 "properties": {

     

       54
       54
       +
                   "comments": {

     

       55
       55
       +
                     "type": "array",

     

       56
       56
       +
                     "description": "Top-level comments with nested replies up to requested depth",

     

       57
       57
       +
                     "items": {

     

       58
       58
       +
                       "type": "ref",

     

       59
       59
       +
                       "ref": "social.coves.community.comment.defs#threadViewComment"

     

       60
       60
       +
                     }

     

       61
       61
       +
                   },

     

       62
       62
       +
                   "post": {

     

       63
       63
       +
                     "type": "ref",

     

       64
       64
       +
                     "ref": "social.coves.community.post.get#postView",

     

       65
       65
       +
                     "description": "The post these comments belong to"

     

       66
       66
       +
                   },

     

       67
       67
       +
                   "cursor": {

     

       68
       68
       +
                     "type": "string",

     

       69
       69
       +
                     "description": "Pagination cursor for fetching next page of top-level comments"

     

       70
       70
       +
                   }

     

       71
       71
       +
                 }

     

       72
       72
       +
               }

     

       73
       73
       +
             },

     

       74
       74
       +
             "errors": [

     

       75
       75
       +
               {

     

       76
       76
       +
                 "name": "NotFound",

     

       77
       77
       +
                 "description": "Post not found"

     

       78
       78
       +
               },

     

       79
       79
       +
               {

     

       80
       80
       +
                 "name": "InvalidRequest",

     

       81
       81
       +
                 "description": "Invalid parameters (malformed URI, invalid sort/timeframe combination, etc.)"

     

       82
       82
       +
               }

     

       83
       83
       +
             ]

     

       84
       84
       +
           }

     

       85
       85
       +
         }

     

       86
       86
       +
       }

+11

internal/core/comments/interfaces.go

···

       64
       64
        
       	// Returns map[commentURI]*Vote for efficient lookups

     

       65
       65
        
       	// Future: Used when votes table is implemented

     

       66
       66
        
       	GetVoteStateForComments(ctx context.Context, viewerDID string, commentURIs []string) (map[string]interface{}, error)

     

       67
       67
       +
       

     

       68
       68
       +
       	// ListByParentsBatch retrieves direct replies to multiple parents in a single query

     

       69
       69
       +
       	// Returns map[parentURI][]*Comment grouped by parent

     

       70
       70
       +
       	// Used to prevent N+1 queries when loading nested replies

     

       71
       71
       +
       	// Limits results per parent to avoid memory exhaustion

     

       72
       72
       +
       	ListByParentsBatch(

     

       73
       73
       +
       		ctx context.Context,

     

       74
       74
       +
       		parentURIs []string,

     

       75
       75
       +
       		sort string,

     

       76
       76
       +
       		limitPerParent int,

     

       77
       77
       +
       	) (map[string][]*Comment, error)

     

       67
       78
        
       }

+5

internal/atproto/lexicon/social/coves/community/post/get.json

···

       150
       150
        
                 "type": "string",

     

       151
       151
        
                 "format": "did"

     

       152
       152
        
               },

     

       153
       153
       +
               "handle": {

     

       154
       154
       +
                 "type": "string",

     

       155
       155
       +
                 "format": "handle",

     

       156
       156
       +
                 "description": "Current handle resolved from DID"

     

       157
       157
       +
               },

     

       153
       158
        
               "name": {

     

       154
       159
        
                 "type": "string"

     

       155
       160
        
               },

+200

internal/core/unfurl/circuit_breaker.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"log"

     

       6
       6
       +
       	"sync"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // circuitState represents the state of a circuit breaker

     

       11
       11
       +
       type circuitState int

     

       12
       12
       +
       

     

       13
       13
       +
       const (

     

       14
       14
       +
       	stateClosed   circuitState = iota // Normal operation

     

       15
       15
       +
       	stateOpen                         // Circuit is open (provider failing)

     

       16
       16
       +
       	stateHalfOpen                     // Testing if provider recovered

     

       17
       17
       +
       )

     

       18
       18
       +
       

     

       19
       19
       +
       // circuitBreaker tracks failures per provider and stops trying failing providers

     

       20
       20
       +
       type circuitBreaker struct {

     

       21
       21
       +
       	failures         map[string]int

     

       22
       22
       +
       	lastFailure      map[string]time.Time

     

       23
       23
       +
       	state            map[string]circuitState

     

       24
       24
       +
       	lastStateLog     map[string]time.Time

     

       25
       25
       +
       	failureThreshold int

     

       26
       26
       +
       	openDuration     time.Duration

     

       27
       27
       +
       	mu               sync.RWMutex

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       // newCircuitBreaker creates a circuit breaker with default settings

     

       31
       31
       +
       func newCircuitBreaker() *circuitBreaker {

     

       32
       32
       +
       	return &circuitBreaker{

     

       33
       33
       +
       		failureThreshold: 3,               // Open after 3 consecutive failures

     

       34
       34
       +
       		openDuration:     5 * time.Minute, // Keep open for 5 minutes

     

       35
       35
       +
       		failures:         make(map[string]int),

     

       36
       36
       +
       		lastFailure:      make(map[string]time.Time),

     

       37
       37
       +
       		state:            make(map[string]circuitState),

     

       38
       38
       +
       		lastStateLog:     make(map[string]time.Time),

     

       39
       39
       +
       	}

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       // canAttempt checks if we should attempt to call this provider

     

       43
       43
       +
       // Returns true if circuit is closed or half-open (ready to retry)

     

       44
       44
       +
       func (cb *circuitBreaker) canAttempt(provider string) (bool, error) {

     

       45
       45
       +
       	cb.mu.RLock()

     

       46
       46
       +
       	defer cb.mu.RUnlock()

     

       47
       47
       +
       

     

       48
       48
       +
       	state := cb.getState(provider)

     

       49
       49
       +
       

     

       50
       50
       +
       	switch state {

     

       51
       51
       +
       	case stateClosed:

     

       52
       52
       +
       		return true, nil

     

       53
       53
       +
       	case stateOpen:

     

       54
       54
       +
       		// Check if we should transition to half-open

     

       55
       55
       +
       		lastFail := cb.lastFailure[provider]

     

       56
       56
       +
       		if time.Since(lastFail) > cb.openDuration {

     

       57
       57
       +
       			// Transition to half-open (allow one retry)

     

       58
       58
       +
       			cb.mu.RUnlock()

     

       59
       59
       +
       			cb.mu.Lock()

     

       60
       60
       +
       			cb.state[provider] = stateHalfOpen

     

       61
       61
       +
       			cb.logStateChange(provider, stateHalfOpen)

     

       62
       62
       +
       			cb.mu.Unlock()

     

       63
       63
       +
       			cb.mu.RLock()

     

       64
       64
       +
       			return true, nil

     

       65
       65
       +
       		}

     

       66
       66
       +
       		// Still in open period

     

       67
       67
       +
       		failCount := cb.failures[provider]

     

       68
       68
       +
       		nextRetry := lastFail.Add(cb.openDuration)

     

       69
       69
       +
       		return false, fmt.Errorf(

     

       70
       70
       +
       			"circuit breaker open for provider '%s' (failures: %d, next retry: %s)",

     

       71
       71
       +
       			provider,

     

       72
       72
       +
       			failCount,

     

       73
       73
       +
       			nextRetry.Format("15:04:05"),

     

       74
       74
       +
       		)

     

       75
       75
       +
       	case stateHalfOpen:

     

       76
       76
       +
       		return true, nil

     

       77
       77
       +
       	default:

     

       78
       78
       +
       		return true, nil

     

       79
       79
       +
       	}

     

       80
       80
       +
       }

     

       81
       81
       +
       

     

       82
       82
       +
       // recordSuccess records a successful unfurl, resetting failure count

     

       83
       83
       +
       func (cb *circuitBreaker) recordSuccess(provider string) {

     

       84
       84
       +
       	cb.mu.Lock()

     

       85
       85
       +
       	defer cb.mu.Unlock()

     

       86
       86
       +
       

     

       87
       87
       +
       	oldState := cb.getState(provider)

     

       88
       88
       +
       

     

       89
       89
       +
       	// Reset failure tracking

     

       90
       90
       +
       	delete(cb.failures, provider)

     

       91
       91
       +
       	delete(cb.lastFailure, provider)

     

       92
       92
       +
       	cb.state[provider] = stateClosed

     

       93
       93
       +
       

     

       94
       94
       +
       	// Log recovery if we were in a failure state

     

       95
       95
       +
       	if oldState != stateClosed {

     

       96
       96
       +
       		cb.logStateChange(provider, stateClosed)

     

       97
       97
       +
       	}

     

       98
       98
       +
       }

     

       99
       99
       +
       

     

       100
       100
       +
       // recordFailure records a failed unfurl attempt

     

       101
       101
       +
       func (cb *circuitBreaker) recordFailure(provider string, err error) {

     

       102
       102
       +
       	cb.mu.Lock()

     

       103
       103
       +
       	defer cb.mu.Unlock()

     

       104
       104
       +
       

     

       105
       105
       +
       	// Increment failure count

     

       106
       106
       +
       	cb.failures[provider]++

     

       107
       107
       +
       	cb.lastFailure[provider] = time.Now()

     

       108
       108
       +
       

     

       109
       109
       +
       	failCount := cb.failures[provider]

     

       110
       110
       +
       

     

       111
       111
       +
       	// Check if we should open the circuit

     

       112
       112
       +
       	if failCount >= cb.failureThreshold {

     

       113
       113
       +
       		oldState := cb.getState(provider)

     

       114
       114
       +
       		cb.state[provider] = stateOpen

     

       115
       115
       +
       		if oldState != stateOpen {

     

       116
       116
       +
       			log.Printf(

     

       117
       117
       +
       				"[UNFURL-CIRCUIT] Opening circuit for provider '%s' after %d consecutive failures. Last error: %v",

     

       118
       118
       +
       				provider,

     

       119
       119
       +
       				failCount,

     

       120
       120
       +
       				err,

     

       121
       121
       +
       			)

     

       122
       122
       +
       			cb.lastStateLog[provider] = time.Now()

     

       123
       123
       +
       		}

     

       124
       124
       +
       	} else {

     

       125
       125
       +
       		log.Printf(

     

       126
       126
       +
       			"[UNFURL-CIRCUIT] Failure %d/%d for provider '%s': %v",

     

       127
       127
       +
       			failCount,

     

       128
       128
       +
       			cb.failureThreshold,

     

       129
       129
       +
       			provider,

     

       130
       130
       +
       			err,

     

       131
       131
       +
       		)

     

       132
       132
       +
       	}

     

       133
       133
       +
       }

     

       134
       134
       +
       

     

       135
       135
       +
       // getState returns the current state (must be called with lock held)

     

       136
       136
       +
       func (cb *circuitBreaker) getState(provider string) circuitState {

     

       137
       137
       +
       	if state, exists := cb.state[provider]; exists {

     

       138
       138
       +
       		return state

     

       139
       139
       +
       	}

     

       140
       140
       +
       	return stateClosed

     

       141
       141
       +
       }

     

       142
       142
       +
       

     

       143
       143
       +
       // logStateChange logs state transitions (must be called with lock held)

     

       144
       144
       +
       // Debounced to avoid log spam (max once per minute per provider)

     

       145
       145
       +
       func (cb *circuitBreaker) logStateChange(provider string, newState circuitState) {

     

       146
       146
       +
       	lastLog, exists := cb.lastStateLog[provider]

     

       147
       147
       +
       	if exists && time.Since(lastLog) < time.Minute {

     

       148
       148
       +
       		return // Don't spam logs

     

       149
       149
       +
       	}

     

       150
       150
       +
       

     

       151
       151
       +
       	var stateStr string

     

       152
       152
       +
       	switch newState {

     

       153
       153
       +
       	case stateClosed:

     

       154
       154
       +
       		stateStr = "CLOSED (recovered)"

     

       155
       155
       +
       	case stateOpen:

     

       156
       156
       +
       		stateStr = "OPEN (failing)"

     

       157
       157
       +
       	case stateHalfOpen:

     

       158
       158
       +
       		stateStr = "HALF-OPEN (testing)"

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	log.Printf("[UNFURL-CIRCUIT] Circuit for provider '%s' is now %s", provider, stateStr)

     

       162
       162
       +
       	cb.lastStateLog[provider] = time.Now()

     

       163
       163
       +
       }

     

       164
       164
       +
       

     

       165
       165
       +
       // getStats returns current circuit breaker stats (for debugging/monitoring)

     

       166
       166
       +
       func (cb *circuitBreaker) getStats() map[string]interface{} {

     

       167
       167
       +
       	cb.mu.RLock()

     

       168
       168
       +
       	defer cb.mu.RUnlock()

     

       169
       169
       +
       

     

       170
       170
       +
       	stats := make(map[string]interface{})

     

       171
       171
       +
       

     

       172
       172
       +
       	// Collect all providers with any activity (state, failures, or both)

     

       173
       173
       +
       	providers := make(map[string]bool)

     

       174
       174
       +
       	for provider := range cb.state {

     

       175
       175
       +
       		providers[provider] = true

     

       176
       176
       +
       	}

     

       177
       177
       +
       	for provider := range cb.failures {

     

       178
       178
       +
       		providers[provider] = true

     

       179
       179
       +
       	}

     

       180
       180
       +
       

     

       181
       181
       +
       	for provider := range providers {

     

       182
       182
       +
       		state := cb.getState(provider)

     

       183
       183
       +
       		var stateStr string

     

       184
       184
       +
       		switch state {

     

       185
       185
       +
       		case stateClosed:

     

       186
       186
       +
       			stateStr = "closed"

     

       187
       187
       +
       		case stateOpen:

     

       188
       188
       +
       			stateStr = "open"

     

       189
       189
       +
       		case stateHalfOpen:

     

       190
       190
       +
       			stateStr = "half-open"

     

       191
       191
       +
       		}

     

       192
       192
       +
       

     

       193
       193
       +
       		stats[provider] = map[string]interface{}{

     

       194
       194
       +
       			"state":        stateStr,

     

       195
       195
       +
       			"failures":     cb.failures[provider],

     

       196
       196
       +
       			"last_failure": cb.lastFailure[provider],

     

       197
       197
       +
       		}

     

       198
       198
       +
       	}

     

       199
       199
       +
       	return stats

     

       200
       200
       +
       }

+175

internal/core/unfurl/circuit_breaker_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"testing"

     

       6
       6
       +
       	"time"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       func TestCircuitBreaker_Basic(t *testing.T) {

     

       10
       10
       +
       	cb := newCircuitBreaker()

     

       11
       11
       +
       

     

       12
       12
       +
       	provider := "test-provider"

     

       13
       13
       +
       

     

       14
       14
       +
       	// Should start closed (allow attempts)

     

       15
       15
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       16
       16
       +
       	if !canAttempt {

     

       17
       17
       +
       		t.Errorf("Expected circuit to be closed initially, but got error: %v", err)

     

       18
       18
       +
       	}

     

       19
       19
       +
       

     

       20
       20
       +
       	// Record success

     

       21
       21
       +
       	cb.recordSuccess(provider)

     

       22
       22
       +
       	canAttempt, _ = cb.canAttempt(provider)

     

       23
       23
       +
       	if !canAttempt {

     

       24
       24
       +
       		t.Error("Expected circuit to remain closed after success")

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       func TestCircuitBreaker_OpensAfterFailures(t *testing.T) {

     

       29
       29
       +
       	cb := newCircuitBreaker()

     

       30
       30
       +
       	provider := "failing-provider"

     

       31
       31
       +
       

     

       32
       32
       +
       	// Record failures up to threshold

     

       33
       33
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       34
       34
       +
       		cb.recordFailure(provider, fmt.Errorf("test error %d", i))

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	// Circuit should now be open

     

       38
       38
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       39
       39
       +
       	if canAttempt {

     

       40
       40
       +
       		t.Error("Expected circuit to be open after threshold failures")

     

       41
       41
       +
       	}

     

       42
       42
       +
       	if err == nil {

     

       43
       43
       +
       		t.Error("Expected error when circuit is open")

     

       44
       44
       +
       	}

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       func TestCircuitBreaker_RecoveryAfterSuccess(t *testing.T) {

     

       48
       48
       +
       	cb := newCircuitBreaker()

     

       49
       49
       +
       	provider := "recovery-provider"

     

       50
       50
       +
       

     

       51
       51
       +
       	// Record some failures

     

       52
       52
       +
       	cb.recordFailure(provider, fmt.Errorf("error 1"))

     

       53
       53
       +
       	cb.recordFailure(provider, fmt.Errorf("error 2"))

     

       54
       54
       +
       

     

       55
       55
       +
       	// Record success - should reset failure count

     

       56
       56
       +
       	cb.recordSuccess(provider)

     

       57
       57
       +
       

     

       58
       58
       +
       	// Should be able to attempt again

     

       59
       59
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       60
       60
       +
       	if !canAttempt {

     

       61
       61
       +
       		t.Errorf("Expected circuit to be closed after success, but got error: %v", err)

     

       62
       62
       +
       	}

     

       63
       63
       +
       

     

       64
       64
       +
       	// Failure count should be reset

     

       65
       65
       +
       	if count := cb.failures[provider]; count != 0 {

     

       66
       66
       +
       		t.Errorf("Expected failure count to be reset to 0, got %d", count)

     

       67
       67
       +
       	}

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       func TestCircuitBreaker_HalfOpenTransition(t *testing.T) {

     

       71
       71
       +
       	cb := newCircuitBreaker()

     

       72
       72
       +
       	cb.openDuration = 100 * time.Millisecond // Short duration for testing

     

       73
       73
       +
       	provider := "half-open-provider"

     

       74
       74
       +
       

     

       75
       75
       +
       	// Open the circuit

     

       76
       76
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       77
       77
       +
       		cb.recordFailure(provider, fmt.Errorf("error %d", i))

     

       78
       78
       +
       	}

     

       79
       79
       +
       

     

       80
       80
       +
       	// Should be open

     

       81
       81
       +
       	canAttempt, _ := cb.canAttempt(provider)

     

       82
       82
       +
       	if canAttempt {

     

       83
       83
       +
       		t.Error("Expected circuit to be open")

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	// Wait for open duration

     

       87
       87
       +
       	time.Sleep(150 * time.Millisecond)

     

       88
       88
       +
       

     

       89
       89
       +
       	// Should transition to half-open and allow one attempt

     

       90
       90
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       91
       91
       +
       	if !canAttempt {

     

       92
       92
       +
       		t.Errorf("Expected circuit to transition to half-open after duration, but got error: %v", err)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	// State should be half-open

     

       96
       96
       +
       	cb.mu.RLock()

     

       97
       97
       +
       	state := cb.state[provider]

     

       98
       98
       +
       	cb.mu.RUnlock()

     

       99
       99
       +
       

     

       100
       100
       +
       	if state != stateHalfOpen {

     

       101
       101
       +
       		t.Errorf("Expected state to be half-open, got %v", state)

     

       102
       102
       +
       	}

     

       103
       103
       +
       }

     

       104
       104
       +
       

     

       105
       105
       +
       func TestCircuitBreaker_MultipleProviders(t *testing.T) {

     

       106
       106
       +
       	cb := newCircuitBreaker()

     

       107
       107
       +
       

     

       108
       108
       +
       	// Open circuit for provider A

     

       109
       109
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       110
       110
       +
       		cb.recordFailure("providerA", fmt.Errorf("error"))

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	// Provider A should be blocked

     

       114
       114
       +
       	canAttemptA, _ := cb.canAttempt("providerA")

     

       115
       115
       +
       	if canAttemptA {

     

       116
       116
       +
       		t.Error("Expected providerA circuit to be open")

     

       117
       117
       +
       	}

     

       118
       118
       +
       

     

       119
       119
       +
       	// Provider B should still be open (independent circuits)

     

       120
       120
       +
       	canAttemptB, err := cb.canAttempt("providerB")

     

       121
       121
       +
       	if !canAttemptB {

     

       122
       122
       +
       		t.Errorf("Expected providerB circuit to be closed, but got error: %v", err)

     

       123
       123
       +
       	}

     

       124
       124
       +
       }

     

       125
       125
       +
       

     

       126
       126
       +
       func TestCircuitBreaker_GetStats(t *testing.T) {

     

       127
       127
       +
       	cb := newCircuitBreaker()

     

       128
       128
       +
       

     

       129
       129
       +
       	// Record some activity

     

       130
       130
       +
       	cb.recordFailure("provider1", fmt.Errorf("error 1"))

     

       131
       131
       +
       	cb.recordFailure("provider1", fmt.Errorf("error 2"))

     

       132
       132
       +
       

     

       133
       133
       +
       	stats := cb.getStats()

     

       134
       134
       +
       

     

       135
       135
       +
       	// Should have stats for providers with failures

     

       136
       136
       +
       	if providerStats, ok := stats["provider1"]; !ok {

     

       137
       137
       +
       		t.Error("Expected stats for provider1")

     

       138
       138
       +
       	} else {

     

       139
       139
       +
       		// Check that failure count is tracked

     

       140
       140
       +
       		statsMap := providerStats.(map[string]interface{})

     

       141
       141
       +
       		if failures, ok := statsMap["failures"].(int); !ok || failures != 2 {

     

       142
       142
       +
       			t.Errorf("Expected 2 failures for provider1, got %v", statsMap["failures"])

     

       143
       143
       +
       		}

     

       144
       144
       +
       	}

     

       145
       145
       +
       

     

       146
       146
       +
       	// Provider that succeeds is cleaned up from state

     

       147
       147
       +
       	cb.recordSuccess("provider2")

     

       148
       148
       +
       	_ = cb.getStats()

     

       149
       149
       +
       	// Provider2 should not be in stats (or have state "closed" with 0 failures)

     

       150
       150
       +
       }

     

       151
       151
       +
       

     

       152
       152
       +
       func TestCircuitBreaker_FailureThresholdExact(t *testing.T) {

     

       153
       153
       +
       	cb := newCircuitBreaker()

     

       154
       154
       +
       	provider := "exact-threshold-provider"

     

       155
       155
       +
       

     

       156
       156
       +
       	// Record failures just below threshold

     

       157
       157
       +
       	for i := 0; i < cb.failureThreshold-1; i++ {

     

       158
       158
       +
       		cb.recordFailure(provider, fmt.Errorf("error %d", i))

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	// Should still be closed

     

       162
       162
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       163
       163
       +
       	if !canAttempt {

     

       164
       164
       +
       		t.Errorf("Expected circuit to be closed below threshold, but got error: %v", err)

     

       165
       165
       +
       	}

     

       166
       166
       +
       

     

       167
       167
       +
       	// One more failure should open it

     

       168
       168
       +
       	cb.recordFailure(provider, fmt.Errorf("final error"))

     

       169
       169
       +
       

     

       170
       170
       +
       	// Should now be open

     

       171
       171
       +
       	canAttempt, _ = cb.canAttempt(provider)

     

       172
       172
       +
       	if canAttempt {

     

       173
       173
       +
       		t.Error("Expected circuit to be open at threshold")

     

       174
       174
       +
       	}

     

       175
       175
       +
       }

+202

internal/core/unfurl/kagi_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       func TestFetchKagiKite_Success(t *testing.T) {

     

       15
       15
       +
       	// Mock Kagi HTML response

     

       16
       16
       +
       	mockHTML := `<!DOCTYPE html>

     

       17
       17
       +
       <html>

     

       18
       18
       +
       <head>

     

       19
       19
       +
       	<title>FAA orders 10% flight cuts at 40 airports - Kagi News</title>

     

       20
       20
       +
       	<meta property="og:title" content="FAA orders 10% flight cuts" />

     

       21
       21
       +
       	<meta property="og:description" content="Flight restrictions announced" />

     

       22
       22
       +
       </head>

     

       23
       23
       +
       <body>

     

       24
       24
       +
       	<img src="https://kagiproxy.com/img/DHdCvN_NqVDWU3UyoNZSv86b" alt="Airport runway" />

     

       25
       25
       +
       </body>

     

       26
       26
       +
       </html>`

     

       27
       27
       +
       

     

       28
       28
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       29
       29
       +
       		w.Header().Set("Content-Type", "text/html")

     

       30
       30
       +
       		w.WriteHeader(http.StatusOK)

     

       31
       31
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       32
       32
       +
       	}))

     

       33
       33
       +
       	defer server.Close()

     

       34
       34
       +
       

     

       35
       35
       +
       	ctx := context.Background()

     

       36
       36
       +
       

     

       37
       37
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       38
       38
       +
       

     

       39
       39
       +
       	require.NoError(t, err)

     

       40
       40
       +
       	assert.Equal(t, "article", result.Type)

     

       41
       41
       +
       	assert.Equal(t, "FAA orders 10% flight cuts", result.Title)

     

       42
       42
       +
       	assert.Equal(t, "Flight restrictions announced", result.Description)

     

       43
       43
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       44
       44
       +
       	assert.Equal(t, "kagi", result.Provider)

     

       45
       45
       +
       	assert.Equal(t, "kite.kagi.com", result.Domain)

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       func TestFetchKagiKite_NoImage(t *testing.T) {

     

       49
       49
       +
       	mockHTML := `<!DOCTYPE html>

     

       50
       50
       +
       <html>

     

       51
       51
       +
       <head><title>Test Story</title></head>

     

       52
       52
       +
       <body><p>No images here</p></body>

     

       53
       53
       +
       </html>`

     

       54
       54
       +
       

     

       55
       55
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       56
       56
       +
       		w.Header().Set("Content-Type", "text/html")

     

       57
       57
       +
       		w.WriteHeader(http.StatusOK)

     

       58
       58
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       59
       59
       +
       	}))

     

       60
       60
       +
       	defer server.Close()

     

       61
       61
       +
       

     

       62
       62
       +
       	ctx := context.Background()

     

       63
       63
       +
       

     

       64
       64
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       65
       65
       +
       

     

       66
       66
       +
       	assert.Error(t, err)

     

       67
       67
       +
       	assert.Nil(t, result)

     

       68
       68
       +
       	assert.Contains(t, err.Error(), "no image found")

     

       69
       69
       +
       }

     

       70
       70
       +
       

     

       71
       71
       +
       func TestFetchKagiKite_FallbackToTitle(t *testing.T) {

     

       72
       72
       +
       	mockHTML := `<!DOCTYPE html>

     

       73
       73
       +
       <html>

     

       74
       74
       +
       <head><title>Fallback Title</title></head>

     

       75
       75
       +
       <body>

     

       76
       76
       +
       	<img src="https://kagiproxy.com/img/test123" />

     

       77
       77
       +
       </body>

     

       78
       78
       +
       </html>`

     

       79
       79
       +
       

     

       80
       80
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       81
       81
       +
       		w.Header().Set("Content-Type", "text/html")

     

       82
       82
       +
       		w.WriteHeader(http.StatusOK)

     

       83
       83
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       84
       84
       +
       	}))

     

       85
       85
       +
       	defer server.Close()

     

       86
       86
       +
       

     

       87
       87
       +
       	ctx := context.Background()

     

       88
       88
       +
       

     

       89
       89
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       90
       90
       +
       

     

       91
       91
       +
       	require.NoError(t, err)

     

       92
       92
       +
       	assert.Equal(t, "Fallback Title", result.Title)

     

       93
       93
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       94
       94
       +
       }

     

       95
       95
       +
       

     

       96
       96
       +
       func TestFetchKagiKite_ImageWithAltText(t *testing.T) {

     

       97
       97
       +
       	mockHTML := `<!DOCTYPE html>

     

       98
       98
       +
       <html>

     

       99
       99
       +
       <head><title>News Story</title></head>

     

       100
       100
       +
       <body>

     

       101
       101
       +
       	<img src="https://kagiproxy.com/img/xyz789" alt="This is the alt text description" />

     

       102
       102
       +
       </body>

     

       103
       103
       +
       </html>`

     

       104
       104
       +
       

     

       105
       105
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       106
       106
       +
       		w.Header().Set("Content-Type", "text/html")

     

       107
       107
       +
       		w.WriteHeader(http.StatusOK)

     

       108
       108
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       109
       109
       +
       	}))

     

       110
       110
       +
       	defer server.Close()

     

       111
       111
       +
       

     

       112
       112
       +
       	ctx := context.Background()

     

       113
       113
       +
       

     

       114
       114
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       115
       115
       +
       

     

       116
       116
       +
       	require.NoError(t, err)

     

       117
       117
       +
       	assert.Equal(t, "News Story", result.Title)

     

       118
       118
       +
       	assert.Equal(t, "This is the alt text description", result.Description)

     

       119
       119
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       120
       120
       +
       }

     

       121
       121
       +
       

     

       122
       122
       +
       func TestFetchKagiKite_HTTPError(t *testing.T) {

     

       123
       123
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       124
       124
       +
       		w.WriteHeader(http.StatusNotFound)

     

       125
       125
       +
       	}))

     

       126
       126
       +
       	defer server.Close()

     

       127
       127
       +
       

     

       128
       128
       +
       	ctx := context.Background()

     

       129
       129
       +
       

     

       130
       130
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       131
       131
       +
       

     

       132
       132
       +
       	assert.Error(t, err)

     

       133
       133
       +
       	assert.Nil(t, result)

     

       134
       134
       +
       	assert.Contains(t, err.Error(), "HTTP 404")

     

       135
       135
       +
       }

     

       136
       136
       +
       

     

       137
       137
       +
       func TestFetchKagiKite_Timeout(t *testing.T) {

     

       138
       138
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       139
       139
       +
       		time.Sleep(2 * time.Second)

     

       140
       140
       +
       		w.WriteHeader(http.StatusOK)

     

       141
       141
       +
       	}))

     

       142
       142
       +
       	defer server.Close()

     

       143
       143
       +
       

     

       144
       144
       +
       	ctx := context.Background()

     

       145
       145
       +
       

     

       146
       146
       +
       	result, err := fetchKagiKite(ctx, server.URL, 100*time.Millisecond, "TestBot/1.0")

     

       147
       147
       +
       

     

       148
       148
       +
       	assert.Error(t, err)

     

       149
       149
       +
       	assert.Nil(t, result)

     

       150
       150
       +
       }

     

       151
       151
       +
       

     

       152
       152
       +
       func TestFetchKagiKite_MultipleImages_PicksSecond(t *testing.T) {

     

       153
       153
       +
       	mockHTML := `<!DOCTYPE html>

     

       154
       154
       +
       <html>

     

       155
       155
       +
       <head><title>Story with multiple images</title></head>

     

       156
       156
       +
       <body>

     

       157
       157
       +
       	<img src="https://kagiproxy.com/img/first123" alt="First image (header/logo)" />

     

       158
       158
       +
       	<img src="https://kagiproxy.com/img/second456" alt="Second image" />

     

       159
       159
       +
       </body>

     

       160
       160
       +
       </html>`

     

       161
       161
       +
       

     

       162
       162
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       163
       163
       +
       		w.Header().Set("Content-Type", "text/html")

     

       164
       164
       +
       		w.WriteHeader(http.StatusOK)

     

       165
       165
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       166
       166
       +
       	}))

     

       167
       167
       +
       	defer server.Close()

     

       168
       168
       +
       

     

       169
       169
       +
       	ctx := context.Background()

     

       170
       170
       +
       

     

       171
       171
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       172
       172
       +
       

     

       173
       173
       +
       	require.NoError(t, err)

     

       174
       174
       +
       	// We skip the first image (often a header/logo) and use the second

     

       175
       175
       +
       	assert.Contains(t, result.ThumbnailURL, "second456")

     

       176
       176
       +
       	assert.Equal(t, "Second image", result.Description)

     

       177
       177
       +
       }

     

       178
       178
       +
       

     

       179
       179
       +
       func TestFetchKagiKite_OnlyNonKagiImages_NoMatch(t *testing.T) {

     

       180
       180
       +
       	mockHTML := `<!DOCTYPE html>

     

       181
       181
       +
       <html>

     

       182
       182
       +
       <head><title>Story with non-Kagi images</title></head>

     

       183
       183
       +
       <body>

     

       184
       184
       +
       	<img src="https://example.com/img/test.jpg" alt="External image" />

     

       185
       185
       +
       </body>

     

       186
       186
       +
       </html>`

     

       187
       187
       +
       

     

       188
       188
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       189
       189
       +
       		w.Header().Set("Content-Type", "text/html")

     

       190
       190
       +
       		w.WriteHeader(http.StatusOK)

     

       191
       191
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       192
       192
       +
       	}))

     

       193
       193
       +
       	defer server.Close()

     

       194
       194
       +
       

     

       195
       195
       +
       	ctx := context.Background()

     

       196
       196
       +
       

     

       197
       197
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       198
       198
       +
       

     

       199
       199
       +
       	assert.Error(t, err)

     

       200
       200
       +
       	assert.Nil(t, result)

     

       201
       201
       +
       	assert.Contains(t, err.Error(), "no image found")

     

       202
       202
       +
       }

+269

internal/core/unfurl/opengraph_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       func TestParseOpenGraph_ValidTags(t *testing.T) {

     

       15
       15
       +
       	html := `

     

       16
       16
       +
       <!DOCTYPE html>

     

       17
       17
       +
       <html>

     

       18
       18
       +
       <head>

     

       19
       19
       +
           <meta property="og:title" content="Test Article Title" />

     

       20
       20
       +
           <meta property="og:description" content="This is a test description" />

     

       21
       21
       +
           <meta property="og:image" content="https://example.com/image.jpg" />

     

       22
       22
       +
           <meta property="og:url" content="https://example.com/canonical" />

     

       23
       23
       +
       </head>

     

       24
       24
       +
       <body>

     

       25
       25
       +
           <p>Some content</p>

     

       26
       26
       +
       </body>

     

       27
       27
       +
       </html>

     

       28
       28
       +
       `

     

       29
       29
       +
       

     

       30
       30
       +
       	og, err := parseOpenGraph(html)

     

       31
       31
       +
       	require.NoError(t, err)

     

       32
       32
       +
       

     

       33
       33
       +
       	assert.Equal(t, "Test Article Title", og.Title)

     

       34
       34
       +
       	assert.Equal(t, "This is a test description", og.Description)

     

       35
       35
       +
       	assert.Equal(t, "https://example.com/image.jpg", og.Image)

     

       36
       36
       +
       	assert.Equal(t, "https://example.com/canonical", og.URL)

     

       37
       37
       +
       }

     

       38
       38
       +
       

     

       39
       39
       +
       func TestParseOpenGraph_MissingImage(t *testing.T) {

     

       40
       40
       +
       	html := `

     

       41
       41
       +
       <!DOCTYPE html>

     

       42
       42
       +
       <html>

     

       43
       43
       +
       <head>

     

       44
       44
       +
           <meta property="og:title" content="Article Without Image" />

     

       45
       45
       +
           <meta property="og:description" content="No image tag" />

     

       46
       46
       +
       </head>

     

       47
       47
       +
       <body></body>

     

       48
       48
       +
       </html>

     

       49
       49
       +
       `

     

       50
       50
       +
       

     

       51
       51
       +
       	og, err := parseOpenGraph(html)

     

       52
       52
       +
       	require.NoError(t, err)

     

       53
       53
       +
       

     

       54
       54
       +
       	assert.Equal(t, "Article Without Image", og.Title)

     

       55
       55
       +
       	assert.Equal(t, "No image tag", og.Description)

     

       56
       56
       +
       	assert.Empty(t, og.Image, "Image should be empty when not provided")

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       func TestParseOpenGraph_FallbackToTitle(t *testing.T) {

     

       60
       60
       +
       	html := `

     

       61
       61
       +
       <!DOCTYPE html>

     

       62
       62
       +
       <html>

     

       63
       63
       +
       <head>

     

       64
       64
       +
           <title>Page Title Fallback</title>

     

       65
       65
       +
           <meta name="description" content="Meta description fallback" />

     

       66
       66
       +
       </head>

     

       67
       67
       +
       <body></body>

     

       68
       68
       +
       </html>

     

       69
       69
       +
       `

     

       70
       70
       +
       

     

       71
       71
       +
       	og, err := parseOpenGraph(html)

     

       72
       72
       +
       	require.NoError(t, err)

     

       73
       73
       +
       

     

       74
       74
       +
       	assert.Equal(t, "Page Title Fallback", og.Title, "Should fall back to <title>")

     

       75
       75
       +
       	assert.Equal(t, "Meta description fallback", og.Description, "Should fall back to meta description")

     

       76
       76
       +
       }

     

       77
       77
       +
       

     

       78
       78
       +
       func TestParseOpenGraph_PreferOpenGraphOverFallback(t *testing.T) {

     

       79
       79
       +
       	html := `

     

       80
       80
       +
       <!DOCTYPE html>

     

       81
       81
       +
       <html>

     

       82
       82
       +
       <head>

     

       83
       83
       +
           <title>Page Title</title>

     

       84
       84
       +
           <meta name="description" content="Meta description" />

     

       85
       85
       +
           <meta property="og:title" content="OpenGraph Title" />

     

       86
       86
       +
           <meta property="og:description" content="OpenGraph Description" />

     

       87
       87
       +
       </head>

     

       88
       88
       +
       <body></body>

     

       89
       89
       +
       </html>

     

       90
       90
       +
       `

     

       91
       91
       +
       

     

       92
       92
       +
       	og, err := parseOpenGraph(html)

     

       93
       93
       +
       	require.NoError(t, err)

     

       94
       94
       +
       

     

       95
       95
       +
       	assert.Equal(t, "OpenGraph Title", og.Title, "Should prefer og:title")

     

       96
       96
       +
       	assert.Equal(t, "OpenGraph Description", og.Description, "Should prefer og:description")

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       func TestParseOpenGraph_MalformedHTML(t *testing.T) {

     

       100
       100
       +
       	html := `

     

       101
       101
       +
       <!DOCTYPE html>

     

       102
       102
       +
       <html>

     

       103
       103
       +
       <head>

     

       104
       104
       +
           <meta property="og:title" content="Still Works" />

     

       105
       105
       +
           <meta property="og:description" content="Even with broken tags

     

       106
       106
       +
       </head>

     

       107
       107
       +
       <body>

     

       108
       108
       +
           <p>Unclosed paragraph

     

       109
       109
       +
       </body>

     

       110
       110
       +
       `

     

       111
       111
       +
       

     

       112
       112
       +
       	og, err := parseOpenGraph(html)

     

       113
       113
       +
       	require.NoError(t, err)

     

       114
       114
       +
       

     

       115
       115
       +
       	// Best-effort parsing should still extract what it can

     

       116
       116
       +
       	assert.NotEmpty(t, og.Title, "Should extract title despite malformed HTML")

     

       117
       117
       +
       }

     

       118
       118
       +
       

     

       119
       119
       +
       func TestParseOpenGraph_Empty(t *testing.T) {

     

       120
       120
       +
       	html := `

     

       121
       121
       +
       <!DOCTYPE html>

     

       122
       122
       +
       <html>

     

       123
       123
       +
       <head></head>

     

       124
       124
       +
       <body></body>

     

       125
       125
       +
       </html>

     

       126
       126
       +
       `

     

       127
       127
       +
       

     

       128
       128
       +
       	og, err := parseOpenGraph(html)

     

       129
       129
       +
       	require.NoError(t, err)

     

       130
       130
       +
       

     

       131
       131
       +
       	assert.Empty(t, og.Title)

     

       132
       132
       +
       	assert.Empty(t, og.Description)

     

       133
       133
       +
       	assert.Empty(t, og.Image)

     

       134
       134
       +
       }

     

       135
       135
       +
       

     

       136
       136
       +
       func TestFetchOpenGraph_Success(t *testing.T) {

     

       137
       137
       +
       	// Create test server with OpenGraph metadata

     

       138
       138
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       139
       139
       +
       		assert.Contains(t, r.Header.Get("User-Agent"), "CovesBot")

     

       140
       140
       +
       

     

       141
       141
       +
       		html := `

     

       142
       142
       +
       <!DOCTYPE html>

     

       143
       143
       +
       <html>

     

       144
       144
       +
       <head>

     

       145
       145
       +
           <meta property="og:title" content="Test News Article" />

     

       146
       146
       +
           <meta property="og:description" content="Breaking news story" />

     

       147
       147
       +
           <meta property="og:image" content="https://example.com/news.jpg" />

     

       148
       148
       +
           <meta property="og:url" content="https://example.com/article/123" />

     

       149
       149
       +
       </head>

     

       150
       150
       +
       <body><p>Article content</p></body>

     

       151
       151
       +
       </html>

     

       152
       152
       +
       `

     

       153
       153
       +
       		w.Header().Set("Content-Type", "text/html")

     

       154
       154
       +
       		w.WriteHeader(http.StatusOK)

     

       155
       155
       +
       		_, _ = w.Write([]byte(html))

     

       156
       156
       +
       	}))

     

       157
       157
       +
       	defer server.Close()

     

       158
       158
       +
       

     

       159
       159
       +
       	ctx := context.Background()

     

       160
       160
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       161
       161
       +
       	require.NoError(t, err)

     

       162
       162
       +
       	require.NotNil(t, result)

     

       163
       163
       +
       

     

       164
       164
       +
       	assert.Equal(t, "Test News Article", result.Title)

     

       165
       165
       +
       	assert.Equal(t, "Breaking news story", result.Description)

     

       166
       166
       +
       	assert.Equal(t, "https://example.com/news.jpg", result.ThumbnailURL)

     

       167
       167
       +
       	assert.Equal(t, "article", result.Type)

     

       168
       168
       +
       	assert.Equal(t, "opengraph", result.Provider)

     

       169
       169
       +
       }

     

       170
       170
       +
       

     

       171
       171
       +
       func TestFetchOpenGraph_HTTPError(t *testing.T) {

     

       172
       172
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       173
       173
       +
       		w.WriteHeader(http.StatusNotFound)

     

       174
       174
       +
       	}))

     

       175
       175
       +
       	defer server.Close()

     

       176
       176
       +
       

     

       177
       177
       +
       	ctx := context.Background()

     

       178
       178
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       179
       179
       +
       	require.Error(t, err)

     

       180
       180
       +
       	assert.Nil(t, result)

     

       181
       181
       +
       	assert.Contains(t, err.Error(), "404")

     

       182
       182
       +
       }

     

       183
       183
       +
       

     

       184
       184
       +
       func TestFetchOpenGraph_Timeout(t *testing.T) {

     

       185
       185
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       186
       186
       +
       		time.Sleep(2 * time.Second)

     

       187
       187
       +
       		w.WriteHeader(http.StatusOK)

     

       188
       188
       +
       	}))

     

       189
       189
       +
       	defer server.Close()

     

       190
       190
       +
       

     

       191
       191
       +
       	ctx := context.Background()

     

       192
       192
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 100*time.Millisecond, "CovesBot/1.0")

     

       193
       193
       +
       	require.Error(t, err)

     

       194
       194
       +
       	assert.Nil(t, result)

     

       195
       195
       +
       }

     

       196
       196
       +
       

     

       197
       197
       +
       func TestFetchOpenGraph_NoMetadata(t *testing.T) {

     

       198
       198
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       199
       199
       +
       		html := `<html><head></head><body><p>No metadata</p></body></html>`

     

       200
       200
       +
       		w.Header().Set("Content-Type", "text/html")

     

       201
       201
       +
       		w.WriteHeader(http.StatusOK)

     

       202
       202
       +
       		_, _ = w.Write([]byte(html))

     

       203
       203
       +
       	}))

     

       204
       204
       +
       	defer server.Close()

     

       205
       205
       +
       

     

       206
       206
       +
       	ctx := context.Background()

     

       207
       207
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       208
       208
       +
       	require.NoError(t, err)

     

       209
       209
       +
       	require.NotNil(t, result)

     

       210
       210
       +
       

     

       211
       211
       +
       	// Should still return a result with domain

     

       212
       212
       +
       	assert.Equal(t, "article", result.Type)

     

       213
       213
       +
       	assert.Equal(t, "opengraph", result.Provider)

     

       214
       214
       +
       	assert.NotEmpty(t, result.Domain)

     

       215
       215
       +
       }

     

       216
       216
       +
       

     

       217
       217
       +
       func TestIsOEmbedProvider(t *testing.T) {

     

       218
       218
       +
       	tests := []struct {

     

       219
       219
       +
       		url      string

     

       220
       220
       +
       		expected bool

     

       221
       221
       +
       	}{

     

       222
       222
       +
       		{"https://streamable.com/abc123", true},

     

       223
       223
       +
       		{"https://www.youtube.com/watch?v=test", true},

     

       224
       224
       +
       		{"https://youtu.be/test", true},

     

       225
       225
       +
       		{"https://reddit.com/r/test/comments/123", true},

     

       226
       226
       +
       		{"https://www.reddit.com/r/test/comments/123", true},

     

       227
       227
       +
       		{"https://example.com/article", false},

     

       228
       228
       +
       		{"https://news.ycombinator.com/item?id=123", false},

     

       229
       229
       +
       		{"https://kite.kagi.com/search?q=test", false},

     

       230
       230
       +
       	}

     

       231
       231
       +
       

     

       232
       232
       +
       	for _, tt := range tests {

     

       233
       233
       +
       		t.Run(tt.url, func(t *testing.T) {

     

       234
       234
       +
       			result := isOEmbedProvider(tt.url)

     

       235
       235
       +
       			assert.Equal(t, tt.expected, result, "URL: %s", tt.url)

     

       236
       236
       +
       		})

     

       237
       237
       +
       	}

     

       238
       238
       +
       }

     

       239
       239
       +
       

     

       240
       240
       +
       func TestIsSupported(t *testing.T) {

     

       241
       241
       +
       	tests := []struct {

     

       242
       242
       +
       		url      string

     

       243
       243
       +
       		expected bool

     

       244
       244
       +
       	}{

     

       245
       245
       +
       		{"https://example.com", true},

     

       246
       246
       +
       		{"http://example.com", true},

     

       247
       247
       +
       		{"https://news.site.com/article", true},

     

       248
       248
       +
       		{"ftp://example.com", false},

     

       249
       249
       +
       		{"not-a-url", false},

     

       250
       250
       +
       		{"", false},

     

       251
       251
       +
       	}

     

       252
       252
       +
       

     

       253
       253
       +
       	for _, tt := range tests {

     

       254
       254
       +
       		t.Run(tt.url, func(t *testing.T) {

     

       255
       255
       +
       			result := isSupported(tt.url)

     

       256
       256
       +
       			assert.Equal(t, tt.expected, result, "URL: %s", tt.url)

     

       257
       257
       +
       		})

     

       258
       258
       +
       	}

     

       259
       259
       +
       }

     

       260
       260
       +
       

     

       261
       261
       +
       func TestGetAttr(t *testing.T) {

     

       262
       262
       +
       	html := `<meta property="og:title" content="Test Title" name="test" />`

     

       263
       263
       +
       	doc, err := parseOpenGraph(html)

     

       264
       264
       +
       	require.NoError(t, err)

     

       265
       265
       +
       

     

       266
       266
       +
       	// This is a simple test to verify the helper function works

     

       267
       267
       +
       	// The actual usage is tested in the parseOpenGraph tests

     

       268
       268
       +
       	assert.NotNil(t, doc)

     

       269
       269
       +
       }

+170

internal/core/unfurl/service.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"log"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // Service handles URL unfurling with caching

     

       11
       11
       +
       type Service interface {

     

       12
       12
       +
       	UnfurlURL(ctx context.Context, url string) (*UnfurlResult, error)

     

       13
       13
       +
       	IsSupported(url string) bool

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       type service struct {

     

       17
       17
       +
       	repo           Repository

     

       18
       18
       +
       	circuitBreaker *circuitBreaker

     

       19
       19
       +
       	userAgent      string

     

       20
       20
       +
       	timeout        time.Duration

     

       21
       21
       +
       	cacheTTL       time.Duration

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       // NewService creates a new unfurl service

     

       25
       25
       +
       func NewService(repo Repository, opts ...ServiceOption) Service {

     

       26
       26
       +
       	s := &service{

     

       27
       27
       +
       		repo:           repo,

     

       28
       28
       +
       		timeout:        10 * time.Second,

     

       29
       29
       +
       		userAgent:      "CovesBot/1.0 (+https://coves.social)",

     

       30
       30
       +
       		cacheTTL:       24 * time.Hour,

     

       31
       31
       +
       		circuitBreaker: newCircuitBreaker(),

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	for _, opt := range opts {

     

       35
       35
       +
       		opt(s)

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	return s

     

       39
       39
       +
       }

     

       40
       40
       +
       

     

       41
       41
       +
       // ServiceOption configures the service

     

       42
       42
       +
       type ServiceOption func(*service)

     

       43
       43
       +
       

     

       44
       44
       +
       // WithTimeout sets the HTTP timeout for oEmbed requests

     

       45
       45
       +
       func WithTimeout(timeout time.Duration) ServiceOption {

     

       46
       46
       +
       	return func(s *service) {

     

       47
       47
       +
       		s.timeout = timeout

     

       48
       48
       +
       	}

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       // WithUserAgent sets the User-Agent header for oEmbed requests

     

       52
       52
       +
       func WithUserAgent(userAgent string) ServiceOption {

     

       53
       53
       +
       	return func(s *service) {

     

       54
       54
       +
       		s.userAgent = userAgent

     

       55
       55
       +
       	}

     

       56
       56
       +
       }

     

       57
       57
       +
       

     

       58
       58
       +
       // WithCacheTTL sets the cache TTL

     

       59
       59
       +
       func WithCacheTTL(ttl time.Duration) ServiceOption {

     

       60
       60
       +
       	return func(s *service) {

     

       61
       61
       +
       		s.cacheTTL = ttl

     

       62
       62
       +
       	}

     

       63
       63
       +
       }

     

       64
       64
       +
       

     

       65
       65
       +
       // IsSupported returns true if we can unfurl this URL

     

       66
       66
       +
       func (s *service) IsSupported(url string) bool {

     

       67
       67
       +
       	return isSupported(url)

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       // UnfurlURL fetches metadata for a URL (with caching)

     

       71
       71
       +
       func (s *service) UnfurlURL(ctx context.Context, urlStr string) (*UnfurlResult, error) {

     

       72
       72
       +
       	// 1. Check cache first

     

       73
       73
       +
       	cached, err := s.repo.Get(ctx, urlStr)

     

       74
       74
       +
       	if err == nil && cached != nil {

     

       75
       75
       +
       		log.Printf("[UNFURL] Cache hit for %s (provider: %s)", urlStr, cached.Provider)

     

       76
       76
       +
       		return cached, nil

     

       77
       77
       +
       	}

     

       78
       78
       +
       

     

       79
       79
       +
       	// 2. Check if we support this URL

     

       80
       80
       +
       	if !isSupported(urlStr) {

     

       81
       81
       +
       		return nil, fmt.Errorf("unsupported URL: %s", urlStr)

     

       82
       82
       +
       	}

     

       83
       83
       +
       

     

       84
       84
       +
       	var result *UnfurlResult

     

       85
       85
       +
       	domain := extractDomain(urlStr)

     

       86
       86
       +
       

     

       87
       87
       +
       	// 3. Smart routing: Special handling for Kagi Kite (client-side rendered, no og:image tags)

     

       88
       88
       +
       	if domain == "kite.kagi.com" {

     

       89
       89
       +
       		provider := "kagi"

     

       90
       90
       +
       

     

       91
       91
       +
       		// Check circuit breaker

     

       92
       92
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       93
       93
       +
       		if !canAttempt {

     

       94
       94
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       95
       95
       +
       			return nil, err

     

       96
       96
       +
       		}

     

       97
       97
       +
       

     

       98
       98
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching via Kagi parser...", urlStr)

     

       99
       99
       +
       		result, err = fetchKagiKite(ctx, urlStr, s.timeout, s.userAgent)

     

       100
       100
       +
       		if err != nil {

     

       101
       101
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       102
       102
       +
       			return nil, err

     

       103
       103
       +
       		}

     

       104
       104
       +
       

     

       105
       105
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       106
       106
       +
       

     

       107
       107
       +
       		// Cache result

     

       108
       108
       +
       		if cacheErr := s.repo.Set(ctx, urlStr, result, s.cacheTTL); cacheErr != nil {

     

       109
       109
       +
       			log.Printf("[UNFURL] Warning: failed to cache result: %v", cacheErr)

     

       110
       110
       +
       		}

     

       111
       111
       +
       		return result, nil

     

       112
       112
       +
       	}

     

       113
       113
       +
       

     

       114
       114
       +
       	// 4. Check if this is a known oEmbed provider

     

       115
       115
       +
       	if isOEmbedProvider(urlStr) {

     

       116
       116
       +
       		provider := domain // Use domain as provider name (e.g., "streamable.com", "youtube.com")

     

       117
       117
       +
       

     

       118
       118
       +
       		// Check circuit breaker

     

       119
       119
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       120
       120
       +
       		if !canAttempt {

     

       121
       121
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       122
       122
       +
       			return nil, err

     

       123
       123
       +
       		}

     

       124
       124
       +
       

     

       125
       125
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching from oEmbed...", urlStr)

     

       126
       126
       +
       

     

       127
       127
       +
       		// Fetch from oEmbed provider

     

       128
       128
       +
       		oembed, err := fetchOEmbed(ctx, urlStr, s.timeout, s.userAgent)

     

       129
       129
       +
       		if err != nil {

     

       130
       130
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       131
       131
       +
       			return nil, fmt.Errorf("failed to fetch oEmbed data: %w", err)

     

       132
       132
       +
       		}

     

       133
       133
       +
       

     

       134
       134
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       135
       135
       +
       

     

       136
       136
       +
       		// Convert to UnfurlResult

     

       137
       137
       +
       		result = mapOEmbedToResult(oembed, urlStr)

     

       138
       138
       +
       	} else {

     

       139
       139
       +
       		provider := "opengraph"

     

       140
       140
       +
       

     

       141
       141
       +
       		// Check circuit breaker

     

       142
       142
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       143
       143
       +
       		if !canAttempt {

     

       144
       144
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       145
       145
       +
       			return nil, err

     

       146
       146
       +
       		}

     

       147
       147
       +
       

     

       148
       148
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching via OpenGraph...", urlStr)

     

       149
       149
       +
       

     

       150
       150
       +
       		// Fetch via OpenGraph

     

       151
       151
       +
       		result, err = fetchOpenGraph(ctx, urlStr, s.timeout, s.userAgent)

     

       152
       152
       +
       		if err != nil {

     

       153
       153
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       154
       154
       +
       			return nil, fmt.Errorf("failed to fetch OpenGraph data: %w", err)

     

       155
       155
       +
       		}

     

       156
       156
       +
       

     

       157
       157
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       158
       158
       +
       	}

     

       159
       159
       +
       

     

       160
       160
       +
       	// 5. Store in cache

     

       161
       161
       +
       	if cacheErr := s.repo.Set(ctx, urlStr, result, s.cacheTTL); cacheErr != nil {

     

       162
       162
       +
       		// Log but don't fail - cache is best-effort

     

       163
       163
       +
       		log.Printf("[UNFURL] Warning: Failed to cache result for %s: %v", urlStr, cacheErr)

     

       164
       164
       +
       	}

     

       165
       165
       +
       

     

       166
       166
       +
       	log.Printf("[UNFURL] Successfully unfurled %s (provider: %s, type: %s)",

     

       167
       167
       +
       		urlStr, result.Provider, result.Type)

     

       168
       168
       +
       

     

       169
       169
       +
       	return result, nil

     

       170
       170
       +
       }

+27

internal/core/unfurl/types.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import "time"

     

       4
       4
       +
       

     

       5
       5
       +
       // UnfurlResult represents the result of unfurling a URL

     

       6
       6
       +
       type UnfurlResult struct {

     

       7
       7
       +
       	Type         string `json:"type"`         // "video", "article", "image", "website"

     

       8
       8
       +
       	URI          string `json:"uri"`          // Original URL

     

       9
       9
       +
       	Title        string `json:"title"`        // Page/video title

     

       10
       10
       +
       	Description  string `json:"description"`  // Page/video description

     

       11
       11
       +
       	ThumbnailURL string `json:"thumbnailUrl"` // Preview image URL

     

       12
       12
       +
       	Provider     string `json:"provider"`     // "streamable", "youtube", "reddit"

     

       13
       13
       +
       	Domain       string `json:"domain"`       // Domain of the URL

     

       14
       14
       +
       	Width        int    `json:"width"`        // Media width (if applicable)

     

       15
       15
       +
       	Height       int    `json:"height"`       // Media height (if applicable)

     

       16
       16
       +
       }

     

       17
       17
       +
       

     

       18
       18
       +
       // CacheEntry represents a cached unfurl result with metadata

     

       19
       19
       +
       type CacheEntry struct {

     

       20
       20
       +
       	FetchedAt    time.Time    `db:"fetched_at"`

     

       21
       21
       +
       	ExpiresAt    time.Time    `db:"expires_at"`

     

       22
       22
       +
       	CreatedAt    time.Time    `db:"created_at"`

     

       23
       23
       +
       	ThumbnailURL *string      `db:"thumbnail_url"`

     

       24
       24
       +
       	URL          string       `db:"url"`

     

       25
       25
       +
       	Provider     string       `db:"provider"`

     

       26
       26
       +
       	Metadata     UnfurlResult `db:"metadata"`

     

       27
       27
       +
       }

+14

internal/core/unfurl/errors.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import "errors"

     

       4
       4
       +
       

     

       5
       5
       +
       var (

     

       6
       6
       +
       	// ErrNotFound is returned when an unfurl cache entry is not found or has expired

     

       7
       7
       +
       	ErrNotFound = errors.New("unfurl cache entry not found or expired")

     

       8
       8
       +
       

     

       9
       9
       +
       	// ErrInvalidURL is returned when the provided URL is invalid

     

       10
       10
       +
       	ErrInvalidURL = errors.New("invalid URL")

     

       11
       11
       +
       

     

       12
       12
       +
       	// ErrInvalidTTL is returned when the provided TTL is invalid (e.g., negative or zero)

     

       13
       13
       +
       	ErrInvalidTTL = errors.New("invalid TTL: must be positive")

     

       14
       14
       +
       )

+19

internal/core/unfurl/interfaces.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       // Repository defines the interface for unfurl cache persistence

     

       9
       9
       +
       type Repository interface {

     

       10
       10
       +
       	// Get retrieves a cached unfurl result for the given URL.

     

       11
       11
       +
       	// Returns nil, nil if not found or expired (not an error condition).

     

       12
       12
       +
       	// Returns error only on database failures.

     

       13
       13
       +
       	Get(ctx context.Context, url string) (*UnfurlResult, error)

     

       14
       14
       +
       

     

       15
       15
       +
       	// Set stores an unfurl result in the cache with the specified TTL.

     

       16
       16
       +
       	// If an entry already exists for the URL, it will be updated.

     

       17
       17
       +
       	// The expires_at is calculated as NOW() + ttl.

     

       18
       18
       +
       	Set(ctx context.Context, url string, result *UnfurlResult, ttl time.Duration) error

     

       19
       19
       +
       }

+117

internal/core/unfurl/repository.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"fmt"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       type postgresUnfurlRepo struct {

     

       12
       12
       +
       	db *sql.DB

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       // NewRepository creates a new PostgreSQL unfurl cache repository

     

       16
       16
       +
       func NewRepository(db *sql.DB) Repository {

     

       17
       17
       +
       	return &postgresUnfurlRepo{db: db}

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // Get retrieves a cached unfurl result for the given URL.

     

       21
       21
       +
       // Returns nil, nil if not found or expired (not an error condition).

     

       22
       22
       +
       // Returns error only on database failures.

     

       23
       23
       +
       func (r *postgresUnfurlRepo) Get(ctx context.Context, url string) (*UnfurlResult, error) {

     

       24
       24
       +
       	query := `

     

       25
       25
       +
       		SELECT metadata, thumbnail_url, provider

     

       26
       26
       +
       		FROM unfurl_cache

     

       27
       27
       +
       		WHERE url = $1 AND expires_at > NOW()

     

       28
       28
       +
       	`

     

       29
       29
       +
       

     

       30
       30
       +
       	var metadataJSON []byte

     

       31
       31
       +
       	var thumbnailURL sql.NullString

     

       32
       32
       +
       	var provider string

     

       33
       33
       +
       

     

       34
       34
       +
       	err := r.db.QueryRowContext(ctx, query, url).Scan(&metadataJSON, &thumbnailURL, &provider)

     

       35
       35
       +
       	if err == sql.ErrNoRows {

     

       36
       36
       +
       		// Not found or expired is not an error

     

       37
       37
       +
       		return nil, nil

     

       38
       38
       +
       	}

     

       39
       39
       +
       	if err != nil {

     

       40
       40
       +
       		return nil, fmt.Errorf("failed to get unfurl cache entry: %w", err)

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// Unmarshal metadata JSONB to UnfurlResult

     

       44
       44
       +
       	var result UnfurlResult

     

       45
       45
       +
       	if err := json.Unmarshal(metadataJSON, &result); err != nil {

     

       46
       46
       +
       		return nil, fmt.Errorf("failed to unmarshal metadata: %w", err)

     

       47
       47
       +
       	}

     

       48
       48
       +
       

     

       49
       49
       +
       	// Ensure provider and thumbnailURL are set (may not be in metadata JSON)

     

       50
       50
       +
       	result.Provider = provider

     

       51
       51
       +
       	if thumbnailURL.Valid {

     

       52
       52
       +
       		result.ThumbnailURL = thumbnailURL.String

     

       53
       53
       +
       	}

     

       54
       54
       +
       

     

       55
       55
       +
       	return &result, nil

     

       56
       56
       +
       }

     

       57
       57
       +
       

     

       58
       58
       +
       // Set stores an unfurl result in the cache with the specified TTL.

     

       59
       59
       +
       // If an entry already exists for the URL, it will be updated.

     

       60
       60
       +
       // The expires_at is calculated as NOW() + ttl.

     

       61
       61
       +
       func (r *postgresUnfurlRepo) Set(ctx context.Context, url string, result *UnfurlResult, ttl time.Duration) error {

     

       62
       62
       +
       	// Marshal UnfurlResult to JSON for metadata column

     

       63
       63
       +
       	metadataJSON, err := json.Marshal(result)

     

       64
       64
       +
       	if err != nil {

     

       65
       65
       +
       		return fmt.Errorf("failed to marshal metadata: %w", err)

     

       66
       66
       +
       	}

     

       67
       67
       +
       

     

       68
       68
       +
       	// Store thumbnail_url separately for potential queries

     

       69
       69
       +
       	var thumbnailURL sql.NullString

     

       70
       70
       +
       	if result.ThumbnailURL != "" {

     

       71
       71
       +
       		thumbnailURL.String = result.ThumbnailURL

     

       72
       72
       +
       		thumbnailURL.Valid = true

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Convert Go duration to PostgreSQL interval string

     

       76
       76
       +
       	// e.g., "1 hour", "24 hours", "7 days"

     

       77
       77
       +
       	intervalStr := formatInterval(ttl)

     

       78
       78
       +
       

     

       79
       79
       +
       	query := `

     

       80
       80
       +
       		INSERT INTO unfurl_cache (url, provider, metadata, thumbnail_url, expires_at)

     

       81
       81
       +
       		VALUES ($1, $2, $3, $4, NOW() + $5::interval)

     

       82
       82
       +
       		ON CONFLICT (url) DO UPDATE

     

       83
       83
       +
       		SET provider = EXCLUDED.provider,

     

       84
       84
       +
       		    metadata = EXCLUDED.metadata,

     

       85
       85
       +
       		    thumbnail_url = EXCLUDED.thumbnail_url,

     

       86
       86
       +
       		    expires_at = EXCLUDED.expires_at,

     

       87
       87
       +
       		    fetched_at = NOW()

     

       88
       88
       +
       	`

     

       89
       89
       +
       

     

       90
       90
       +
       	_, err = r.db.ExecContext(ctx, query, url, result.Provider, metadataJSON, thumbnailURL, intervalStr)

     

       91
       91
       +
       	if err != nil {

     

       92
       92
       +
       		return fmt.Errorf("failed to insert/update unfurl cache entry: %w", err)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	return nil

     

       96
       96
       +
       }

     

       97
       97
       +
       

     

       98
       98
       +
       // formatInterval converts a Go duration to a PostgreSQL interval string

     

       99
       99
       +
       // PostgreSQL accepts intervals like "1 hour", "24 hours", "7 days"

     

       100
       100
       +
       func formatInterval(d time.Duration) string {

     

       101
       101
       +
       	seconds := int64(d.Seconds())

     

       102
       102
       +
       

     

       103
       103
       +
       	// Convert to appropriate unit for readability

     

       104
       104
       +
       	switch {

     

       105
       105
       +
       	case seconds >= 86400: // >= 1 day

     

       106
       106
       +
       		days := seconds / 86400

     

       107
       107
       +
       		return fmt.Sprintf("%d days", days)

     

       108
       108
       +
       	case seconds >= 3600: // >= 1 hour

     

       109
       109
       +
       		hours := seconds / 3600

     

       110
       110
       +
       		return fmt.Sprintf("%d hours", hours)

     

       111
       111
       +
       	case seconds >= 60: // >= 1 minute

     

       112
       112
       +
       		minutes := seconds / 60

     

       113
       113
       +
       		return fmt.Sprintf("%d minutes", minutes)

     

       114
       114
       +
       	default:

     

       115
       115
       +
       		return fmt.Sprintf("%d seconds", seconds)

     

       116
       116
       +
       	}

     

       117
       117
       +
       }

+23

internal/db/migrations/017_create_unfurl_cache.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       CREATE TABLE unfurl_cache (

     

       3
       3
       +
           url TEXT PRIMARY KEY,

     

       4
       4
       +
           provider TEXT NOT NULL,

     

       5
       5
       +
           metadata JSONB NOT NULL,

     

       6
       6
       +
           thumbnail_url TEXT,

     

       7
       7
       +
           fetched_at TIMESTAMP NOT NULL DEFAULT NOW(),

     

       8
       8
       +
           expires_at TIMESTAMP NOT NULL,

     

       9
       9
       +
           created_at TIMESTAMP NOT NULL DEFAULT NOW()

     

       10
       10
       +
       );

     

       11
       11
       +
       

     

       12
       12
       +
       CREATE INDEX idx_unfurl_cache_expires ON unfurl_cache(expires_at);

     

       13
       13
       +
       

     

       14
       14
       +
       COMMENT ON TABLE unfurl_cache IS 'Cache for oEmbed/URL unfurl results to reduce external API calls';

     

       15
       15
       +
       COMMENT ON COLUMN unfurl_cache.url IS 'The URL that was unfurled (primary key)';

     

       16
       16
       +
       COMMENT ON COLUMN unfurl_cache.provider IS 'Provider name (streamable, youtube, reddit, etc.)';

     

       17
       17
       +
       COMMENT ON COLUMN unfurl_cache.metadata IS 'Full unfurl result as JSON (title, description, type, etc.)';

     

       18
       18
       +
       COMMENT ON COLUMN unfurl_cache.thumbnail_url IS 'URL of the thumbnail image';

     

       19
       19
       +
       COMMENT ON COLUMN unfurl_cache.expires_at IS 'When this cache entry should be refetched (TTL-based)';

     

       20
       20
       +
       

     

       21
       21
       +
       -- +goose Down

     

       22
       22
       +
       DROP INDEX IF EXISTS idx_unfurl_cache_expires;

     

       23
       23
       +
       DROP TABLE IF EXISTS unfurl_cache;

+9

internal/core/blobs/types.go

···

       1
       1
       +
       package blobs

     

       2
       2
       +
       

     

       3
       3
       +
       // BlobRef represents a blob reference for atproto records

     

       4
       4
       +
       type BlobRef struct {

     

       5
       5
       +
       	Type     string            `json:"$type"`

     

       6
       6
       +
       	Ref      map[string]string `json:"ref"`

     

       7
       7
       +
       	MimeType string            `json:"mimeType"`

     

       8
       8
       +
       	Size     int               `json:"size"`

     

       9
       9
       +
       }

+81

internal/core/posts/blob_transform.go

···

       1
       1
       +
       package posts

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       )

     

       6
       6
       +
       

     

       7
       7
       +
       // TransformBlobRefsToURLs transforms all blob references in a PostView to PDS URLs

     

       8
       8
       +
       // This modifies the Embed field in-place, converting blob refs to direct URLs

     

       9
       9
       +
       // The transformation only affects external embeds with thumbnail blobs

     

       10
       10
       +
       func TransformBlobRefsToURLs(postView *PostView) {

     

       11
       11
       +
       	if postView == nil || postView.Embed == nil {

     

       12
       12
       +
       		return

     

       13
       13
       +
       	}

     

       14
       14
       +
       

     

       15
       15
       +
       	// Get community PDS URL from post view

     

       16
       16
       +
       	if postView.Community == nil || postView.Community.PDSURL == "" {

     

       17
       17
       +
       		return // Cannot transform without PDS URL

     

       18
       18
       +
       	}

     

       19
       19
       +
       

     

       20
       20
       +
       	communityDID := postView.Community.DID

     

       21
       21
       +
       	pdsURL := postView.Community.PDSURL

     

       22
       22
       +
       

     

       23
       23
       +
       	// Check if embed is a map (should be for external embeds)

     

       24
       24
       +
       	embedMap, ok := postView.Embed.(map[string]interface{})

     

       25
       25
       +
       	if !ok {

     

       26
       26
       +
       		return

     

       27
       27
       +
       	}

     

       28
       28
       +
       

     

       29
       29
       +
       	// Check embed type

     

       30
       30
       +
       	embedType, ok := embedMap["$type"].(string)

     

       31
       31
       +
       	if !ok {

     

       32
       32
       +
       		return

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	// Only transform external embeds

     

       36
       36
       +
       	if embedType == "social.coves.embed.external" {

     

       37
       37
       +
       		if external, ok := embedMap["external"].(map[string]interface{}); ok {

     

       38
       38
       +
       			transformThumbToURL(external, communityDID, pdsURL)

     

       39
       39
       +
       		}

     

       40
       40
       +
       	}

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       // transformThumbToURL converts a thumb blob ref to a PDS URL

     

       44
       44
       +
       // This modifies the external map in-place

     

       45
       45
       +
       func transformThumbToURL(external map[string]interface{}, communityDID, pdsURL string) {

     

       46
       46
       +
       	// Check if thumb exists

     

       47
       47
       +
       	thumb, ok := external["thumb"]

     

       48
       48
       +
       	if !ok {

     

       49
       49
       +
       		return

     

       50
       50
       +
       	}

     

       51
       51
       +
       

     

       52
       52
       +
       	// If thumb is already a string (URL), don't transform

     

       53
       53
       +
       	if _, isString := thumb.(string); isString {

     

       54
       54
       +
       		return

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	// Try to parse as blob ref

     

       58
       58
       +
       	thumbMap, ok := thumb.(map[string]interface{})

     

       59
       59
       +
       	if !ok {

     

       60
       60
       +
       		return

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Extract CID from blob ref

     

       64
       64
       +
       	ref, ok := thumbMap["ref"].(map[string]interface{})

     

       65
       65
       +
       	if !ok {

     

       66
       66
       +
       		return

     

       67
       67
       +
       	}

     

       68
       68
       +
       

     

       69
       69
       +
       	cid, ok := ref["$link"].(string)

     

       70
       70
       +
       	if !ok || cid == "" {

     

       71
       71
       +
       		return

     

       72
       72
       +
       	}

     

       73
       73
       +
       

     

       74
       74
       +
       	// Transform to PDS blob endpoint URL

     

       75
       75
       +
       	// Format: {pds_url}/xrpc/com.atproto.sync.getBlob?did={community_did}&cid={cid}

     

       76
       76
       +
       	blobURL := fmt.Sprintf("%s/xrpc/com.atproto.sync.getBlob?did=%s&cid=%s",

     

       77
       77
       +
       		pdsURL, communityDID, cid)

     

       78
       78
       +
       

     

       79
       79
       +
       	// Replace blob ref with URL string

     

       80
       80
       +
       	external["thumb"] = blobURL

     

       81
       81
       +
       }

+312

internal/core/posts/blob_transform_test.go

···

       1
       1
       +
       package posts

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"testing"

     

       5
       5
       +
       

     

       6
       6
       +
       	"github.com/stretchr/testify/assert"

     

       7
       7
       +
       	"github.com/stretchr/testify/require"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       func TestTransformBlobRefsToURLs(t *testing.T) {

     

       11
       11
       +
       	t.Run("transforms external embed thumb from blob to URL", func(t *testing.T) {

     

       12
       12
       +
       		post := &PostView{

     

       13
       13
       +
       			Community: &CommunityRef{

     

       14
       14
       +
       				DID:    "did:plc:testcommunity",

     

       15
       15
       +
       				PDSURL: "http://localhost:3001",

     

       16
       16
       +
       			},

     

       17
       17
       +
       			Embed: map[string]interface{}{

     

       18
       18
       +
       				"$type": "social.coves.embed.external",

     

       19
       19
       +
       				"external": map[string]interface{}{

     

       20
       20
       +
       					"uri": "https://example.com",

     

       21
       21
       +
       					"thumb": map[string]interface{}{

     

       22
       22
       +
       						"$type": "blob",

     

       23
       23
       +
       						"ref": map[string]interface{}{

     

       24
       24
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       25
       25
       +
       						},

     

       26
       26
       +
       						"mimeType": "image/jpeg",

     

       27
       27
       +
       						"size":     52813,

     

       28
       28
       +
       					},

     

       29
       29
       +
       				},

     

       30
       30
       +
       			},

     

       31
       31
       +
       		}

     

       32
       32
       +
       

     

       33
       33
       +
       		TransformBlobRefsToURLs(post)

     

       34
       34
       +
       

     

       35
       35
       +
       		// Verify embed is still a map

     

       36
       36
       +
       		embedMap, ok := post.Embed.(map[string]interface{})

     

       37
       37
       +
       		require.True(t, ok, "embed should still be a map")

     

       38
       38
       +
       

     

       39
       39
       +
       		// Verify external is still a map

     

       40
       40
       +
       		external, ok := embedMap["external"].(map[string]interface{})

     

       41
       41
       +
       		require.True(t, ok, "external should be a map")

     

       42
       42
       +
       

     

       43
       43
       +
       		// Verify thumb is now a URL string

     

       44
       44
       +
       		thumbURL, ok := external["thumb"].(string)

     

       45
       45
       +
       		require.True(t, ok, "thumb should be a string URL")

     

       46
       46
       +
       		assert.Equal(t,

     

       47
       47
       +
       			"http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:testcommunity&cid=bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       48
       48
       +
       			thumbURL)

     

       49
       49
       +
       	})

     

       50
       50
       +
       

     

       51
       51
       +
       	t.Run("handles missing thumb gracefully", func(t *testing.T) {

     

       52
       52
       +
       		post := &PostView{

     

       53
       53
       +
       			Community: &CommunityRef{

     

       54
       54
       +
       				DID:    "did:plc:testcommunity",

     

       55
       55
       +
       				PDSURL: "http://localhost:3001",

     

       56
       56
       +
       			},

     

       57
       57
       +
       			Embed: map[string]interface{}{

     

       58
       58
       +
       				"$type": "social.coves.embed.external",

     

       59
       59
       +
       				"external": map[string]interface{}{

     

       60
       60
       +
       					"uri": "https://example.com",

     

       61
       61
       +
       					// No thumb field

     

       62
       62
       +
       				},

     

       63
       63
       +
       			},

     

       64
       64
       +
       		}

     

       65
       65
       +
       

     

       66
       66
       +
       		// Should not panic

     

       67
       67
       +
       		TransformBlobRefsToURLs(post)

     

       68
       68
       +
       

     

       69
       69
       +
       		// Verify external is unchanged

     

       70
       70
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       71
       71
       +
       		external := embedMap["external"].(map[string]interface{})

     

       72
       72
       +
       		_, hasThumb := external["thumb"]

     

       73
       73
       +
       		assert.False(t, hasThumb, "thumb should not be added")

     

       74
       74
       +
       	})

     

       75
       75
       +
       

     

       76
       76
       +
       	t.Run("handles already-transformed URL thumb", func(t *testing.T) {

     

       77
       77
       +
       		expectedURL := "http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafytest"

     

       78
       78
       +
       		post := &PostView{

     

       79
       79
       +
       			Community: &CommunityRef{

     

       80
       80
       +
       				DID:    "did:plc:testcommunity",

     

       81
       81
       +
       				PDSURL: "http://localhost:3001",

     

       82
       82
       +
       			},

     

       83
       83
       +
       			Embed: map[string]interface{}{

     

       84
       84
       +
       				"$type": "social.coves.embed.external",

     

       85
       85
       +
       				"external": map[string]interface{}{

     

       86
       86
       +
       					"uri":   "https://example.com",

     

       87
       87
       +
       					"thumb": expectedURL, // Already a URL string

     

       88
       88
       +
       				},

     

       89
       89
       +
       			},

     

       90
       90
       +
       		}

     

       91
       91
       +
       

     

       92
       92
       +
       		// Should not error or change the URL

     

       93
       93
       +
       		TransformBlobRefsToURLs(post)

     

       94
       94
       +
       

     

       95
       95
       +
       		// Verify thumb is unchanged

     

       96
       96
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       97
       97
       +
       		external := embedMap["external"].(map[string]interface{})

     

       98
       98
       +
       		thumbURL, ok := external["thumb"].(string)

     

       99
       99
       +
       		require.True(t, ok, "thumb should still be a string")

     

       100
       100
       +
       		assert.Equal(t, expectedURL, thumbURL, "thumb URL should be unchanged")

     

       101
       101
       +
       	})

     

       102
       102
       +
       

     

       103
       103
       +
       	t.Run("handles missing embed", func(t *testing.T) {

     

       104
       104
       +
       		post := &PostView{

     

       105
       105
       +
       			Community: &CommunityRef{

     

       106
       106
       +
       				DID:    "did:plc:testcommunity",

     

       107
       107
       +
       				PDSURL: "http://localhost:3001",

     

       108
       108
       +
       			},

     

       109
       109
       +
       			Embed: nil,

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       112
       112
       +
       		// Should not panic

     

       113
       113
       +
       		TransformBlobRefsToURLs(post)

     

       114
       114
       +
       

     

       115
       115
       +
       		// Verify embed is still nil

     

       116
       116
       +
       		assert.Nil(t, post.Embed, "embed should remain nil")

     

       117
       117
       +
       	})

     

       118
       118
       +
       

     

       119
       119
       +
       	t.Run("handles nil post", func(t *testing.T) {

     

       120
       120
       +
       		// Should not panic

     

       121
       121
       +
       		TransformBlobRefsToURLs(nil)

     

       122
       122
       +
       	})

     

       123
       123
       +
       

     

       124
       124
       +
       	t.Run("handles missing community", func(t *testing.T) {

     

       125
       125
       +
       		post := &PostView{

     

       126
       126
       +
       			Community: nil,

     

       127
       127
       +
       			Embed: map[string]interface{}{

     

       128
       128
       +
       				"$type": "social.coves.embed.external",

     

       129
       129
       +
       				"external": map[string]interface{}{

     

       130
       130
       +
       					"uri": "https://example.com",

     

       131
       131
       +
       					"thumb": map[string]interface{}{

     

       132
       132
       +
       						"$type": "blob",

     

       133
       133
       +
       						"ref": map[string]interface{}{

     

       134
       134
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       135
       135
       +
       						},

     

       136
       136
       +
       					},

     

       137
       137
       +
       				},

     

       138
       138
       +
       			},

     

       139
       139
       +
       		}

     

       140
       140
       +
       

     

       141
       141
       +
       		// Should not panic or transform

     

       142
       142
       +
       		TransformBlobRefsToURLs(post)

     

       143
       143
       +
       

     

       144
       144
       +
       		// Verify thumb is unchanged (still a blob)

     

       145
       145
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       146
       146
       +
       		external := embedMap["external"].(map[string]interface{})

     

       147
       147
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       148
       148
       +
       		require.True(t, ok, "thumb should still be a map (blob ref)")

     

       149
       149
       +
       		assert.Equal(t, "blob", thumb["$type"], "blob type should be unchanged")

     

       150
       150
       +
       	})

     

       151
       151
       +
       

     

       152
       152
       +
       	t.Run("handles missing PDS URL", func(t *testing.T) {

     

       153
       153
       +
       		post := &PostView{

     

       154
       154
       +
       			Community: &CommunityRef{

     

       155
       155
       +
       				DID:    "did:plc:testcommunity",

     

       156
       156
       +
       				PDSURL: "", // Empty PDS URL

     

       157
       157
       +
       			},

     

       158
       158
       +
       			Embed: map[string]interface{}{

     

       159
       159
       +
       				"$type": "social.coves.embed.external",

     

       160
       160
       +
       				"external": map[string]interface{}{

     

       161
       161
       +
       					"uri": "https://example.com",

     

       162
       162
       +
       					"thumb": map[string]interface{}{

     

       163
       163
       +
       						"$type": "blob",

     

       164
       164
       +
       						"ref": map[string]interface{}{

     

       165
       165
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       166
       166
       +
       						},

     

       167
       167
       +
       					},

     

       168
       168
       +
       				},

     

       169
       169
       +
       			},

     

       170
       170
       +
       		}

     

       171
       171
       +
       

     

       172
       172
       +
       		// Should not panic or transform

     

       173
       173
       +
       		TransformBlobRefsToURLs(post)

     

       174
       174
       +
       

     

       175
       175
       +
       		// Verify thumb is unchanged (still a blob)

     

       176
       176
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       177
       177
       +
       		external := embedMap["external"].(map[string]interface{})

     

       178
       178
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       179
       179
       +
       		require.True(t, ok, "thumb should still be a map (blob ref)")

     

       180
       180
       +
       		assert.Equal(t, "blob", thumb["$type"], "blob type should be unchanged")

     

       181
       181
       +
       	})

     

       182
       182
       +
       

     

       183
       183
       +
       	t.Run("handles malformed blob ref gracefully", func(t *testing.T) {

     

       184
       184
       +
       		post := &PostView{

     

       185
       185
       +
       			Community: &CommunityRef{

     

       186
       186
       +
       				DID:    "did:plc:testcommunity",

     

       187
       187
       +
       				PDSURL: "http://localhost:3001",

     

       188
       188
       +
       			},

     

       189
       189
       +
       			Embed: map[string]interface{}{

     

       190
       190
       +
       				"$type": "social.coves.embed.external",

     

       191
       191
       +
       				"external": map[string]interface{}{

     

       192
       192
       +
       					"uri": "https://example.com",

     

       193
       193
       +
       					"thumb": map[string]interface{}{

     

       194
       194
       +
       						"$type": "blob",

     

       195
       195
       +
       						"ref":   "invalid-ref-format", // Should be a map with $link

     

       196
       196
       +
       					},

     

       197
       197
       +
       				},

     

       198
       198
       +
       			},

     

       199
       199
       +
       		}

     

       200
       200
       +
       

     

       201
       201
       +
       		// Should not panic

     

       202
       202
       +
       		TransformBlobRefsToURLs(post)

     

       203
       203
       +
       

     

       204
       204
       +
       		// Verify thumb is unchanged (malformed blob)

     

       205
       205
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       206
       206
       +
       		external := embedMap["external"].(map[string]interface{})

     

       207
       207
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       208
       208
       +
       		require.True(t, ok, "thumb should still be a map")

     

       209
       209
       +
       		assert.Equal(t, "invalid-ref-format", thumb["ref"], "malformed ref should be unchanged")

     

       210
       210
       +
       	})

     

       211
       211
       +
       

     

       212
       212
       +
       	t.Run("ignores non-external embed types", func(t *testing.T) {

     

       213
       213
       +
       		post := &PostView{

     

       214
       214
       +
       			Community: &CommunityRef{

     

       215
       215
       +
       				DID:    "did:plc:testcommunity",

     

       216
       216
       +
       				PDSURL: "http://localhost:3001",

     

       217
       217
       +
       			},

     

       218
       218
       +
       			Embed: map[string]interface{}{

     

       219
       219
       +
       				"$type": "social.coves.embed.images",

     

       220
       220
       +
       				"images": []interface{}{

     

       221
       221
       +
       					map[string]interface{}{

     

       222
       222
       +
       						"image": map[string]interface{}{

     

       223
       223
       +
       							"$type": "blob",

     

       224
       224
       +
       							"ref": map[string]interface{}{

     

       225
       225
       +
       								"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       226
       226
       +
       							},

     

       227
       227
       +
       						},

     

       228
       228
       +
       					},

     

       229
       229
       +
       				},

     

       230
       230
       +
       			},

     

       231
       231
       +
       		}

     

       232
       232
       +
       

     

       233
       233
       +
       		// Should not transform non-external embeds

     

       234
       234
       +
       		TransformBlobRefsToURLs(post)

     

       235
       235
       +
       

     

       236
       236
       +
       		// Verify images embed is unchanged

     

       237
       237
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       238
       238
       +
       		images := embedMap["images"].([]interface{})

     

       239
       239
       +
       		imageObj := images[0].(map[string]interface{})

     

       240
       240
       +
       		imageBlob := imageObj["image"].(map[string]interface{})

     

       241
       241
       +
       		assert.Equal(t, "blob", imageBlob["$type"], "image blob should be unchanged")

     

       242
       242
       +
       	})

     

       243
       243
       +
       }

     

       244
       244
       +
       

     

       245
       245
       +
       func TestTransformThumbToURL(t *testing.T) {

     

       246
       246
       +
       	t.Run("transforms valid blob ref to URL", func(t *testing.T) {

     

       247
       247
       +
       		external := map[string]interface{}{

     

       248
       248
       +
       			"uri": "https://example.com",

     

       249
       249
       +
       			"thumb": map[string]interface{}{

     

       250
       250
       +
       				"$type": "blob",

     

       251
       251
       +
       				"ref": map[string]interface{}{

     

       252
       252
       +
       					"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       253
       253
       +
       				},

     

       254
       254
       +
       				"mimeType": "image/jpeg",

     

       255
       255
       +
       				"size":     52813,

     

       256
       256
       +
       			},

     

       257
       257
       +
       		}

     

       258
       258
       +
       

     

       259
       259
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       260
       260
       +
       

     

       261
       261
       +
       		thumbURL, ok := external["thumb"].(string)

     

       262
       262
       +
       		require.True(t, ok, "thumb should be a string URL")

     

       263
       263
       +
       		assert.Equal(t,

     

       264
       264
       +
       			"http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       265
       265
       +
       			thumbURL)

     

       266
       266
       +
       	})

     

       267
       267
       +
       

     

       268
       268
       +
       	t.Run("does not transform if thumb is already string", func(t *testing.T) {

     

       269
       269
       +
       		expectedURL := "http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafytest"

     

       270
       270
       +
       		external := map[string]interface{}{

     

       271
       271
       +
       			"uri":   "https://example.com",

     

       272
       272
       +
       			"thumb": expectedURL,

     

       273
       273
       +
       		}

     

       274
       274
       +
       

     

       275
       275
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       276
       276
       +
       

     

       277
       277
       +
       		thumbURL, ok := external["thumb"].(string)

     

       278
       278
       +
       		require.True(t, ok, "thumb should still be a string")

     

       279
       279
       +
       		assert.Equal(t, expectedURL, thumbURL, "thumb should be unchanged")

     

       280
       280
       +
       	})

     

       281
       281
       +
       

     

       282
       282
       +
       	t.Run("does not transform if thumb is missing", func(t *testing.T) {

     

       283
       283
       +
       		external := map[string]interface{}{

     

       284
       284
       +
       			"uri": "https://example.com",

     

       285
       285
       +
       		}

     

       286
       286
       +
       

     

       287
       287
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       288
       288
       +
       

     

       289
       289
       +
       		_, hasThumb := external["thumb"]

     

       290
       290
       +
       		assert.False(t, hasThumb, "thumb should not be added")

     

       291
       291
       +
       	})

     

       292
       292
       +
       

     

       293
       293
       +
       	t.Run("does not transform if CID is empty", func(t *testing.T) {

     

       294
       294
       +
       		external := map[string]interface{}{

     

       295
       295
       +
       			"uri": "https://example.com",

     

       296
       296
       +
       			"thumb": map[string]interface{}{

     

       297
       297
       +
       				"$type": "blob",

     

       298
       298
       +
       				"ref": map[string]interface{}{

     

       299
       299
       +
       					"$link": "", // Empty CID

     

       300
       300
       +
       				},

     

       301
       301
       +
       			},

     

       302
       302
       +
       		}

     

       303
       303
       +
       

     

       304
       304
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       305
       305
       +
       

     

       306
       306
       +
       		// Verify thumb is unchanged

     

       307
       307
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       308
       308
       +
       		require.True(t, ok, "thumb should still be a map")

     

       309
       309
       +
       		ref := thumb["ref"].(map[string]interface{})

     

       310
       310
       +
       		assert.Equal(t, "", ref["$link"], "empty CID should be unchanged")

     

       311
       311
       +
       	})

     

       312
       312
       +
       }

+4 -3

aggregators/kagi-news/src/main.py

···

       173
       173
        
                       embed = self.coves_client.create_external_embed(

     

       174
       174
        
                           uri=story.link,

     

       175
       175
        
                           title=story.title,

     

       176
       176
       -
                           description=story.summary[:200] if len(story.summary) > 200 else story.summary,

     

       177
       177
       -
                           thumb=story.image_url

     

       176
       176
       +
                           description=story.summary[:200] if len(story.summary) > 200 else story.summary

     

       178
       177
        
                       )

     

       179
       178
        
       

     

       180
       179
        
                       # Post to community

     

       180
       180
       +
                       # Pass thumbnail URL from RSS feed at top level for trusted aggregator upload

     

       181
       181
        
                       try:

     

       182
       182
        
                           post_uri = self.coves_client.create_post(

     

       183
       183
        
                               community_handle=feed_config.community_handle,

     

       184
       184
        
                               title=story.title,

     

       185
       185
        
                               content=rich_text["content"],

     

       186
       186
        
                               facets=rich_text["facets"],

     

       187
       187
       -
                               embed=embed

     

       187
       187
       +
                               embed=embed,

     

       188
       188
       +
                               thumbnail_url=story.image_url  # From RSS feed - server will validate and upload

     

       188
       189
        
                           )

     

       189
       190
        
       

     

       190
       191
        
                           # Mark as posted (only if successful)

+134

scripts/post_streamable.py

···

       1
       1
       +
       #!/usr/bin/env python3

     

       2
       2
       +
       """

     

       3
       3
       +
       Quick script to post a Streamable video to test-usnews community.

     

       4
       4
       +
       Uses the kagi-news CovesClient infrastructure.

     

       5
       5
       +
       """

     

       6
       6
       +
       

     

       7
       7
       +
       import sys

     

       8
       8
       +
       import os

     

       9
       9
       +
       

     

       10
       10
       +
       # Add kagi-news src to path to use CovesClient

     

       11
       11
       +
       sys.path.insert(0, os.path.join(os.path.dirname(__file__), '../aggregators/kagi-news'))

     

       12
       12
       +
       

     

       13
       13
       +
       from src.coves_client import CovesClient

     

       14
       14
       +
       

     

       15
       15
       +
       def main():

     

       16
       16
       +
           # Configuration

     

       17
       17
       +
           COVES_API_URL = "http://localhost:8081"

     

       18
       18
       +
           PDS_URL = "http://localhost:3001"

     

       19
       19
       +
       

     

       20
       20
       +
           # Use PDS instance credentials (from .env.dev)

     

       21
       21
       +
           HANDLE = "testuser123.local.coves.dev"

     

       22
       22
       +
           PASSWORD = "test-password-123"

     

       23
       23
       +
       

     

       24
       24
       +
           # Post details

     

       25
       25
       +
           COMMUNITY_HANDLE = "test-usnews.community.coves.social"

     

       26
       26
       +
       

     

       27
       27
       +
           # Post 1: Streamable video

     

       28
       28
       +
           STREAMABLE_URL = "https://streamable.com/7kpdft"

     

       29
       29
       +
           STREAMABLE_TITLE = "NBACentral - \"Your son don't wanna be here, we know it's your last weekend. Enjoy ..."

     

       30
       30
       +
       

     

       31
       31
       +
           # Post 2: Reddit highlight

     

       32
       32
       +
           REDDIT_URL = "https://www.reddit.com/r/nba/comments/1orfsgm/highlight_giannis_antetokounmpo_41_pts_15_reb_9/"

     

       33
       33
       +
           REDDIT_TITLE = "[Highlight] Giannis Antetokounmpo (41 PTS, 15 REB, 9 AST) tallies his 56th career regular season game of 40+ points, passing Kareem Abdul-Jabbar for the most such games in franchise history. Milwaukee defeats Chicago 126-110 to win their NBA Cup opener."

     

       34
       34
       +
       

     

       35
       35
       +
           # Initialize client

     

       36
       36
       +
           print(f"Initializing Coves client...")

     

       37
       37
       +
           print(f"  API URL: {COVES_API_URL}")

     

       38
       38
       +
           print(f"  PDS URL: {PDS_URL}")

     

       39
       39
       +
           print(f"  Handle: {HANDLE}")

     

       40
       40
       +
       

     

       41
       41
       +
           client = CovesClient(

     

       42
       42
       +
               api_url=COVES_API_URL,

     

       43
       43
       +
               handle=HANDLE,

     

       44
       44
       +
               password=PASSWORD,

     

       45
       45
       +
               pds_url=PDS_URL

     

       46
       46
       +
           )

     

       47
       47
       +
       

     

       48
       48
       +
           # Authenticate

     

       49
       49
       +
           print("\nAuthenticating...")

     

       50
       50
       +
           try:

     

       51
       51
       +
               client.authenticate()

     

       52
       52
       +
               print(f"✓ Authenticated as {client.did}")

     

       53
       53
       +
           except Exception as e:

     

       54
       54
       +
               print(f"✗ Authentication failed: {e}")

     

       55
       55
       +
               return 1

     

       56
       56
       +
       

     

       57
       57
       +
           # Post 1: Streamable video

     

       58
       58
       +
           print("\n" + "="*60)

     

       59
       59
       +
           print("POST 1: STREAMABLE VIDEO")

     

       60
       60
       +
           print("="*60)

     

       61
       61
       +
       

     

       62
       62
       +
           print("\nCreating minimal external embed (URI only)...")

     

       63
       63
       +
           streamable_embed = {

     

       64
       64
       +
               "$type": "social.coves.embed.external",

     

       65
       65
       +
               "external": {

     

       66
       66
       +
                   "uri": STREAMABLE_URL

     

       67
       67
       +
               }

     

       68
       68
       +
           }

     

       69
       69
       +
           print(f"✓ Embed created with URI only (unfurl service should enrich)")

     

       70
       70
       +
       

     

       71
       71
       +
           print(f"\nPosting to {COMMUNITY_HANDLE}...")

     

       72
       72
       +
           print(f"  Title: {STREAMABLE_TITLE}")

     

       73
       73
       +
           print(f"  Video: {STREAMABLE_URL}")

     

       74
       74
       +
       

     

       75
       75
       +
           try:

     

       76
       76
       +
               post_uri = client.create_post(

     

       77
       77
       +
                   community_handle=COMMUNITY_HANDLE,

     

       78
       78
       +
                   title=STREAMABLE_TITLE,

     

       79
       79
       +
                   content="",

     

       80
       80
       +
                   facets=[],

     

       81
       81
       +
                   embed=streamable_embed

     

       82
       82
       +
               )

     

       83
       83
       +
       

     

       84
       84
       +
               print(f"\n✓ Streamable post created successfully!")

     

       85
       85
       +
               print(f"  URI: {post_uri}")

     

       86
       86
       +
       

     

       87
       87
       +
           except Exception as e:

     

       88
       88
       +
               print(f"\n✗ Streamable post creation failed: {e}")

     

       89
       89
       +
               import traceback

     

       90
       90
       +
               traceback.print_exc()

     

       91
       91
       +
               return 1

     

       92
       92
       +
       

     

       93
       93
       +
           # Post 2: Reddit highlight

     

       94
       94
       +
           print("\n" + "="*60)

     

       95
       95
       +
           print("POST 2: REDDIT HIGHLIGHT")

     

       96
       96
       +
           print("="*60)

     

       97
       97
       +
       

     

       98
       98
       +
           print("\nCreating minimal external embed (URI only)...")

     

       99
       99
       +
           reddit_embed = {

     

       100
       100
       +
               "$type": "social.coves.embed.external",

     

       101
       101
       +
               "external": {

     

       102
       102
       +
                   "uri": REDDIT_URL

     

       103
       103
       +
               }

     

       104
       104
       +
           }

     

       105
       105
       +
           print(f"✓ Embed created with URI only (unfurl service should enrich)")

     

       106
       106
       +
       

     

       107
       107
       +
           print(f"\nPosting to {COMMUNITY_HANDLE}...")

     

       108
       108
       +
           print(f"  Title: {REDDIT_TITLE}")

     

       109
       109
       +
           print(f"  URL: {REDDIT_URL}")

     

       110
       110
       +
       

     

       111
       111
       +
           try:

     

       112
       112
       +
               post_uri = client.create_post(

     

       113
       113
       +
                   community_handle=COMMUNITY_HANDLE,

     

       114
       114
       +
                   title=REDDIT_TITLE,

     

       115
       115
       +
                   content="",

     

       116
       116
       +
                   facets=[],

     

       117
       117
       +
                   embed=reddit_embed

     

       118
       118
       +
               )

     

       119
       119
       +
       

     

       120
       120
       +
               print(f"\n✓ Reddit post created successfully!")

     

       121
       121
       +
               print(f"  URI: {post_uri}")

     

       122
       122
       +
               print(f"\n" + "="*60)

     

       123
       123
       +
               print("Both posts created! Check them out at !test-usnews")

     

       124
       124
       +
               print("="*60)

     

       125
       125
       +
               return 0

     

       126
       126
       +
       

     

       127
       127
       +
           except Exception as e:

     

       128
       128
       +
               print(f"\n✗ Reddit post creation failed: {e}")

     

       129
       129
       +
               import traceback

     

       130
       130
       +
               traceback.print_exc()

     

       131
       131
       +
               return 1

     

       132
       132
       +
       

     

       133
       133
       +
       if __name__ == "__main__":

     

       134
       134
       +
           sys.exit(main())

-2

docker-compose.dev.yml

···

       1
       1
       -
       version: '3.8'

     

       2
       2
       -
       

     

       3
       1
        
       # Coves Local Development Stack

     

       4
       2
        
       # All-in-one setup: PDS + PostgreSQL + optional Relay

     

       5
       3
        
       #

+1 -1

internal/atproto/lexicon/social/coves/feed/comment.json internal/atproto/lexicon/social/coves/community/comment.json

···

       1
       1
        
       {

     

       2
       2
        
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.feed.comment",

     

       3
       3
       +
         "id": "social.coves.community.comment",

     

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "record",

+34

internal/db/migrations/018_migrate_comment_namespace.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Migration: Update comment URIs from social.coves.feed.comment to social.coves.community.comment

     

       3
       3
       +
       -- This updates the namespace for all comment records in the database.

     

       4
       4
       +
       -- Since we're pre-production, we're only updating the comments table (not votes).

     

       5
       5
       +
       

     

       6
       6
       +
       -- Update main comment URIs

     

       7
       7
       +
       UPDATE comments

     

       8
       8
       +
       SET uri = REPLACE(uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       9
       9
       +
       WHERE uri LIKE '%/social.coves.feed.comment/%';

     

       10
       10
       +
       

     

       11
       11
       +
       -- Update root references (when root is a comment, not a post)

     

       12
       12
       +
       UPDATE comments

     

       13
       13
       +
       SET root_uri = REPLACE(root_uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       14
       14
       +
       WHERE root_uri LIKE '%/social.coves.feed.comment/%';

     

       15
       15
       +
       

     

       16
       16
       +
       -- Update parent references (when parent is a comment)

     

       17
       17
       +
       UPDATE comments

     

       18
       18
       +
       SET parent_uri = REPLACE(parent_uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       19
       19
       +
       WHERE parent_uri LIKE '%/social.coves.feed.comment/%';

     

       20
       20
       +
       

     

       21
       21
       +
       -- +goose Down

     

       22
       22
       +
       -- Rollback: Revert comment URIs from social.coves.community.comment to social.coves.feed.comment

     

       23
       23
       +
       

     

       24
       24
       +
       UPDATE comments

     

       25
       25
       +
       SET uri = REPLACE(uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       26
       26
       +
       WHERE uri LIKE '%/social.coves.community.comment/%';

     

       27
       27
       +
       

     

       28
       28
       +
       UPDATE comments

     

       29
       29
       +
       SET root_uri = REPLACE(root_uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       30
       30
       +
       WHERE root_uri LIKE '%/social.coves.community.comment/%';

     

       31
       31
       +
       

     

       32
       32
       +
       UPDATE comments

     

       33
       33
       +
       SET parent_uri = REPLACE(parent_uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       34
       34
       +
       WHERE parent_uri LIKE '%/social.coves.community.comment/%';

+1 -1

internal/atproto/utils/record_utils.go

···

       20
       20
        
       // Format: at://did/collection/rkey -> collection

     

       21
       21
        
       //

     

       22
       22
        
       // Returns:

     

       23
       23
       -
       //   - Collection name (e.g., "social.coves.feed.comment") if URI is well-formed

     

       23
       23
       +
       //   - Collection name (e.g., "social.coves.community.comment") if URI is well-formed

     

       24
       24
        
       //   - Empty string if URI is malformed or doesn't contain a collection segment

     

       25
       25
        
       //

     

       26
       26
        
       // Note: Empty string indicates "unknown/unsupported collection" and should be

+2 -2

internal/core/comments/view_models.go

···

       5
       5
        
       )

     

       6
       6
        
       

     

       7
       7
        
       // CommentView represents the full view of a comment with all metadata

     

       8
       8
       -
       // Matches social.coves.feed.getComments#commentView lexicon

     

       8
       8
       +
       // Matches social.coves.community.comment.getComments#commentView lexicon

     

       9
       9
        
       // Used in thread views and get endpoints

     

       10
       10
        
       type CommentView struct {

     

       11
       11
        
       	Embed         interface{}         `json:"embed,omitempty"`

     
···

       24
       24
        
       }

     

       25
       25
        
       

     

       26
       26
        
       // ThreadViewComment represents a comment with its nested replies

     

       27
       27
       -
       // Matches social.coves.feed.getComments#threadViewComment lexicon

     

       27
       27
       +
       // Matches social.coves.community.comment.getComments#threadViewComment lexicon

     

       28
       28
        
       // Supports recursive threading for comment trees

     

       29
       29
        
       type ThreadViewComment struct {

     

       30
       30
        
       	Comment *CommentView         `json:"comment"`

+3 -2

internal/core/unfurl/providers.go

···

       108
       108
        
       

     

       109
       109
        
       // normalizeURL converts protocol-relative URLs to HTTPS

     

       110
       110
        
       // Examples:

     

       111
       111
       -
       //   "//example.com/image.jpg" -> "https://example.com/image.jpg"

     

       112
       112
       -
       //   "https://example.com/image.jpg" -> "https://example.com/image.jpg" (unchanged)

     

       111
       111
       +
       //

     

       112
       112
       +
       //	"//example.com/image.jpg" -> "https://example.com/image.jpg"

     

       113
       113
       +
       //	"https://example.com/image.jpg" -> "https://example.com/image.jpg" (unchanged)

     

       113
       114
        
       func normalizeURL(urlStr string) string {

     

       114
       115
        
       	if strings.HasPrefix(urlStr, "//") {

     

       115
       116
        
       		return "https:" + urlStr

+130 -28

docs/PRD_ALPHA_GO_LIVE.md

···

       7
       7
        
       ## 🎯 Major Progress Update

     

       8
       8
        
       

     

       9
       9
        
       **✅ ALL E2E TESTS COMPLETE!** (Completed 2025-11-16)

     

       10
       10
       +
       **✅ BIDIRECTIONAL DID VERIFICATION COMPLETE!** (Completed 2025-11-16)

     

       10
       11
        
       

     

       11
       12
        
       All 6 critical E2E test suites have been implemented and are passing:

     

       12
       13
        
       - ✅ Full User Journey (signup → community → post → comment → vote)

     
···

       19
       20
        
       **Time Saved**: ~7-12 hours through parallel agent implementation

     

       20
       21
        
       **Test Quality**: Enhanced with comprehensive database record verification to catch race conditions

     

       21
       22
        
       

     

       23
       23
       +
       ### Production Deployment Requirements

     

       24
       24
       +
       

     

       25
       25
       +
       **Architecture**:

     

       26
       26
       +
       - **AppView Domain**: coves.social (instance identity, API, frontend)

     

       27
       27
       +
       - **PDS Domain**: coves.me (separate domain required - cannot be same as AppView)

     

       28
       28
       +
       - **Community Handles**: Use @coves.social (AppView domain)

     

       29
       29
       +
       - **Jetstream**: Connects to Bluesky's production firehose (wss://jetstream2.us-east.bsky.network)

     

       30
       30
       +
       

     

       31
       31
       +
       **Required: .well-known/did.json at coves.social**:

     

       32
       32
       +
       ```json

     

       33
       33
       +
       {

     

       34
       34
       +
         "id": "did:web:coves.social",

     

       35
       35
       +
         "alsoKnownAs": ["at://coves.social"],

     

       36
       36
       +
         "verificationMethod": [

     

       37
       37
       +
           {

     

       38
       38
       +
             "id": "did:web:coves.social#atproto",

     

       39
       39
       +
             "type": "Multikey",

     

       40
       40
       +
             "controller": "did:web:coves.social",

     

       41
       41
       +
             "publicKeyMultibase": "z..."

     

       42
       42
       +
           }

     

       43
       43
       +
         ],

     

       44
       44
       +
         "service": [

     

       45
       45
       +
           {

     

       46
       46
       +
             "id": "#atproto_pds",

     

       47
       47
       +
             "type": "AtprotoPersonalDataServer",

     

       48
       48
       +
             "serviceEndpoint": "https://coves.me"

     

       49
       49
       +
           }

     

       50
       50
       +
         ]

     

       51
       51
       +
       }

     

       52
       52
       +
       ```

     

       53
       53
       +
       

     

       54
       54
       +
       **Environment Variables**:

     

       55
       55
       +
       - AppView:

     

       56
       56
       +
         - `INSTANCE_DID=did:web:coves.social`

     

       57
       57
       +
         - `INSTANCE_DOMAIN=coves.social`

     

       58
       58
       +
         - `PDS_URL=https://coves.me` (separate domain)

     

       59
       59
       +
         - `SKIP_DID_WEB_VERIFICATION=false` (production)

     

       60
       60
       +
         - `JETSTREAM_URL=wss://jetstream2.us-east.bsky.network/subscribe`

     

       61
       61
       +
       

     

       62
       62
       +
       **Verification**:

     

       63
       63
       +
       - `curl https://coves.social/.well-known/did.json` (should return DID document)

     

       64
       64
       +
       - `curl https://coves.me/xrpc/_health` (PDS health check)

     

       65
       65
       +
       

     

       22
       66
        
       ## Overview

     

       23
       67
        
       

     

       24
       68
        
       This document tracks the remaining work required to launch Coves alpha with real users. Focus is on critical functionality, security, and operational readiness.

     
···

       29
       73
        
       

     

       30
       74
        
       ### 1. Authentication & Security

     

       31
       75
        
       

     

       76
       76
       +
       #### Production PDS Deployment

     

       77
       77
       +
       **CRITICAL**: PDS must be on separate domain from AppView (coves.me, not coves.social)

     

       78
       78
       +
       

     

       79
       79
       +
       - [ ] Deploy PDS to coves.me domain

     

       80
       80
       +
         - [ ] Set up DNS: A record for coves.me → server IP

     

       81
       81
       +
         - [ ] Configure SSL certificate for coves.me

     

       82
       82
       +
         - [ ] Deploy PDS container/service on port 2583

     

       83
       83
       +
         - [ ] Configure nginx/Caddy reverse proxy for coves.me → localhost:2583

     

       84
       84
       +
         - [ ] Set PDS_HOSTNAME=coves.me in PDS environment

     

       85
       85
       +
         - [ ] Mount persistent volume for PDS data (/pds/data)

     

       86
       86
       +
       - [ ] Verify PDS connectivity

     

       87
       87
       +
         - [ ] Test: `curl https://coves.me/xrpc/_health`

     

       88
       88
       +
         - [ ] Create test community account on PDS

     

       89
       89
       +
         - [ ] Verify JWKS endpoint: `curl https://coves.me/.well-known/jwks.json`

     

       90
       90
       +
         - [ ] Test community account token provisioning

     

       91
       91
       +
       - [ ] Configure AppView to use production PDS

     

       92
       92
       +
         - [ ] Set `PDS_URL=https://coves.me` in AppView .env

     

       93
       93
       +
         - [ ] Test community creation flow (provisions account on coves.me)

     

       94
       94
       +
         - [ ] Verify account provisioning works end-to-end

     

       95
       95
       +
       

     

       96
       96
       +
       **Important**: Jetstream connects to Bluesky's production firehose, which automatically includes events from all production PDS instances (including coves.me once it's live)

     

       97
       97
       +
       

     

       98
       98
       +
       **Estimated Effort**: 4-6 hours

     

       99
       99
       +
       **Risk**: Medium (infrastructure setup, DNS propagation)

     

       100
       100
       +
       

     

       32
       101
        
       #### JWT Signature Verification (Production Mode)

     

       33
       33
       -
       - [ ] Test with production PDS at `pds.bretton.dev`

     

       34
       34
       -
         - [ ] Create test account on production PDS

     

       35
       35
       -
         - [ ] Verify JWKS endpoint is accessible

     

       102
       102
       +
       - [ ] Test with production PDS at coves.me

     

       103
       103
       +
         - [ ] Verify JWKS endpoint is accessible: `https://coves.me/.well-known/jwks.json`

     

       36
       104
        
         - [ ] Run `TestJWTSignatureVerification` against production PDS

     

       37
       105
        
         - [ ] Confirm signature verification succeeds

     

       38
       38
       -
         - [ ] Test token refresh flow

     

       106
       106
       +
         - [ ] Test token refresh flow for community accounts

     

       39
       107
        
       - [ ] Set `AUTH_SKIP_VERIFY=false` in production environment

     

       40
       108
        
       - [ ] Verify all auth middleware tests pass with verification enabled

     

       41
       41
       -
       - [ ] Document production PDS requirements for communities

     

       42
       42
       -
       

     

       43
       43
       -
       **Estimated Effort**: 2-3 hours

     

       44
       44
       -
       **Risk**: Medium (code implemented, needs validation)

     

       45
       45
       -
       

     

       46
       46
       -
       #### did:web Verification

     

       47
       47
       -
       - [ ] Complete did:web domain verification implementation

     

       48
       48
       -
       - [ ] Test with real did:web identities

     

       49
       49
       -
       - [ ] Add security logging for verification failures

     

       50
       50
       -
       - [ ] Set `SKIP_DID_WEB_VERIFICATION=false` for production

     

       51
       109
        
       

     

       52
       110
        
       **Estimated Effort**: 2-3 hours

     

       53
       53
       -
       **Risk**: Medium

     

       111
       111
       +
       **Risk**: Low (depends on PDS deployment)

     

       112
       112
       +
       

     

       113
       113
       +
       #### did:web Verification ✅ COMPLETE

     

       114
       114
       +
       - [x] Complete did:web domain verification implementation (2025-11-16)

     

       115
       115
       +
       - [x] Implement Bluesky-compatible bidirectional verification

     

       116
       116
       +
       - [x] Add alsoKnownAs field verification in DID documents

     

       117
       117
       +
       - [x] Add security logging for verification failures

     

       118
       118
       +
       - [x] Update cache TTL to 24h (matches Bluesky recommendations)

     

       119
       119
       +
       - [x] Comprehensive test coverage with mock HTTP servers

     

       120
       120
       +
       - [ ] Set `SKIP_DID_WEB_VERIFICATION=false` for production (dev default: true)

     

       121
       121
       +
       - [ ] Deploy `.well-known/did.json` to production domain

     

       122
       122
       +
       

     

       123
       123
       +
       **Implementation Details**:

     

       124
       124
       +
       - **Location**: [internal/atproto/jetstream/community_consumer.go](../internal/atproto/jetstream/community_consumer.go)

     

       125
       125
       +
       - **Verification Flow**: Domain matching + DID document fetch + alsoKnownAs validation

     

       126
       126
       +
       - **Security Model**: Matches Bluesky (DNS/HTTPS authority + bidirectional binding)

     

       127
       127
       +
       - **Performance**: Bounded LRU cache (1000 entries), rate limiting (10 req/s), 24h TTL

     

       128
       128
       +
       - **Impact**: AppView indexing and federation trust (not community creation API)

     

       129
       129
       +
       - **Tests**: `tests/integration/community_hostedby_security_test.go`

     

       130
       130
       +
       

     

       131
       131
       +
       **Actual Effort**: 3 hours (implementation + testing)

     

       132
       132
       +
       **Risk**: ✅ Low (complete and tested)

     

       54
       133
        
       

     

       55
       134
        
       ### 2. DPoP Token Architecture Fix

     

       56
       135
        
       

     
···

       172
       251
        
         - [ ] Common issues and fixes

     

       173
       252
        
         - [ ] Emergency procedures (PDS down, database down, etc.)

     

       174
       253
        
       - [ ] Create production environment checklist

     

       175
       175
       -
         - [ ] All environment variables set

     

       176
       176
       -
         - [ ] `AUTH_SKIP_VERIFY=false`

     

       177
       177
       -
         - [ ] `SKIP_DID_WEB_VERIFICATION=false`

     

       178
       178
       -
         - [ ] Database migrations applied

     

       179
       179
       -
         - [ ] PDS connectivity verified

     

       180
       180
       -
         - [ ] JWKS caching working

     

       181
       181
       -
         - [ ] Jetstream consumers running

     

       254
       254
       +
         - [ ] **Domain Setup**

     

       255
       255
       +
           - [ ] AppView domain (coves.social) DNS configured

     

       256
       256
       +
           - [ ] PDS domain (coves.me) DNS configured - MUST be separate domain

     

       257
       257
       +
           - [ ] SSL certificates for both domains

     

       258
       258
       +
           - [ ] Nginx/Caddy reverse proxy configured for both domains

     

       259
       259
       +
         - [ ] **AppView Environment Variables**

     

       260
       260
       +
           - [ ] `INSTANCE_DID=did:web:coves.social`

     

       261
       261
       +
           - [ ] `INSTANCE_DOMAIN=coves.social`

     

       262
       262
       +
           - [ ] `PDS_URL=https://coves.me` (separate domain)

     

       263
       263
       +
           - [ ] `AUTH_SKIP_VERIFY=false`

     

       264
       264
       +
           - [ ] `SKIP_DID_WEB_VERIFICATION=false`

     

       265
       265
       +
           - [ ] `JETSTREAM_URL=wss://jetstream2.us-east.bsky.network/subscribe`

     

       266
       266
       +
         - [ ] **PDS Environment Variables**

     

       267
       267
       +
           - [ ] `PDS_HOSTNAME=coves.me`

     

       268
       268
       +
           - [ ] `PDS_PORT=2583`

     

       269
       269
       +
           - [ ] Persistent storage mounted

     

       270
       270
       +
         - [ ] **Deployment Verification**

     

       271
       271
       +
           - [ ] Deploy `.well-known/did.json` to coves.social with `serviceEndpoint: https://coves.me`

     

       272
       272
       +
           - [ ] Verify: `curl https://coves.social/.well-known/did.json`

     

       273
       273
       +
           - [ ] Verify: `curl https://coves.me/xrpc/_health`

     

       274
       274
       +
           - [ ] Database migrations applied

     

       275
       275
       +
           - [ ] PDS connectivity verified from AppView

     

       276
       276
       +
           - [ ] JWKS caching working

     

       277
       277
       +
           - [ ] Jetstream consumer connected to Bluesky production firehose

     

       278
       278
       +
           - [ ] Test community creation end-to-end

     

       182
       279
        
         - [ ] Monitoring and alerting active

     

       183
       280
        
       

     

       184
       281
        
       **Estimated Effort**: 6-8 hours

     
···

       342
       439
        
       ## Timeline Estimate

     

       343
       440
        
       

     

       344
       441
        
       ### Week 1: Critical Blockers (P0)

     

       345
       345
       -
       - **Days 1-2**: Authentication (JWT + did:web verification)

     

       442
       442
       +
       - ~~**Days 1-2**: Authentication (JWT + did:web verification)~~ ✅ **did:web COMPLETED**

     

       443
       443
       +
       - **Day 1**: Production PDS deployment (coves.me domain setup)

     

       444
       444
       +
       - **Day 2**: JWT signature verification with production PDS

     

       346
       445
        
       - **Day 3**: DPoP token architecture fix

     

       347
       446
        
       - ~~**Day 4**: Handle resolution + comment count reconciliation~~ ✅ **COMPLETED**

     

       348
       447
        
       - **Day 4-5**: Testing and bug fixes

     

       349
       448
        
       

     

       350
       350
       -
       **Total**: 15-20 hours (reduced from 20-25 due to completed items)

     

       449
       449
       +
       **Total**: 16-23 hours (added 4-6 hours for PDS deployment, reduced from original due to did:web completion)

     

       351
       450
        
       

     

       352
       451
        
       ### Week 2: Production Infrastructure (P1)

     

       353
       452
        
       - **Days 6-7**: Monitoring + structured logging

     
···

       363
       462
        
       

     

       364
       463
        
       **Total**: ~~20-25 hours~~ → **13 hours actual** (E2E tests) + 7-12 hours remaining (load testing, polish)

     

       365
       464
        
       

     

       366
       366
       -
       **Grand Total: ~~65-80 hours~~ → 50-65 hours remaining (approximately 1.5-2 weeks full-time)**

     

       367
       367
       -
       *(Originally 70-85 hours. Reduced by completed items: handle resolution, comment count reconciliation, and ALL E2E tests)*

     

       465
       465
       +
       **Grand Total: ~~65-80 hours~~ → 51-68 hours remaining (approximately 1.5-2 weeks full-time)**

     

       466
       466
       +
       *(Originally 70-85 hours. Adjusted for: +4-6 hours PDS deployment, -3 hours did:web completion, -13 hours E2E tests completion, -4 hours handle resolution and comment reconciliation)*

     

       368
       467
        
       

     

       369
       468
        
       **✅ Progress Update**: E2E testing section COMPLETE ahead of schedule - saved ~7-12 hours through parallel agent implementation

     

       370
       469
        
       

     
···

       377
       476
        
       - [ ] All P0 blockers resolved

     

       378
       477
        
         - ✅ Handle resolution (COMPLETE)

     

       379
       478
        
         - ✅ Comment count reconciliation (COMPLETE)

     

       479
       479
       +
         - ✅ did:web verification (COMPLETE - needs production deployment)

     

       480
       480
       +
         - [ ] Production PDS deployed to coves.me (separate domain)

     

       380
       481
        
         - [ ] JWT signature verification working with production PDS

     

       381
       482
        
         - [ ] DPoP architecture fix implemented

     

       382
       382
       -
         - [ ] did:web verification complete

     

       383
       483
        
       - [ ] Subscriptions/blocking work via client-write pattern

     

       384
       484
        
       - [x] **All integration tests passing** ✅

     

       385
       485
        
       - [x] **E2E user journey test passing** ✅

     
···

       461
       561
        
       11. [ ] Go/no-go decision

     

       462
       562
        
       12. [ ] Launch! 🚀

     

       463
       563
        
       

     

       464
       464
       -
       **🎉 Major Milestone**: All E2E tests complete! Test coverage now includes full user journey, blob uploads, concurrent operations, rate limiting, and error recovery.

     

       564
       564
       +
       **🎉 Major Milestones**:

     

       565
       565
       +
       - All E2E tests complete! Test coverage now includes full user journey, blob uploads, concurrent operations, rate limiting, and error recovery.

     

       566
       566
       +
       - Bidirectional DID verification complete! Bluesky-compatible security model with alsoKnownAs validation, 24h cache TTL, and comprehensive test coverage.

+19 -16

docs/PRD_BACKLOG.md

···

       295
       295
        
       

     

       296
       296
        
       ---

     

       297
       297
        
       

     

       298
       298
       -
       ### did:web Domain Verification & hostedByDID Auto-Population

     

       299
       299
       -
       **Added:** 2025-10-11 | **Updated:** 2025-10-16 | **Effort:** 2-3 days | **Priority:** ALPHA BLOCKER

     

       298
       298
       +
       ### ✅ did:web Domain Verification & hostedByDID Auto-Population - COMPLETE

     

       299
       299
       +
       **Added:** 2025-10-11 | **Updated:** 2025-11-16 | **Completed:** 2025-11-16 | **Status:** ✅ DONE

     

       300
       300
        
       

     

       301
       301
        
       **Problem:**

     

       302
       302
        
       1. **Domain Impersonation**: Self-hosters can set `INSTANCE_DID=did:web:nintendo.com` without owning the domain, enabling attacks where communities appear hosted by trusted domains

     
···

       307
       307
        
       - Federation partners can't verify instance authenticity

     

       308
       308
        
       - AppView pollution with fake hosting claims

     

       309
       309
        
       

     

       310
       310
       -
       **Solution:**

     

       311
       311
       -
       1. **Basic Validation (Phase 1)**: Verify `did:web:` domain matches configured `instanceDomain`

     

       312
       312
       -
       2. **Cryptographic Verification (Phase 2)**: Fetch `https://domain/.well-known/did.json` and verify:

     

       310
       310
       +
       **Solution Implemented (Bluesky-Compatible):**

     

       311
       311
       +
       1. ✅ **Domain Matching**: Verify `did:web:` domain matches configured `instanceDomain`

     

       312
       312
       +
       2. ✅ **Bidirectional Verification**: Fetch `https://domain/.well-known/did.json` and verify:

     

       313
       313
        
          - DID document exists and is valid

     

       314
       314
       -
          - Domain ownership proven via HTTPS hosting

     

       315
       315
       -
          - DID document matches claimed `instanceDID`

     

       316
       316
       -
       3. **Auto-populate hostedByDID**: Remove from client API, derive from instance configuration in service layer

     

       314
       314
       +
          - DID document ID matches claimed `instanceDID`

     

       315
       315
       +
          - DID document claims handle domain in `alsoKnownAs` field (bidirectional binding)

     

       316
       316
       +
          - Domain ownership proven via HTTPS hosting (matches Bluesky's trust model)

     

       317
       317
       +
       3. ✅ **Auto-populate hostedByDID**: Removed from client API, derived from instance configuration in service layer

     

       317
       318
        
       

     

       318
       319
        
       **Current Status:**

     

       319
       320
        
       - ✅ Default changed from `coves.local` → `coves.social` (fixes `.local` TLD bug)

     

       320
       320
       -
       - ✅ TODO comment in [cmd/server/main.go:126-131](../cmd/server/main.go#L126-L131)

     

       321
       321
        
       - ✅ hostedByDID removed from client requests (2025-10-16)

     

       322
       322
        
       - ✅ Service layer auto-populates `hostedByDID` from `instanceDID` (2025-10-16)

     

       323
       323
        
       - ✅ Handler rejects client-provided `hostedByDID` (2025-10-16)

     

       324
       324
        
       - ✅ Basic validation: Logs warning if `did:web:` domain ≠ `instanceDomain` (2025-10-16)

     

       325
       325
       -
       - ⚠️ **REMAINING**: Full DID document verification (cryptographic proof of ownership)

     

       326
       326
       -
       

     

       327
       327
       -
       **Implementation Notes:**

     

       328
       328
       -
       - Phase 1 complete: Basic validation catches config errors, logs warnings

     

       329
       329
       -
       - Phase 2 needed: Fetch `https://domain/.well-known/did.json` and verify ownership

     

       330
       330
       -
       - Add `SKIP_DID_WEB_VERIFICATION=true` for dev mode

     

       331
       331
       -
       - Full verification blocks startup if domain ownership cannot be proven

     

       325
       325
       +
       - ✅ **MANDATORY bidirectional DID verification** (2025-11-16)

     

       326
       326
       +
       - ✅ Cache TTL updated to 24h (matches Bluesky recommendations) (2025-11-16)

     

       327
       327
       +
       

     

       328
       328
       +
       **Implementation Details:**

     

       329
       329
       +
       - **Security Model**: Matches Bluesky's approach - relies on DNS/HTTPS authority, not cryptographic proof

     

       330
       330
       +
       - **Enforcement**: MANDATORY hard-fail in production (rejects communities with verification failures)

     

       331
       331
       +
       - **Dev Mode**: Set `SKIP_DID_WEB_VERIFICATION=true` to bypass verification for local development

     

       332
       332
       +
       - **Performance**: Bounded LRU cache (1000 entries), rate limiting (10 req/s), 24h cache TTL

     

       333
       333
       +
       - **Bidirectional Check**: Prevents impersonation by requiring DID document to claim the handle

     

       334
       334
       +
       - **Location**: [internal/atproto/jetstream/community_consumer.go](../internal/atproto/jetstream/community_consumer.go)

     

       332
       335
        
       

     

       333
       336
        
       ---

     

       334
       337

+73

internal/atproto/lexicon/social/coves/aggregator/register.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.register",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Register an existing aggregator DID with this Coves instance. Aggregators must first create their own DID via PLC directory, then call this endpoint to register. Domain ownership is verified via .well-known/atproto-did file.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["did", "domain"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "did": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "did",

     

       17
       17
       +
                     "description": "DID of the aggregator (did:plc or did:web format)"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "domain": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "format": "uri",

     

       22
       22
       +
                     "description": "Domain where the aggregator is hosted (e.g., 'rss-bot.example.com'). Must serve .well-known/atproto-did file containing the DID."

     

       23
       23
       +
                   }

     

       24
       24
       +
                 }

     

       25
       25
       +
               }

     

       26
       26
       +
             },

     

       27
       27
       +
             "output": {

     

       28
       28
       +
               "encoding": "application/json",

     

       29
       29
       +
               "schema": {

     

       30
       30
       +
                 "type": "object",

     

       31
       31
       +
                 "required": ["did", "handle"],

     

       32
       32
       +
                 "properties": {

     

       33
       33
       +
                   "did": {

     

       34
       34
       +
                     "type": "string",

     

       35
       35
       +
                     "format": "did",

     

       36
       36
       +
                     "description": "DID of the registered aggregator"

     

       37
       37
       +
                   },

     

       38
       38
       +
                   "handle": {

     

       39
       39
       +
                     "type": "string",

     

       40
       40
       +
                     "description": "Handle extracted from DID document"

     

       41
       41
       +
                   },

     

       42
       42
       +
                   "message": {

     

       43
       43
       +
                     "type": "string",

     

       44
       44
       +
                     "description": "Success message with next steps"

     

       45
       45
       +
                   }

     

       46
       46
       +
                 }

     

       47
       47
       +
               }

     

       48
       48
       +
             },

     

       49
       49
       +
             "errors": [

     

       50
       50
       +
               {

     

       51
       51
       +
                 "name": "InvalidDID",

     

       52
       52
       +
                 "description": "DID format is invalid or not did:plc or did:web format"

     

       53
       53
       +
               },

     

       54
       54
       +
               {

     

       55
       55
       +
                 "name": "DomainVerificationFailed",

     

       56
       56
       +
                 "description": "Could not verify domain ownership via .well-known/atproto-did or DID mismatch"

     

       57
       57
       +
               },

     

       58
       58
       +
               {

     

       59
       59
       +
                 "name": "AlreadyRegistered",

     

       60
       60
       +
                 "description": "This aggregator DID is already registered with this instance"

     

       61
       61
       +
               },

     

       62
       62
       +
               {

     

       63
       63
       +
                 "name": "DIDResolutionFailed",

     

       64
       64
       +
                 "description": "Could not resolve DID document to extract handle and PDS URL"

     

       65
       65
       +
               },

     

       66
       66
       +
               {

     

       67
       67
       +
                 "name": "RegistrationFailed",

     

       68
       68
       +
                 "description": "Internal server error occurred during registration"

     

       69
       69
       +
               }

     

       70
       70
       +
             ]

     

       71
       71
       +
           }

     

       72
       72
       +
         }

     

       73
       73
       +
       }

+95

scripts/aggregator-setup/1-create-pds-account.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 1-create-pds-account.sh

     

       4
       4
       +
       # Purpose: Create a PDS account for your aggregator

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script helps you create an account on a PDS (Personal Data Server).

     

       7
       7
       +
       # The PDS will automatically create a DID:PLC for you.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 1: Create PDS Account for Your Aggregator"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Get PDS URL

     

       17
       17
       +
       read -p "Enter PDS URL (default: https://bsky.social): " PDS_URL

     

       18
       18
       +
       PDS_URL=${PDS_URL:-https://bsky.social}

     

       19
       19
       +
       

     

       20
       20
       +
       # Get credentials

     

       21
       21
       +
       read -p "Enter desired handle (e.g., mynewsbot.bsky.social): " HANDLE

     

       22
       22
       +
       read -p "Enter email: " EMAIL

     

       23
       23
       +
       read -sp "Enter password: " PASSWORD

     

       24
       24
       +
       echo ""

     

       25
       25
       +
       

     

       26
       26
       +
       # Validate inputs

     

       27
       27
       +
       if [ -z "$HANDLE" ] || [ -z "$EMAIL" ] || [ -z "$PASSWORD" ]; then

     

       28
       28
       +
           echo "Error: All fields are required"

     

       29
       29
       +
           exit 1

     

       30
       30
       +
       fi

     

       31
       31
       +
       

     

       32
       32
       +
       echo ""

     

       33
       33
       +
       echo "Creating account on $PDS_URL..."

     

       34
       34
       +
       

     

       35
       35
       +
       # Create account via com.atproto.server.createAccount

     

       36
       36
       +
       RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.server.createAccount" \

     

       37
       37
       +
           -H "Content-Type: application/json" \

     

       38
       38
       +
           -d "{

     

       39
       39
       +
               \"handle\": \"$HANDLE\",

     

       40
       40
       +
               \"email\": \"$EMAIL\",

     

       41
       41
       +
               \"password\": \"$PASSWORD\"

     

       42
       42
       +
           }")

     

       43
       43
       +
       

     

       44
       44
       +
       # Check if successful

     

       45
       45
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       46
       46
       +
           echo "Error creating account:"

     

       47
       47
       +
           echo "$RESPONSE" | jq '.'

     

       48
       48
       +
           exit 1

     

       49
       49
       +
       fi

     

       50
       50
       +
       

     

       51
       51
       +
       # Extract DID and access token

     

       52
       52
       +
       DID=$(echo "$RESPONSE" | jq -r '.did')

     

       53
       53
       +
       ACCESS_JWT=$(echo "$RESPONSE" | jq -r '.accessJwt')

     

       54
       54
       +
       REFRESH_JWT=$(echo "$RESPONSE" | jq -r '.refreshJwt')

     

       55
       55
       +
       

     

       56
       56
       +
       if [ -z "$DID" ] || [ "$DID" = "null" ]; then

     

       57
       57
       +
           echo "Error: Failed to extract DID from response"

     

       58
       58
       +
           echo "$RESPONSE" | jq '.'

     

       59
       59
       +
           exit 1

     

       60
       60
       +
       fi

     

       61
       61
       +
       

     

       62
       62
       +
       echo ""

     

       63
       63
       +
       echo "✓ Account created successfully!"

     

       64
       64
       +
       echo ""

     

       65
       65
       +
       echo "=== Save these credentials ===="

     

       66
       66
       +
       echo "DID:          $DID"

     

       67
       67
       +
       echo "Handle:       $HANDLE"

     

       68
       68
       +
       echo "PDS URL:      $PDS_URL"

     

       69
       69
       +
       echo "Email:        $EMAIL"

     

       70
       70
       +
       echo "Password:     [hidden]"

     

       71
       71
       +
       echo "Access JWT:   $ACCESS_JWT"

     

       72
       72
       +
       echo "Refresh JWT:  $REFRESH_JWT"

     

       73
       73
       +
       echo "==============================="

     

       74
       74
       +
       echo ""

     

       75
       75
       +
       

     

       76
       76
       +
       # Save to config file

     

       77
       77
       +
       CONFIG_FILE="aggregator-config.env"

     

       78
       78
       +
       cat > "$CONFIG_FILE" <<EOF

     

       79
       79
       +
       # Aggregator Account Configuration

     

       80
       80
       +
       # Generated: $(date)

     

       81
       81
       +
       

     

       82
       82
       +
       AGGREGATOR_DID="$DID"

     

       83
       83
       +
       AGGREGATOR_HANDLE="$HANDLE"

     

       84
       84
       +
       AGGREGATOR_PDS_URL="$PDS_URL"

     

       85
       85
       +
       AGGREGATOR_EMAIL="$EMAIL"

     

       86
       86
       +
       AGGREGATOR_PASSWORD="$PASSWORD"

     

       87
       87
       +
       AGGREGATOR_ACCESS_JWT="$ACCESS_JWT"

     

       88
       88
       +
       AGGREGATOR_REFRESH_JWT="$REFRESH_JWT"

     

       89
       89
       +
       EOF

     

       90
       90
       +
       

     

       91
       91
       +
       echo "✓ Configuration saved to $CONFIG_FILE"

     

       92
       92
       +
       echo ""

     

       93
       93
       +
       echo "IMPORTANT: Keep this file secure! It contains your credentials."

     

       94
       94
       +
       echo ""

     

       95
       95
       +
       echo "Next step: Run ./2-setup-wellknown.sh"

+93

scripts/aggregator-setup/2-setup-wellknown.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 2-setup-wellknown.sh

     

       4
       4
       +
       # Purpose: Generate .well-known/atproto-did file for domain verification

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script creates the .well-known/atproto-did file that proves you own your domain.

     

       7
       7
       +
       # You'll need to host this file at https://yourdomain.com/.well-known/atproto-did

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 2: Setup .well-known/atproto-did"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Load config if available

     

       17
       17
       +
       if [ -f "aggregator-config.env" ]; then

     

       18
       18
       +
           source aggregator-config.env

     

       19
       19
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       20
       20
       +
           echo "  DID: $AGGREGATOR_DID"

     

       21
       21
       +
           echo ""

     

       22
       22
       +
       else

     

       23
       23
       +
           echo "Configuration file not found. Please run 1-create-pds-account.sh first."

     

       24
       24
       +
           exit 1

     

       25
       25
       +
       fi

     

       26
       26
       +
       

     

       27
       27
       +
       # Get domain

     

       28
       28
       +
       read -p "Enter your aggregator's domain (e.g., rss-bot.example.com): " DOMAIN

     

       29
       29
       +
       

     

       30
       30
       +
       if [ -z "$DOMAIN" ]; then

     

       31
       31
       +
           echo "Error: Domain is required"

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       # Save domain to config

     

       36
       36
       +
       echo "" >> aggregator-config.env

     

       37
       37
       +
       echo "AGGREGATOR_DOMAIN=\"$DOMAIN\"" >> aggregator-config.env

     

       38
       38
       +
       

     

       39
       39
       +
       echo ""

     

       40
       40
       +
       echo "Creating .well-known directory..."

     

       41
       41
       +
       mkdir -p .well-known

     

       42
       42
       +
       

     

       43
       43
       +
       # Create the atproto-did file

     

       44
       44
       +
       echo "$AGGREGATOR_DID" > .well-known/atproto-did

     

       45
       45
       +
       

     

       46
       46
       +
       echo "✓ Created .well-known/atproto-did with content: $AGGREGATOR_DID"

     

       47
       47
       +
       echo ""

     

       48
       48
       +
       

     

       49
       49
       +
       echo "================================================"

     

       50
       50
       +
       echo "Next Steps:"

     

       51
       51
       +
       echo "================================================"

     

       52
       52
       +
       echo ""

     

       53
       53
       +
       echo "1. Upload the .well-known directory to your web server"

     

       54
       54
       +
       echo "   The file must be accessible at:"

     

       55
       55
       +
       echo "   https://$DOMAIN/.well-known/atproto-did"

     

       56
       56
       +
       echo ""

     

       57
       57
       +
       echo "2. Verify it's working by running:"

     

       58
       58
       +
       echo "   curl https://$DOMAIN/.well-known/atproto-did"

     

       59
       59
       +
       echo "   (Should return: $AGGREGATOR_DID)"

     

       60
       60
       +
       echo ""

     

       61
       61
       +
       echo "3. Once verified, run: ./3-register-with-coves.sh"

     

       62
       62
       +
       echo ""

     

       63
       63
       +
       

     

       64
       64
       +
       # Create nginx example

     

       65
       65
       +
       cat > nginx-example.conf <<EOF

     

       66
       66
       +
       # Example nginx configuration for serving .well-known

     

       67
       67
       +
       # Add this to your nginx server block:

     

       68
       68
       +
       

     

       69
       69
       +
       location /.well-known/atproto-did {

     

       70
       70
       +
           alias /path/to/your/.well-known/atproto-did;

     

       71
       71
       +
           default_type text/plain;

     

       72
       72
       +
           add_header Access-Control-Allow-Origin *;

     

       73
       73
       +
       }

     

       74
       74
       +
       EOF

     

       75
       75
       +
       

     

       76
       76
       +
       echo "✓ Created nginx-example.conf for reference"

     

       77
       77
       +
       echo ""

     

       78
       78
       +
       

     

       79
       79
       +
       # Create Apache example

     

       80
       80
       +
       cat > apache-example.conf <<EOF

     

       81
       81
       +
       # Example Apache configuration for serving .well-known

     

       82
       82
       +
       # Add this to your Apache virtual host:

     

       83
       83
       +
       

     

       84
       84
       +
       Alias /.well-known /path/to/your/.well-known

     

       85
       85
       +
       <Directory /path/to/your/.well-known>

     

       86
       86
       +
           Options None

     

       87
       87
       +
           AllowOverride None

     

       88
       88
       +
           Require all granted

     

       89
       89
       +
           Header set Access-Control-Allow-Origin "*"

     

       90
       90
       +
       </Directory>

     

       91
       91
       +
       EOF

     

       92
       92
       +
       

     

       93
       93
       +
       echo "✓ Created apache-example.conf for reference"

+103

scripts/aggregator-setup/3-register-with-coves.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 3-register-with-coves.sh

     

       4
       4
       +
       # Purpose: Register your aggregator with a Coves instance

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script calls the social.coves.aggregator.register XRPC endpoint

     

       7
       7
       +
       # to register your aggregator DID with the Coves instance.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 3: Register with Coves Instance"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Load config if available

     

       17
       17
       +
       if [ -f "aggregator-config.env" ]; then

     

       18
       18
       +
           source aggregator-config.env

     

       19
       19
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       20
       20
       +
           echo "  DID:    $AGGREGATOR_DID"

     

       21
       21
       +
           echo "  Domain: $AGGREGATOR_DOMAIN"

     

       22
       22
       +
           echo ""

     

       23
       23
       +
       else

     

       24
       24
       +
           echo "Configuration file not found. Please run previous scripts first."

     

       25
       25
       +
           exit 1

     

       26
       26
       +
       fi

     

       27
       27
       +
       

     

       28
       28
       +
       # Validate domain is set

     

       29
       29
       +
       if [ -z "$AGGREGATOR_DOMAIN" ]; then

     

       30
       30
       +
           echo "Error: AGGREGATOR_DOMAIN not set. Please run 2-setup-wellknown.sh first."

     

       31
       31
       +
           exit 1

     

       32
       32
       +
       fi

     

       33
       33
       +
       

     

       34
       34
       +
       # Get Coves instance URL

     

       35
       35
       +
       read -p "Enter Coves instance URL (default: https://api.coves.social): " COVES_URL

     

       36
       36
       +
       COVES_URL=${COVES_URL:-https://api.coves.social}

     

       37
       37
       +
       

     

       38
       38
       +
       echo ""

     

       39
       39
       +
       echo "Verifying .well-known/atproto-did is accessible..."

     

       40
       40
       +
       

     

       41
       41
       +
       # Verify .well-known is accessible

     

       42
       42
       +
       WELLKNOWN_URL="https://$AGGREGATOR_DOMAIN/.well-known/atproto-did"

     

       43
       43
       +
       WELLKNOWN_CONTENT=$(curl -s "$WELLKNOWN_URL" || echo "ERROR")

     

       44
       44
       +
       

     

       45
       45
       +
       if [ "$WELLKNOWN_CONTENT" = "ERROR" ]; then

     

       46
       46
       +
           echo "✗ Error: Could not access $WELLKNOWN_URL"

     

       47
       47
       +
           echo "  Please ensure the file is uploaded and accessible."

     

       48
       48
       +
           exit 1

     

       49
       49
       +
       elif [ "$WELLKNOWN_CONTENT" != "$AGGREGATOR_DID" ]; then

     

       50
       50
       +
           echo "✗ Error: .well-known/atproto-did contains wrong DID"

     

       51
       51
       +
           echo "  Expected: $AGGREGATOR_DID"

     

       52
       52
       +
           echo "  Got:      $WELLKNOWN_CONTENT"

     

       53
       53
       +
           exit 1

     

       54
       54
       +
       fi

     

       55
       55
       +
       

     

       56
       56
       +
       echo "✓ .well-known/atproto-did is correctly configured"

     

       57
       57
       +
       echo ""

     

       58
       58
       +
       

     

       59
       59
       +
       echo "Registering with $COVES_URL..."

     

       60
       60
       +
       

     

       61
       61
       +
       # Call registration endpoint

     

       62
       62
       +
       RESPONSE=$(curl -s -X POST "$COVES_URL/xrpc/social.coves.aggregator.register" \

     

       63
       63
       +
           -H "Content-Type: application/json" \

     

       64
       64
       +
           -d "{

     

       65
       65
       +
               \"did\": \"$AGGREGATOR_DID\",

     

       66
       66
       +
               \"domain\": \"$AGGREGATOR_DOMAIN\"

     

       67
       67
       +
           }")

     

       68
       68
       +
       

     

       69
       69
       +
       # Check if successful

     

       70
       70
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       71
       71
       +
           echo "✗ Registration failed:"

     

       72
       72
       +
           echo "$RESPONSE" | jq '.'

     

       73
       73
       +
           exit 1

     

       74
       74
       +
       fi

     

       75
       75
       +
       

     

       76
       76
       +
       # Extract response

     

       77
       77
       +
       REGISTERED_DID=$(echo "$RESPONSE" | jq -r '.did')

     

       78
       78
       +
       REGISTERED_HANDLE=$(echo "$RESPONSE" | jq -r '.handle')

     

       79
       79
       +
       MESSAGE=$(echo "$RESPONSE" | jq -r '.message')

     

       80
       80
       +
       

     

       81
       81
       +
       if [ -z "$REGISTERED_DID" ] || [ "$REGISTERED_DID" = "null" ]; then

     

       82
       82
       +
           echo "✗ Error: Unexpected response format"

     

       83
       83
       +
           echo "$RESPONSE" | jq '.'

     

       84
       84
       +
           exit 1

     

       85
       85
       +
       fi

     

       86
       86
       +
       

     

       87
       87
       +
       echo ""

     

       88
       88
       +
       echo "✓ Registration successful!"

     

       89
       89
       +
       echo ""

     

       90
       90
       +
       echo "=== Registration Details ===="

     

       91
       91
       +
       echo "DID:     $REGISTERED_DID"

     

       92
       92
       +
       echo "Handle:  $REGISTERED_HANDLE"

     

       93
       93
       +
       echo "Message: $MESSAGE"

     

       94
       94
       +
       echo "============================="

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       

     

       97
       97
       +
       # Save Coves URL to config

     

       98
       98
       +
       echo "" >> aggregator-config.env

     

       99
       99
       +
       echo "COVES_INSTANCE_URL=\"$COVES_URL\"" >> aggregator-config.env

     

       100
       100
       +
       

     

       101
       101
       +
       echo "✓ Updated aggregator-config.env with Coves instance URL"

     

       102
       102
       +
       echo ""

     

       103
       103
       +
       echo "Next step: Run ./4-create-service-declaration.sh"

+125

scripts/aggregator-setup/4-create-service-declaration.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 4-create-service-declaration.sh

     

       4
       4
       +
       # Purpose: Create aggregator service declaration record

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script writes a social.coves.aggregator.service record to your aggregator's repository.

     

       7
       7
       +
       # This record contains metadata about your aggregator (name, description, etc.) and will be

     

       8
       8
       +
       # indexed by Coves' Jetstream consumer into the aggregators table.

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       echo "================================================"

     

       13
       13
       +
       echo "Step 4: Create Service Declaration"

     

       14
       14
       +
       echo "================================================"

     

       15
       15
       +
       echo ""

     

       16
       16
       +
       

     

       17
       17
       +
       # Load config if available

     

       18
       18
       +
       if [ -f "aggregator-config.env" ]; then

     

       19
       19
       +
           source aggregator-config.env

     

       20
       20
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       21
       21
       +
           echo "  DID:       $AGGREGATOR_DID"

     

       22
       22
       +
           echo "  PDS URL:   $AGGREGATOR_PDS_URL"

     

       23
       23
       +
           echo ""

     

       24
       24
       +
       else

     

       25
       25
       +
           echo "Configuration file not found. Please run previous scripts first."

     

       26
       26
       +
           exit 1

     

       27
       27
       +
       fi

     

       28
       28
       +
       

     

       29
       29
       +
       # Validate required fields

     

       30
       30
       +
       if [ -z "$AGGREGATOR_ACCESS_JWT" ]; then

     

       31
       31
       +
           echo "Error: AGGREGATOR_ACCESS_JWT not set. Please run 1-create-pds-account.sh first."

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       echo "Enter aggregator metadata:"

     

       36
       36
       +
       echo ""

     

       37
       37
       +
       

     

       38
       38
       +
       # Get metadata from user

     

       39
       39
       +
       read -p "Display Name (e.g., 'RSS News Aggregator'): " DISPLAY_NAME

     

       40
       40
       +
       read -p "Description: " DESCRIPTION

     

       41
       41
       +
       read -p "Source URL (e.g., 'https://github.com/yourname/aggregator'): " SOURCE_URL

     

       42
       42
       +
       read -p "Maintainer DID (your personal DID, optional): " MAINTAINER_DID

     

       43
       43
       +
       

     

       44
       44
       +
       if [ -z "$DISPLAY_NAME" ]; then

     

       45
       45
       +
           echo "Error: Display name is required"

     

       46
       46
       +
           exit 1

     

       47
       47
       +
       fi

     

       48
       48
       +
       

     

       49
       49
       +
       echo ""

     

       50
       50
       +
       echo "Creating service declaration record..."

     

       51
       51
       +
       

     

       52
       52
       +
       # Build the service record

     

       53
       53
       +
       SERVICE_RECORD=$(cat <<EOF

     

       54
       54
       +
       {

     

       55
       55
       +
           "\$type": "social.coves.aggregator.service",

     

       56
       56
       +
           "did": "$AGGREGATOR_DID",

     

       57
       57
       +
           "displayName": "$DISPLAY_NAME",

     

       58
       58
       +
           "description": "$DESCRIPTION",

     

       59
       59
       +
           "sourceUrl": "$SOURCE_URL",

     

       60
       60
       +
           "maintainer": "$MAINTAINER_DID",

     

       61
       61
       +
           "createdAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"

     

       62
       62
       +
       }

     

       63
       63
       +
       EOF

     

       64
       64
       +
       )

     

       65
       65
       +
       

     

       66
       66
       +
       # Call com.atproto.repo.createRecord

     

       67
       67
       +
       RESPONSE=$(curl -s -X POST "$AGGREGATOR_PDS_URL/xrpc/com.atproto.repo.createRecord" \

     

       68
       68
       +
           -H "Authorization: Bearer $AGGREGATOR_ACCESS_JWT" \

     

       69
       69
       +
           -H "Content-Type: application/json" \

     

       70
       70
       +
           -d "{

     

       71
       71
       +
               \"repo\": \"$AGGREGATOR_DID\",

     

       72
       72
       +
               \"collection\": \"social.coves.aggregator.service\",

     

       73
       73
       +
               \"rkey\": \"self\",

     

       74
       74
       +
               \"record\": $SERVICE_RECORD

     

       75
       75
       +
           }")

     

       76
       76
       +
       

     

       77
       77
       +
       # Check if successful

     

       78
       78
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       79
       79
       +
           echo "✗ Failed to create service declaration:"

     

       80
       80
       +
           echo "$RESPONSE" | jq '.'

     

       81
       81
       +
           exit 1

     

       82
       82
       +
       fi

     

       83
       83
       +
       

     

       84
       84
       +
       # Extract response

     

       85
       85
       +
       RECORD_URI=$(echo "$RESPONSE" | jq -r '.uri')

     

       86
       86
       +
       RECORD_CID=$(echo "$RESPONSE" | jq -r '.cid')

     

       87
       87
       +
       

     

       88
       88
       +
       if [ -z "$RECORD_URI" ] || [ "$RECORD_URI" = "null" ]; then

     

       89
       89
       +
           echo "✗ Error: Unexpected response format"

     

       90
       90
       +
           echo "$RESPONSE" | jq '.'

     

       91
       91
       +
           exit 1

     

       92
       92
       +
       fi

     

       93
       93
       +
       

     

       94
       94
       +
       echo ""

     

       95
       95
       +
       echo "✓ Service declaration created successfully!"

     

       96
       96
       +
       echo ""

     

       97
       97
       +
       echo "=== Record Details ===="

     

       98
       98
       +
       echo "URI: $RECORD_URI"

     

       99
       99
       +
       echo "CID: $RECORD_CID"

     

       100
       100
       +
       echo "======================="

     

       101
       101
       +
       echo ""

     

       102
       102
       +
       

     

       103
       103
       +
       # Save to config

     

       104
       104
       +
       echo "" >> aggregator-config.env

     

       105
       105
       +
       echo "SERVICE_DECLARATION_URI=\"$RECORD_URI\"" >> aggregator-config.env

     

       106
       106
       +
       echo "SERVICE_DECLARATION_CID=\"$RECORD_CID\"" >> aggregator-config.env

     

       107
       107
       +
       

     

       108
       108
       +
       echo "✓ Updated aggregator-config.env"

     

       109
       109
       +
       echo ""

     

       110
       110
       +
       echo "================================================"

     

       111
       111
       +
       echo "Setup Complete!"

     

       112
       112
       +
       echo "================================================"

     

       113
       113
       +
       echo ""

     

       114
       114
       +
       echo "Your aggregator is now registered with Coves!"

     

       115
       115
       +
       echo ""

     

       116
       116
       +
       echo "Next steps:"

     

       117
       117
       +
       echo "1. Wait a few seconds for Jetstream to index your service declaration"

     

       118
       118
       +
       echo "2. Verify your aggregator appears in the aggregators list"

     

       119
       119
       +
       echo "3. Community moderators can now authorize your aggregator"

     

       120
       120
       +
       echo "4. Once authorized, you can start posting to communities"

     

       121
       121
       +
       echo ""

     

       122
       122
       +
       echo "To test posting, use the Coves XRPC endpoint:"

     

       123
       123
       +
       echo "  POST $COVES_INSTANCE_URL/xrpc/social.coves.community.post.create"

     

       124
       124
       +
       echo ""

     

       125
       125
       +
       echo "See docs/aggregators/SETUP_GUIDE.md for more information"

+188 -1

aggregators/kagi-news/README.md

···

       31
       31
        
       │       ├── sample_rss_item.xml

     

       32
       32
        
       │       └── world.xml

     

       33
       33
        
       ├── scripts/

     

       34
       34
       -
       │   └── generate_did.py        # Helper to generate aggregator DID (TODO)

     

       34
       34
       +
       │   └── setup.sh               # Automated Coves registration script

     

       35
       35
       +
       ├── Dockerfile                 # Docker image definition

     

       36
       36
       +
       ├── docker-compose.yml         # Docker Compose configuration

     

       37
       37
       +
       ├── docker-entrypoint.sh       # Container entrypoint script

     

       38
       38
       +
       ├── .dockerignore              # Docker build exclusions

     

       35
       39
        
       ├── requirements.txt           # Python dependencies

     

       36
       40
        
       ├── config.example.yaml        # Example configuration

     

       37
       41
        
       ├── .env.example               # Environment variables template

     
···

       39
       43
        
       └── README.md

     

       40
       44
        
       ```

     

       41
       45
        
       

     

       46
       46
       +
       ## Registration with Coves

     

       47
       47
       +
       

     

       48
       48
       +
       Before running the aggregator, you must register it with a Coves instance. This creates a DID for your aggregator and registers it with Coves.

     

       49
       49
       +
       

     

       50
       50
       +
       ### Quick Setup (Automated)

     

       51
       51
       +
       

     

       52
       52
       +
       The automated setup script handles the entire registration process:

     

       53
       53
       +
       

     

       54
       54
       +
       ```bash

     

       55
       55
       +
       cd scripts

     

       56
       56
       +
       chmod +x setup.sh

     

       57
       57
       +
       ./setup.sh

     

       58
       58
       +
       ```

     

       59
       59
       +
       

     

       60
       60
       +
       This will:

     

       61
       61
       +
       1. **Create a PDS account** for your aggregator (generates a DID)

     

       62
       62
       +
       2. **Generate `.well-known/atproto-did`** file for domain verification

     

       63
       63
       +
       3. **Pause for manual upload** - you'll upload the file to your web server

     

       64
       64
       +
       4. **Register with Coves** instance via XRPC

     

       65
       65
       +
       5. **Create service declaration** record (indexed by Jetstream)

     

       66
       66
       +
       

     

       67
       67
       +
       **Manual step required:** During the process, you'll need to upload the `.well-known/atproto-did` file to your domain so it's accessible at `https://yourdomain.com/.well-known/atproto-did`.

     

       68
       68
       +
       

     

       69
       69
       +
       After completion, you'll have a `kagi-aggregator-config.env` file with:

     

       70
       70
       +
       - Aggregator DID and credentials

     

       71
       71
       +
       - Access/refresh JWTs

     

       72
       72
       +
       - Service declaration URI

     

       73
       73
       +
       

     

       74
       74
       +
       **Keep this file secure!** It contains your aggregator's credentials.

     

       75
       75
       +
       

     

       76
       76
       +
       ### Manual Setup (Step-by-step)

     

       77
       77
       +
       

     

       78
       78
       +
       Alternatively, use the generic setup scripts from the main Coves repo for more control:

     

       79
       79
       +
       

     

       80
       80
       +
       ```bash

     

       81
       81
       +
       # From the Coves project root

     

       82
       82
       +
       cd scripts/aggregator-setup

     

       83
       83
       +
       

     

       84
       84
       +
       # Follow the 4-step process

     

       85
       85
       +
       ./1-create-pds-account.sh

     

       86
       86
       +
       ./2-setup-wellknown.sh

     

       87
       87
       +
       ./3-register-with-coves.sh

     

       88
       88
       +
       ./4-create-service-declaration.sh

     

       89
       89
       +
       ```

     

       90
       90
       +
       

     

       91
       91
       +
       See [scripts/aggregator-setup/README.md](../../scripts/aggregator-setup/README.md) for detailed documentation on each step.

     

       92
       92
       +
       

     

       93
       93
       +
       ### What Happens During Registration?

     

       94
       94
       +
       

     

       95
       95
       +
       1. **PDS Account Creation**: Your aggregator gets a `did:plc:...` identifier

     

       96
       96
       +
       2. **Domain Verification**: Proves you control your aggregator's domain

     

       97
       97
       +
       3. **Coves Registration**: Inserts your DID into the Coves instance's `users` table

     

       98
       98
       +
       4. **Service Declaration**: Creates a record that gets indexed into the `aggregators` table

     

       99
       99
       +
       5. **Ready for Authorization**: Community moderators can now authorize your aggregator

     

       100
       100
       +
       

     

       101
       101
       +
       Once registered and authorized by a community, your aggregator can post content.

     

       102
       102
       +
       

     

       42
       103
        
       ## Setup

     

       43
       104
        
       

     

       44
       105
        
       ### Prerequisites

     

       45
       106
        
       

     

       46
       107
        
       - Python 3.11+

     

       47
       108
        
       - python3-venv package (`apt install python3.12-venv`)

     

       109
       109
       +
       - **Completed registration** (see above)

     

       48
       110
        
       

     

       49
       111
        
       ### Installation

     

       50
       112
        
       

     
···

       84
       146
        
       pytest --cov=src --cov-report=html

     

       85
       147
        
       ```

     

       86
       148
        
       

     

       149
       149
       +
       ## Deployment

     

       150
       150
       +
       

     

       151
       151
       +
       ### Docker Deployment (Recommended for Production)

     

       152
       152
       +
       

     

       153
       153
       +
       The easiest way to deploy the Kagi aggregator is using Docker. The cron job runs inside the container automatically.

     

       154
       154
       +
       

     

       155
       155
       +
       #### Prerequisites

     

       156
       156
       +
       

     

       157
       157
       +
       - Docker and Docker Compose installed

     

       158
       158
       +
       - Completed registration (you have `.env` with credentials)

     

       159
       159
       +
       - `config.yaml` configured with your feed mappings

     

       160
       160
       +
       

     

       161
       161
       +
       #### Quick Start

     

       162
       162
       +
       

     

       163
       163
       +
       1. **Configure your environment:**

     

       164
       164
       +
          ```bash

     

       165
       165
       +
          # Copy and edit configuration

     

       166
       166
       +
          cp config.example.yaml config.yaml

     

       167
       167
       +
          cp .env.example .env

     

       168
       168
       +
       

     

       169
       169
       +
          # Edit .env with your aggregator credentials

     

       170
       170
       +
          nano .env

     

       171
       171
       +
          ```

     

       172
       172
       +
       

     

       173
       173
       +
       2. **Start the aggregator:**

     

       174
       174
       +
          ```bash

     

       175
       175
       +
          docker compose up -d

     

       176
       176
       +
          ```

     

       177
       177
       +
       

     

       178
       178
       +
       3. **View logs:**

     

       179
       179
       +
          ```bash

     

       180
       180
       +
          docker compose logs -f

     

       181
       181
       +
          ```

     

       182
       182
       +
       

     

       183
       183
       +
       4. **Stop the aggregator:**

     

       184
       184
       +
          ```bash

     

       185
       185
       +
          docker compose down

     

       186
       186
       +
          ```

     

       187
       187
       +
       

     

       188
       188
       +
       #### Configuration

     

       189
       189
       +
       

     

       190
       190
       +
       The `docker-compose.yml` file supports these environment variables:

     

       191
       191
       +
       

     

       192
       192
       +
       - **`AGGREGATOR_HANDLE`** (required): Your aggregator's handle

     

       193
       193
       +
       - **`AGGREGATOR_PASSWORD`** (required): Your aggregator's password

     

       194
       194
       +
       - **`COVES_API_URL`** (optional): Override Coves API endpoint (defaults to `https://api.coves.social`)

     

       195
       195
       +
       - **`RUN_ON_STARTUP`** (optional): Set to `true` to run immediately on container start (useful for testing)

     

       196
       196
       +
       

     

       197
       197
       +
       #### Testing the Setup

     

       198
       198
       +
       

     

       199
       199
       +
       Run the aggregator immediately without waiting for cron:

     

       200
       200
       +
       

     

       201
       201
       +
       ```bash

     

       202
       202
       +
       # Run once and exit

     

       203
       203
       +
       docker compose run --rm kagi-aggregator python -m src.main

     

       204
       204
       +
       

     

       205
       205
       +
       # Or set RUN_ON_STARTUP=true in .env and restart

     

       206
       206
       +
       docker compose restart

     

       207
       207
       +
       ```

     

       208
       208
       +
       

     

       209
       209
       +
       #### Production Deployment

     

       210
       210
       +
       

     

       211
       211
       +
       For production, consider:

     

       212
       212
       +
       

     

       213
       213
       +
       1. **Using Docker Secrets** for credentials:

     

       214
       214
       +
          ```yaml

     

       215
       215
       +
          secrets:

     

       216
       216
       +
            aggregator_credentials:

     

       217
       217
       +
              file: ./secrets/aggregator.env

     

       218
       218
       +
          ```

     

       219
       219
       +
       

     

       220
       220
       +
       2. **Setting up log rotation** (already configured in docker-compose.yml):

     

       221
       221
       +
          - Max size: 10MB per file

     

       222
       222
       +
          - Max files: 3

     

       223
       223
       +
       

     

       224
       224
       +
       3. **Monitoring health checks:**

     

       225
       225
       +
          ```bash

     

       226
       226
       +
          docker inspect --format='{{.State.Health.Status}}' kagi-news-aggregator

     

       227
       227
       +
          ```

     

       228
       228
       +
       

     

       229
       229
       +
       4. **Auto-restart on failure** (already enabled with `restart: unless-stopped`)

     

       230
       230
       +
       

     

       231
       231
       +
       #### Viewing Cron Logs

     

       232
       232
       +
       

     

       233
       233
       +
       ```bash

     

       234
       234
       +
       # Follow cron execution logs

     

       235
       235
       +
       docker compose logs -f kagi-aggregator

     

       236
       236
       +
       

     

       237
       237
       +
       # View last 100 lines

     

       238
       238
       +
       docker compose logs --tail=100 kagi-aggregator

     

       239
       239
       +
       ```

     

       240
       240
       +
       

     

       241
       241
       +
       #### Updating the Aggregator

     

       242
       242
       +
       

     

       243
       243
       +
       ```bash

     

       244
       244
       +
       # Pull latest code

     

       245
       245
       +
       git pull

     

       246
       246
       +
       

     

       247
       247
       +
       # Rebuild and restart

     

       248
       248
       +
       docker compose up -d --build

     

       249
       249
       +
       ```

     

       250
       250
       +
       

     

       251
       251
       +
       ### Manual Deployment (Alternative)

     

       252
       252
       +
       

     

       253
       253
       +
       If you prefer running without Docker, use the traditional approach:

     

       254
       254
       +
       

     

       255
       255
       +
       1. **Install dependencies:**

     

       256
       256
       +
          ```bash

     

       257
       257
       +
          python3 -m venv venv

     

       258
       258
       +
          source venv/bin/activate

     

       259
       259
       +
          pip install -r requirements.txt

     

       260
       260
       +
          ```

     

       261
       261
       +
       

     

       262
       262
       +
       2. **Configure crontab:**

     

       263
       263
       +
          ```bash

     

       264
       264
       +
          # Edit the crontab file with your paths

     

       265
       265
       +
          # Then install it:

     

       266
       266
       +
          crontab crontab

     

       267
       267
       +
          ```

     

       268
       268
       +
       

     

       269
       269
       +
       3. **Verify cron is running:**

     

       270
       270
       +
          ```bash

     

       271
       271
       +
          crontab -l

     

       272
       272
       +
          ```

     

       273
       273
       +
       

     

       87
       274
        
       ## Development Status

     

       88
       275
        
       

     

       89
       276
        
       ### ✅ Phase 1-2 Complete (Oct 24, 2025)

+195

aggregators/kagi-news/scripts/setup.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: setup-kagi-aggregator.sh

     

       4
       4
       +
       # Purpose: Complete setup script for Kagi News RSS aggregator

     

       5
       5
       +
       #

     

       6
       6
       +
       # This is a reference implementation showing automated setup for a specific aggregator.

     

       7
       7
       +
       # Other aggregator developers can use this as a template.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Kagi News RSS Aggregator - Automated Setup"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Configuration for Kagi aggregator

     

       17
       17
       +
       AGGREGATOR_NAME="kagi-news-bot"

     

       18
       18
       +
       DISPLAY_NAME="Kagi News RSS"

     

       19
       19
       +
       DESCRIPTION="Aggregates tech news from Kagi RSS feeds and posts to relevant communities"

     

       20
       20
       +
       SOURCE_URL="https://github.com/coves-social/kagi-aggregator"

     

       21
       21
       +
       

     

       22
       22
       +
       # Check if config already exists

     

       23
       23
       +
       if [ -f "kagi-aggregator-config.env" ]; then

     

       24
       24
       +
           echo "Configuration file already exists. Loading existing configuration..."

     

       25
       25
       +
           source kagi-aggregator-config.env

     

       26
       26
       +
           SKIP_ACCOUNT_CREATION=true

     

       27
       27
       +
       else

     

       28
       28
       +
           SKIP_ACCOUNT_CREATION=false

     

       29
       29
       +
       fi

     

       30
       30
       +
       

     

       31
       31
       +
       # Get runtime configuration

     

       32
       32
       +
       if [ "$SKIP_ACCOUNT_CREATION" = false ]; then

     

       33
       33
       +
           read -p "Enter PDS URL (default: https://bsky.social): " PDS_URL

     

       34
       34
       +
           PDS_URL=${PDS_URL:-https://bsky.social}

     

       35
       35
       +
       

     

       36
       36
       +
           read -p "Enter email for bot account: " EMAIL

     

       37
       37
       +
           read -sp "Enter password for bot account: " PASSWORD

     

       38
       38
       +
           echo ""

     

       39
       39
       +
       

     

       40
       40
       +
           # Generate handle

     

       41
       41
       +
           TIMESTAMP=$(date +%s)

     

       42
       42
       +
           HANDLE="$AGGREGATOR_NAME-$TIMESTAMP.bsky.social"

     

       43
       43
       +
       

     

       44
       44
       +
           echo ""

     

       45
       45
       +
           echo "Creating PDS account..."

     

       46
       46
       +
           echo "Handle: $HANDLE"

     

       47
       47
       +
       

     

       48
       48
       +
           # Create account

     

       49
       49
       +
           RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.server.createAccount" \

     

       50
       50
       +
               -H "Content-Type: application/json" \

     

       51
       51
       +
               -d "{

     

       52
       52
       +
                   \"handle\": \"$HANDLE\",

     

       53
       53
       +
                   \"email\": \"$EMAIL\",

     

       54
       54
       +
                   \"password\": \"$PASSWORD\"

     

       55
       55
       +
               }")

     

       56
       56
       +
       

     

       57
       57
       +
           if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       58
       58
       +
               echo "✗ Error creating account:"

     

       59
       59
       +
               echo "$RESPONSE" | jq '.'

     

       60
       60
       +
               exit 1

     

       61
       61
       +
           fi

     

       62
       62
       +
       

     

       63
       63
       +
           DID=$(echo "$RESPONSE" | jq -r '.did')

     

       64
       64
       +
           ACCESS_JWT=$(echo "$RESPONSE" | jq -r '.accessJwt')

     

       65
       65
       +
           REFRESH_JWT=$(echo "$RESPONSE" | jq -r '.refreshJwt')

     

       66
       66
       +
       

     

       67
       67
       +
           echo "✓ Account created: $DID"

     

       68
       68
       +
       

     

       69
       69
       +
           # Save configuration

     

       70
       70
       +
           cat > kagi-aggregator-config.env <<EOF

     

       71
       71
       +
       # Kagi Aggregator Configuration

     

       72
       72
       +
       AGGREGATOR_DID="$DID"

     

       73
       73
       +
       AGGREGATOR_HANDLE="$HANDLE"

     

       74
       74
       +
       AGGREGATOR_PDS_URL="$PDS_URL"

     

       75
       75
       +
       AGGREGATOR_EMAIL="$EMAIL"

     

       76
       76
       +
       AGGREGATOR_PASSWORD="$PASSWORD"

     

       77
       77
       +
       AGGREGATOR_ACCESS_JWT="$ACCESS_JWT"

     

       78
       78
       +
       AGGREGATOR_REFRESH_JWT="$REFRESH_JWT"

     

       79
       79
       +
       EOF

     

       80
       80
       +
       

     

       81
       81
       +
           echo "✓ Configuration saved to kagi-aggregator-config.env"

     

       82
       82
       +
       fi

     

       83
       83
       +
       

     

       84
       84
       +
       # Get domain and Coves instance

     

       85
       85
       +
       read -p "Enter aggregator domain (e.g., kagi-news.example.com): " DOMAIN

     

       86
       86
       +
       read -p "Enter Coves instance URL (default: https://api.coves.social): " COVES_URL

     

       87
       87
       +
       COVES_URL=${COVES_URL:-https://api.coves.social}

     

       88
       88
       +
       

     

       89
       89
       +
       # Setup .well-known

     

       90
       90
       +
       echo ""

     

       91
       91
       +
       echo "Setting up .well-known/atproto-did..."

     

       92
       92
       +
       mkdir -p .well-known

     

       93
       93
       +
       echo "$DID" > .well-known/atproto-did

     

       94
       94
       +
       echo "✓ Created .well-known/atproto-did"

     

       95
       95
       +
       

     

       96
       96
       +
       echo ""

     

       97
       97
       +
       echo "================================================"

     

       98
       98
       +
       echo "IMPORTANT: Manual Step Required"

     

       99
       99
       +
       echo "================================================"

     

       100
       100
       +
       echo ""

     

       101
       101
       +
       echo "Upload the .well-known directory to your web server at:"

     

       102
       102
       +
       echo "  https://$DOMAIN/.well-known/atproto-did"

     

       103
       103
       +
       echo ""

     

       104
       104
       +
       read -p "Press Enter when the file is uploaded and accessible..."

     

       105
       105
       +
       

     

       106
       106
       +
       # Verify .well-known

     

       107
       107
       +
       echo ""

     

       108
       108
       +
       echo "Verifying .well-known/atproto-did..."

     

       109
       109
       +
       WELLKNOWN_CONTENT=$(curl -s "https://$DOMAIN/.well-known/atproto-did" || echo "ERROR")

     

       110
       110
       +
       

     

       111
       111
       +
       if [ "$WELLKNOWN_CONTENT" != "$DID" ]; then

     

       112
       112
       +
           echo "✗ Error: .well-known/atproto-did not accessible or contains wrong DID"

     

       113
       113
       +
           echo "  Expected: $DID"

     

       114
       114
       +
           echo "  Got:      $WELLKNOWN_CONTENT"

     

       115
       115
       +
           exit 1

     

       116
       116
       +
       fi

     

       117
       117
       +
       

     

       118
       118
       +
       echo "✓ .well-known/atproto-did verified"

     

       119
       119
       +
       

     

       120
       120
       +
       # Register with Coves

     

       121
       121
       +
       echo ""

     

       122
       122
       +
       echo "Registering with Coves instance..."

     

       123
       123
       +
       RESPONSE=$(curl -s -X POST "$COVES_URL/xrpc/social.coves.aggregator.register" \

     

       124
       124
       +
           -H "Content-Type: application/json" \

     

       125
       125
       +
           -d "{

     

       126
       126
       +
               \"did\": \"$DID\",

     

       127
       127
       +
               \"domain\": \"$DOMAIN\"

     

       128
       128
       +
           }")

     

       129
       129
       +
       

     

       130
       130
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       131
       131
       +
           echo "✗ Registration failed:"

     

       132
       132
       +
           echo "$RESPONSE" | jq '.'

     

       133
       133
       +
           exit 1

     

       134
       134
       +
       fi

     

       135
       135
       +
       

     

       136
       136
       +
       echo "✓ Registered with Coves"

     

       137
       137
       +
       

     

       138
       138
       +
       # Create service declaration

     

       139
       139
       +
       echo ""

     

       140
       140
       +
       echo "Creating service declaration..."

     

       141
       141
       +
       SERVICE_RECORD=$(cat <<EOF

     

       142
       142
       +
       {

     

       143
       143
       +
           "\$type": "social.coves.aggregator.service",

     

       144
       144
       +
           "did": "$DID",

     

       145
       145
       +
           "displayName": "$DISPLAY_NAME",

     

       146
       146
       +
           "description": "$DESCRIPTION",

     

       147
       147
       +
           "sourceUrl": "$SOURCE_URL",

     

       148
       148
       +
           "createdAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"

     

       149
       149
       +
       }

     

       150
       150
       +
       EOF

     

       151
       151
       +
       )

     

       152
       152
       +
       

     

       153
       153
       +
       RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.repo.createRecord" \

     

       154
       154
       +
           -H "Authorization: Bearer $ACCESS_JWT" \

     

       155
       155
       +
           -H "Content-Type: application/json" \

     

       156
       156
       +
           -d "{

     

       157
       157
       +
               \"repo\": \"$DID\",

     

       158
       158
       +
               \"collection\": \"social.coves.aggregator.service\",

     

       159
       159
       +
               \"rkey\": \"self\",

     

       160
       160
       +
               \"record\": $SERVICE_RECORD

     

       161
       161
       +
           }")

     

       162
       162
       +
       

     

       163
       163
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       164
       164
       +
           echo "✗ Failed to create service declaration:"

     

       165
       165
       +
           echo "$RESPONSE" | jq '.'

     

       166
       166
       +
           exit 1

     

       167
       167
       +
       fi

     

       168
       168
       +
       

     

       169
       169
       +
       RECORD_URI=$(echo "$RESPONSE" | jq -r '.uri')

     

       170
       170
       +
       echo "✓ Service declaration created: $RECORD_URI"

     

       171
       171
       +
       

     

       172
       172
       +
       # Save final configuration

     

       173
       173
       +
       cat >> kagi-aggregator-config.env <<EOF

     

       174
       174
       +
       

     

       175
       175
       +
       # Setup completed on $(date)

     

       176
       176
       +
       AGGREGATOR_DOMAIN="$DOMAIN"

     

       177
       177
       +
       COVES_INSTANCE_URL="$COVES_URL"

     

       178
       178
       +
       SERVICE_DECLARATION_URI="$RECORD_URI"

     

       179
       179
       +
       EOF

     

       180
       180
       +
       

     

       181
       181
       +
       echo ""

     

       182
       182
       +
       echo "================================================"

     

       183
       183
       +
       echo "✓ Kagi Aggregator Setup Complete!"

     

       184
       184
       +
       echo "================================================"

     

       185
       185
       +
       echo ""

     

       186
       186
       +
       echo "Configuration saved to: kagi-aggregator-config.env"

     

       187
       187
       +
       echo ""

     

       188
       188
       +
       echo "Your aggregator is now registered and ready to use."

     

       189
       189
       +
       echo ""

     

       190
       190
       +
       echo "Next steps:"

     

       191
       191
       +
       echo "1. Start your aggregator bot: npm start (or appropriate command)"

     

       192
       192
       +
       echo "2. Community moderators can authorize your aggregator"

     

       193
       193
       +
       echo "3. Once authorized, your bot can start posting"

     

       194
       194
       +
       echo ""

     

       195
       195
       +
       echo "See docs/aggregators/SETUP_GUIDE.md for more information"

+55

aggregators/kagi-news/.dockerignore

···

       1
       1
       +
       # Git

     

       2
       2
       +
       .git

     

       3
       3
       +
       .gitignore

     

       4
       4
       +
       

     

       5
       5
       +
       # Python

     

       6
       6
       +
       __pycache__

     

       7
       7
       +
       *.py[cod]

     

       8
       8
       +
       *$py.class

     

       9
       9
       +
       *.so

     

       10
       10
       +
       .Python

     

       11
       11
       +
       venv/

     

       12
       12
       +
       *.egg-info

     

       13
       13
       +
       dist/

     

       14
       14
       +
       build/

     

       15
       15
       +
       

     

       16
       16
       +
       # Testing

     

       17
       17
       +
       .pytest_cache/

     

       18
       18
       +
       .coverage

     

       19
       19
       +
       htmlcov/

     

       20
       20
       +
       .tox/

     

       21
       21
       +
       .hypothesis/

     

       22
       22
       +
       

     

       23
       23
       +
       # IDE

     

       24
       24
       +
       .vscode/

     

       25
       25
       +
       .idea/

     

       26
       26
       +
       *.swp

     

       27
       27
       +
       *.swo

     

       28
       28
       +
       *~

     

       29
       29
       +
       

     

       30
       30
       +
       # Environment

     

       31
       31
       +
       .env.local

     

       32
       32
       +
       .env.*.local

     

       33
       33
       +
       

     

       34
       34
       +
       # Data and logs

     

       35
       35
       +
       data/

     

       36
       36
       +
       *.log

     

       37
       37
       +
       

     

       38
       38
       +
       # Documentation

     

       39
       39
       +
       README.md

     

       40
       40
       +
       docs/

     

       41
       41
       +
       

     

       42
       42
       +
       # Docker

     

       43
       43
       +
       Dockerfile

     

       44
       44
       +
       docker-compose.yml

     

       45
       45
       +
       .dockerignore

     

       46
       46
       +
       

     

       47
       47
       +
       # Development

     

       48
       48
       +
       tests/

     

       49
       49
       +
       pytest.ini

     

       50
       50
       +
       mypy.ini

     

       51
       51
       +
       .mypy_cache/

     

       52
       52
       +
       

     

       53
       53
       +
       # OS

     

       54
       54
       +
       .DS_Store

     

       55
       55
       +
       Thumbs.db

+53

aggregators/kagi-news/Dockerfile

···

       1
       1
       +
       # Kagi News RSS Aggregator

     

       2
       2
       +
       # Production-ready Docker image with cron scheduler

     

       3
       3
       +
       

     

       4
       4
       +
       FROM python:3.11-slim

     

       5
       5
       +
       

     

       6
       6
       +
       # Install cron and other utilities

     

       7
       7
       +
       RUN apt-get update && apt-get install -y \

     

       8
       8
       +
           cron \

     

       9
       9
       +
           curl \

     

       10
       10
       +
           procps \

     

       11
       11
       +
           && rm -rf /var/lib/apt/lists/*

     

       12
       12
       +
       

     

       13
       13
       +
       # Set working directory

     

       14
       14
       +
       WORKDIR /app

     

       15
       15
       +
       

     

       16
       16
       +
       # Copy requirements first for better caching

     

       17
       17
       +
       COPY requirements.txt .

     

       18
       18
       +
       

     

       19
       19
       +
       # Install Python dependencies (exclude dev/test deps in production)

     

       20
       20
       +
       RUN pip install --no-cache-dir \

     

       21
       21
       +
           feedparser==6.0.11 \

     

       22
       22
       +
           beautifulsoup4==4.12.3 \

     

       23
       23
       +
           requests==2.31.0 \

     

       24
       24
       +
           atproto==0.0.55 \

     

       25
       25
       +
           pyyaml==6.0.1

     

       26
       26
       +
       

     

       27
       27
       +
       # Copy application code

     

       28
       28
       +
       COPY src/ ./src/

     

       29
       29
       +
       COPY config.yaml ./

     

       30
       30
       +
       

     

       31
       31
       +
       # Copy crontab file

     

       32
       32
       +
       COPY crontab /etc/cron.d/kagi-aggregator

     

       33
       33
       +
       

     

       34
       34
       +
       # Give execution rights on the cron job and apply it

     

       35
       35
       +
       RUN chmod 0644 /etc/cron.d/kagi-aggregator && \

     

       36
       36
       +
           crontab /etc/cron.d/kagi-aggregator

     

       37
       37
       +
       

     

       38
       38
       +
       # Create log file to be able to run tail

     

       39
       39
       +
       RUN touch /var/log/cron.log

     

       40
       40
       +
       

     

       41
       41
       +
       # Copy entrypoint script

     

       42
       42
       +
       COPY docker-entrypoint.sh /usr/local/bin/

     

       43
       43
       +
       RUN chmod +x /usr/local/bin/docker-entrypoint.sh

     

       44
       44
       +
       

     

       45
       45
       +
       # Health check - verify cron is running

     

       46
       46
       +
       HEALTHCHECK --interval=60s --timeout=10s --start-period=10s --retries=3 \

     

       47
       47
       +
           CMD pgrep cron || exit 1

     

       48
       48
       +
       

     

       49
       49
       +
       # Run the entrypoint script

     

       50
       50
       +
       ENTRYPOINT ["docker-entrypoint.sh"]

     

       51
       51
       +
       

     

       52
       52
       +
       # Default command: tail the cron log

     

       53
       53
       +
       CMD ["tail", "-f", "/var/log/cron.log"]

+48

aggregators/kagi-news/docker-compose.yml

···

       1
       1
       +
       services:

     

       2
       2
       +
         kagi-aggregator:

     

       3
       3
       +
           build:

     

       4
       4
       +
             context: .

     

       5
       5
       +
             dockerfile: Dockerfile

     

       6
       6
       +
           container_name: kagi-news-aggregator

     

       7
       7
       +
           restart: unless-stopped

     

       8
       8
       +
       

     

       9
       9
       +
           # Environment variables - override in .env file or here

     

       10
       10
       +
           environment:

     

       11
       11
       +
             # Required: Aggregator credentials

     

       12
       12
       +
             - AGGREGATOR_HANDLE=${AGGREGATOR_HANDLE}

     

       13
       13
       +
             - AGGREGATOR_PASSWORD=${AGGREGATOR_PASSWORD}

     

       14
       14
       +
       

     

       15
       15
       +
             # Optional: Override Coves API URL

     

       16
       16
       +
             - COVES_API_URL=${COVES_API_URL:-https://api.coves.social}

     

       17
       17
       +
       

     

       18
       18
       +
             # Optional: Run immediately on startup (useful for testing)

     

       19
       19
       +
             - RUN_ON_STARTUP=${RUN_ON_STARTUP:-false}

     

       20
       20
       +
       

     

       21
       21
       +
           # Mount config file if you want to modify it without rebuilding

     

       22
       22
       +
           volumes:

     

       23
       23
       +
             - ./config.yaml:/app/config.yaml:ro

     

       24
       24
       +
             - ./data:/app/data  # For state persistence (if implemented)

     

       25
       25
       +
       

     

       26
       26
       +
           # Use env_file to load credentials from .env

     

       27
       27
       +
           env_file:

     

       28
       28
       +
             - .env

     

       29
       29
       +
       

     

       30
       30
       +
           # Logging configuration

     

       31
       31
       +
           logging:

     

       32
       32
       +
             driver: "json-file"

     

       33
       33
       +
             options:

     

       34
       34
       +
               max-size: "10m"

     

       35
       35
       +
               max-file: "3"

     

       36
       36
       +
       

     

       37
       37
       +
           # Health check

     

       38
       38
       +
           healthcheck:

     

       39
       39
       +
             test: ["CMD", "pgrep", "cron"]

     

       40
       40
       +
             interval: 60s

     

       41
       41
       +
             timeout: 10s

     

       42
       42
       +
             retries: 3

     

       43
       43
       +
             start_period: 10s

     

       44
       44
       +
       

     

       45
       45
       +
       # Optional: Networks for multi-container setups

     

       46
       46
       +
       # networks:

     

       47
       47
       +
       #   coves:

     

       48
       48
       +
       #     external: true

+41

aggregators/kagi-news/docker-entrypoint.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       set -e

     

       3
       3
       +
       

     

       4
       4
       +
       echo "Starting Kagi News RSS Aggregator..."

     

       5
       5
       +
       echo "========================================="

     

       6
       6
       +
       

     

       7
       7
       +
       # Load environment variables if .env file exists

     

       8
       8
       +
       if [ -f /app/.env ]; then

     

       9
       9
       +
           echo "Loading environment variables from .env"

     

       10
       10
       +
           export $(grep -v '^#' /app/.env | xargs)

     

       11
       11
       +
       fi

     

       12
       12
       +
       

     

       13
       13
       +
       # Validate required environment variables

     

       14
       14
       +
       if [ -z "$AGGREGATOR_HANDLE" ] || [ -z "$AGGREGATOR_PASSWORD" ]; then

     

       15
       15
       +
           echo "ERROR: Missing required environment variables!"

     

       16
       16
       +
           echo "Please set AGGREGATOR_HANDLE and AGGREGATOR_PASSWORD"

     

       17
       17
       +
           exit 1

     

       18
       18
       +
       fi

     

       19
       19
       +
       

     

       20
       20
       +
       echo "Aggregator Handle: $AGGREGATOR_HANDLE"

     

       21
       21
       +
       echo "Cron schedule loaded from /etc/cron.d/kagi-aggregator"

     

       22
       22
       +
       

     

       23
       23
       +
       # Start cron in the background

     

       24
       24
       +
       echo "Starting cron daemon..."

     

       25
       25
       +
       cron

     

       26
       26
       +
       

     

       27
       27
       +
       # Optional: Run aggregator immediately on startup (for testing)

     

       28
       28
       +
       if [ "$RUN_ON_STARTUP" = "true" ]; then

     

       29
       29
       +
           echo "Running aggregator immediately (RUN_ON_STARTUP=true)..."

     

       30
       30
       +
           cd /app && python -m src.main

     

       31
       31
       +
       fi

     

       32
       32
       +
       

     

       33
       33
       +
       echo "========================================="

     

       34
       34
       +
       echo "Kagi News Aggregator is running!"

     

       35
       35
       +
       echo "Cron schedule: Daily at 1 PM UTC"

     

       36
       36
       +
       echo "Logs will appear below:"

     

       37
       37
       +
       echo "========================================="

     

       38
       38
       +
       echo ""

     

       39
       39
       +
       

     

       40
       40
       +
       # Execute the command passed to docker run (defaults to tail -f /var/log/cron.log)

     

       41
       41
       +
       exec "$@"

+20

.beads/.gitignore

···

       1
       1
       +
       # SQLite databases

     

       2
       2
       +
       *.db

     

       3
       3
       +
       *.db-journal

     

       4
       4
       +
       *.db-wal

     

       5
       5
       +
       *.db-shm

     

       6
       6
       +
       

     

       7
       7
       +
       # Daemon runtime files

     

       8
       8
       +
       daemon.lock

     

       9
       9
       +
       daemon.log

     

       10
       10
       +
       daemon.pid

     

       11
       11
       +
       bd.sock

     

       12
       12
       +
       

     

       13
       13
       +
       # Legacy database files

     

       14
       14
       +
       db.sqlite

     

       15
       15
       +
       bd.db

     

       16
       16
       +
       

     

       17
       17
       +
       # Keep JSONL exports and config (source of truth for git)

     

       18
       18
       +
       !*.jsonl

     

       19
       19
       +
       !metadata.json

     

       20
       20
       +
       !config.json

+56

.beads/config.yaml

···

       1
       1
       +
       # Beads Configuration File

     

       2
       2
       +
       # This file configures default behavior for all bd commands in this repository

     

       3
       3
       +
       # All settings can also be set via environment variables (BD_* prefix)

     

       4
       4
       +
       # or overridden with command-line flags

     

       5
       5
       +
       

     

       6
       6
       +
       # Issue prefix for this repository (used by bd init)

     

       7
       7
       +
       # If not set, bd init will auto-detect from directory name

     

       8
       8
       +
       # Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.

     

       9
       9
       +
       # issue-prefix: ""

     

       10
       10
       +
       

     

       11
       11
       +
       # Use no-db mode: load from JSONL, no SQLite, write back after each command

     

       12
       12
       +
       # When true, bd will use .beads/issues.jsonl as the source of truth

     

       13
       13
       +
       # instead of SQLite database

     

       14
       14
       +
       # no-db: false

     

       15
       15
       +
       

     

       16
       16
       +
       # Disable daemon for RPC communication (forces direct database access)

     

       17
       17
       +
       # no-daemon: false

     

       18
       18
       +
       

     

       19
       19
       +
       # Disable auto-flush of database to JSONL after mutations

     

       20
       20
       +
       # no-auto-flush: false

     

       21
       21
       +
       

     

       22
       22
       +
       # Disable auto-import from JSONL when it's newer than database

     

       23
       23
       +
       # no-auto-import: false

     

       24
       24
       +
       

     

       25
       25
       +
       # Enable JSON output by default

     

       26
       26
       +
       # json: false

     

       27
       27
       +
       

     

       28
       28
       +
       # Default actor for audit trails (overridden by BD_ACTOR or --actor)

     

       29
       29
       +
       # actor: ""

     

       30
       30
       +
       

     

       31
       31
       +
       # Path to database (overridden by BEADS_DB or --db)

     

       32
       32
       +
       # db: ""

     

       33
       33
       +
       

     

       34
       34
       +
       # Auto-start daemon if not running (can also use BEADS_AUTO_START_DAEMON)

     

       35
       35
       +
       # auto-start-daemon: true

     

       36
       36
       +
       

     

       37
       37
       +
       # Debounce interval for auto-flush (can also use BEADS_FLUSH_DEBOUNCE)

     

       38
       38
       +
       # flush-debounce: "5s"

     

       39
       39
       +
       

     

       40
       40
       +
       # Multi-repo configuration (experimental - bd-307)

     

       41
       41
       +
       # Allows hydrating from multiple repositories and routing writes to the correct JSONL

     

       42
       42
       +
       # repos:

     

       43
       43
       +
       #   primary: "."  # Primary repo (where this database lives)

     

       44
       44
       +
       #   additional:   # Additional repos to hydrate from (read-only)

     

       45
       45
       +
       #     - ~/beads-planning  # Personal planning repo

     

       46
       46
       +
       #     - ~/work-planning   # Work planning repo

     

       47
       47
       +
       

     

       48
       48
       +
       # Integration settings (access with 'bd config get/set')

     

       49
       49
       +
       # These are stored in the database, not in this file:

     

       50
       50
       +
       # - jira.url

     

       51
       51
       +
       # - jira.project

     

       52
       52
       +
       # - linear.url

     

       53
       53
       +
       # - linear.api-key

     

       54
       54
       +
       # - github.org

     

       55
       55
       +
       # - github.repo

     

       56
       56
       +
       # - sync.branch - Git branch for beads commits (use BEADS_SYNC_BRANCH env var or bd config set)

+4

.beads/metadata.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "database": "beads.db",

     

       3
       3
       +
         "jsonl_export": "beads.jsonl"

     

       4
       4
       +
       }

+3

.gitattributes

···

       1
       1
       +
       

     

       2
       2
       +
       # Use bd merge for beads JSONL files

     

       3
       3
       +
       .beads/beads.jsonl merge=beads

+131

AGENTS.md

···

       1
       1
       +
       # AI Agent Guidelines for Coves

     

       2
       2
       +
       

     

       3
       3
       +
       ## Issue Tracking with bd (beads)

     

       4
       4
       +
       

     

       5
       5
       +
       **IMPORTANT**: This project uses **bd (beads)** for ALL issue tracking. Do NOT use markdown TODOs, task lists, or other tracking methods.

     

       6
       6
       +
       

     

       7
       7
       +
       ### Why bd?

     

       8
       8
       +
       

     

       9
       9
       +
       - Dependency-aware: Track blockers and relationships between issues

     

       10
       10
       +
       - Git-friendly: Auto-syncs to JSONL for version control

     

       11
       11
       +
       - Agent-optimized: JSON output, ready work detection, discovered-from links

     

       12
       12
       +
       - Prevents duplicate tracking systems and confusion

     

       13
       13
       +
       

     

       14
       14
       +
       ### Quick Start

     

       15
       15
       +
       

     

       16
       16
       +
       **Check for ready work:**

     

       17
       17
       +
       ```bash

     

       18
       18
       +
       bd ready --json

     

       19
       19
       +
       ```

     

       20
       20
       +
       

     

       21
       21
       +
       **Create new issues:**

     

       22
       22
       +
       ```bash

     

       23
       23
       +
       bd create "Issue title" -t bug|feature|task -p 0-4 --json

     

       24
       24
       +
       bd create "Issue title" -p 1 --deps discovered-from:bd-123 --json

     

       25
       25
       +
       ```

     

       26
       26
       +
       

     

       27
       27
       +
       **Claim and update:**

     

       28
       28
       +
       ```bash

     

       29
       29
       +
       bd update bd-42 --status in_progress --json

     

       30
       30
       +
       bd update bd-42 --priority 1 --json

     

       31
       31
       +
       ```

     

       32
       32
       +
       

     

       33
       33
       +
       **Complete work:**

     

       34
       34
       +
       ```bash

     

       35
       35
       +
       bd close bd-42 --reason "Completed" --json

     

       36
       36
       +
       ```

     

       37
       37
       +
       

     

       38
       38
       +
       ### Issue Types

     

       39
       39
       +
       

     

       40
       40
       +
       - `bug` - Something broken

     

       41
       41
       +
       - `feature` - New functionality

     

       42
       42
       +
       - `task` - Work item (tests, docs, refactoring)

     

       43
       43
       +
       - `epic` - Large feature with subtasks

     

       44
       44
       +
       - `chore` - Maintenance (dependencies, tooling)

     

       45
       45
       +
       

     

       46
       46
       +
       ### Priorities

     

       47
       47
       +
       

     

       48
       48
       +
       - `0` - Critical (security, data loss, broken builds)

     

       49
       49
       +
       - `1` - High (major features, important bugs)

     

       50
       50
       +
       - `2` - Medium (default, nice-to-have)

     

       51
       51
       +
       - `3` - Low (polish, optimization)

     

       52
       52
       +
       - `4` - Backlog (future ideas)

     

       53
       53
       +
       

     

       54
       54
       +
       ### Workflow for AI Agents

     

       55
       55
       +
       

     

       56
       56
       +
       1. **Check ready work**: `bd ready` shows unblocked issues

     

       57
       57
       +
       2. **Claim your task**: `bd update <id> --status in_progress`

     

       58
       58
       +
       3. **Work on it**: Implement, test, document

     

       59
       59
       +
       4. **Discover new work?** Create linked issue:

     

       60
       60
       +
          - `bd create "Found bug" -p 1 --deps discovered-from:<parent-id>`

     

       61
       61
       +
       5. **Complete**: `bd close <id> --reason "Done"`

     

       62
       62
       +
       6. **Commit together**: Always commit the `.beads/issues.jsonl` file together with the code changes so issue state stays in sync with code state

     

       63
       63
       +
       

     

       64
       64
       +
       ### Auto-Sync

     

       65
       65
       +
       

     

       66
       66
       +
       bd automatically syncs with git:

     

       67
       67
       +
       - Exports to `.beads/issues.jsonl` after changes (5s debounce)

     

       68
       68
       +
       - Imports from JSONL when newer (e.g., after `git pull`)

     

       69
       69
       +
       - No manual export/import needed!

     

       70
       70
       +
       

     

       71
       71
       +
       ### MCP Server (Recommended)

     

       72
       72
       +
       

     

       73
       73
       +
       If using Claude or MCP-compatible clients, install the beads MCP server:

     

       74
       74
       +
       

     

       75
       75
       +
       ```bash

     

       76
       76
       +
       pip install beads-mcp

     

       77
       77
       +
       ```

     

       78
       78
       +
       

     

       79
       79
       +
       Add to MCP config (e.g., `~/.config/claude/config.json`):

     

       80
       80
       +
       ```json

     

       81
       81
       +
       {

     

       82
       82
       +
         "beads": {

     

       83
       83
       +
           "command": "beads-mcp",

     

       84
       84
       +
           "args": []

     

       85
       85
       +
         }

     

       86
       86
       +
       }

     

       87
       87
       +
       ```

     

       88
       88
       +
       

     

       89
       89
       +
       Then use `mcp__beads__*` functions instead of CLI commands.

     

       90
       90
       +
       

     

       91
       91
       +
       ### Managing AI-Generated Planning Documents

     

       92
       92
       +
       

     

       93
       93
       +
       AI assistants often create planning and design documents during development:

     

       94
       94
       +
       - PLAN.md, IMPLEMENTATION.md, ARCHITECTURE.md

     

       95
       95
       +
       - DESIGN.md, CODEBASE_SUMMARY.md, INTEGRATION_PLAN.md

     

       96
       96
       +
       - TESTING_GUIDE.md, TECHNICAL_DESIGN.md, and similar files

     

       97
       97
       +
       

     

       98
       98
       +
       **Best Practice: Use a dedicated directory for these ephemeral files**

     

       99
       99
       +
       

     

       100
       100
       +
       **Recommended approach:**

     

       101
       101
       +
       - Create a `history/` directory in the project root

     

       102
       102
       +
       - Store ALL AI-generated planning/design docs in `history/`

     

       103
       103
       +
       - Keep the repository root clean and focused on permanent project files

     

       104
       104
       +
       - Only access `history/` when explicitly asked to review past planning

     

       105
       105
       +
       

     

       106
       106
       +
       **Example .gitignore entry (optional):**

     

       107
       107
       +
       ```

     

       108
       108
       +
       # AI planning documents (ephemeral)

     

       109
       109
       +
       history/

     

       110
       110
       +
       ```

     

       111
       111
       +
       

     

       112
       112
       +
       **Benefits:**

     

       113
       113
       +
       - ✅ Clean repository root

     

       114
       114
       +
       - ✅ Clear separation between ephemeral and permanent documentation

     

       115
       115
       +
       - ✅ Easy to exclude from version control if desired

     

       116
       116
       +
       - ✅ Preserves planning history for archeological research

     

       117
       117
       +
       - ✅ Reduces noise when browsing the project

     

       118
       118
       +
       

     

       119
       119
       +
       ### Important Rules

     

       120
       120
       +
       

     

       121
       121
       +
       - ✅ Use bd for ALL task tracking

     

       122
       122
       +
       - ✅ Always use `--json` flag for programmatic use

     

       123
       123
       +
       - ✅ Link discovered work with `discovered-from` dependencies

     

       124
       124
       +
       - ✅ Check `bd ready` before asking "what should I work on?"

     

       125
       125
       +
       - ✅ Store AI planning docs in `history/` directory

     

       126
       126
       +
       - ❌ Do NOT create markdown TODO lists

     

       127
       127
       +
       - ❌ Do NOT use external issue trackers

     

       128
       128
       +
       - ❌ Do NOT duplicate tracking systems

     

       129
       129
       +
       - ❌ Do NOT clutter repo root with planning documents

     

       130
       130
       +
       

     

       131
       131
       +
       For more details, see the [beads repository](https://github.com/steveyegge/beads).

+5

internal/atproto/lexicon/social/coves/community/list.json

···

       18
       18
        
                   "type": "string",

     

       19
       19
        
                   "description": "Pagination cursor"

     

       20
       20
        
                 },

     

       21
       21
       +
                 "visibility": {

     

       22
       22
       +
                   "type": "string",

     

       23
       23
       +
                   "knownValues": ["public", "unlisted", "private"],

     

       24
       24
       +
                   "description": "Filter communities by visibility level"

     

       25
       25
       +
                 },

     

       21
       26
        
                 "sort": {

     

       22
       27
        
                   "type": "string",

     

       23
       28
        
                   "knownValues": ["popular", "active", "new", "alphabetical"],

+2 -2

internal/core/communities/interfaces.go

···

       16
       16
        
       	UpdateCredentials(ctx context.Context, did, accessToken, refreshToken string) error

     

       17
       17
        
       

     

       18
       18
        
       	// Listing & Search

     

       19
       19
       -
       	List(ctx context.Context, req ListCommunitiesRequest) ([]*Community, int, error) // Returns communities + total count

     

       19
       19
       +
       	List(ctx context.Context, req ListCommunitiesRequest) ([]*Community, error)

     

       20
       20
        
       	Search(ctx context.Context, req SearchCommunitiesRequest) ([]*Community, int, error)

     

       21
       21
        
       

     

       22
       22
        
       	// Subscriptions (lightweight feed follows)

     
···

       62
       62
        
       	CreateCommunity(ctx context.Context, req CreateCommunityRequest) (*Community, error)

     

       63
       63
        
       	GetCommunity(ctx context.Context, identifier string) (*Community, error) // identifier can be DID or handle

     

       64
       64
        
       	UpdateCommunity(ctx context.Context, req UpdateCommunityRequest) (*Community, error)

     

       65
       65
       -
       	ListCommunities(ctx context.Context, req ListCommunitiesRequest) ([]*Community, int, error)

     

       65
       65
       +
       	ListCommunities(ctx context.Context, req ListCommunitiesRequest) ([]*Community, error)

     

       66
       66
        
       	SearchCommunities(ctx context.Context, req SearchCommunitiesRequest) ([]*Community, int, error)

     

       67
       67
        
       

     

       68
       68
        
       	// Subscription operations (write-forward: creates record in user's PDS)

+57

scripts/backup.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Database Backup Script

     

       3
       3
       +
       # Usage: ./scripts/backup.sh

     

       4
       4
       +
       #

     

       5
       5
       +
       # Creates timestamped PostgreSQL backups in ./backups/

     

       6
       6
       +
       # Retention: Keeps last 30 days of backups

     

       7
       7
       +
       

     

       8
       8
       +
       set -e

     

       9
       9
       +
       

     

       10
       10
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       11
       11
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       12
       12
       +
       BACKUP_DIR="$PROJECT_DIR/backups"

     

       13
       13
       +
       COMPOSE_FILE="$PROJECT_DIR/docker-compose.prod.yml"

     

       14
       14
       +
       

     

       15
       15
       +
       # Load environment

     

       16
       16
       +
       set -a

     

       17
       17
       +
       source "$PROJECT_DIR/.env.prod"

     

       18
       18
       +
       set +a

     

       19
       19
       +
       

     

       20
       20
       +
       # Colors

     

       21
       21
       +
       GREEN='\033[0;32m'

     

       22
       22
       +
       YELLOW='\033[1;33m'

     

       23
       23
       +
       NC='\033[0m'

     

       24
       24
       +
       

     

       25
       25
       +
       log() { echo -e "${GREEN}[BACKUP]${NC} $1"; }

     

       26
       26
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       27
       27
       +
       

     

       28
       28
       +
       # Create backup directory

     

       29
       29
       +
       mkdir -p "$BACKUP_DIR"

     

       30
       30
       +
       

     

       31
       31
       +
       # Generate timestamp

     

       32
       32
       +
       TIMESTAMP=$(date +%Y%m%d_%H%M%S)

     

       33
       33
       +
       BACKUP_FILE="$BACKUP_DIR/coves_${TIMESTAMP}.sql.gz"

     

       34
       34
       +
       

     

       35
       35
       +
       log "Starting backup..."

     

       36
       36
       +
       

     

       37
       37
       +
       # Run pg_dump inside container

     

       38
       38
       +
       docker compose -f "$COMPOSE_FILE" exec -T postgres \

     

       39
       39
       +
           pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" --clean --if-exists \

     

       40
       40
       +
           | gzip > "$BACKUP_FILE"

     

       41
       41
       +
       

     

       42
       42
       +
       # Get file size

     

       43
       43
       +
       SIZE=$(du -h "$BACKUP_FILE" | cut -f1)

     

       44
       44
       +
       

     

       45
       45
       +
       log "✅ Backup complete: $BACKUP_FILE ($SIZE)"

     

       46
       46
       +
       

     

       47
       47
       +
       # Cleanup old backups (keep last 30 days)

     

       48
       48
       +
       log "Cleaning up backups older than 30 days..."

     

       49
       49
       +
       find "$BACKUP_DIR" -name "coves_*.sql.gz" -mtime +30 -delete

     

       50
       50
       +
       

     

       51
       51
       +
       # List recent backups

     

       52
       52
       +
       log ""

     

       53
       53
       +
       log "Recent backups:"

     

       54
       54
       +
       ls -lh "$BACKUP_DIR"/*.sql.gz 2>/dev/null | tail -5

     

       55
       55
       +
       

     

       56
       56
       +
       log ""

     

       57
       57
       +
       log "To restore: gunzip -c $BACKUP_FILE | docker compose -f docker-compose.prod.yml exec -T postgres psql -U $POSTGRES_USER -d $POSTGRES_DB"

+133

scripts/deploy.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Deployment Script

     

       3
       3
       +
       # Usage: ./scripts/deploy.sh [service]

     

       4
       4
       +
       #

     

       5
       5
       +
       # Examples:

     

       6
       6
       +
       #   ./scripts/deploy.sh           # Deploy all services

     

       7
       7
       +
       #   ./scripts/deploy.sh appview   # Deploy only AppView

     

       8
       8
       +
       #   ./scripts/deploy.sh --pull    # Pull from git first, then deploy

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       COMPOSE_FILE="$PROJECT_DIR/docker-compose.prod.yml"

     

       15
       15
       +
       

     

       16
       16
       +
       # Colors for output

     

       17
       17
       +
       RED='\033[0;31m'

     

       18
       18
       +
       GREEN='\033[0;32m'

     

       19
       19
       +
       YELLOW='\033[1;33m'

     

       20
       20
       +
       NC='\033[0m' # No Color

     

       21
       21
       +
       

     

       22
       22
       +
       log() {

     

       23
       23
       +
           echo -e "${GREEN}[DEPLOY]${NC} $1"

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       warn() {

     

       27
       27
       +
           echo -e "${YELLOW}[WARN]${NC} $1"

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       error() {

     

       31
       31
       +
           echo -e "${RED}[ERROR]${NC} $1"

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       # Parse arguments

     

       36
       36
       +
       PULL_GIT=false

     

       37
       37
       +
       SERVICE=""

     

       38
       38
       +
       

     

       39
       39
       +
       for arg in "$@"; do

     

       40
       40
       +
           case $arg in

     

       41
       41
       +
               --pull)

     

       42
       42
       +
                   PULL_GIT=true

     

       43
       43
       +
                   ;;

     

       44
       44
       +
               *)

     

       45
       45
       +
                   SERVICE="$arg"

     

       46
       46
       +
                   ;;

     

       47
       47
       +
           esac

     

       48
       48
       +
       done

     

       49
       49
       +
       

     

       50
       50
       +
       cd "$PROJECT_DIR"

     

       51
       51
       +
       

     

       52
       52
       +
       # Load environment variables

     

       53
       53
       +
       if [ ! -f ".env.prod" ]; then

     

       54
       54
       +
           error ".env.prod not found! Copy from .env.prod.example and configure secrets."

     

       55
       55
       +
       fi

     

       56
       56
       +
       

     

       57
       57
       +
       log "Loading environment from .env.prod..."

     

       58
       58
       +
       set -a

     

       59
       59
       +
       source .env.prod

     

       60
       60
       +
       set +a

     

       61
       61
       +
       

     

       62
       62
       +
       # Optional: Pull from git

     

       63
       63
       +
       if [ "$PULL_GIT" = true ]; then

     

       64
       64
       +
           log "Pulling latest code from git..."

     

       65
       65
       +
           git fetch origin

     

       66
       66
       +
           git pull origin main

     

       67
       67
       +
       fi

     

       68
       68
       +
       

     

       69
       69
       +
       # Check database connectivity before deployment

     

       70
       70
       +
       log "Checking database connectivity..."

     

       71
       71
       +
       if docker compose -f "$COMPOSE_FILE" exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; then

     

       72
       72
       +
           log "Database is ready"

     

       73
       73
       +
       else

     

       74
       74
       +
           warn "Database not ready yet - it will start with the deployment"

     

       75
       75
       +
       fi

     

       76
       76
       +
       

     

       77
       77
       +
       # Build and deploy

     

       78
       78
       +
       if [ -n "$SERVICE" ]; then

     

       79
       79
       +
           log "Building $SERVICE..."

     

       80
       80
       +
           docker compose -f "$COMPOSE_FILE" build --no-cache "$SERVICE"

     

       81
       81
       +
       

     

       82
       82
       +
           log "Deploying $SERVICE..."

     

       83
       83
       +
           docker compose -f "$COMPOSE_FILE" up -d "$SERVICE"

     

       84
       84
       +
       else

     

       85
       85
       +
           log "Building all services..."

     

       86
       86
       +
           docker compose -f "$COMPOSE_FILE" build --no-cache

     

       87
       87
       +
       

     

       88
       88
       +
           log "Deploying all services..."

     

       89
       89
       +
           docker compose -f "$COMPOSE_FILE" up -d

     

       90
       90
       +
       fi

     

       91
       91
       +
       

     

       92
       92
       +
       # Health check

     

       93
       93
       +
       log "Waiting for services to be healthy..."

     

       94
       94
       +
       sleep 10

     

       95
       95
       +
       

     

       96
       96
       +
       # Wait for database to be ready before running migrations

     

       97
       97
       +
       log "Waiting for database..."

     

       98
       98
       +
       for i in {1..30}; do

     

       99
       99
       +
           if docker compose -f "$COMPOSE_FILE" exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; then

     

       100
       100
       +
               break

     

       101
       101
       +
           fi

     

       102
       102
       +
           sleep 1

     

       103
       103
       +
       done

     

       104
       104
       +
       

     

       105
       105
       +
       # Run database migrations

     

       106
       106
       +
       # The AppView runs migrations on startup, but we can also trigger them explicitly

     

       107
       107
       +
       log "Running database migrations..."

     

       108
       108
       +
       if docker compose -f "$COMPOSE_FILE" exec -T appview /app/coves-server migrate 2>/dev/null; then

     

       109
       109
       +
           log "✅ Migrations completed"

     

       110
       110
       +
       else

     

       111
       111
       +
           warn "⚠️  Migration command not available or failed - AppView will run migrations on startup"

     

       112
       112
       +
       fi

     

       113
       113
       +
       

     

       114
       114
       +
       # Check AppView health

     

       115
       115
       +
       if docker compose -f "$COMPOSE_FILE" exec -T appview wget --spider -q http://localhost:8080/xrpc/_health 2>/dev/null; then

     

       116
       116
       +
           log "✅ AppView is healthy"

     

       117
       117
       +
       else

     

       118
       118
       +
           warn "⚠️  AppView health check failed - check logs with: docker compose -f docker-compose.prod.yml logs appview"

     

       119
       119
       +
       fi

     

       120
       120
       +
       

     

       121
       121
       +
       # Check PDS health

     

       122
       122
       +
       if docker compose -f "$COMPOSE_FILE" exec -T pds wget --spider -q http://localhost:3000/xrpc/_health 2>/dev/null; then

     

       123
       123
       +
           log "✅ PDS is healthy"

     

       124
       124
       +
       else

     

       125
       125
       +
           warn "⚠️  PDS health check failed - check logs with: docker compose -f docker-compose.prod.yml logs pds"

     

       126
       126
       +
       fi

     

       127
       127
       +
       

     

       128
       128
       +
       log "Deployment complete!"

     

       129
       129
       +
       log ""

     

       130
       130
       +
       log "Useful commands:"

     

       131
       131
       +
       log "  View logs:     docker compose -f docker-compose.prod.yml logs -f"

     

       132
       132
       +
       log "  Check status:  docker compose -f docker-compose.prod.yml ps"

     

       133
       133
       +
       log "  Rollback:      docker compose -f docker-compose.prod.yml down && git checkout HEAD~1 && ./scripts/deploy.sh"

+149

scripts/generate-did-keys.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Generate cryptographic keys for Coves did:web DID document

     

       3
       3
       +
       #

     

       4
       4
       +
       # This script generates a secp256k1 (K-256) key pair as required by atproto.

     

       5
       5
       +
       # Reference: https://atproto.com/specs/cryptography

     

       6
       6
       +
       #

     

       7
       7
       +
       # Key format:

     

       8
       8
       +
       #   - Curve: secp256k1 (K-256) - same as Bitcoin/Ethereum

     

       9
       9
       +
       #   - Type: Multikey

     

       10
       10
       +
       #   - Encoding: publicKeyMultibase with base58btc ('z' prefix)

     

       11
       11
       +
       #   - Multicodec: 0xe7 for secp256k1 compressed public key

     

       12
       12
       +
       #

     

       13
       13
       +
       # Output:

     

       14
       14
       +
       #   - Private key (hex) for PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX

     

       15
       15
       +
       #   - Public key (multibase) for did.json publicKeyMultibase field

     

       16
       16
       +
       #   - Complete did.json file

     

       17
       17
       +
       

     

       18
       18
       +
       set -e

     

       19
       19
       +
       

     

       20
       20
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       21
       21
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       22
       22
       +
       OUTPUT_DIR="$PROJECT_DIR/static/.well-known"

     

       23
       23
       +
       

     

       24
       24
       +
       # Colors

     

       25
       25
       +
       GREEN='\033[0;32m'

     

       26
       26
       +
       YELLOW='\033[1;33m'

     

       27
       27
       +
       RED='\033[0;31m'

     

       28
       28
       +
       NC='\033[0m'

     

       29
       29
       +
       

     

       30
       30
       +
       log() { echo -e "${GREEN}[KEYGEN]${NC} $1"; }

     

       31
       31
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       32
       32
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       33
       33
       +
       

     

       34
       34
       +
       # Check for required tools

     

       35
       35
       +
       if ! command -v openssl &> /dev/null; then

     

       36
       36
       +
           error "openssl is required but not installed"

     

       37
       37
       +
       fi

     

       38
       38
       +
       

     

       39
       39
       +
       if ! command -v python3 &> /dev/null; then

     

       40
       40
       +
           error "python3 is required for base58 encoding"

     

       41
       41
       +
       fi

     

       42
       42
       +
       

     

       43
       43
       +
       # Check for base58 library

     

       44
       44
       +
       if ! python3 -c "import base58" 2>/dev/null; then

     

       45
       45
       +
           warn "Installing base58 Python library..."

     

       46
       46
       +
           pip3 install base58 || error "Failed to install base58. Run: pip3 install base58"

     

       47
       47
       +
       fi

     

       48
       48
       +
       

     

       49
       49
       +
       log "Generating secp256k1 key pair for did:web..."

     

       50
       50
       +
       

     

       51
       51
       +
       # Generate private key

     

       52
       52
       +
       PRIVATE_KEY_PEM=$(mktemp)

     

       53
       53
       +
       openssl ecparam -name secp256k1 -genkey -noout -out "$PRIVATE_KEY_PEM" 2>/dev/null

     

       54
       54
       +
       

     

       55
       55
       +
       # Extract private key as hex (for PDS config)

     

       56
       56
       +
       PRIVATE_KEY_HEX=$(openssl ec -in "$PRIVATE_KEY_PEM" -text -noout 2>/dev/null | \

     

       57
       57
       +
           grep -A 3 "priv:" | tail -n 3 | tr -d ' :\n' | tr -d '\r')

     

       58
       58
       +
       

     

       59
       59
       +
       # Extract public key as compressed format

     

       60
       60
       +
       # OpenSSL outputs the public key, we need to get the compressed form

     

       61
       61
       +
       PUBLIC_KEY_HEX=$(openssl ec -in "$PRIVATE_KEY_PEM" -pubout -conv_form compressed -outform DER 2>/dev/null | \

     

       62
       62
       +
           tail -c 33 | xxd -p | tr -d '\n')

     

       63
       63
       +
       

     

       64
       64
       +
       # Clean up temp file

     

       65
       65
       +
       rm -f "$PRIVATE_KEY_PEM"

     

       66
       66
       +
       

     

       67
       67
       +
       # Encode public key as multibase with multicodec

     

       68
       68
       +
       # Multicodec 0xe7 = secp256k1 compressed public key

     

       69
       69
       +
       # Then base58btc encode with 'z' prefix

     

       70
       70
       +
       PUBLIC_KEY_MULTIBASE=$(python3 << EOF

     

       71
       71
       +
       import base58

     

       72
       72
       +
       

     

       73
       73
       +
       # Compressed public key bytes

     

       74
       74
       +
       pub_hex = "$PUBLIC_KEY_HEX"

     

       75
       75
       +
       pub_bytes = bytes.fromhex(pub_hex)

     

       76
       76
       +
       

     

       77
       77
       +
       # Prepend multicodec 0xe7 for secp256k1-pub

     

       78
       78
       +
       # 0xe7 as varint is just 0xe7 (single byte, < 128)

     

       79
       79
       +
       multicodec = bytes([0xe7, 0x01])  # 0xe701 for secp256k1-pub compressed

     

       80
       80
       +
       key_with_codec = multicodec + pub_bytes

     

       81
       81
       +
       

     

       82
       82
       +
       # Base58btc encode

     

       83
       83
       +
       encoded = base58.b58encode(key_with_codec).decode('ascii')

     

       84
       84
       +
       

     

       85
       85
       +
       # Add 'z' prefix for multibase

     

       86
       86
       +
       print('z' + encoded)

     

       87
       87
       +
       EOF

     

       88
       88
       +
       )

     

       89
       89
       +
       

     

       90
       90
       +
       log "Keys generated successfully!"

     

       91
       91
       +
       echo ""

     

       92
       92
       +
       echo "============================================"

     

       93
       93
       +
       echo "  PRIVATE KEY (keep secret!)"

     

       94
       94
       +
       echo "============================================"

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       echo "Add this to your .env.prod file:"

     

       97
       97
       +
       echo ""

     

       98
       98
       +
       echo "PDS_ROTATION_KEY=$PRIVATE_KEY_HEX"

     

       99
       99
       +
       echo ""

     

       100
       100
       +
       echo "============================================"

     

       101
       101
       +
       echo "  PUBLIC KEY (for did.json)"

     

       102
       102
       +
       echo "============================================"

     

       103
       103
       +
       echo ""

     

       104
       104
       +
       echo "publicKeyMultibase: $PUBLIC_KEY_MULTIBASE"

     

       105
       105
       +
       echo ""

     

       106
       106
       +
       

     

       107
       107
       +
       # Generate the did.json file

     

       108
       108
       +
       log "Generating did.json..."

     

       109
       109
       +
       

     

       110
       110
       +
       mkdir -p "$OUTPUT_DIR"

     

       111
       111
       +
       

     

       112
       112
       +
       cat > "$OUTPUT_DIR/did.json" << EOF

     

       113
       113
       +
       {

     

       114
       114
       +
         "id": "did:web:coves.social",

     

       115
       115
       +
         "alsoKnownAs": ["at://coves.social"],

     

       116
       116
       +
         "verificationMethod": [

     

       117
       117
       +
           {

     

       118
       118
       +
             "id": "did:web:coves.social#atproto",

     

       119
       119
       +
             "type": "Multikey",

     

       120
       120
       +
             "controller": "did:web:coves.social",

     

       121
       121
       +
             "publicKeyMultibase": "$PUBLIC_KEY_MULTIBASE"

     

       122
       122
       +
           }

     

       123
       123
       +
         ],

     

       124
       124
       +
         "service": [

     

       125
       125
       +
           {

     

       126
       126
       +
             "id": "#atproto_pds",

     

       127
       127
       +
             "type": "AtprotoPersonalDataServer",

     

       128
       128
       +
             "serviceEndpoint": "https://coves.me"

     

       129
       129
       +
           }

     

       130
       130
       +
         ]

     

       131
       131
       +
       }

     

       132
       132
       +
       EOF

     

       133
       133
       +
       

     

       134
       134
       +
       log "Created: $OUTPUT_DIR/did.json"

     

       135
       135
       +
       echo ""

     

       136
       136
       +
       echo "============================================"

     

       137
       137
       +
       echo "  NEXT STEPS"

     

       138
       138
       +
       echo "============================================"

     

       139
       139
       +
       echo ""

     

       140
       140
       +
       echo "1. Copy the PDS_ROTATION_KEY value to your .env.prod file"

     

       141
       141
       +
       echo ""

     

       142
       142
       +
       echo "2. Verify the did.json looks correct:"

     

       143
       143
       +
       echo "   cat $OUTPUT_DIR/did.json"

     

       144
       144
       +
       echo ""

     

       145
       145
       +
       echo "3. After deployment, verify it's accessible:"

     

       146
       146
       +
       echo "   curl https://coves.social/.well-known/did.json"

     

       147
       147
       +
       echo ""

     

       148
       148
       +
       warn "IMPORTANT: Keep the private key secret! Only share the public key."

     

       149
       149
       +
       warn "The did.json file with the public key IS safe to commit to git."

+106

scripts/setup-production.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Production Setup Script

     

       3
       3
       +
       # Run this once on a fresh server to set up everything

     

       4
       4
       +
       #

     

       5
       5
       +
       # Prerequisites:

     

       6
       6
       +
       #   - Docker and docker-compose installed

     

       7
       7
       +
       #   - Git installed

     

       8
       8
       +
       #   - .env.prod file configured

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       

     

       15
       15
       +
       # Colors

     

       16
       16
       +
       GREEN='\033[0;32m'

     

       17
       17
       +
       YELLOW='\033[1;33m'

     

       18
       18
       +
       RED='\033[0;31m'

     

       19
       19
       +
       NC='\033[0m'

     

       20
       20
       +
       

     

       21
       21
       +
       log() { echo -e "${GREEN}[SETUP]${NC} $1"; }

     

       22
       22
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       23
       23
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       24
       24
       +
       

     

       25
       25
       +
       cd "$PROJECT_DIR"

     

       26
       26
       +
       

     

       27
       27
       +
       # Check prerequisites

     

       28
       28
       +
       log "Checking prerequisites..."

     

       29
       29
       +
       

     

       30
       30
       +
       if ! command -v docker &> /dev/null; then

     

       31
       31
       +
           error "Docker is not installed. Install with: curl -fsSL https://get.docker.com | sh"

     

       32
       32
       +
       fi

     

       33
       33
       +
       

     

       34
       34
       +
       if ! docker compose version &> /dev/null; then

     

       35
       35
       +
           error "docker compose is not available. Install with: apt install docker-compose-plugin"

     

       36
       36
       +
       fi

     

       37
       37
       +
       

     

       38
       38
       +
       # Check for .env.prod

     

       39
       39
       +
       if [ ! -f ".env.prod" ]; then

     

       40
       40
       +
           error ".env.prod not found! Copy from .env.prod.example and configure secrets."

     

       41
       41
       +
       fi

     

       42
       42
       +
       

     

       43
       43
       +
       # Load environment

     

       44
       44
       +
       set -a

     

       45
       45
       +
       source .env.prod

     

       46
       46
       +
       set +a

     

       47
       47
       +
       

     

       48
       48
       +
       # Create required directories

     

       49
       49
       +
       log "Creating directories..."

     

       50
       50
       +
       mkdir -p backups

     

       51
       51
       +
       mkdir -p static/.well-known

     

       52
       52
       +
       

     

       53
       53
       +
       # Check for did.json

     

       54
       54
       +
       if [ ! -f "static/.well-known/did.json" ]; then

     

       55
       55
       +
           warn "static/.well-known/did.json not found!"

     

       56
       56
       +
           warn "Run ./scripts/generate-did-keys.sh to create it."

     

       57
       57
       +
       fi

     

       58
       58
       +
       

     

       59
       59
       +
       # Note: Caddy logs are written to Docker volume (caddy-data)

     

       60
       60
       +
       # If you need host-accessible logs, uncomment and run as root:

     

       61
       61
       +
       # mkdir -p /var/log/caddy && chown 1000:1000 /var/log/caddy

     

       62
       62
       +
       

     

       63
       63
       +
       # Pull Docker images

     

       64
       64
       +
       log "Pulling Docker images..."

     

       65
       65
       +
       docker compose -f docker-compose.prod.yml pull postgres pds caddy

     

       66
       66
       +
       

     

       67
       67
       +
       # Build AppView

     

       68
       68
       +
       log "Building AppView..."

     

       69
       69
       +
       docker compose -f docker-compose.prod.yml build appview

     

       70
       70
       +
       

     

       71
       71
       +
       # Start services

     

       72
       72
       +
       log "Starting services..."

     

       73
       73
       +
       docker compose -f docker-compose.prod.yml up -d

     

       74
       74
       +
       

     

       75
       75
       +
       # Wait for PostgreSQL

     

       76
       76
       +
       log "Waiting for PostgreSQL to be ready..."

     

       77
       77
       +
       until docker compose -f docker-compose.prod.yml exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; do

     

       78
       78
       +
           sleep 2

     

       79
       79
       +
       done

     

       80
       80
       +
       log "PostgreSQL is ready!"

     

       81
       81
       +
       

     

       82
       82
       +
       # Run migrations

     

       83
       83
       +
       log "Running database migrations..."

     

       84
       84
       +
       # The AppView runs migrations on startup, but you can also run them manually:

     

       85
       85
       +
       # docker compose -f docker-compose.prod.yml exec appview /app/coves-server migrate

     

       86
       86
       +
       

     

       87
       87
       +
       # Final status

     

       88
       88
       +
       log ""

     

       89
       89
       +
       log "============================================"

     

       90
       90
       +
       log "  Coves Production Setup Complete!"

     

       91
       91
       +
       log "============================================"

     

       92
       92
       +
       log ""

     

       93
       93
       +
       log "Services running:"

     

       94
       94
       +
       docker compose -f docker-compose.prod.yml ps

     

       95
       95
       +
       log ""

     

       96
       96
       +
       log "Next steps:"

     

       97
       97
       +
       log "  1. Configure DNS for coves.social and coves.me"

     

       98
       98
       +
       log "  2. Run ./scripts/generate-did-keys.sh to create DID keys"

     

       99
       99
       +
       log "  3. Test health endpoints:"

     

       100
       100
       +
       log "     curl https://coves.social/xrpc/_health"

     

       101
       101
       +
       log "     curl https://coves.me/xrpc/_health"

     

       102
       102
       +
       log ""

     

       103
       103
       +
       log "Useful commands:"

     

       104
       104
       +
       log "  View logs:     docker compose -f docker-compose.prod.yml logs -f"

     

       105
       105
       +
       log "  Deploy update: ./scripts/deploy.sh appview"

     

       106
       106
       +
       log "  Backup DB:     ./scripts/backup.sh"

+19

static/.well-known/did.json.template

···

       1
       1
       +
       {

     

       2
       2
       +
         "id": "did:web:coves.social",

     

       3
       3
       +
         "alsoKnownAs": ["at://coves.social"],

     

       4
       4
       +
         "verificationMethod": [

     

       5
       5
       +
           {

     

       6
       6
       +
             "id": "did:web:coves.social#atproto",

     

       7
       7
       +
             "type": "Multikey",

     

       8
       8
       +
             "controller": "did:web:coves.social",

     

       9
       9
       +
             "publicKeyMultibase": "REPLACE_WITH_YOUR_PUBLIC_KEY"

     

       10
       10
       +
           }

     

       11
       11
       +
         ],

     

       12
       12
       +
         "service": [

     

       13
       13
       +
           {

     

       14
       14
       +
             "id": "#atproto_pds",

     

       15
       15
       +
             "type": "AtprotoPersonalDataServer",

     

       16
       16
       +
             "serviceEndpoint": "https://coves.me"

     

       17
       17
       +
           }

     

       18
       18
       +
         ]

     

       19
       19
       +
       }

+18

static/client-metadata.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "client_id": "https://coves.social/client-metadata.json",

     

       3
       3
       +
         "client_name": "Coves",

     

       4
       4
       +
         "client_uri": "https://coves.social",

     

       5
       5
       +
         "logo_uri": "https://coves.social/logo.png",

     

       6
       6
       +
         "tos_uri": "https://coves.social/terms",

     

       7
       7
       +
         "policy_uri": "https://coves.social/privacy",

     

       8
       8
       +
         "redirect_uris": [

     

       9
       9
       +
           "https://coves.social/oauth/callback",

     

       10
       10
       +
           "social.coves:/oauth/callback"

     

       11
       11
       +
         ],

     

       12
       12
       +
         "scope": "atproto transition:generic",

     

       13
       13
       +
         "grant_types": ["authorization_code", "refresh_token"],

     

       14
       14
       +
         "response_types": ["code"],

     

       15
       15
       +
         "application_type": "native",

     

       16
       16
       +
         "token_endpoint_auth_method": "none",

     

       17
       17
       +
         "dpop_bound_access_tokens": true

     

       18
       18
       +
       }

+2 -1

Dockerfile

···

       42
       42
        
       COPY --from=builder /build/coves-server /app/coves-server

     

       43
       43
        
       

     

       44
       44
        
       # Copy migrations (needed for goose)

     

       45
       45
       -
       COPY --from=builder /build/internal/db/migrations /app/migrations

     

       45
       45
       +
       # Must maintain path structure as app looks for internal/db/migrations

     

       46
       46
       +
       COPY --from=builder /build/internal/db/migrations /app/internal/db/migrations

     

       46
       47
        
       

     

       47
       48
        
       # Set ownership

     

       48
       49
        
       RUN chown -R coves:coves /app

+187

scripts/derive-did-from-key.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Derive public key from existing PDS_ROTATION_KEY and create did.json

     

       3
       3
       +
       #

     

       4
       4
       +
       # This script takes your existing private key and derives the public key from it.

     

       5
       5
       +
       # Use this if you already have a PDS running with a rotation key but need to

     

       6
       6
       +
       # create/fix the did.json file.

     

       7
       7
       +
       #

     

       8
       8
       +
       # Usage: ./scripts/derive-did-from-key.sh

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       OUTPUT_DIR="$PROJECT_DIR/static/.well-known"

     

       15
       15
       +
       

     

       16
       16
       +
       # Colors

     

       17
       17
       +
       GREEN='\033[0;32m'

     

       18
       18
       +
       YELLOW='\033[1;33m'

     

       19
       19
       +
       RED='\033[0;31m'

     

       20
       20
       +
       NC='\033[0m'

     

       21
       21
       +
       

     

       22
       22
       +
       log() { echo -e "${GREEN}[DERIVE]${NC} $1"; }

     

       23
       23
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       24
       24
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       25
       25
       +
       

     

       26
       26
       +
       # Check for required tools

     

       27
       27
       +
       if ! command -v openssl &> /dev/null; then

     

       28
       28
       +
           error "openssl is required but not installed"

     

       29
       29
       +
       fi

     

       30
       30
       +
       

     

       31
       31
       +
       if ! command -v python3 &> /dev/null; then

     

       32
       32
       +
           error "python3 is required for base58 encoding"

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       # Check for base58 library

     

       36
       36
       +
       if ! python3 -c "import base58" 2>/dev/null; then

     

       37
       37
       +
           warn "Installing base58 Python library..."

     

       38
       38
       +
           pip3 install base58 || error "Failed to install base58. Run: pip3 install base58"

     

       39
       39
       +
       fi

     

       40
       40
       +
       

     

       41
       41
       +
       # Load environment to get the existing key

     

       42
       42
       +
       if [ -f "$PROJECT_DIR/.env.prod" ]; then

     

       43
       43
       +
           source "$PROJECT_DIR/.env.prod"

     

       44
       44
       +
       elif [ -f "$PROJECT_DIR/.env" ]; then

     

       45
       45
       +
           source "$PROJECT_DIR/.env"

     

       46
       46
       +
       else

     

       47
       47
       +
           error "No .env.prod or .env file found"

     

       48
       48
       +
       fi

     

       49
       49
       +
       

     

       50
       50
       +
       if [ -z "$PDS_ROTATION_KEY" ]; then

     

       51
       51
       +
           error "PDS_ROTATION_KEY not found in environment"

     

       52
       52
       +
       fi

     

       53
       53
       +
       

     

       54
       54
       +
       # Validate key format (should be 64 hex chars)

     

       55
       55
       +
       if [[ ! "$PDS_ROTATION_KEY" =~ ^[0-9a-fA-F]{64}$ ]]; then

     

       56
       56
       +
           error "PDS_ROTATION_KEY is not a valid 64-character hex string"

     

       57
       57
       +
       fi

     

       58
       58
       +
       

     

       59
       59
       +
       log "Deriving public key from existing PDS_ROTATION_KEY..."

     

       60
       60
       +
       

     

       61
       61
       +
       # Create a temporary PEM file from the hex private key

     

       62
       62
       +
       TEMP_DIR=$(mktemp -d)

     

       63
       63
       +
       PRIVATE_KEY_HEX="$PDS_ROTATION_KEY"

     

       64
       64
       +
       

     

       65
       65
       +
       # Convert hex private key to PEM format

     

       66
       66
       +
       # secp256k1 curve OID: 1.3.132.0.10

     

       67
       67
       +
       python3 > "$TEMP_DIR/private.pem" << EOF

     

       68
       68
       +
       import binascii

     

       69
       69
       +
       

     

       70
       70
       +
       # Private key in hex

     

       71
       71
       +
       priv_hex = "$PRIVATE_KEY_HEX"

     

       72
       72
       +
       priv_bytes = binascii.unhexlify(priv_hex)

     

       73
       73
       +
       

     

       74
       74
       +
       # secp256k1 OID

     

       75
       75
       +
       oid = bytes([0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a])

     

       76
       76
       +
       

     

       77
       77
       +
       # Build the EC private key structure

     

       78
       78
       +
       # SEQUENCE { version INTEGER, privateKey OCTET STRING, [0] OID, [1] publicKey }

     

       79
       79
       +
       # We'll use a simpler approach: just the private key with curve params

     

       80
       80
       +
       

     

       81
       81
       +
       # EC PARAMETERS for secp256k1

     

       82
       82
       +
       ec_params = bytes([

     

       83
       83
       +
           0x30, 0x07,  # SEQUENCE, 7 bytes

     

       84
       84
       +
           0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a  # OID for secp256k1

     

       85
       85
       +
       ])

     

       86
       86
       +
       

     

       87
       87
       +
       # EC PRIVATE KEY structure

     

       88
       88
       +
       # SEQUENCE { version, privateKey, [0] parameters }

     

       89
       89
       +
       inner = bytes([0x02, 0x01, 0x01])  # version = 1

     

       90
       90
       +
       inner += bytes([0x04, 0x20]) + priv_bytes  # OCTET STRING with 32-byte key

     

       91
       91
       +
       inner += bytes([0xa0, 0x07]) + bytes([0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a])  # [0] OID

     

       92
       92
       +
       

     

       93
       93
       +
       # Wrap in SEQUENCE

     

       94
       94
       +
       key_der = bytes([0x30, len(inner)]) + inner

     

       95
       95
       +
       

     

       96
       96
       +
       # Base64 encode

     

       97
       97
       +
       import base64

     

       98
       98
       +
       key_b64 = base64.b64encode(key_der).decode('ascii')

     

       99
       99
       +
       

     

       100
       100
       +
       # Format as PEM

     

       101
       101
       +
       print("-----BEGIN EC PRIVATE KEY-----")

     

       102
       102
       +
       for i in range(0, len(key_b64), 64):

     

       103
       103
       +
           print(key_b64[i:i+64])

     

       104
       104
       +
       print("-----END EC PRIVATE KEY-----")

     

       105
       105
       +
       EOF

     

       106
       106
       +
       

     

       107
       107
       +
       # Extract the compressed public key

     

       108
       108
       +
       PUBLIC_KEY_HEX=$(openssl ec -in "$TEMP_DIR/private.pem" -pubout -conv_form compressed -outform DER 2>/dev/null | \

     

       109
       109
       +
           tail -c 33 | xxd -p | tr -d '\n')

     

       110
       110
       +
       

     

       111
       111
       +
       # Clean up

     

       112
       112
       +
       rm -rf "$TEMP_DIR"

     

       113
       113
       +
       

     

       114
       114
       +
       if [ -z "$PUBLIC_KEY_HEX" ] || [ ${#PUBLIC_KEY_HEX} -ne 66 ]; then

     

       115
       115
       +
           error "Failed to derive public key. Got: $PUBLIC_KEY_HEX"

     

       116
       116
       +
       fi

     

       117
       117
       +
       

     

       118
       118
       +
       log "Derived public key: ${PUBLIC_KEY_HEX:0:8}...${PUBLIC_KEY_HEX: -8}"

     

       119
       119
       +
       

     

       120
       120
       +
       # Encode public key as multibase with multicodec

     

       121
       121
       +
       PUBLIC_KEY_MULTIBASE=$(python3 << EOF

     

       122
       122
       +
       import base58

     

       123
       123
       +
       

     

       124
       124
       +
       # Compressed public key bytes

     

       125
       125
       +
       pub_hex = "$PUBLIC_KEY_HEX"

     

       126
       126
       +
       pub_bytes = bytes.fromhex(pub_hex)

     

       127
       127
       +
       

     

       128
       128
       +
       # Prepend multicodec 0xe7 for secp256k1-pub

     

       129
       129
       +
       # 0xe7 as varint is just 0xe7 (single byte, < 128)

     

       130
       130
       +
       multicodec = bytes([0xe7, 0x01])  # 0xe701 for secp256k1-pub compressed

     

       131
       131
       +
       key_with_codec = multicodec + pub_bytes

     

       132
       132
       +
       

     

       133
       133
       +
       # Base58btc encode

     

       134
       134
       +
       encoded = base58.b58encode(key_with_codec).decode('ascii')

     

       135
       135
       +
       

     

       136
       136
       +
       # Add 'z' prefix for multibase

     

       137
       137
       +
       print('z' + encoded)

     

       138
       138
       +
       EOF

     

       139
       139
       +
       )

     

       140
       140
       +
       

     

       141
       141
       +
       log "Public key multibase: $PUBLIC_KEY_MULTIBASE"

     

       142
       142
       +
       

     

       143
       143
       +
       # Generate the did.json file

     

       144
       144
       +
       log "Generating did.json..."

     

       145
       145
       +
       

     

       146
       146
       +
       mkdir -p "$OUTPUT_DIR"

     

       147
       147
       +
       

     

       148
       148
       +
       cat > "$OUTPUT_DIR/did.json" << EOF

     

       149
       149
       +
       {

     

       150
       150
       +
         "id": "did:web:coves.social",

     

       151
       151
       +
         "alsoKnownAs": ["at://coves.social"],

     

       152
       152
       +
         "verificationMethod": [

     

       153
       153
       +
           {

     

       154
       154
       +
             "id": "did:web:coves.social#atproto",

     

       155
       155
       +
             "type": "Multikey",

     

       156
       156
       +
             "controller": "did:web:coves.social",

     

       157
       157
       +
             "publicKeyMultibase": "$PUBLIC_KEY_MULTIBASE"

     

       158
       158
       +
           }

     

       159
       159
       +
         ],

     

       160
       160
       +
         "service": [

     

       161
       161
       +
           {

     

       162
       162
       +
             "id": "#atproto_pds",

     

       163
       163
       +
             "type": "AtprotoPersonalDataServer",

     

       164
       164
       +
             "serviceEndpoint": "https://coves.me"

     

       165
       165
       +
           }

     

       166
       166
       +
         ]

     

       167
       167
       +
       }

     

       168
       168
       +
       EOF

     

       169
       169
       +
       

     

       170
       170
       +
       log "Created: $OUTPUT_DIR/did.json"

     

       171
       171
       +
       echo ""

     

       172
       172
       +
       echo "============================================"

     

       173
       173
       +
       echo "  DID Document Generated Successfully!"

     

       174
       174
       +
       echo "============================================"

     

       175
       175
       +
       echo ""

     

       176
       176
       +
       echo "Public key multibase: $PUBLIC_KEY_MULTIBASE"

     

       177
       177
       +
       echo ""

     

       178
       178
       +
       echo "Next steps:"

     

       179
       179
       +
       echo "  1. Copy this file to your production server:"

     

       180
       180
       +
       echo "     scp $OUTPUT_DIR/did.json user@server:/opt/coves/static/.well-known/"

     

       181
       181
       +
       echo ""

     

       182
       182
       +
       echo "  2. Or if running on production, restart Caddy:"

     

       183
       183
       +
       echo "     docker compose -f docker-compose.prod.yml restart caddy"

     

       184
       184
       +
       echo ""

     

       185
       185
       +
       echo "  3. Verify it's accessible:"

     

       186
       186
       +
       echo "     curl https://coves.social/.well-known/did.json"

     

       187
       187
       +
       echo ""

+1 -2

internal/api/handlers/aggregator/errors.go

···

       1
       1
        
       package aggregator

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"log"

     

       6
       7
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/aggregators"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // ErrorResponse represents an XRPC error response

+1 -2

internal/api/handlers/comments/errors.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/comments"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"log"

     

       6
       7
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/comments"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // errorResponse represents a standardized JSON error response

+1 -2

internal/api/handlers/comments/service_adapter.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"net/http"

     

       5
       5
       -
       

     

       6
       4
        
       	"Coves/internal/core/comments"

     

       5
       5
       +
       	"net/http"

     

       7
       6
        
       )

     

       8
       7
        
       

     

       9
       8
        
       // ServiceAdapter adapts the core comments.Service to the handler's Service interface

+2 -3

internal/api/handlers/community/block.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/api/middleware"

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // BlockHandler handles community blocking operations

+2 -3

internal/api/handlers/community/create.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"encoding/json"

     

       5
       5
       -
       	"net/http"

     

       6
       6
       -
       

     

       7
       4
        
       	"Coves/internal/api/middleware"

     

       8
       5
        
       	"Coves/internal/core/communities"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"net/http"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // CreateHandler handles community creation

+1 -2

internal/api/handlers/community/errors.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"log"

     

       6
       7
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/communities"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // XRPCError represents an XRPC error response

+1 -2

internal/api/handlers/community/list.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"net/http"

     

       6
       7
        
       	"strconv"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/communities"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // ListHandler handles listing communities

+1 -2

internal/api/handlers/communityFeed/errors.go

···

       1
       1
        
       package communityFeed

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communityFeeds"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"errors"

     

       6
       7
        
       	"log"

     

       7
       8
        
       	"net/http"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/communityFeeds"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // ErrorResponse represents an XRPC error response

+1 -2

internal/api/handlers/discover/errors.go

···

       1
       1
        
       package discover

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/discover"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"errors"

     

       6
       7
        
       	"log"

     

       7
       8
        
       	"net/http"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/discover"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // XRPCError represents an XRPC error response

+2 -3

internal/api/handlers/post/errors.go

···

       1
       1
        
       package post

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/aggregators"

     

       9
       9
       -
       	"Coves/internal/core/posts"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       type errorResponse struct {

+1 -2

internal/api/handlers/timeline/errors.go

···

       1
       1
        
       package timeline

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/timeline"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"errors"

     

       6
       7
        
       	"log"

     

       7
       8
        
       	"net/http"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/timeline"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // XRPCError represents an XRPC error response

+1 -2

internal/atproto/jetstream/aggregator_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"encoding/json"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"log"

     

       8
       9
        
       	"time"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/core/aggregators"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // AggregatorEventConsumer consumes aggregator-related events from Jetstream

+2 -3

internal/atproto/jetstream/comment_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/utils"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"database/sql"

     

       6
       8
        
       	"encoding/json"

     
···

       9
       11
        
       	"strings"

     

       10
       12
        
       	"time"

     

       11
       13
        
       

     

       12
       12
       -
       	"Coves/internal/atproto/utils"

     

       13
       13
       -
       	"Coves/internal/core/comments"

     

       14
       14
       -
       

     

       15
       14
        
       	"github.com/lib/pq"

     

       16
       15
        
       )

     

       17
       16

+3 -4

internal/atproto/jetstream/community_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/atproto/utils"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"fmt"

     
···

       9
       12
        
       	"strings"

     

       10
       13
        
       	"time"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/atproto/identity"

     

       13
       13
       -
       	"Coves/internal/atproto/utils"

     

       14
       14
       -
       	"Coves/internal/core/communities"

     

       15
       15
       -
       

     

       16
       15
        
       	lru "github.com/hashicorp/golang-lru/v2"

     

       17
       16
        
       	"golang.org/x/net/publicsuffix"

     

       18
       17
        
       	"golang.org/x/time/rate"

+2 -3

internal/atproto/jetstream/user_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/core/users"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"encoding/json"

     

       6
       8
        
       	"fmt"

     
···

       8
       10
        
       	"sync"

     

       9
       11
        
       	"time"

     

       10
       12
        
       

     

       11
       11
       -
       	"Coves/internal/atproto/identity"

     

       12
       12
       -
       	"Coves/internal/core/users"

     

       13
       13
       -
       

     

       14
       13
        
       	"github.com/gorilla/websocket"

     

       15
       14
        
       )

     

       16
       15

+1 -2

internal/core/aggregators/service.go

···

       1
       1
        
       package aggregators

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"encoding/json"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"time"

     

       8
       9
        
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       10
       -
       

     

       11
       10
        
       	"github.com/xeipuuv/gojsonschema"

     

       12
       11
        
       )

     

       13
       12

+1 -2

internal/core/blobs/service.go

···

       1
       1
        
       package blobs

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"bytes"

     

       5
       6
        
       	"context"

     

       6
       7
        
       	"encoding/json"

     
···

       9
       10
        
       	"log"

     

       10
       11
        
       	"net/http"

     

       11
       12
        
       	"time"

     

       12
       12
       -
       

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       13
        
       )

     

       15
       14
        
       

     

       16
       15
        
       // Service defines the interface for blob operations

+3 -4

internal/core/comments/comment_service.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"errors"

     
···

       9
       12
        
       	"net/url"

     

       10
       13
        
       	"strings"

     

       11
       14
        
       	"time"

     

       12
       12
       -
       

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/core/users"

     

       16
       15
        
       )

     

       17
       16
        
       

     

       18
       17
        
       const (

+5 -6

internal/core/comments/comment_service_test.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"errors"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       11
        
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       11
       -
       	"Coves/internal/core/users"

     

       12
       12
       -
       

     

       13
       12
        
       	"github.com/stretchr/testify/assert"

     

       14
       13
        
       )

     

       15
       14
        
       

     
···

       232
       231
        
       	return nil

     

       233
       232
        
       }

     

       234
       233
        
       

     

       235
       235
       -
       func (m *mockCommunityRepo) List(ctx context.Context, req communities.ListCommunitiesRequest) ([]*communities.Community, int, error) {

     

       236
       236
       -
       	return nil, 0, nil

     

       234
       234
       +
       func (m *mockCommunityRepo) List(ctx context.Context, req communities.ListCommunitiesRequest) ([]*communities.Community, error) {

     

       235
       235
       +
       	return nil, nil

     

       237
       236
        
       }

     

       238
       237
        
       

     

       239
       238
        
       func (m *mockCommunityRepo) Search(ctx context.Context, req communities.SearchCommunitiesRequest) ([]*communities.Community, int, error) {

+1 -2

internal/core/communityFeeds/service.go

···

       1
       1
        
       package communityFeeds

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"fmt"

     

       6
       6
       -
       

     

       7
       7
       -
       	"Coves/internal/core/communities"

     

       8
       7
        
       )

     

       9
       8
        
       

     

       10
       9
        
       type feedService struct {

+1 -2

internal/core/communityFeeds/types.go

···

       1
       1
        
       package communityFeeds

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"time"

     

       5
       5
       -
       

     

       6
       4
        
       	"Coves/internal/core/posts"

     

       5
       5
       +
       	"time"

     

       7
       6
        
       )

     

       8
       7
        
       

     

       9
       8
        
       // GetCommunityFeedRequest represents input for fetching a community feed

+1 -2

internal/core/discover/types.go

···

       1
       1
        
       package discover

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/posts"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"errors"

     

       6
       6
       -
       

     

       7
       7
       -
       	"Coves/internal/core/posts"

     

       8
       7
        
       )

     

       9
       8
        
       

     

       10
       9
        
       // Repository defines discover data access interface

+5 -6

internal/core/posts/service.go

···

       1
       1
        
       package posts

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/aggregators"

     

       6
       6
       +
       	"Coves/internal/core/blobs"

     

       7
       7
       +
       	"Coves/internal/core/communities"

     

       8
       8
       +
       	"Coves/internal/core/unfurl"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"context"

     

       6
       11
        
       	"encoding/json"

     
···

       10
       15
        
       	"net/http"

     

       11
       16
        
       	"os"

     

       12
       17
        
       	"time"

     

       13
       13
       -
       

     

       14
       14
       -
       	"Coves/internal/api/middleware"

     

       15
       15
       -
       	"Coves/internal/core/aggregators"

     

       16
       16
       -
       	"Coves/internal/core/blobs"

     

       17
       17
       -
       	"Coves/internal/core/communities"

     

       18
       18
       -
       	"Coves/internal/core/unfurl"

     

       19
       18
        
       )

     

       20
       19
        
       

     

       21
       20
        
       type postService struct {

+1 -2

internal/core/timeline/types.go

···

       1
       1
        
       package timeline

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/posts"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"errors"

     

       6
       7
        
       	"time"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/posts"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // Repository defines timeline data access interface

+1 -2

internal/db/postgres/aggregator_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"strings"

     

       8
       9
        
       	"time"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/core/aggregators"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       type postgresAggregatorRepo struct {

+1 -2

internal/db/postgres/comment_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/comments"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"encoding/base64"

     
···

       8
       9
        
       	"log"

     

       9
       10
        
       	"strings"

     

       10
       11
        
       

     

       11
       11
       -
       	"Coves/internal/core/comments"

     

       12
       12
       -
       

     

       13
       12
        
       	"github.com/lib/pq"

     

       14
       13
        
       )

     

       15
       14

+1 -2

internal/db/postgres/community_repo_blocks.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"log"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // BlockCommunity creates a new block record (idempotent)

+1 -2

internal/db/postgres/community_repo_subscriptions.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"log"

     

       8
       9
        
       	"strings"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/core/communities"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // Subscribe creates a new subscription record

+1 -2

internal/db/postgres/discover_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/discover"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/discover"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       type postgresDiscoverRepo struct {

+1 -2

internal/db/postgres/timeline_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/timeline"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/timeline"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       type postgresTimelineRepo struct {

+7 -8

tests/e2e/error_recovery_test.go

···

       1
       1
        
       package e2e

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/atproto/jetstream"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       7
       7
       +
       	"Coves/internal/db/postgres"

     

       4
       8
        
       	"context"

     

       5
       9
        
       	"database/sql"

     

       6
       10
        
       	"fmt"

     
···

       12
       16
        
       	"testing"

     

       13
       17
        
       	"time"

     

       14
       18
        
       

     

       15
       15
       -
       	"Coves/internal/atproto/identity"

     

       16
       16
       -
       	"Coves/internal/atproto/jetstream"

     

       17
       17
       -
       	"Coves/internal/core/users"

     

       18
       18
       -
       	"Coves/internal/db/postgres"

     

       19
       19
       -
       

     

       20
       19
        
       	_ "github.com/lib/pq"

     

       21
       20
        
       	"github.com/pressly/goose/v3"

     

       22
       21
        
       )

     
···

       138
       137
        
       

     

       139
       138
        
       	testCases := []struct {

     

       140
       139
        
       		name      string

     

       141
       141
       -
       		event     jetstream.JetstreamEvent

     

       142
       140
        
       		shouldLog string

     

       141
       141
       +
       		event     jetstream.JetstreamEvent

     

       143
       142
        
       	}{

     

       144
       143
        
       		{

     

       145
       144
        
       			name: "Nil identity data",

     
···

       348
       347
        
       		if shouldFail.Load() {

     

       349
       348
        
       			t.Logf("Mock PDS: Simulating unavailability (request #%d)", requestCount.Load())

     

       350
       349
        
       			w.WriteHeader(http.StatusServiceUnavailable)

     

       351
       351
       -
       			w.Write([]byte(`{"error":"ServiceUnavailable","message":"PDS temporarily unavailable"}`))

     

       350
       350
       +
       			_, _ = w.Write([]byte(`{"error":"ServiceUnavailable","message":"PDS temporarily unavailable"}`))

     

       352
       351
        
       			return

     

       353
       352
        
       		}

     

       354
       353
        
       

     

       355
       354
        
       		t.Logf("Mock PDS: Serving request successfully (request #%d)", requestCount.Load())

     

       356
       355
        
       		// Simulate successful PDS response

     

       357
       356
        
       		w.WriteHeader(http.StatusOK)

     

       358
       358
       -
       		w.Write([]byte(`{"did":"did:plc:pdstest123","handle":"pds.test"}`))

     

       357
       357
       +
       		_, _ = w.Write([]byte(`{"did":"did:plc:pdstest123","handle":"pds.test"}`))

     

       359
       358
        
       	}))

     

       360
       359
        
       	defer mockPDS.Close()

     

       361
       360

+3 -4

tests/integration/aggregator_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"fmt"

     

       7
       10
        
       	"testing"

     

       8
       11
        
       	"time"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/core/aggregators"

     

       11
       11
       -
       	"Coves/internal/core/communities"

     

       12
       12
       -
       	"Coves/internal/db/postgres"

     

       13
       12
        
       )

     

       14
       13
        
       

     

       15
       14
        
       // TestAggregatorRepository_Create tests basic aggregator creation

+14 -14

tests/integration/block_handle_resolution_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/community"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       4
       7
        
       	"bytes"

     

       5
       8
        
       	"context"

     

       6
       9
        
       	"encoding/json"

     
···

       9
       12
        
       	"net/http/httptest"

     

       10
       13
        
       	"testing"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/community"

     

       13
       13
       -
       	"Coves/internal/api/middleware"

     

       14
       14
       -
       	"Coves/internal/core/communities"

     

       15
       15
        
       	postgresRepo "Coves/internal/db/postgres"

     

       16
       16
        
       )

     

       17
       17
        
       

     
···

       73
       73
        
       		// We expect 401 (no auth) but verify the error is NOT "Community not found"

     

       74
       74
        
       		// If handle resolution worked, we'd get past that validation

     

       75
       75
        
       		resp := w.Result()

     

       76
       76
       -
       		defer resp.Body.Close()

     

       76
       76
       +
       		defer func() { _ = resp.Body.Close() }()

     

       77
       77
        
       

     

       78
       78
        
       		if resp.StatusCode == http.StatusNotFound {

     

       79
       79
        
       			t.Errorf("Handle resolution failed - got 404 CommunityNotFound")

     
···

       82
       82
        
       		// Expected: 401 Unauthorized (because we didn't add auth context)

     

       83
       83
        
       		if resp.StatusCode != http.StatusUnauthorized {

     

       84
       84
        
       			var errorResp map[string]interface{}

     

       85
       85
       -
       			json.NewDecoder(resp.Body).Decode(&errorResp)

     

       85
       85
       +
       			_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       86
       86
        
       			t.Logf("Response status: %d, body: %+v", resp.StatusCode, errorResp)

     

       87
       87
        
       		}

     

       88
       88
        
       	})

     
···

       100
       100
        
       		blockHandler.HandleBlock(w, req)

     

       101
       101
        
       

     

       102
       102
        
       		resp := w.Result()

     

       103
       103
       -
       		defer resp.Body.Close()

     

       103
       103
       +
       		defer func() { _ = resp.Body.Close() }()

     

       104
       104
        
       

     

       105
       105
        
       		if resp.StatusCode == http.StatusNotFound {

     

       106
       106
        
       			t.Errorf("@-prefixed handle resolution failed - got 404 CommunityNotFound")

     
···

       121
       121
        
       		blockHandler.HandleBlock(w, req)

     

       122
       122
        
       

     

       123
       123
        
       		resp := w.Result()

     

       124
       124
       -
       		defer resp.Body.Close()

     

       124
       124
       +
       		defer func() { _ = resp.Body.Close() }()

     

       125
       125
        
       

     

       126
       126
        
       		if resp.StatusCode == http.StatusNotFound {

     

       127
       127
        
       			t.Errorf("Scoped format resolution failed - got 404 CommunityNotFound")

     
···

       141
       141
        
       		blockHandler.HandleBlock(w, req)

     

       142
       142
        
       

     

       143
       143
        
       		resp := w.Result()

     

       144
       144
       -
       		defer resp.Body.Close()

     

       144
       144
       +
       		defer func() { _ = resp.Body.Close() }()

     

       145
       145
        
       

     

       146
       146
        
       		if resp.StatusCode == http.StatusNotFound {

     

       147
       147
        
       			t.Errorf("DID resolution failed - got 404 CommunityNotFound")

     
···

       202
       202
        
       				blockHandler.HandleBlock(w, req)

     

       203
       203
        
       

     

       204
       204
        
       				resp := w.Result()

     

       205
       205
       -
       				defer resp.Body.Close()

     

       205
       205
       +
       				defer func() { _ = resp.Body.Close() }()

     

       206
       206
        
       

     

       207
       207
        
       				// Should return 400 Bad Request for validation errors

     

       208
       208
        
       				if resp.StatusCode != http.StatusBadRequest {

     
···

       210
       210
        
       				}

     

       211
       211
        
       

     

       212
       212
        
       				var errorResp map[string]interface{}

     

       213
       213
       -
       				json.NewDecoder(resp.Body).Decode(&errorResp)

     

       213
       213
       +
       				_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       214
       214
        
       

     

       215
       215
        
       				if errorCode, ok := errorResp["error"].(string); !ok || errorCode != "InvalidRequest" {

     

       216
       216
        
       					t.Errorf("Expected error code 'InvalidRequest', got %v", errorResp["error"])

     
···

       242
       242
        
       		blockHandler.HandleBlock(w, req)

     

       243
       243
        
       

     

       244
       244
        
       		resp := w.Result()

     

       245
       245
       -
       		defer resp.Body.Close()

     

       245
       245
       +
       		defer func() { _ = resp.Body.Close() }()

     

       246
       246
        
       

     

       247
       247
        
       		// Expected: 401 (auth check happens before resolution)

     

       248
       248
        
       		// In a real scenario with auth, invalid handle would return 404

     
···

       299
       299
        
       		blockHandler.HandleUnblock(w, req)

     

       300
       300
        
       

     

       301
       301
        
       		resp := w.Result()

     

       302
       302
       -
       		defer resp.Body.Close()

     

       302
       302
       +
       		defer func() { _ = resp.Body.Close() }()

     

       303
       303
        
       

     

       304
       304
        
       		// Should NOT be 404 (handle resolution should work)

     

       305
       305
        
       		if resp.StatusCode == http.StatusNotFound {

     
···

       309
       309
        
       		// Expected: 401 (no auth context)

     

       310
       310
        
       		if resp.StatusCode != http.StatusUnauthorized {

     

       311
       311
        
       			var errorResp map[string]interface{}

     

       312
       312
       -
       			json.NewDecoder(resp.Body).Decode(&errorResp)

     

       312
       312
       +
       			_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       313
       313
        
       			t.Logf("Response: status=%d, body=%+v", resp.StatusCode, errorResp)

     

       314
       314
        
       		}

     

       315
       315
        
       	})

     
···

       328
       328
        
       		blockHandler.HandleUnblock(w, req)

     

       329
       329
        
       

     

       330
       330
        
       		resp := w.Result()

     

       331
       331
       -
       		defer resp.Body.Close()

     

       331
       331
       +
       		defer func() { _ = resp.Body.Close() }()

     

       332
       332
        
       

     

       333
       333
        
       		// Expected: 401 (auth check happens before resolution)

     

       334
       334
        
       		if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusNotFound {

+3 -4

tests/integration/comment_consumer_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/comments"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       func TestCommentConsumer_CreateComment(t *testing.T) {

+3 -4

tests/integration/comment_query_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"database/sql"

     

       6
       9
        
       	"encoding/json"

     
···

       11
       14
        
       	"testing"

     

       12
       15
        
       	"time"

     

       13
       16
        
       

     

       14
       14
       -
       	"Coves/internal/atproto/jetstream"

     

       15
       15
       -
       	"Coves/internal/core/comments"

     

       16
       16
       -
       	"Coves/internal/db/postgres"

     

       17
       17
       -
       

     

       18
       17
        
       	"github.com/stretchr/testify/assert"

     

       19
       18
        
       	"github.com/stretchr/testify/require"

     

       20
       19
        
       )

+4 -5

tests/integration/comment_vote_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"testing"

     

       7
       7
       -
       	"time"

     

       8
       8
       -
       

     

       9
       4
        
       	"Coves/internal/atproto/jetstream"

     

       10
       5
        
       	"Coves/internal/core/comments"

     

       11
       6
        
       	"Coves/internal/core/users"

     

       12
       7
        
       	"Coves/internal/db/postgres"

     

       8
       8
       +
       	"context"

     

       9
       9
       +
       	"fmt"

     

       10
       10
       +
       	"testing"

     

       11
       11
       +
       	"time"

     

       13
       12
        
       )

     

       14
       13
        
       

     

       15
       14
        
       // TestCommentVote_CreateAndUpdate tests voting on comments and vote count updates

+2 -3

tests/integration/community_blocking_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"database/sql"

     

       6
       8
        
       	"fmt"

     

       7
       9
        
       	"testing"

     

       8
       10
        
       	"time"

     

       9
       11
        
       

     

       10
       10
       -
       	"Coves/internal/atproto/jetstream"

     

       11
       11
       -
       	"Coves/internal/core/communities"

     

       12
       12
       -
       

     

       13
       12
        
       	postgresRepo "Coves/internal/db/postgres"

     

       14
       13
        
       )

     

       15
       14

+4 -5

tests/integration/community_hostedby_security_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"fmt"

     

       6
       8
        
       	"net/http"

     
···

       8
       10
        
       	"strings"

     

       9
       11
        
       	"testing"

     

       10
       12
        
       	"time"

     

       11
       11
       -
       

     

       12
       12
       -
       	"Coves/internal/atproto/jetstream"

     

       13
       13
       -
       	"Coves/internal/db/postgres"

     

       14
       13
        
       )

     

       15
       14
        
       

     

       16
       15
        
       // TestHostedByVerification_DomainMatching tests that hostedBy domain must match handle domain

     
···

       257
       256
        
       				// Return a DID document with matching alsoKnownAs

     

       258
       257
        
       				w.Header().Set("Content-Type", "application/json")

     

       259
       258
        
       				w.WriteHeader(http.StatusOK)

     

       260
       260
       -
       				fmt.Fprintf(w, `{

     

       259
       259
       +
       				_, _ = fmt.Fprintf(w, `{

     

       261
       260
        
       					"id": "did:web:example.com",

     

       262
       261
        
       					"alsoKnownAs": ["at://example.com"],

     

       263
       262
        
       					"verificationMethod": [],

     
···

       332
       331
        
       				// Return a DID document WITHOUT alsoKnownAs field

     

       333
       332
        
       				w.Header().Set("Content-Type", "application/json")

     

       334
       333
        
       				w.WriteHeader(http.StatusOK)

     

       335
       335
       -
       				fmt.Fprintf(w, `{

     

       334
       334
       +
       				_, _ = fmt.Fprintf(w, `{

     

       336
       335
        
       					"id": "did:web:example.com",

     

       337
       336
        
       					"verificationMethod": [],

     

       338
       337
        
       					"service": []

+2 -3

tests/integration/community_identifier_resolution_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"fmt"

     

       6
       8
        
       	"os"

     
···

       8
       10
        
       	"testing"

     

       9
       11
        
       	"time"

     

       10
       12
        
       

     

       11
       11
       -
       	"Coves/internal/core/communities"

     

       12
       12
       -
       	"Coves/internal/db/postgres"

     

       13
       13
       -
       

     

       14
       13
        
       	"github.com/stretchr/testify/assert"

     

       15
       14
        
       	"github.com/stretchr/testify/require"

     

       16
       15
        
       )

+2 -3

tests/integration/community_repo_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"fmt"

     

       6
       8
        
       	"testing"

     

       7
       9
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       10
       -
       	"Coves/internal/db/postgres"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       func TestCommunityRepository_Create(t *testing.T) {

+2 -3

tests/integration/community_service_integration_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"bytes"

     

       5
       7
        
       	"context"

     

       6
       8
        
       	"encoding/json"

     
···

       10
       12
        
       	"strings"

     

       11
       13
        
       	"testing"

     

       12
       14
        
       	"time"

     

       13
       13
       -
       

     

       14
       14
       -
       	"Coves/internal/core/communities"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       15
        
       )

     

       17
       16
        
       

     

       18
       17
        
       // TestCommunityService_CreateWithRealPDS tests the complete service layer flow

+3 -4

tests/integration/community_v2_validation_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/communities"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       // TestCommunityConsumer_V2RKeyValidation tests that only V2 communities (rkey="self") are accepted

+6 -7

tests/integration/concurrent_scenarios_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"sync"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       	"time"

     

       9
       9
       -
       

     

       10
       4
        
       	"Coves/internal/atproto/jetstream"

     

       11
       5
        
       	"Coves/internal/core/comments"

     

       12
       6
        
       	"Coves/internal/core/communities"

     

       13
       7
        
       	"Coves/internal/core/users"

     

       14
       8
        
       	"Coves/internal/db/postgres"

     

       9
       9
       +
       	"context"

     

       10
       10
       +
       	"fmt"

     

       11
       11
       +
       	"sync"

     

       12
       12
       +
       	"testing"

     

       13
       13
       +
       	"time"

     

       15
       14
        
       )

     

       16
       15
        
       

     

       17
       16
        
       // TestConcurrentVoting_MultipleUsersOnSamePost tests race conditions when multiple users

     
···

       611
       610
        
       		wg.Add(numAttempts)

     

       612
       611
        
       

     

       613
       612
        
       		type result struct {

     

       614
       614
       -
       			success bool

     

       615
       613
        
       			err     error

     

       614
       614
       +
       			success bool

     

       616
       615
        
       		}

     

       617
       616
        
       		results := make(chan result, numAttempts)

     

       618
       617

+4 -5

tests/integration/feed_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/communityFeed"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       6
       6
       +
       	"Coves/internal/core/communityFeeds"

     

       7
       7
       +
       	"Coves/internal/db/postgres"

     

       4
       8
        
       	"context"

     

       5
       9
        
       	"encoding/json"

     

       6
       10
        
       	"fmt"

     
···

       9
       13
        
       	"testing"

     

       10
       14
        
       	"time"

     

       11
       15
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/communityFeed"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/communityFeeds"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+3 -4

tests/integration/jetstream_consumer_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"testing"

     

       6
       6
       -
       	"time"

     

       7
       7
       -
       

     

       8
       4
        
       	"Coves/internal/atproto/identity"

     

       9
       5
        
       	"Coves/internal/atproto/jetstream"

     

       10
       6
        
       	"Coves/internal/core/users"

     

       11
       7
        
       	"Coves/internal/db/postgres"

     

       8
       8
       +
       	"context"

     

       9
       9
       +
       	"testing"

     

       10
       10
       +
       	"time"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       func TestUserIndexingFromJetstream(t *testing.T) {

+3 -4

tests/integration/post_consumer_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/users"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/users"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       // TestPostConsumer_CommentCountReconciliation tests that post comment_count

+5 -6

tests/integration/post_handler_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/post"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       7
       7
       +
       	"Coves/internal/core/posts"

     

       8
       8
       +
       	"Coves/internal/db/postgres"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"encoding/json"

     

       6
       11
        
       	"net/http"

     
···

       8
       13
        
       	"strings"

     

       9
       14
        
       	"testing"

     

       10
       15
        
       

     

       11
       11
       -
       	"Coves/internal/api/handlers/post"

     

       12
       12
       -
       	"Coves/internal/api/middleware"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+5 -6

tests/integration/post_thumb_validation_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/post"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       7
       7
       +
       	"Coves/internal/core/posts"

     

       8
       8
       +
       	"Coves/internal/db/postgres"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"context"

     

       6
       11
        
       	"encoding/json"

     
···

       8
       13
        
       	"net/http/httptest"

     

       9
       14
        
       	"testing"

     

       10
       15
        
       

     

       11
       11
       -
       	"Coves/internal/api/handlers/post"

     

       12
       12
       -
       	"Coves/internal/api/middleware"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+5 -6

tests/integration/post_unfurl_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"encoding/json"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       	"time"

     

       9
       9
       -
       

     

       10
       4
        
       	"Coves/internal/api/middleware"

     

       11
       5
        
       	"Coves/internal/atproto/identity"

     

       12
       6
        
       	"Coves/internal/atproto/jetstream"

     
···

       15
       9
        
       	"Coves/internal/core/unfurl"

     

       16
       10
        
       	"Coves/internal/core/users"

     

       17
       11
        
       	"Coves/internal/db/postgres"

     

       12
       12
       +
       	"context"

     

       13
       13
       +
       	"encoding/json"

     

       14
       14
       +
       	"fmt"

     

       15
       15
       +
       	"testing"

     

       16
       16
       +
       	"time"

     

       18
       17
        
       

     

       19
       18
        
       	"github.com/stretchr/testify/assert"

     

       20
       19
        
       	"github.com/stretchr/testify/require"

+2 -3

tests/integration/subscription_indexing_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"database/sql"

     

       6
       8
        
       	"fmt"

     

       7
       9
        
       	"testing"

     

       8
       10
        
       	"time"

     

       9
       11
        
       

     

       10
       10
       -
       	"Coves/internal/atproto/jetstream"

     

       11
       11
       -
       	"Coves/internal/core/communities"

     

       12
       12
       -
       

     

       13
       12
        
       	postgresRepo "Coves/internal/db/postgres"

     

       14
       13
        
       )

     

       15
       14

+23

static/.well-known/did.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "@context": [

     

       3
       3
       +
           "https://www.w3.org/ns/did/v1",

     

       4
       4
       +
           "https://w3id.org/security/multikey/v1"

     

       5
       5
       +
         ],

     

       6
       6
       +
         "id": "did:web:coves.social",

     

       7
       7
       +
         "alsoKnownAs": ["at://coves.social"],

     

       8
       8
       +
         "verificationMethod": [

     

       9
       9
       +
           {

     

       10
       10
       +
             "id": "did:web:coves.social#atproto",

     

       11
       11
       +
             "type": "Multikey",

     

       12
       12
       +
             "controller": "did:web:coves.social",

     

       13
       13
       +
             "publicKeyMultibase": "zQ3shu1T3Y3MYoC1n7fCqkZqyrk8FiY3PV3BYM2JwyqcXFY6s"

     

       14
       14
       +
           }

     

       15
       15
       +
         ],

     

       16
       16
       +
         "service": [

     

       17
       17
       +
           {

     

       18
       18
       +
             "id": "#atproto_pds",

     

       19
       19
       +
             "type": "AtprotoPersonalDataServer",

     

       20
       20
       +
             "serviceEndpoint": "https://pds.coves.me"

     

       21
       21
       +
           }

     

       22
       22
       +
         ]

     

       23
       23
       +
       }

+44 -5

internal/atproto/lexicon/social/coves/embed/external.json

···

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "object",

     

       7
       7
       -
             "description": "External link embed with preview metadata and provider support",

     

       7
       7
       +
             "description": "External link embed with optional aggregated sources for megathreads",

     

       8
       8
        
             "required": ["external"],

     

       9
       9
        
             "properties": {

     

       10
       10
        
               "external": {

     
···

       15
       15
        
           },

     

       16
       16
        
           "external": {

     

       17
       17
        
             "type": "object",

     

       18
       18
       -
             "description": "External link metadata",

     

       18
       18
       +
             "description": "Primary external link metadata",

     

       19
       19
        
             "required": ["uri"],

     

       20
       20
        
             "properties": {

     

       21
       21
        
               "uri": {

     

       22
       22
        
                 "type": "string",

     

       23
       23
        
                 "format": "uri",

     

       24
       24
       -
                 "description": "URI of the external content"

     

       24
       24
       +
                 "description": "URI of the primary external content"

     

       25
       25
        
               },

     

       26
       26
        
               "title": {

     

       27
       27
        
                 "type": "string",

     
···

       39
       39
        
                 "type": "blob",

     

       40
       40
        
                 "accept": ["image/png", "image/jpeg", "image/webp"],

     

       41
       41
        
                 "maxSize": 1000000,

     

       42
       42
       -
                 "description": "Thumbnail image for the link"

     

       42
       42
       +
                 "description": "Thumbnail image for the post (applies to primary link)"

     

       43
       43
        
               },

     

       44
       44
        
               "domain": {

     

       45
       45
        
                 "type": "string",

     

       46
       46
       -
                 "description": "Domain of the linked content"

     

       46
       46
       +
                 "maxLength": 253,

     

       47
       47
       +
                 "description": "Domain of the linked content (e.g., nytimes.com)"

     

       47
       48
        
               },

     

       48
       49
        
               "embedType": {

     

       49
       50
        
                 "type": "string",

     
···

       52
       53
        
               },

     

       53
       54
        
               "provider": {

     

       54
       55
        
                 "type": "string",

     

       56
       56
       +
                 "maxLength": 100,

     

       55
       57
        
                 "description": "Service provider name (e.g., imgur, streamable)"

     

       56
       58
        
               },

     

       57
       59
        
               "images": {

     
···

       67
       69
        
                 "type": "integer",

     

       68
       70
        
                 "minimum": 0,

     

       69
       71
        
                 "description": "Total number of items if more than displayed (for galleries)"

     

       72
       72
       +
               },

     

       73
       73
       +
               "sources": {

     

       74
       74
       +
                 "type": "array",

     

       75
       75
       +
                 "description": "Aggregated source links for megathreads. Each source references an original article and optionally the Coves post that shared it",

     

       76
       76
       +
                 "maxLength": 50,

     

       77
       77
       +
                 "items": {

     

       78
       78
       +
                   "type": "ref",

     

       79
       79
       +
                   "ref": "#source"

     

       80
       80
       +
                 }

     

       81
       81
       +
               }

     

       82
       82
       +
             }

     

       83
       83
       +
           },

     

       84
       84
       +
           "source": {

     

       85
       85
       +
             "type": "object",

     

       86
       86
       +
             "description": "A source link aggregated into a megathread",

     

       87
       87
       +
             "required": ["uri"],

     

       88
       88
       +
             "properties": {

     

       89
       89
       +
               "uri": {

     

       90
       90
       +
                 "type": "string",

     

       91
       91
       +
                 "format": "uri",

     

       92
       92
       +
                 "description": "URI of the source article"

     

       93
       93
       +
               },

     

       94
       94
       +
               "title": {

     

       95
       95
       +
                 "type": "string",

     

       96
       96
       +
                 "maxLength": 500,

     

       97
       97
       +
                 "maxGraphemes": 500,

     

       98
       98
       +
                 "description": "Title of the source article"

     

       99
       99
       +
               },

     

       100
       100
       +
               "domain": {

     

       101
       101
       +
                 "type": "string",

     

       102
       102
       +
                 "maxLength": 253,

     

       103
       103
       +
                 "description": "Domain of the source (e.g., nytimes.com)"

     

       104
       104
       +
               },

     

       105
       105
       +
               "sourcePost": {

     

       106
       106
       +
                 "type": "ref",

     

       107
       107
       +
                 "ref": "com.atproto.repo.strongRef",

     

       108
       108
       +
                 "description": "Reference to the Coves post that originally shared this link. Used for feed deprioritization of rolled-up posts"

     

       70
       109
        
               }

     

       71
       110
        
             }

     

       72
       111
        
           }

+4 -1

.gitignore

···

       47
       47
        
       

     

       48
       48
        
       # Build artifacts

     

       49
       49
        
       /validate-lexicon

     

       50
       50
       -
       /bin/
     

       50
       50
       +
       /bin/

     

       51
       51
       +
       

     

       52
       52
       +
       # Go build cache

     

       53
       53
       +
       .cache/

+7 -4

docs/FEED_SYSTEM_IMPLEMENTATION.md

···

       203
       203
        
       # Get personalized timeline (hot posts from subscriptions)

     

       204
       204
        
       curl -X GET \

     

       205
       205
        
         'http://localhost:8081/xrpc/social.coves.feed.getTimeline?sort=hot&limit=15' \

     

       206
       206
       -
         -H 'Authorization: Bearer eyJhbGc...'

     

       206
       206
       +
         -H 'Authorization: DPoP eyJhbGc...' \

     

       207
       207
       +
         -H 'DPoP: eyJhbGc...'

     

       207
       208
        
       

     

       208
       209
        
       # Get top posts from last week

     

       209
       210
        
       curl -X GET \

     

       210
       211
        
         'http://localhost:8081/xrpc/social.coves.feed.getTimeline?sort=top&timeframe=week&limit=20' \

     

       211
       211
       -
         -H 'Authorization: Bearer eyJhbGc...'

     

       212
       212
       +
         -H 'Authorization: DPoP eyJhbGc...' \

     

       213
       213
       +
         -H 'DPoP: eyJhbGc...'

     

       212
       214
        
       

     

       213
       215
        
       # Get newest posts with pagination

     

       214
       216
        
       curl -X GET \

     

       215
       217
        
         'http://localhost:8081/xrpc/social.coves.feed.getTimeline?sort=new&limit=10&cursor=<cursor>' \

     

       216
       216
       -
         -H 'Authorization: Bearer eyJhbGc...'

     

       218
       218
       +
         -H 'Authorization: DPoP eyJhbGc...' \

     

       219
       219
       +
         -H 'DPoP: eyJhbGc...'

     

       217
       220
        
       ```

     

       218
       221
        
       

     

       219
       222
        
       **Response:**

     
···

       313
       316
        
       - ✅ Context timeout support

     

       314
       317
        
       

     

       315
       318
        
       ### Authentication (Timeline)

     

       316
       316
       -
       - ✅ JWT Bearer token required

     

       319
       319
       +
       - ✅ DPoP-bound access token required

     

       317
       320
        
       - ✅ DID extracted from auth context

     

       318
       321
        
       - ✅ Validates token signature (when AUTH_SKIP_VERIFY=false)

     

       319
       322
        
       - ✅ Returns 401 on auth failure

+477

internal/atproto/oauth/handlers_security_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"net/http"

     

       5
       5
       +
       	"net/http/httptest"

     

       6
       6
       +
       	"testing"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/stretchr/testify/assert"

     

       9
       9
       +
       	"github.com/stretchr/testify/require"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       // TestIsAllowedMobileRedirectURI tests the mobile redirect URI allowlist with EXACT URI matching

     

       13
       13
       +
       // Only Universal Links (HTTPS) are allowed - custom schemes are blocked for security

     

       14
       14
       +
       func TestIsAllowedMobileRedirectURI(t *testing.T) {

     

       15
       15
       +
       	tests := []struct {

     

       16
       16
       +
       		name     string

     

       17
       17
       +
       		uri      string

     

       18
       18
       +
       		expected bool

     

       19
       19
       +
       	}{

     

       20
       20
       +
       		{

     

       21
       21
       +
       			name:     "allowed - Universal Link",

     

       22
       22
       +
       			uri:      "https://coves.social/app/oauth/callback",

     

       23
       23
       +
       			expected: true,

     

       24
       24
       +
       		},

     

       25
       25
       +
       		{

     

       26
       26
       +
       			name:     "rejected - custom scheme coves-app (vulnerable to interception)",

     

       27
       27
       +
       			uri:      "coves-app://oauth/callback",

     

       28
       28
       +
       			expected: false,

     

       29
       29
       +
       		},

     

       30
       30
       +
       		{

     

       31
       31
       +
       			name:     "rejected - custom scheme coves (vulnerable to interception)",

     

       32
       32
       +
       			uri:      "coves://oauth/callback",

     

       33
       33
       +
       			expected: false,

     

       34
       34
       +
       		},

     

       35
       35
       +
       		{

     

       36
       36
       +
       			name:     "rejected - evil scheme",

     

       37
       37
       +
       			uri:      "evil://callback",

     

       38
       38
       +
       			expected: false,

     

       39
       39
       +
       		},

     

       40
       40
       +
       		{

     

       41
       41
       +
       			name:     "rejected - http (not secure)",

     

       42
       42
       +
       			uri:      "http://example.com/callback",

     

       43
       43
       +
       			expected: false,

     

       44
       44
       +
       		},

     

       45
       45
       +
       		{

     

       46
       46
       +
       			name:     "rejected - https different domain",

     

       47
       47
       +
       			uri:      "https://example.com/callback",

     

       48
       48
       +
       			expected: false,

     

       49
       49
       +
       		},

     

       50
       50
       +
       		{

     

       51
       51
       +
       			name:     "rejected - https coves.social wrong path",

     

       52
       52
       +
       			uri:      "https://coves.social/wrong/path",

     

       53
       53
       +
       			expected: false,

     

       54
       54
       +
       		},

     

       55
       55
       +
       		{

     

       56
       56
       +
       			name:     "rejected - invalid URI",

     

       57
       57
       +
       			uri:      "not a uri",

     

       58
       58
       +
       			expected: false,

     

       59
       59
       +
       		},

     

       60
       60
       +
       		{

     

       61
       61
       +
       			name:     "rejected - empty string",

     

       62
       62
       +
       			uri:      "",

     

       63
       63
       +
       			expected: false,

     

       64
       64
       +
       		},

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	for _, tt := range tests {

     

       68
       68
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       69
       69
       +
       			result := isAllowedMobileRedirectURI(tt.uri)

     

       70
       70
       +
       			assert.Equal(t, tt.expected, result,

     

       71
       71
       +
       				"isAllowedMobileRedirectURI(%q) = %v, want %v", tt.uri, result, tt.expected)

     

       72
       72
       +
       		})

     

       73
       73
       +
       	}

     

       74
       74
       +
       }

     

       75
       75
       +
       

     

       76
       76
       +
       // TestExtractScheme tests the scheme extraction function

     

       77
       77
       +
       func TestExtractScheme(t *testing.T) {

     

       78
       78
       +
       	tests := []struct {

     

       79
       79
       +
       		name     string

     

       80
       80
       +
       		uri      string

     

       81
       81
       +
       		expected string

     

       82
       82
       +
       	}{

     

       83
       83
       +
       		{

     

       84
       84
       +
       			name:     "https scheme",

     

       85
       85
       +
       			uri:      "https://coves.social/app/oauth/callback",

     

       86
       86
       +
       			expected: "https",

     

       87
       87
       +
       		},

     

       88
       88
       +
       		{

     

       89
       89
       +
       			name:     "custom scheme",

     

       90
       90
       +
       			uri:      "coves-app://callback",

     

       91
       91
       +
       			expected: "coves-app",

     

       92
       92
       +
       		},

     

       93
       93
       +
       		{

     

       94
       94
       +
       			name:     "invalid URI",

     

       95
       95
       +
       			uri:      "not a uri",

     

       96
       96
       +
       			expected: "invalid",

     

       97
       97
       +
       		},

     

       98
       98
       +
       	}

     

       99
       99
       +
       

     

       100
       100
       +
       	for _, tt := range tests {

     

       101
       101
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       102
       102
       +
       			result := extractScheme(tt.uri)

     

       103
       103
       +
       			assert.Equal(t, tt.expected, result)

     

       104
       104
       +
       		})

     

       105
       105
       +
       	}

     

       106
       106
       +
       }

     

       107
       107
       +
       

     

       108
       108
       +
       // TestGenerateCSRFToken tests CSRF token generation

     

       109
       109
       +
       func TestGenerateCSRFToken(t *testing.T) {

     

       110
       110
       +
       	// Generate two tokens and verify they are different (randomness check)

     

       111
       111
       +
       	token1, err1 := generateCSRFToken()

     

       112
       112
       +
       	require.NoError(t, err1)

     

       113
       113
       +
       	require.NotEmpty(t, token1)

     

       114
       114
       +
       

     

       115
       115
       +
       	token2, err2 := generateCSRFToken()

     

       116
       116
       +
       	require.NoError(t, err2)

     

       117
       117
       +
       	require.NotEmpty(t, token2)

     

       118
       118
       +
       

     

       119
       119
       +
       	assert.NotEqual(t, token1, token2, "CSRF tokens should be unique")

     

       120
       120
       +
       

     

       121
       121
       +
       	// Verify token is base64 encoded (should decode without error)

     

       122
       122
       +
       	assert.Greater(t, len(token1), 40, "CSRF token should be reasonably long (32 bytes base64 encoded)")

     

       123
       123
       +
       }

     

       124
       124
       +
       

     

       125
       125
       +
       // TestHandleMobileLogin_RedirectURIValidation tests that HandleMobileLogin validates redirect URIs

     

       126
       126
       +
       func TestHandleMobileLogin_RedirectURIValidation(t *testing.T) {

     

       127
       127
       +
       	// Note: This is a unit test for the validation logic only.

     

       128
       128
       +
       	// Full integration tests with OAuth flow are in tests/integration/oauth_e2e_test.go

     

       129
       129
       +
       

     

       130
       130
       +
       	tests := []struct {

     

       131
       131
       +
       		name           string

     

       132
       132
       +
       		redirectURI    string

     

       133
       133
       +
       		expectedLog    string

     

       134
       134
       +
       		expectedStatus int

     

       135
       135
       +
       	}{

     

       136
       136
       +
       		{

     

       137
       137
       +
       			name:           "allowed - Universal Link",

     

       138
       138
       +
       			redirectURI:    "https://coves.social/app/oauth/callback",

     

       139
       139
       +
       			expectedStatus: http.StatusBadRequest, // Will fail at StartAuthFlow (no OAuth client setup)

     

       140
       140
       +
       		},

     

       141
       141
       +
       		{

     

       142
       142
       +
       			name:           "rejected - custom scheme coves-app (insecure)",

     

       143
       143
       +
       			redirectURI:    "coves-app://oauth/callback",

     

       144
       144
       +
       			expectedStatus: http.StatusBadRequest,

     

       145
       145
       +
       			expectedLog:    "rejected unauthorized mobile redirect URI",

     

       146
       146
       +
       		},

     

       147
       147
       +
       		{

     

       148
       148
       +
       			name:           "rejected evil scheme",

     

       149
       149
       +
       			redirectURI:    "evil://callback",

     

       150
       150
       +
       			expectedStatus: http.StatusBadRequest,

     

       151
       151
       +
       			expectedLog:    "rejected unauthorized mobile redirect URI",

     

       152
       152
       +
       		},

     

       153
       153
       +
       		{

     

       154
       154
       +
       			name:           "rejected http",

     

       155
       155
       +
       			redirectURI:    "http://evil.com/callback",

     

       156
       156
       +
       			expectedStatus: http.StatusBadRequest,

     

       157
       157
       +
       			expectedLog:    "scheme not allowed",

     

       158
       158
       +
       		},

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	for _, tt := range tests {

     

       162
       162
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       163
       163
       +
       			// Test the validation function directly

     

       164
       164
       +
       			result := isAllowedMobileRedirectURI(tt.redirectURI)

     

       165
       165
       +
       			if tt.expectedLog != "" {

     

       166
       166
       +
       				assert.False(t, result, "Should reject %s", tt.redirectURI)

     

       167
       167
       +
       			}

     

       168
       168
       +
       		})

     

       169
       169
       +
       	}

     

       170
       170
       +
       }

     

       171
       171
       +
       

     

       172
       172
       +
       // TestHandleCallback_CSRFValidation tests that HandleCallback validates CSRF tokens for mobile flow

     

       173
       173
       +
       func TestHandleCallback_CSRFValidation(t *testing.T) {

     

       174
       174
       +
       	// This is a conceptual test structure. Full implementation would require:

     

       175
       175
       +
       	// 1. Mock OAuthClient

     

       176
       176
       +
       	// 2. Mock OAuth store

     

       177
       177
       +
       	// 3. Simulated OAuth callback with cookies

     

       178
       178
       +
       

     

       179
       179
       +
       	t.Run("mobile callback requires CSRF token", func(t *testing.T) {

     

       180
       180
       +
       		// Setup: Create request with mobile_redirect_uri cookie but NO oauth_csrf cookie

     

       181
       181
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test", nil)

     

       182
       182
       +
       		req.AddCookie(&http.Cookie{

     

       183
       183
       +
       			Name:  "mobile_redirect_uri",

     

       184
       184
       +
       			Value: "https%3A%2F%2Fcoves.social%2Fapp%2Foauth%2Fcallback",

     

       185
       185
       +
       		})

     

       186
       186
       +
       		// Missing: oauth_csrf cookie

     

       187
       187
       +
       

     

       188
       188
       +
       		// This would be rejected with 403 Forbidden in the actual handler

     

       189
       189
       +
       		// (Full test in integration tests with real OAuth flow)

     

       190
       190
       +
       

     

       191
       191
       +
       		assert.NotNil(t, req) // Placeholder assertion

     

       192
       192
       +
       	})

     

       193
       193
       +
       

     

       194
       194
       +
       	t.Run("mobile callback with valid CSRF token", func(t *testing.T) {

     

       195
       195
       +
       		// Setup: Create request with both cookies

     

       196
       196
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test", nil)

     

       197
       197
       +
       		req.AddCookie(&http.Cookie{

     

       198
       198
       +
       			Name:  "mobile_redirect_uri",

     

       199
       199
       +
       			Value: "https%3A%2F%2Fcoves.social%2Fapp%2Foauth%2Fcallback",

     

       200
       200
       +
       		})

     

       201
       201
       +
       		req.AddCookie(&http.Cookie{

     

       202
       202
       +
       			Name:  "oauth_csrf",

     

       203
       203
       +
       			Value: "valid-csrf-token",

     

       204
       204
       +
       		})

     

       205
       205
       +
       

     

       206
       206
       +
       		// This would be accepted (assuming valid OAuth code/state)

     

       207
       207
       +
       		// (Full test in integration tests with real OAuth flow)

     

       208
       208
       +
       

     

       209
       209
       +
       		assert.NotNil(t, req) // Placeholder assertion

     

       210
       210
       +
       	})

     

       211
       211
       +
       }

     

       212
       212
       +
       

     

       213
       213
       +
       // TestHandleMobileCallback_RevalidatesRedirectURI tests that handleMobileCallback re-validates the redirect URI

     

       214
       214
       +
       func TestHandleMobileCallback_RevalidatesRedirectURI(t *testing.T) {

     

       215
       215
       +
       	// This is a critical security test: even if an attacker somehow bypasses the initial check,

     

       216
       216
       +
       	// the callback handler should re-validate the redirect URI before redirecting.

     

       217
       217
       +
       

     

       218
       218
       +
       	tests := []struct {

     

       219
       219
       +
       		name        string

     

       220
       220
       +
       		redirectURI string

     

       221
       221
       +
       		shouldPass  bool

     

       222
       222
       +
       	}{

     

       223
       223
       +
       		{

     

       224
       224
       +
       			name:        "allowed - Universal Link",

     

       225
       225
       +
       			redirectURI: "https://coves.social/app/oauth/callback",

     

       226
       226
       +
       			shouldPass:  true,

     

       227
       227
       +
       		},

     

       228
       228
       +
       		{

     

       229
       229
       +
       			name:        "blocked - custom scheme (insecure)",

     

       230
       230
       +
       			redirectURI: "coves-app://oauth/callback",

     

       231
       231
       +
       			shouldPass:  false,

     

       232
       232
       +
       		},

     

       233
       233
       +
       		{

     

       234
       234
       +
       			name:        "blocked - evil scheme",

     

       235
       235
       +
       			redirectURI: "evil://callback",

     

       236
       236
       +
       			shouldPass:  false,

     

       237
       237
       +
       		},

     

       238
       238
       +
       	}

     

       239
       239
       +
       

     

       240
       240
       +
       	for _, tt := range tests {

     

       241
       241
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       242
       242
       +
       			result := isAllowedMobileRedirectURI(tt.redirectURI)

     

       243
       243
       +
       			assert.Equal(t, tt.shouldPass, result)

     

       244
       244
       +
       		})

     

       245
       245
       +
       	}

     

       246
       246
       +
       }

     

       247
       247
       +
       

     

       248
       248
       +
       // TestGenerateMobileRedirectBinding tests the binding token generation

     

       249
       249
       +
       // The binding now includes the CSRF token for proper double-submit validation

     

       250
       250
       +
       func TestGenerateMobileRedirectBinding(t *testing.T) {

     

       251
       251
       +
       	csrfToken := "test-csrf-token-12345"

     

       252
       252
       +
       	tests := []struct {

     

       253
       253
       +
       		name        string

     

       254
       254
       +
       		redirectURI string

     

       255
       255
       +
       	}{

     

       256
       256
       +
       		{

     

       257
       257
       +
       			name:        "Universal Link",

     

       258
       258
       +
       			redirectURI: "https://coves.social/app/oauth/callback",

     

       259
       259
       +
       		},

     

       260
       260
       +
       		{

     

       261
       261
       +
       			name:        "different path",

     

       262
       262
       +
       			redirectURI: "https://coves.social/different/path",

     

       263
       263
       +
       		},

     

       264
       264
       +
       	}

     

       265
       265
       +
       

     

       266
       266
       +
       	for _, tt := range tests {

     

       267
       267
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       268
       268
       +
       			binding1 := generateMobileRedirectBinding(csrfToken, tt.redirectURI)

     

       269
       269
       +
       			binding2 := generateMobileRedirectBinding(csrfToken, tt.redirectURI)

     

       270
       270
       +
       

     

       271
       271
       +
       			// Same CSRF token + URI should produce same binding (deterministic)

     

       272
       272
       +
       			assert.Equal(t, binding1, binding2, "binding should be deterministic for same inputs")

     

       273
       273
       +
       

     

       274
       274
       +
       			// Binding should not be empty

     

       275
       275
       +
       			assert.NotEmpty(t, binding1, "binding should not be empty")

     

       276
       276
       +
       

     

       277
       277
       +
       			// Binding should be base64 encoded (should decode without error)

     

       278
       278
       +
       			assert.Greater(t, len(binding1), 20, "binding should be reasonably long")

     

       279
       279
       +
       		})

     

       280
       280
       +
       	}

     

       281
       281
       +
       

     

       282
       282
       +
       	// Different URIs should produce different bindings

     

       283
       283
       +
       	binding1 := generateMobileRedirectBinding(csrfToken, "https://coves.social/app/oauth/callback")

     

       284
       284
       +
       	binding2 := generateMobileRedirectBinding(csrfToken, "https://coves.social/different/path")

     

       285
       285
       +
       	assert.NotEqual(t, binding1, binding2, "different URIs should produce different bindings")

     

       286
       286
       +
       

     

       287
       287
       +
       	// Different CSRF tokens should produce different bindings

     

       288
       288
       +
       	binding3 := generateMobileRedirectBinding("different-csrf-token", "https://coves.social/app/oauth/callback")

     

       289
       289
       +
       	assert.NotEqual(t, binding1, binding3, "different CSRF tokens should produce different bindings")

     

       290
       290
       +
       }

     

       291
       291
       +
       

     

       292
       292
       +
       // TestValidateMobileRedirectBinding tests the binding validation

     

       293
       293
       +
       // Now validates both CSRF token and redirect URI together (double-submit pattern)

     

       294
       294
       +
       func TestValidateMobileRedirectBinding(t *testing.T) {

     

       295
       295
       +
       	csrfToken := "test-csrf-token-for-validation"

     

       296
       296
       +
       	redirectURI := "https://coves.social/app/oauth/callback"

     

       297
       297
       +
       	validBinding := generateMobileRedirectBinding(csrfToken, redirectURI)

     

       298
       298
       +
       

     

       299
       299
       +
       	tests := []struct {

     

       300
       300
       +
       		name        string

     

       301
       301
       +
       		csrfToken   string

     

       302
       302
       +
       		redirectURI string

     

       303
       303
       +
       		binding     string

     

       304
       304
       +
       		shouldPass  bool

     

       305
       305
       +
       	}{

     

       306
       306
       +
       		{

     

       307
       307
       +
       			name:        "valid - correct CSRF token and redirect URI",

     

       308
       308
       +
       			csrfToken:   csrfToken,

     

       309
       309
       +
       			redirectURI: redirectURI,

     

       310
       310
       +
       			binding:     validBinding,

     

       311
       311
       +
       			shouldPass:  true,

     

       312
       312
       +
       		},

     

       313
       313
       +
       		{

     

       314
       314
       +
       			name:        "invalid - wrong redirect URI",

     

       315
       315
       +
       			csrfToken:   csrfToken,

     

       316
       316
       +
       			redirectURI: "https://coves.social/different/path",

     

       317
       317
       +
       			binding:     validBinding,

     

       318
       318
       +
       			shouldPass:  false,

     

       319
       319
       +
       		},

     

       320
       320
       +
       		{

     

       321
       321
       +
       			name:        "invalid - wrong CSRF token",

     

       322
       322
       +
       			csrfToken:   "wrong-csrf-token",

     

       323
       323
       +
       			redirectURI: redirectURI,

     

       324
       324
       +
       			binding:     validBinding,

     

       325
       325
       +
       			shouldPass:  false,

     

       326
       326
       +
       		},

     

       327
       327
       +
       		{

     

       328
       328
       +
       			name:        "invalid - random binding",

     

       329
       329
       +
       			csrfToken:   csrfToken,

     

       330
       330
       +
       			redirectURI: redirectURI,

     

       331
       331
       +
       			binding:     "random-invalid-binding",

     

       332
       332
       +
       			shouldPass:  false,

     

       333
       333
       +
       		},

     

       334
       334
       +
       		{

     

       335
       335
       +
       			name:        "invalid - empty binding",

     

       336
       336
       +
       			csrfToken:   csrfToken,

     

       337
       337
       +
       			redirectURI: redirectURI,

     

       338
       338
       +
       			binding:     "",

     

       339
       339
       +
       			shouldPass:  false,

     

       340
       340
       +
       		},

     

       341
       341
       +
       		{

     

       342
       342
       +
       			name:        "invalid - empty CSRF token",

     

       343
       343
       +
       			csrfToken:   "",

     

       344
       344
       +
       			redirectURI: redirectURI,

     

       345
       345
       +
       			binding:     validBinding,

     

       346
       346
       +
       			shouldPass:  false,

     

       347
       347
       +
       		},

     

       348
       348
       +
       	}

     

       349
       349
       +
       

     

       350
       350
       +
       	for _, tt := range tests {

     

       351
       351
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       352
       352
       +
       			result := validateMobileRedirectBinding(tt.csrfToken, tt.redirectURI, tt.binding)

     

       353
       353
       +
       			assert.Equal(t, tt.shouldPass, result)

     

       354
       354
       +
       		})

     

       355
       355
       +
       	}

     

       356
       356
       +
       }

     

       357
       357
       +
       

     

       358
       358
       +
       // TestSessionFixationAttackPrevention tests that the binding prevents session fixation

     

       359
       359
       +
       func TestSessionFixationAttackPrevention(t *testing.T) {

     

       360
       360
       +
       	// Simulate attack scenario:

     

       361
       361
       +
       	// 1. Attacker plants a cookie for evil://steal with binding for evil://steal

     

       362
       362
       +
       	// 2. User does a web login (no mobile_redirect_binding cookie)

     

       363
       363
       +
       	// 3. Callback should NOT redirect to evil://steal

     

       364
       364
       +
       

     

       365
       365
       +
       	attackerCSRF := "attacker-csrf-token"

     

       366
       366
       +
       	attackerRedirectURI := "evil://steal"

     

       367
       367
       +
       	attackerBinding := generateMobileRedirectBinding(attackerCSRF, attackerRedirectURI)

     

       368
       368
       +
       

     

       369
       369
       +
       	// Later, user's legitimate mobile login

     

       370
       370
       +
       	userCSRF := "user-csrf-token"

     

       371
       371
       +
       	userRedirectURI := "https://coves.social/app/oauth/callback"

     

       372
       372
       +
       	userBinding := generateMobileRedirectBinding(userCSRF, userRedirectURI)

     

       373
       373
       +
       

     

       374
       374
       +
       	// The attacker's binding should NOT validate for the user's redirect URI

     

       375
       375
       +
       	assert.False(t, validateMobileRedirectBinding(userCSRF, userRedirectURI, attackerBinding),

     

       376
       376
       +
       		"attacker's binding should not validate for user's CSRF token and redirect URI")

     

       377
       377
       +
       

     

       378
       378
       +
       	// The user's binding should validate for the user's CSRF token and redirect URI

     

       379
       379
       +
       	assert.True(t, validateMobileRedirectBinding(userCSRF, userRedirectURI, userBinding),

     

       380
       380
       +
       		"user's binding should validate for user's CSRF token and redirect URI")

     

       381
       381
       +
       

     

       382
       382
       +
       	// Cross-validation should fail

     

       383
       383
       +
       	assert.False(t, validateMobileRedirectBinding(attackerCSRF, attackerRedirectURI, userBinding),

     

       384
       384
       +
       		"user's binding should not validate for attacker's CSRF token and redirect URI")

     

       385
       385
       +
       }

     

       386
       386
       +
       

     

       387
       387
       +
       // TestCSRFTokenValidation tests that CSRF token VALUE is validated, not just presence

     

       388
       388
       +
       func TestCSRFTokenValidation(t *testing.T) {

     

       389
       389
       +
       	// This test verifies the fix for the P1 security issue:

     

       390
       390
       +
       	// "The callback never validates the token... the csrfToken argument is ignored entirely"

     

       391
       391
       +
       	//

     

       392
       392
       +
       	// The fix ensures that the CSRF token VALUE is cryptographically bound to the

     

       393
       393
       +
       	// binding token, so changing the CSRF token will invalidate the binding.

     

       394
       394
       +
       

     

       395
       395
       +
       	t.Run("CSRF token value must match", func(t *testing.T) {

     

       396
       396
       +
       		originalCSRF := "original-csrf-token-from-login"

     

       397
       397
       +
       		redirectURI := "https://coves.social/app/oauth/callback"

     

       398
       398
       +
       		binding := generateMobileRedirectBinding(originalCSRF, redirectURI)

     

       399
       399
       +
       

     

       400
       400
       +
       		// Original CSRF token should validate

     

       401
       401
       +
       		assert.True(t, validateMobileRedirectBinding(originalCSRF, redirectURI, binding),

     

       402
       402
       +
       			"original CSRF token should validate")

     

       403
       403
       +
       

     

       404
       404
       +
       		// Different CSRF token should NOT validate (this is the key security fix)

     

       405
       405
       +
       		differentCSRF := "attacker-forged-csrf-token"

     

       406
       406
       +
       		assert.False(t, validateMobileRedirectBinding(differentCSRF, redirectURI, binding),

     

       407
       407
       +
       			"different CSRF token should NOT validate - this is the security fix")

     

       408
       408
       +
       	})

     

       409
       409
       +
       

     

       410
       410
       +
       	t.Run("attacker cannot forge binding without CSRF token", func(t *testing.T) {

     

       411
       411
       +
       		// Attacker knows the redirect URI but not the CSRF token

     

       412
       412
       +
       		redirectURI := "https://coves.social/app/oauth/callback"

     

       413
       413
       +
       		victimCSRF := "victim-secret-csrf-token"

     

       414
       414
       +
       		victimBinding := generateMobileRedirectBinding(victimCSRF, redirectURI)

     

       415
       415
       +
       

     

       416
       416
       +
       		// Attacker tries various CSRF tokens to forge the binding

     

       417
       417
       +
       		attackerGuesses := []string{

     

       418
       418
       +
       			"",

     

       419
       419
       +
       			"guess1",

     

       420
       420
       +
       			"attacker-csrf",

     

       421
       421
       +
       			redirectURI, // trying the redirect URI as CSRF

     

       422
       422
       +
       		}

     

       423
       423
       +
       

     

       424
       424
       +
       		for _, guess := range attackerGuesses {

     

       425
       425
       +
       			assert.False(t, validateMobileRedirectBinding(guess, redirectURI, victimBinding),

     

       426
       426
       +
       				"attacker's CSRF guess %q should not validate", guess)

     

       427
       427
       +
       		}

     

       428
       428
       +
       	})

     

       429
       429
       +
       }

     

       430
       430
       +
       

     

       431
       431
       +
       // TestConstantTimeCompare tests the timing-safe comparison function

     

       432
       432
       +
       func TestConstantTimeCompare(t *testing.T) {

     

       433
       433
       +
       	tests := []struct {

     

       434
       434
       +
       		name     string

     

       435
       435
       +
       		a        string

     

       436
       436
       +
       		b        string

     

       437
       437
       +
       		expected bool

     

       438
       438
       +
       	}{

     

       439
       439
       +
       		{

     

       440
       440
       +
       			name:     "equal strings",

     

       441
       441
       +
       			a:        "abc123",

     

       442
       442
       +
       			b:        "abc123",

     

       443
       443
       +
       			expected: true,

     

       444
       444
       +
       		},

     

       445
       445
       +
       		{

     

       446
       446
       +
       			name:     "different strings same length",

     

       447
       447
       +
       			a:        "abc123",

     

       448
       448
       +
       			b:        "xyz789",

     

       449
       449
       +
       			expected: false,

     

       450
       450
       +
       		},

     

       451
       451
       +
       		{

     

       452
       452
       +
       			name:     "different lengths",

     

       453
       453
       +
       			a:        "short",

     

       454
       454
       +
       			b:        "longer",

     

       455
       455
       +
       			expected: false,

     

       456
       456
       +
       		},

     

       457
       457
       +
       		{

     

       458
       458
       +
       			name:     "empty strings",

     

       459
       459
       +
       			a:        "",

     

       460
       460
       +
       			b:        "",

     

       461
       461
       +
       			expected: true,

     

       462
       462
       +
       		},

     

       463
       463
       +
       		{

     

       464
       464
       +
       			name:     "one empty",

     

       465
       465
       +
       			a:        "abc",

     

       466
       466
       +
       			b:        "",

     

       467
       467
       +
       			expected: false,

     

       468
       468
       +
       		},

     

       469
       469
       +
       	}

     

       470
       470
       +
       

     

       471
       471
       +
       	for _, tt := range tests {

     

       472
       472
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       473
       473
       +
       			result := constantTimeCompare(tt.a, tt.b)

     

       474
       474
       +
       			assert.Equal(t, tt.expected, result)

     

       475
       475
       +
       		})

     

       476
       476
       +
       	}

     

       477
       477
       +
       }

+152

internal/atproto/oauth/seal.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"crypto/aes"

     

       5
       5
       +
       	"crypto/cipher"

     

       6
       6
       +
       	"crypto/rand"

     

       7
       7
       +
       	"encoding/base64"

     

       8
       8
       +
       	"encoding/json"

     

       9
       9
       +
       	"fmt"

     

       10
       10
       +
       	"time"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // SealedSession represents the data sealed in a mobile session token

     

       14
       14
       +
       type SealedSession struct {

     

       15
       15
       +
       	DID       string `json:"did"` // User's DID

     

       16
       16
       +
       	SessionID string `json:"sid"` // Session identifier

     

       17
       17
       +
       	ExpiresAt int64  `json:"exp"` // Unix timestamp when token expires

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // SealSession creates an encrypted token containing session information.

     

       21
       21
       +
       // The token is encrypted using AES-256-GCM and encoded as base64url.

     

       22
       22
       +
       //

     

       23
       23
       +
       // Token format: base64url(nonce || ciphertext || tag)

     

       24
       24
       +
       // - nonce: 12 bytes (GCM standard nonce size)

     

       25
       25
       +
       // - ciphertext: encrypted JSON payload

     

       26
       26
       +
       // - tag: 16 bytes (GCM authentication tag)

     

       27
       27
       +
       //

     

       28
       28
       +
       // The sealed token can be safely given to mobile clients and used as

     

       29
       29
       +
       // a reference to the server-side session without exposing sensitive data.

     

       30
       30
       +
       func (c *OAuthClient) SealSession(did, sessionID string, ttl time.Duration) (string, error) {

     

       31
       31
       +
       	if len(c.SealSecret) == 0 {

     

       32
       32
       +
       		return "", fmt.Errorf("seal secret not configured")

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	if did == "" {

     

       36
       36
       +
       		return "", fmt.Errorf("DID is required")

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	if sessionID == "" {

     

       40
       40
       +
       		return "", fmt.Errorf("session ID is required")

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// Create the session data

     

       44
       44
       +
       	expiresAt := time.Now().Add(ttl).Unix()

     

       45
       45
       +
       	session := SealedSession{

     

       46
       46
       +
       		DID:       did,

     

       47
       47
       +
       		SessionID: sessionID,

     

       48
       48
       +
       		ExpiresAt: expiresAt,

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	// Marshal to JSON

     

       52
       52
       +
       	plaintext, err := json.Marshal(session)

     

       53
       53
       +
       	if err != nil {

     

       54
       54
       +
       		return "", fmt.Errorf("failed to marshal session: %w", err)

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	// Create AES cipher

     

       58
       58
       +
       	block, err := aes.NewCipher(c.SealSecret)

     

       59
       59
       +
       	if err != nil {

     

       60
       60
       +
       		return "", fmt.Errorf("failed to create cipher: %w", err)

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Create GCM mode

     

       64
       64
       +
       	gcm, err := cipher.NewGCM(block)

     

       65
       65
       +
       	if err != nil {

     

       66
       66
       +
       		return "", fmt.Errorf("failed to create GCM: %w", err)

     

       67
       67
       +
       	}

     

       68
       68
       +
       

     

       69
       69
       +
       	// Generate random nonce

     

       70
       70
       +
       	nonce := make([]byte, gcm.NonceSize())

     

       71
       71
       +
       	if _, err := rand.Read(nonce); err != nil {

     

       72
       72
       +
       		return "", fmt.Errorf("failed to generate nonce: %w", err)

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Encrypt and authenticate

     

       76
       76
       +
       	// GCM.Seal appends the ciphertext and tag to the nonce

     

       77
       77
       +
       	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)

     

       78
       78
       +
       

     

       79
       79
       +
       	// Encode as base64url (no padding)

     

       80
       80
       +
       	token := base64.RawURLEncoding.EncodeToString(ciphertext)

     

       81
       81
       +
       

     

       82
       82
       +
       	return token, nil

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       // UnsealSession decrypts and validates a sealed session token.

     

       86
       86
       +
       // Returns the session information if the token is valid and not expired.

     

       87
       87
       +
       func (c *OAuthClient) UnsealSession(token string) (*SealedSession, error) {

     

       88
       88
       +
       	if len(c.SealSecret) == 0 {

     

       89
       89
       +
       		return nil, fmt.Errorf("seal secret not configured")

     

       90
       90
       +
       	}

     

       91
       91
       +
       

     

       92
       92
       +
       	if token == "" {

     

       93
       93
       +
       		return nil, fmt.Errorf("token is required")

     

       94
       94
       +
       	}

     

       95
       95
       +
       

     

       96
       96
       +
       	// Decode from base64url

     

       97
       97
       +
       	ciphertext, err := base64.RawURLEncoding.DecodeString(token)

     

       98
       98
       +
       	if err != nil {

     

       99
       99
       +
       		return nil, fmt.Errorf("invalid token encoding: %w", err)

     

       100
       100
       +
       	}

     

       101
       101
       +
       

     

       102
       102
       +
       	// Create AES cipher

     

       103
       103
       +
       	block, err := aes.NewCipher(c.SealSecret)

     

       104
       104
       +
       	if err != nil {

     

       105
       105
       +
       		return nil, fmt.Errorf("failed to create cipher: %w", err)

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	// Create GCM mode

     

       109
       109
       +
       	gcm, err := cipher.NewGCM(block)

     

       110
       110
       +
       	if err != nil {

     

       111
       111
       +
       		return nil, fmt.Errorf("failed to create GCM: %w", err)

     

       112
       112
       +
       	}

     

       113
       113
       +
       

     

       114
       114
       +
       	// Verify minimum size (nonce + tag)

     

       115
       115
       +
       	nonceSize := gcm.NonceSize()

     

       116
       116
       +
       	if len(ciphertext) < nonceSize {

     

       117
       117
       +
       		return nil, fmt.Errorf("invalid token: too short")

     

       118
       118
       +
       	}

     

       119
       119
       +
       

     

       120
       120
       +
       	// Extract nonce and ciphertext

     

       121
       121
       +
       	nonce := ciphertext[:nonceSize]

     

       122
       122
       +
       	ciphertextData := ciphertext[nonceSize:]

     

       123
       123
       +
       

     

       124
       124
       +
       	// Decrypt and authenticate

     

       125
       125
       +
       	plaintext, err := gcm.Open(nil, nonce, ciphertextData, nil)

     

       126
       126
       +
       	if err != nil {

     

       127
       127
       +
       		return nil, fmt.Errorf("failed to decrypt token: %w", err)

     

       128
       128
       +
       	}

     

       129
       129
       +
       

     

       130
       130
       +
       	// Unmarshal JSON

     

       131
       131
       +
       	var session SealedSession

     

       132
       132
       +
       	if err := json.Unmarshal(plaintext, &session); err != nil {

     

       133
       133
       +
       		return nil, fmt.Errorf("failed to unmarshal session: %w", err)

     

       134
       134
       +
       	}

     

       135
       135
       +
       

     

       136
       136
       +
       	// Validate required fields

     

       137
       137
       +
       	if session.DID == "" {

     

       138
       138
       +
       		return nil, fmt.Errorf("invalid session: missing DID")

     

       139
       139
       +
       	}

     

       140
       140
       +
       

     

       141
       141
       +
       	if session.SessionID == "" {

     

       142
       142
       +
       		return nil, fmt.Errorf("invalid session: missing session ID")

     

       143
       143
       +
       	}

     

       144
       144
       +
       

     

       145
       145
       +
       	// Check expiration

     

       146
       146
       +
       	now := time.Now().Unix()

     

       147
       147
       +
       	if session.ExpiresAt <= now {

     

       148
       148
       +
       		return nil, fmt.Errorf("token expired at %v", time.Unix(session.ExpiresAt, 0))

     

       149
       149
       +
       	}

     

       150
       150
       +
       

     

       151
       151
       +
       	return &session, nil

     

       152
       152
       +
       }

+331

internal/atproto/oauth/seal_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"crypto/rand"

     

       5
       5
       +
       	"encoding/base64"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // generateSealSecret generates a random 32-byte seal secret for testing

     

       15
       15
       +
       func generateSealSecret() []byte {

     

       16
       16
       +
       	secret := make([]byte, 32)

     

       17
       17
       +
       	if _, err := rand.Read(secret); err != nil {

     

       18
       18
       +
       		panic(err)

     

       19
       19
       +
       	}

     

       20
       20
       +
       	return secret

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func TestSealSession_RoundTrip(t *testing.T) {

     

       24
       24
       +
       	// Create client with seal secret

     

       25
       25
       +
       	client := &OAuthClient{

     

       26
       26
       +
       		SealSecret: generateSealSecret(),

     

       27
       27
       +
       	}

     

       28
       28
       +
       

     

       29
       29
       +
       	did := "did:plc:abc123"

     

       30
       30
       +
       	sessionID := "session-xyz"

     

       31
       31
       +
       	ttl := 1 * time.Hour

     

       32
       32
       +
       

     

       33
       33
       +
       	// Seal the session

     

       34
       34
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       35
       35
       +
       	require.NoError(t, err)

     

       36
       36
       +
       	require.NotEmpty(t, token)

     

       37
       37
       +
       

     

       38
       38
       +
       	// Token should be base64url encoded

     

       39
       39
       +
       	_, err = base64.RawURLEncoding.DecodeString(token)

     

       40
       40
       +
       	require.NoError(t, err, "token should be valid base64url")

     

       41
       41
       +
       

     

       42
       42
       +
       	// Unseal the session

     

       43
       43
       +
       	session, err := client.UnsealSession(token)

     

       44
       44
       +
       	require.NoError(t, err)

     

       45
       45
       +
       	require.NotNil(t, session)

     

       46
       46
       +
       

     

       47
       47
       +
       	// Verify data

     

       48
       48
       +
       	assert.Equal(t, did, session.DID)

     

       49
       49
       +
       	assert.Equal(t, sessionID, session.SessionID)

     

       50
       50
       +
       

     

       51
       51
       +
       	// Verify expiration is approximately correct (within 1 second)

     

       52
       52
       +
       	expectedExpiry := time.Now().Add(ttl).Unix()

     

       53
       53
       +
       	assert.InDelta(t, expectedExpiry, session.ExpiresAt, 1.0)

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       func TestSealSession_ExpirationValidation(t *testing.T) {

     

       57
       57
       +
       	client := &OAuthClient{

     

       58
       58
       +
       		SealSecret: generateSealSecret(),

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	did := "did:plc:abc123"

     

       62
       62
       +
       	sessionID := "session-xyz"

     

       63
       63
       +
       	ttl := 2 * time.Second // Short TTL (must be >= 1 second due to Unix timestamp granularity)

     

       64
       64
       +
       

     

       65
       65
       +
       	// Seal the session

     

       66
       66
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       67
       67
       +
       	require.NoError(t, err)

     

       68
       68
       +
       

     

       69
       69
       +
       	// Should work immediately

     

       70
       70
       +
       	session, err := client.UnsealSession(token)

     

       71
       71
       +
       	require.NoError(t, err)

     

       72
       72
       +
       	assert.Equal(t, did, session.DID)

     

       73
       73
       +
       

     

       74
       74
       +
       	// Wait well past expiration

     

       75
       75
       +
       	time.Sleep(2500 * time.Millisecond)

     

       76
       76
       +
       

     

       77
       77
       +
       	// Should fail after expiration

     

       78
       78
       +
       	session, err = client.UnsealSession(token)

     

       79
       79
       +
       	assert.Error(t, err)

     

       80
       80
       +
       	assert.Nil(t, session)

     

       81
       81
       +
       	assert.Contains(t, err.Error(), "token expired")

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       func TestSealSession_TamperedTokenDetection(t *testing.T) {

     

       85
       85
       +
       	client := &OAuthClient{

     

       86
       86
       +
       		SealSecret: generateSealSecret(),

     

       87
       87
       +
       	}

     

       88
       88
       +
       

     

       89
       89
       +
       	did := "did:plc:abc123"

     

       90
       90
       +
       	sessionID := "session-xyz"

     

       91
       91
       +
       	ttl := 1 * time.Hour

     

       92
       92
       +
       

     

       93
       93
       +
       	// Seal the session

     

       94
       94
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       95
       95
       +
       	require.NoError(t, err)

     

       96
       96
       +
       

     

       97
       97
       +
       	// Tamper with the token by modifying one character

     

       98
       98
       +
       	tampered := token[:len(token)-5] + "XXXX" + token[len(token)-1:]

     

       99
       99
       +
       

     

       100
       100
       +
       	// Should fail to unseal tampered token

     

       101
       101
       +
       	session, err := client.UnsealSession(tampered)

     

       102
       102
       +
       	assert.Error(t, err)

     

       103
       103
       +
       	assert.Nil(t, session)

     

       104
       104
       +
       	assert.Contains(t, err.Error(), "failed to decrypt token")

     

       105
       105
       +
       }

     

       106
       106
       +
       

     

       107
       107
       +
       func TestSealSession_InvalidTokenFormats(t *testing.T) {

     

       108
       108
       +
       	client := &OAuthClient{

     

       109
       109
       +
       		SealSecret: generateSealSecret(),

     

       110
       110
       +
       	}

     

       111
       111
       +
       

     

       112
       112
       +
       	tests := []struct {

     

       113
       113
       +
       		name  string

     

       114
       114
       +
       		token string

     

       115
       115
       +
       	}{

     

       116
       116
       +
       		{

     

       117
       117
       +
       			name:  "empty token",

     

       118
       118
       +
       			token: "",

     

       119
       119
       +
       		},

     

       120
       120
       +
       		{

     

       121
       121
       +
       			name:  "invalid base64",

     

       122
       122
       +
       			token: "not-valid-base64!@#$",

     

       123
       123
       +
       		},

     

       124
       124
       +
       		{

     

       125
       125
       +
       			name:  "too short",

     

       126
       126
       +
       			token: base64.RawURLEncoding.EncodeToString([]byte("short")),

     

       127
       127
       +
       		},

     

       128
       128
       +
       		{

     

       129
       129
       +
       			name:  "random bytes",

     

       130
       130
       +
       			token: base64.RawURLEncoding.EncodeToString(make([]byte, 50)),

     

       131
       131
       +
       		},

     

       132
       132
       +
       	}

     

       133
       133
       +
       

     

       134
       134
       +
       	for _, tt := range tests {

     

       135
       135
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       136
       136
       +
       			session, err := client.UnsealSession(tt.token)

     

       137
       137
       +
       			assert.Error(t, err)

     

       138
       138
       +
       			assert.Nil(t, session)

     

       139
       139
       +
       		})

     

       140
       140
       +
       	}

     

       141
       141
       +
       }

     

       142
       142
       +
       

     

       143
       143
       +
       func TestSealSession_DifferentSecrets(t *testing.T) {

     

       144
       144
       +
       	// Create two clients with different secrets

     

       145
       145
       +
       	client1 := &OAuthClient{

     

       146
       146
       +
       		SealSecret: generateSealSecret(),

     

       147
       147
       +
       	}

     

       148
       148
       +
       	client2 := &OAuthClient{

     

       149
       149
       +
       		SealSecret: generateSealSecret(),

     

       150
       150
       +
       	}

     

       151
       151
       +
       

     

       152
       152
       +
       	did := "did:plc:abc123"

     

       153
       153
       +
       	sessionID := "session-xyz"

     

       154
       154
       +
       	ttl := 1 * time.Hour

     

       155
       155
       +
       

     

       156
       156
       +
       	// Seal with client1

     

       157
       157
       +
       	token, err := client1.SealSession(did, sessionID, ttl)

     

       158
       158
       +
       	require.NoError(t, err)

     

       159
       159
       +
       

     

       160
       160
       +
       	// Try to unseal with client2 (different secret)

     

       161
       161
       +
       	session, err := client2.UnsealSession(token)

     

       162
       162
       +
       	assert.Error(t, err)

     

       163
       163
       +
       	assert.Nil(t, session)

     

       164
       164
       +
       	assert.Contains(t, err.Error(), "failed to decrypt token")

     

       165
       165
       +
       }

     

       166
       166
       +
       

     

       167
       167
       +
       func TestSealSession_NoSecretConfigured(t *testing.T) {

     

       168
       168
       +
       	client := &OAuthClient{

     

       169
       169
       +
       		SealSecret: nil,

     

       170
       170
       +
       	}

     

       171
       171
       +
       

     

       172
       172
       +
       	did := "did:plc:abc123"

     

       173
       173
       +
       	sessionID := "session-xyz"

     

       174
       174
       +
       	ttl := 1 * time.Hour

     

       175
       175
       +
       

     

       176
       176
       +
       	// Should fail to seal without secret

     

       177
       177
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       178
       178
       +
       	assert.Error(t, err)

     

       179
       179
       +
       	assert.Empty(t, token)

     

       180
       180
       +
       	assert.Contains(t, err.Error(), "seal secret not configured")

     

       181
       181
       +
       

     

       182
       182
       +
       	// Should fail to unseal without secret

     

       183
       183
       +
       	session, err := client.UnsealSession("dummy-token")

     

       184
       184
       +
       	assert.Error(t, err)

     

       185
       185
       +
       	assert.Nil(t, session)

     

       186
       186
       +
       	assert.Contains(t, err.Error(), "seal secret not configured")

     

       187
       187
       +
       }

     

       188
       188
       +
       

     

       189
       189
       +
       func TestSealSession_MissingRequiredFields(t *testing.T) {

     

       190
       190
       +
       	client := &OAuthClient{

     

       191
       191
       +
       		SealSecret: generateSealSecret(),

     

       192
       192
       +
       	}

     

       193
       193
       +
       

     

       194
       194
       +
       	ttl := 1 * time.Hour

     

       195
       195
       +
       

     

       196
       196
       +
       	tests := []struct {

     

       197
       197
       +
       		name      string

     

       198
       198
       +
       		did       string

     

       199
       199
       +
       		sessionID string

     

       200
       200
       +
       		errorMsg  string

     

       201
       201
       +
       	}{

     

       202
       202
       +
       		{

     

       203
       203
       +
       			name:      "missing DID",

     

       204
       204
       +
       			did:       "",

     

       205
       205
       +
       			sessionID: "session-123",

     

       206
       206
       +
       			errorMsg:  "DID is required",

     

       207
       207
       +
       		},

     

       208
       208
       +
       		{

     

       209
       209
       +
       			name:      "missing session ID",

     

       210
       210
       +
       			did:       "did:plc:abc123",

     

       211
       211
       +
       			sessionID: "",

     

       212
       212
       +
       			errorMsg:  "session ID is required",

     

       213
       213
       +
       		},

     

       214
       214
       +
       	}

     

       215
       215
       +
       

     

       216
       216
       +
       	for _, tt := range tests {

     

       217
       217
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       218
       218
       +
       			token, err := client.SealSession(tt.did, tt.sessionID, ttl)

     

       219
       219
       +
       			assert.Error(t, err)

     

       220
       220
       +
       			assert.Empty(t, token)

     

       221
       221
       +
       			assert.Contains(t, err.Error(), tt.errorMsg)

     

       222
       222
       +
       		})

     

       223
       223
       +
       	}

     

       224
       224
       +
       }

     

       225
       225
       +
       

     

       226
       226
       +
       func TestSealSession_UniquenessPerCall(t *testing.T) {

     

       227
       227
       +
       	client := &OAuthClient{

     

       228
       228
       +
       		SealSecret: generateSealSecret(),

     

       229
       229
       +
       	}

     

       230
       230
       +
       

     

       231
       231
       +
       	did := "did:plc:abc123"

     

       232
       232
       +
       	sessionID := "session-xyz"

     

       233
       233
       +
       	ttl := 1 * time.Hour

     

       234
       234
       +
       

     

       235
       235
       +
       	// Seal the same session twice

     

       236
       236
       +
       	token1, err := client.SealSession(did, sessionID, ttl)

     

       237
       237
       +
       	require.NoError(t, err)

     

       238
       238
       +
       

     

       239
       239
       +
       	token2, err := client.SealSession(did, sessionID, ttl)

     

       240
       240
       +
       	require.NoError(t, err)

     

       241
       241
       +
       

     

       242
       242
       +
       	// Tokens should be different (different nonces)

     

       243
       243
       +
       	assert.NotEqual(t, token1, token2, "tokens should be unique due to different nonces")

     

       244
       244
       +
       

     

       245
       245
       +
       	// But both should unseal to the same session data

     

       246
       246
       +
       	session1, err := client.UnsealSession(token1)

     

       247
       247
       +
       	require.NoError(t, err)

     

       248
       248
       +
       

     

       249
       249
       +
       	session2, err := client.UnsealSession(token2)

     

       250
       250
       +
       	require.NoError(t, err)

     

       251
       251
       +
       

     

       252
       252
       +
       	assert.Equal(t, session1.DID, session2.DID)

     

       253
       253
       +
       	assert.Equal(t, session1.SessionID, session2.SessionID)

     

       254
       254
       +
       }

     

       255
       255
       +
       

     

       256
       256
       +
       func TestSealSession_LongDIDAndSessionID(t *testing.T) {

     

       257
       257
       +
       	client := &OAuthClient{

     

       258
       258
       +
       		SealSecret: generateSealSecret(),

     

       259
       259
       +
       	}

     

       260
       260
       +
       

     

       261
       261
       +
       	// Test with very long DID and session ID

     

       262
       262
       +
       	did := "did:plc:" + strings.Repeat("a", 200)

     

       263
       263
       +
       	sessionID := "session-" + strings.Repeat("x", 200)

     

       264
       264
       +
       	ttl := 1 * time.Hour

     

       265
       265
       +
       

     

       266
       266
       +
       	// Should work with long values

     

       267
       267
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       268
       268
       +
       	require.NoError(t, err)

     

       269
       269
       +
       

     

       270
       270
       +
       	session, err := client.UnsealSession(token)

     

       271
       271
       +
       	require.NoError(t, err)

     

       272
       272
       +
       	assert.Equal(t, did, session.DID)

     

       273
       273
       +
       	assert.Equal(t, sessionID, session.SessionID)

     

       274
       274
       +
       }

     

       275
       275
       +
       

     

       276
       276
       +
       func TestSealSession_URLSafeEncoding(t *testing.T) {

     

       277
       277
       +
       	client := &OAuthClient{

     

       278
       278
       +
       		SealSecret: generateSealSecret(),

     

       279
       279
       +
       	}

     

       280
       280
       +
       

     

       281
       281
       +
       	did := "did:plc:abc123"

     

       282
       282
       +
       	sessionID := "session-xyz"

     

       283
       283
       +
       	ttl := 1 * time.Hour

     

       284
       284
       +
       

     

       285
       285
       +
       	// Seal multiple times to get different nonces

     

       286
       286
       +
       	for i := 0; i < 100; i++ {

     

       287
       287
       +
       		token, err := client.SealSession(did, sessionID, ttl)

     

       288
       288
       +
       		require.NoError(t, err)

     

       289
       289
       +
       

     

       290
       290
       +
       		// Token should not contain URL-unsafe characters

     

       291
       291
       +
       		assert.NotContains(t, token, "+", "token should not contain '+'")

     

       292
       292
       +
       		assert.NotContains(t, token, "/", "token should not contain '/'")

     

       293
       293
       +
       		assert.NotContains(t, token, "=", "token should not contain '='")

     

       294
       294
       +
       

     

       295
       295
       +
       		// Should unseal successfully

     

       296
       296
       +
       		session, err := client.UnsealSession(token)

     

       297
       297
       +
       		require.NoError(t, err)

     

       298
       298
       +
       		assert.Equal(t, did, session.DID)

     

       299
       299
       +
       	}

     

       300
       300
       +
       }

     

       301
       301
       +
       

     

       302
       302
       +
       func TestSealSession_ConcurrentAccess(t *testing.T) {

     

       303
       303
       +
       	client := &OAuthClient{

     

       304
       304
       +
       		SealSecret: generateSealSecret(),

     

       305
       305
       +
       	}

     

       306
       306
       +
       

     

       307
       307
       +
       	did := "did:plc:abc123"

     

       308
       308
       +
       	sessionID := "session-xyz"

     

       309
       309
       +
       	ttl := 1 * time.Hour

     

       310
       310
       +
       

     

       311
       311
       +
       	// Run concurrent seal/unseal operations

     

       312
       312
       +
       	done := make(chan bool)

     

       313
       313
       +
       	for i := 0; i < 10; i++ {

     

       314
       314
       +
       		go func() {

     

       315
       315
       +
       			for j := 0; j < 100; j++ {

     

       316
       316
       +
       				token, err := client.SealSession(did, sessionID, ttl)

     

       317
       317
       +
       				require.NoError(t, err)

     

       318
       318
       +
       

     

       319
       319
       +
       				session, err := client.UnsealSession(token)

     

       320
       320
       +
       				require.NoError(t, err)

     

       321
       321
       +
       				assert.Equal(t, did, session.DID)

     

       322
       322
       +
       			}

     

       323
       323
       +
       			done <- true

     

       324
       324
       +
       		}()

     

       325
       325
       +
       	}

     

       326
       326
       +
       

     

       327
       327
       +
       	// Wait for all goroutines

     

       328
       328
       +
       	for i := 0; i < 10; i++ {

     

       329
       329
       +
       		<-done

     

       330
       330
       +
       	}

     

       331
       331
       +
       }

+614

internal/atproto/oauth/store.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       	"errors"

     

       7
       7
       +
       	"fmt"

     

       8
       8
       +
       	"log/slog"

     

       9
       9
       +
       	"net/url"

     

       10
       10
       +
       	"strings"

     

       11
       11
       +
       	"time"

     

       12
       12
       +
       

     

       13
       13
       +
       	"github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       14
       14
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       15
       15
       +
       	"github.com/lib/pq"

     

       16
       16
       +
       )

     

       17
       17
       +
       

     

       18
       18
       +
       var (

     

       19
       19
       +
       	ErrSessionNotFound     = errors.New("oauth session not found")

     

       20
       20
       +
       	ErrAuthRequestNotFound = errors.New("oauth auth request not found")

     

       21
       21
       +
       )

     

       22
       22
       +
       

     

       23
       23
       +
       // PostgresOAuthStore implements oauth.ClientAuthStore interface using PostgreSQL

     

       24
       24
       +
       type PostgresOAuthStore struct {

     

       25
       25
       +
       	db         *sql.DB

     

       26
       26
       +
       	sessionTTL time.Duration

     

       27
       27
       +
       }

     

       28
       28
       +
       

     

       29
       29
       +
       // NewPostgresOAuthStore creates a new PostgreSQL-backed OAuth store

     

       30
       30
       +
       func NewPostgresOAuthStore(db *sql.DB, sessionTTL time.Duration) oauth.ClientAuthStore {

     

       31
       31
       +
       	if sessionTTL == 0 {

     

       32
       32
       +
       		sessionTTL = 7 * 24 * time.Hour // Default to 7 days

     

       33
       33
       +
       	}

     

       34
       34
       +
       	return &PostgresOAuthStore{

     

       35
       35
       +
       		db:         db,

     

       36
       36
       +
       		sessionTTL: sessionTTL,

     

       37
       37
       +
       	}

     

       38
       38
       +
       }

     

       39
       39
       +
       

     

       40
       40
       +
       // GetSession retrieves a session by DID and session ID

     

       41
       41
       +
       func (s *PostgresOAuthStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauth.ClientSessionData, error) {

     

       42
       42
       +
       	query := `

     

       43
       43
       +
       		SELECT

     

       44
       44
       +
       			did, session_id, host_url, auth_server_iss,

     

       45
       45
       +
       			auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       46
       46
       +
       			scopes, access_token, refresh_token,

     

       47
       47
       +
       			dpop_authserver_nonce, dpop_pds_nonce, dpop_private_key_multibase

     

       48
       48
       +
       		FROM oauth_sessions

     

       49
       49
       +
       		WHERE did = $1 AND session_id = $2 AND expires_at > NOW()

     

       50
       50
       +
       	`

     

       51
       51
       +
       

     

       52
       52
       +
       	var session oauth.ClientSessionData

     

       53
       53
       +
       	var authServerIss, authServerTokenEndpoint, authServerRevocationEndpoint sql.NullString

     

       54
       54
       +
       	var hostURL, dpopPrivateKeyMultibase sql.NullString

     

       55
       55
       +
       	var scopes pq.StringArray

     

       56
       56
       +
       	var dpopAuthServerNonce, dpopHostNonce sql.NullString

     

       57
       57
       +
       

     

       58
       58
       +
       	err := s.db.QueryRowContext(ctx, query, did.String(), sessionID).Scan(

     

       59
       59
       +
       		&session.AccountDID,

     

       60
       60
       +
       		&session.SessionID,

     

       61
       61
       +
       		&hostURL,

     

       62
       62
       +
       		&authServerIss,

     

       63
       63
       +
       		&authServerTokenEndpoint,

     

       64
       64
       +
       		&authServerRevocationEndpoint,

     

       65
       65
       +
       		&scopes,

     

       66
       66
       +
       		&session.AccessToken,

     

       67
       67
       +
       		&session.RefreshToken,

     

       68
       68
       +
       		&dpopAuthServerNonce,

     

       69
       69
       +
       		&dpopHostNonce,

     

       70
       70
       +
       		&dpopPrivateKeyMultibase,

     

       71
       71
       +
       	)

     

       72
       72
       +
       

     

       73
       73
       +
       	if err == sql.ErrNoRows {

     

       74
       74
       +
       		return nil, ErrSessionNotFound

     

       75
       75
       +
       	}

     

       76
       76
       +
       	if err != nil {

     

       77
       77
       +
       		return nil, fmt.Errorf("failed to get session: %w", err)

     

       78
       78
       +
       	}

     

       79
       79
       +
       

     

       80
       80
       +
       	// Convert nullable fields

     

       81
       81
       +
       	if hostURL.Valid {

     

       82
       82
       +
       		session.HostURL = hostURL.String

     

       83
       83
       +
       	}

     

       84
       84
       +
       	if authServerIss.Valid {

     

       85
       85
       +
       		session.AuthServerURL = authServerIss.String

     

       86
       86
       +
       	}

     

       87
       87
       +
       	if authServerTokenEndpoint.Valid {

     

       88
       88
       +
       		session.AuthServerTokenEndpoint = authServerTokenEndpoint.String

     

       89
       89
       +
       	}

     

       90
       90
       +
       	if authServerRevocationEndpoint.Valid {

     

       91
       91
       +
       		session.AuthServerRevocationEndpoint = authServerRevocationEndpoint.String

     

       92
       92
       +
       	}

     

       93
       93
       +
       	if dpopAuthServerNonce.Valid {

     

       94
       94
       +
       		session.DPoPAuthServerNonce = dpopAuthServerNonce.String

     

       95
       95
       +
       	}

     

       96
       96
       +
       	if dpopHostNonce.Valid {

     

       97
       97
       +
       		session.DPoPHostNonce = dpopHostNonce.String

     

       98
       98
       +
       	}

     

       99
       99
       +
       	if dpopPrivateKeyMultibase.Valid {

     

       100
       100
       +
       		session.DPoPPrivateKeyMultibase = dpopPrivateKeyMultibase.String

     

       101
       101
       +
       	}

     

       102
       102
       +
       	session.Scopes = scopes

     

       103
       103
       +
       

     

       104
       104
       +
       	return &session, nil

     

       105
       105
       +
       }

     

       106
       106
       +
       

     

       107
       107
       +
       // SaveSession saves or updates a session (upsert operation)

     

       108
       108
       +
       func (s *PostgresOAuthStore) SaveSession(ctx context.Context, sess oauth.ClientSessionData) error {

     

       109
       109
       +
       	// Input validation per atProto OAuth security requirements

     

       110
       110
       +
       

     

       111
       111
       +
       	// Validate DID format

     

       112
       112
       +
       	if _, err := syntax.ParseDID(sess.AccountDID.String()); err != nil {

     

       113
       113
       +
       		return fmt.Errorf("invalid DID format: %w", err)

     

       114
       114
       +
       	}

     

       115
       115
       +
       

     

       116
       116
       +
       	// Validate token lengths (max 10000 chars to prevent memory issues)

     

       117
       117
       +
       	const maxTokenLength = 10000

     

       118
       118
       +
       	if len(sess.AccessToken) > maxTokenLength {

     

       119
       119
       +
       		return fmt.Errorf("access_token exceeds maximum length of %d characters", maxTokenLength)

     

       120
       120
       +
       	}

     

       121
       121
       +
       	if len(sess.RefreshToken) > maxTokenLength {

     

       122
       122
       +
       		return fmt.Errorf("refresh_token exceeds maximum length of %d characters", maxTokenLength)

     

       123
       123
       +
       	}

     

       124
       124
       +
       

     

       125
       125
       +
       	// Validate session ID is not empty

     

       126
       126
       +
       	if sess.SessionID == "" {

     

       127
       127
       +
       		return fmt.Errorf("session_id cannot be empty")

     

       128
       128
       +
       	}

     

       129
       129
       +
       

     

       130
       130
       +
       	// Validate URLs if provided

     

       131
       131
       +
       	if sess.HostURL != "" {

     

       132
       132
       +
       		if _, err := url.Parse(sess.HostURL); err != nil {

     

       133
       133
       +
       			return fmt.Errorf("invalid host_url: %w", err)

     

       134
       134
       +
       		}

     

       135
       135
       +
       	}

     

       136
       136
       +
       	if sess.AuthServerURL != "" {

     

       137
       137
       +
       		if _, err := url.Parse(sess.AuthServerURL); err != nil {

     

       138
       138
       +
       			return fmt.Errorf("invalid auth_server URL: %w", err)

     

       139
       139
       +
       		}

     

       140
       140
       +
       	}

     

       141
       141
       +
       	if sess.AuthServerTokenEndpoint != "" {

     

       142
       142
       +
       		if _, err := url.Parse(sess.AuthServerTokenEndpoint); err != nil {

     

       143
       143
       +
       			return fmt.Errorf("invalid auth_server_token_endpoint: %w", err)

     

       144
       144
       +
       		}

     

       145
       145
       +
       	}

     

       146
       146
       +
       	if sess.AuthServerRevocationEndpoint != "" {

     

       147
       147
       +
       		if _, err := url.Parse(sess.AuthServerRevocationEndpoint); err != nil {

     

       148
       148
       +
       			return fmt.Errorf("invalid auth_server_revocation_endpoint: %w", err)

     

       149
       149
       +
       		}

     

       150
       150
       +
       	}

     

       151
       151
       +
       

     

       152
       152
       +
       	query := `

     

       153
       153
       +
       		INSERT INTO oauth_sessions (

     

       154
       154
       +
       			did, session_id, handle, pds_url, host_url,

     

       155
       155
       +
       			access_token, refresh_token,

     

       156
       156
       +
       			dpop_private_jwk, dpop_private_key_multibase,

     

       157
       157
       +
       			dpop_authserver_nonce, dpop_pds_nonce,

     

       158
       158
       +
       			auth_server_iss, auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       159
       159
       +
       			scopes, expires_at, created_at, updated_at

     

       160
       160
       +
       		) VALUES (

     

       161
       161
       +
       			$1, $2, $3, $4, $5,

     

       162
       162
       +
       			$6, $7,

     

       163
       163
       +
       			NULL, $8,

     

       164
       164
       +
       			$9, $10,

     

       165
       165
       +
       			$11, $12, $13,

     

       166
       166
       +
       			$14, $15, NOW(), NOW()

     

       167
       167
       +
       		)

     

       168
       168
       +
       		ON CONFLICT (did, session_id) DO UPDATE SET

     

       169
       169
       +
       			handle = EXCLUDED.handle,

     

       170
       170
       +
       			pds_url = EXCLUDED.pds_url,

     

       171
       171
       +
       			host_url = EXCLUDED.host_url,

     

       172
       172
       +
       			access_token = EXCLUDED.access_token,

     

       173
       173
       +
       			refresh_token = EXCLUDED.refresh_token,

     

       174
       174
       +
       			dpop_private_key_multibase = EXCLUDED.dpop_private_key_multibase,

     

       175
       175
       +
       			dpop_authserver_nonce = EXCLUDED.dpop_authserver_nonce,

     

       176
       176
       +
       			dpop_pds_nonce = EXCLUDED.dpop_pds_nonce,

     

       177
       177
       +
       			auth_server_iss = EXCLUDED.auth_server_iss,

     

       178
       178
       +
       			auth_server_token_endpoint = EXCLUDED.auth_server_token_endpoint,

     

       179
       179
       +
       			auth_server_revocation_endpoint = EXCLUDED.auth_server_revocation_endpoint,

     

       180
       180
       +
       			scopes = EXCLUDED.scopes,

     

       181
       181
       +
       			expires_at = EXCLUDED.expires_at,

     

       182
       182
       +
       			updated_at = NOW()

     

       183
       183
       +
       	`

     

       184
       184
       +
       

     

       185
       185
       +
       	// Calculate token expiration using configured TTL

     

       186
       186
       +
       	expiresAt := time.Now().Add(s.sessionTTL)

     

       187
       187
       +
       

     

       188
       188
       +
       	// Convert empty strings to NULL for optional fields

     

       189
       189
       +
       	var authServerRevocationEndpoint sql.NullString

     

       190
       190
       +
       	if sess.AuthServerRevocationEndpoint != "" {

     

       191
       191
       +
       		authServerRevocationEndpoint.String = sess.AuthServerRevocationEndpoint

     

       192
       192
       +
       		authServerRevocationEndpoint.Valid = true

     

       193
       193
       +
       	}

     

       194
       194
       +
       

     

       195
       195
       +
       	// Extract handle from DID (placeholder - in real implementation, resolve from identity)

     

       196
       196
       +
       	// For now, use DID as handle since we don't have the handle in ClientSessionData

     

       197
       197
       +
       	handle := sess.AccountDID.String()

     

       198
       198
       +
       

     

       199
       199
       +
       	// Use HostURL as PDS URL

     

       200
       200
       +
       	pdsURL := sess.HostURL

     

       201
       201
       +
       	if pdsURL == "" {

     

       202
       202
       +
       		pdsURL = sess.AuthServerURL // Fallback to auth server URL

     

       203
       203
       +
       	}

     

       204
       204
       +
       

     

       205
       205
       +
       	_, err := s.db.ExecContext(

     

       206
       206
       +
       		ctx, query,

     

       207
       207
       +
       		sess.AccountDID.String(),

     

       208
       208
       +
       		sess.SessionID,

     

       209
       209
       +
       		handle,

     

       210
       210
       +
       		pdsURL,

     

       211
       211
       +
       		sess.HostURL,

     

       212
       212
       +
       		sess.AccessToken,

     

       213
       213
       +
       		sess.RefreshToken,

     

       214
       214
       +
       		sess.DPoPPrivateKeyMultibase,

     

       215
       215
       +
       		sess.DPoPAuthServerNonce,

     

       216
       216
       +
       		sess.DPoPHostNonce,

     

       217
       217
       +
       		sess.AuthServerURL,

     

       218
       218
       +
       		sess.AuthServerTokenEndpoint,

     

       219
       219
       +
       		authServerRevocationEndpoint,

     

       220
       220
       +
       		pq.Array(sess.Scopes),

     

       221
       221
       +
       		expiresAt,

     

       222
       222
       +
       	)

     

       223
       223
       +
       	if err != nil {

     

       224
       224
       +
       		return fmt.Errorf("failed to save session: %w", err)

     

       225
       225
       +
       	}

     

       226
       226
       +
       

     

       227
       227
       +
       	return nil

     

       228
       228
       +
       }

     

       229
       229
       +
       

     

       230
       230
       +
       // DeleteSession deletes a session by DID and session ID

     

       231
       231
       +
       func (s *PostgresOAuthStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error {

     

       232
       232
       +
       	query := `DELETE FROM oauth_sessions WHERE did = $1 AND session_id = $2`

     

       233
       233
       +
       

     

       234
       234
       +
       	result, err := s.db.ExecContext(ctx, query, did.String(), sessionID)

     

       235
       235
       +
       	if err != nil {

     

       236
       236
       +
       		return fmt.Errorf("failed to delete session: %w", err)

     

       237
       237
       +
       	}

     

       238
       238
       +
       

     

       239
       239
       +
       	rows, err := result.RowsAffected()

     

       240
       240
       +
       	if err != nil {

     

       241
       241
       +
       		return fmt.Errorf("failed to get rows affected: %w", err)

     

       242
       242
       +
       	}

     

       243
       243
       +
       

     

       244
       244
       +
       	if rows == 0 {

     

       245
       245
       +
       		return ErrSessionNotFound

     

       246
       246
       +
       	}

     

       247
       247
       +
       

     

       248
       248
       +
       	return nil

     

       249
       249
       +
       }

     

       250
       250
       +
       

     

       251
       251
       +
       // GetAuthRequestInfo retrieves auth request information by state

     

       252
       252
       +
       func (s *PostgresOAuthStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauth.AuthRequestData, error) {

     

       253
       253
       +
       	query := `

     

       254
       254
       +
       		SELECT

     

       255
       255
       +
       			state, did, handle, pds_url, pkce_verifier,

     

       256
       256
       +
       			dpop_private_key_multibase, dpop_authserver_nonce,

     

       257
       257
       +
       			auth_server_iss, request_uri,

     

       258
       258
       +
       			auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       259
       259
       +
       			scopes, created_at

     

       260
       260
       +
       		FROM oauth_requests

     

       261
       261
       +
       		WHERE state = $1

     

       262
       262
       +
       	`

     

       263
       263
       +
       

     

       264
       264
       +
       	var info oauth.AuthRequestData

     

       265
       265
       +
       	var did, handle, pdsURL sql.NullString

     

       266
       266
       +
       	var dpopPrivateKeyMultibase, dpopAuthServerNonce sql.NullString

     

       267
       267
       +
       	var requestURI, authServerTokenEndpoint, authServerRevocationEndpoint sql.NullString

     

       268
       268
       +
       	var scopes pq.StringArray

     

       269
       269
       +
       	var createdAt time.Time

     

       270
       270
       +
       

     

       271
       271
       +
       	err := s.db.QueryRowContext(ctx, query, state).Scan(

     

       272
       272
       +
       		&info.State,

     

       273
       273
       +
       		&did,

     

       274
       274
       +
       		&handle,

     

       275
       275
       +
       		&pdsURL,

     

       276
       276
       +
       		&info.PKCEVerifier,

     

       277
       277
       +
       		&dpopPrivateKeyMultibase,

     

       278
       278
       +
       		&dpopAuthServerNonce,

     

       279
       279
       +
       		&info.AuthServerURL,

     

       280
       280
       +
       		&requestURI,

     

       281
       281
       +
       		&authServerTokenEndpoint,

     

       282
       282
       +
       		&authServerRevocationEndpoint,

     

       283
       283
       +
       		&scopes,

     

       284
       284
       +
       		&createdAt,

     

       285
       285
       +
       	)

     

       286
       286
       +
       

     

       287
       287
       +
       	if err == sql.ErrNoRows {

     

       288
       288
       +
       		return nil, ErrAuthRequestNotFound

     

       289
       289
       +
       	}

     

       290
       290
       +
       	if err != nil {

     

       291
       291
       +
       		return nil, fmt.Errorf("failed to get auth request info: %w", err)

     

       292
       292
       +
       	}

     

       293
       293
       +
       

     

       294
       294
       +
       	// Parse DID if present

     

       295
       295
       +
       	if did.Valid && did.String != "" {

     

       296
       296
       +
       		parsedDID, err := syntax.ParseDID(did.String)

     

       297
       297
       +
       		if err != nil {

     

       298
       298
       +
       			return nil, fmt.Errorf("failed to parse DID: %w", err)

     

       299
       299
       +
       		}

     

       300
       300
       +
       		info.AccountDID = &parsedDID

     

       301
       301
       +
       	}

     

       302
       302
       +
       

     

       303
       303
       +
       	// Convert nullable fields

     

       304
       304
       +
       	if dpopPrivateKeyMultibase.Valid {

     

       305
       305
       +
       		info.DPoPPrivateKeyMultibase = dpopPrivateKeyMultibase.String

     

       306
       306
       +
       	}

     

       307
       307
       +
       	if dpopAuthServerNonce.Valid {

     

       308
       308
       +
       		info.DPoPAuthServerNonce = dpopAuthServerNonce.String

     

       309
       309
       +
       	}

     

       310
       310
       +
       	if requestURI.Valid {

     

       311
       311
       +
       		info.RequestURI = requestURI.String

     

       312
       312
       +
       	}

     

       313
       313
       +
       	if authServerTokenEndpoint.Valid {

     

       314
       314
       +
       		info.AuthServerTokenEndpoint = authServerTokenEndpoint.String

     

       315
       315
       +
       	}

     

       316
       316
       +
       	if authServerRevocationEndpoint.Valid {

     

       317
       317
       +
       		info.AuthServerRevocationEndpoint = authServerRevocationEndpoint.String

     

       318
       318
       +
       	}

     

       319
       319
       +
       	info.Scopes = scopes

     

       320
       320
       +
       

     

       321
       321
       +
       	return &info, nil

     

       322
       322
       +
       }

     

       323
       323
       +
       

     

       324
       324
       +
       // SaveAuthRequestInfo saves auth request information (create only, not upsert)

     

       325
       325
       +
       func (s *PostgresOAuthStore) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error {

     

       326
       326
       +
       	query := `

     

       327
       327
       +
       		INSERT INTO oauth_requests (

     

       328
       328
       +
       			state, did, handle, pds_url, pkce_verifier,

     

       329
       329
       +
       			dpop_private_key_multibase, dpop_authserver_nonce,

     

       330
       330
       +
       			auth_server_iss, request_uri,

     

       331
       331
       +
       			auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       332
       332
       +
       			scopes, return_url, created_at

     

       333
       333
       +
       		) VALUES (

     

       334
       334
       +
       			$1, $2, $3, $4, $5,

     

       335
       335
       +
       			$6, $7,

     

       336
       336
       +
       			$8, $9,

     

       337
       337
       +
       			$10, $11,

     

       338
       338
       +
       			$12, NULL, NOW()

     

       339
       339
       +
       		)

     

       340
       340
       +
       	`

     

       341
       341
       +
       

     

       342
       342
       +
       	// Extract DID string if present

     

       343
       343
       +
       	var didStr sql.NullString

     

       344
       344
       +
       	if info.AccountDID != nil {

     

       345
       345
       +
       		didStr.String = info.AccountDID.String()

     

       346
       346
       +
       		didStr.Valid = true

     

       347
       347
       +
       	}

     

       348
       348
       +
       

     

       349
       349
       +
       	// Convert empty strings to NULL for optional fields

     

       350
       350
       +
       	var authServerRevocationEndpoint sql.NullString

     

       351
       351
       +
       	if info.AuthServerRevocationEndpoint != "" {

     

       352
       352
       +
       		authServerRevocationEndpoint.String = info.AuthServerRevocationEndpoint

     

       353
       353
       +
       		authServerRevocationEndpoint.Valid = true

     

       354
       354
       +
       	}

     

       355
       355
       +
       

     

       356
       356
       +
       	// Placeholder values for handle and pds_url (not in AuthRequestData)

     

       357
       357
       +
       	// In production, these would be resolved during the auth flow

     

       358
       358
       +
       	handle := ""

     

       359
       359
       +
       	pdsURL := ""

     

       360
       360
       +
       	if info.AccountDID != nil {

     

       361
       361
       +
       		handle = info.AccountDID.String() // Temporary placeholder

     

       362
       362
       +
       		pdsURL = info.AuthServerURL       // Temporary placeholder

     

       363
       363
       +
       	}

     

       364
       364
       +
       

     

       365
       365
       +
       	_, err := s.db.ExecContext(

     

       366
       366
       +
       		ctx, query,

     

       367
       367
       +
       		info.State,

     

       368
       368
       +
       		didStr,

     

       369
       369
       +
       		handle,

     

       370
       370
       +
       		pdsURL,

     

       371
       371
       +
       		info.PKCEVerifier,

     

       372
       372
       +
       		info.DPoPPrivateKeyMultibase,

     

       373
       373
       +
       		info.DPoPAuthServerNonce,

     

       374
       374
       +
       		info.AuthServerURL,

     

       375
       375
       +
       		info.RequestURI,

     

       376
       376
       +
       		info.AuthServerTokenEndpoint,

     

       377
       377
       +
       		authServerRevocationEndpoint,

     

       378
       378
       +
       		pq.Array(info.Scopes),

     

       379
       379
       +
       	)

     

       380
       380
       +
       	if err != nil {

     

       381
       381
       +
       		// Check for duplicate state

     

       382
       382
       +
       		if strings.Contains(err.Error(), "duplicate key") && strings.Contains(err.Error(), "oauth_requests_state_key") {

     

       383
       383
       +
       			return fmt.Errorf("auth request with state already exists: %s", info.State)

     

       384
       384
       +
       		}

     

       385
       385
       +
       		return fmt.Errorf("failed to save auth request info: %w", err)

     

       386
       386
       +
       	}

     

       387
       387
       +
       

     

       388
       388
       +
       	return nil

     

       389
       389
       +
       }

     

       390
       390
       +
       

     

       391
       391
       +
       // DeleteAuthRequestInfo deletes auth request information by state

     

       392
       392
       +
       func (s *PostgresOAuthStore) DeleteAuthRequestInfo(ctx context.Context, state string) error {

     

       393
       393
       +
       	query := `DELETE FROM oauth_requests WHERE state = $1`

     

       394
       394
       +
       

     

       395
       395
       +
       	result, err := s.db.ExecContext(ctx, query, state)

     

       396
       396
       +
       	if err != nil {

     

       397
       397
       +
       		return fmt.Errorf("failed to delete auth request info: %w", err)

     

       398
       398
       +
       	}

     

       399
       399
       +
       

     

       400
       400
       +
       	rows, err := result.RowsAffected()

     

       401
       401
       +
       	if err != nil {

     

       402
       402
       +
       		return fmt.Errorf("failed to get rows affected: %w", err)

     

       403
       403
       +
       	}

     

       404
       404
       +
       

     

       405
       405
       +
       	if rows == 0 {

     

       406
       406
       +
       		return ErrAuthRequestNotFound

     

       407
       407
       +
       	}

     

       408
       408
       +
       

     

       409
       409
       +
       	return nil

     

       410
       410
       +
       }

     

       411
       411
       +
       

     

       412
       412
       +
       // CleanupExpiredSessions removes sessions that have expired

     

       413
       413
       +
       // Should be called periodically (e.g., via cron job)

     

       414
       414
       +
       func (s *PostgresOAuthStore) CleanupExpiredSessions(ctx context.Context) (int64, error) {

     

       415
       415
       +
       	query := `DELETE FROM oauth_sessions WHERE expires_at < NOW()`

     

       416
       416
       +
       

     

       417
       417
       +
       	result, err := s.db.ExecContext(ctx, query)

     

       418
       418
       +
       	if err != nil {

     

       419
       419
       +
       		return 0, fmt.Errorf("failed to cleanup expired sessions: %w", err)

     

       420
       420
       +
       	}

     

       421
       421
       +
       

     

       422
       422
       +
       	rows, err := result.RowsAffected()

     

       423
       423
       +
       	if err != nil {

     

       424
       424
       +
       		return 0, fmt.Errorf("failed to get rows affected: %w", err)

     

       425
       425
       +
       	}

     

       426
       426
       +
       

     

       427
       427
       +
       	return rows, nil

     

       428
       428
       +
       }

     

       429
       429
       +
       

     

       430
       430
       +
       // CleanupExpiredAuthRequests removes auth requests older than 30 minutes

     

       431
       431
       +
       // Should be called periodically (e.g., via cron job)

     

       432
       432
       +
       func (s *PostgresOAuthStore) CleanupExpiredAuthRequests(ctx context.Context) (int64, error) {

     

       433
       433
       +
       	query := `DELETE FROM oauth_requests WHERE created_at < NOW() - INTERVAL '30 minutes'`

     

       434
       434
       +
       

     

       435
       435
       +
       	result, err := s.db.ExecContext(ctx, query)

     

       436
       436
       +
       	if err != nil {

     

       437
       437
       +
       		return 0, fmt.Errorf("failed to cleanup expired auth requests: %w", err)

     

       438
       438
       +
       	}

     

       439
       439
       +
       

     

       440
       440
       +
       	rows, err := result.RowsAffected()

     

       441
       441
       +
       	if err != nil {

     

       442
       442
       +
       		return 0, fmt.Errorf("failed to get rows affected: %w", err)

     

       443
       443
       +
       	}

     

       444
       444
       +
       

     

       445
       445
       +
       	return rows, nil

     

       446
       446
       +
       }

     

       447
       447
       +
       

     

       448
       448
       +
       // MobileOAuthData holds mobile-specific OAuth flow data

     

       449
       449
       +
       type MobileOAuthData struct {

     

       450
       450
       +
       	CSRFToken   string

     

       451
       451
       +
       	RedirectURI string

     

       452
       452
       +
       }

     

       453
       453
       +
       

     

       454
       454
       +
       // mobileFlowContextKey is the context key for mobile flow data

     

       455
       455
       +
       type mobileFlowContextKey struct{}

     

       456
       456
       +
       

     

       457
       457
       +
       // ContextWithMobileFlowData adds mobile flow data to a context.

     

       458
       458
       +
       // This is used by HandleMobileLogin to pass mobile data to the store wrapper,

     

       459
       459
       +
       // which will save it when SaveAuthRequestInfo is called by indigo.

     

       460
       460
       +
       func ContextWithMobileFlowData(ctx context.Context, data MobileOAuthData) context.Context {

     

       461
       461
       +
       	return context.WithValue(ctx, mobileFlowContextKey{}, data)

     

       462
       462
       +
       }

     

       463
       463
       +
       

     

       464
       464
       +
       // getMobileFlowDataFromContext retrieves mobile flow data from context, if present

     

       465
       465
       +
       func getMobileFlowDataFromContext(ctx context.Context) (MobileOAuthData, bool) {

     

       466
       466
       +
       	data, ok := ctx.Value(mobileFlowContextKey{}).(MobileOAuthData)

     

       467
       467
       +
       	return data, ok

     

       468
       468
       +
       }

     

       469
       469
       +
       

     

       470
       470
       +
       // MobileAwareClientStore is a marker interface that indicates a store is properly

     

       471
       471
       +
       // configured for mobile OAuth flows. Only stores that intercept SaveAuthRequestInfo

     

       472
       472
       +
       // to save mobile CSRF data should implement this interface.

     

       473
       473
       +
       // This prevents silent mobile OAuth breakage when a plain PostgresOAuthStore is used.

     

       474
       474
       +
       type MobileAwareClientStore interface {

     

       475
       475
       +
       	IsMobileAware() bool

     

       476
       476
       +
       }

     

       477
       477
       +
       

     

       478
       478
       +
       // MobileAwareStoreWrapper wraps a ClientAuthStore to automatically save mobile

     

       479
       479
       +
       // CSRF data when SaveAuthRequestInfo is called during a mobile OAuth flow.

     

       480
       480
       +
       // This is necessary because indigo's StartAuthFlow doesn't expose the OAuth state,

     

       481
       481
       +
       // so we intercept the SaveAuthRequestInfo call to capture it.

     

       482
       482
       +
       type MobileAwareStoreWrapper struct {

     

       483
       483
       +
       	oauth.ClientAuthStore

     

       484
       484
       +
       	mobileStore MobileOAuthStore

     

       485
       485
       +
       }

     

       486
       486
       +
       

     

       487
       487
       +
       // IsMobileAware implements MobileAwareClientStore, indicating this store

     

       488
       488
       +
       // properly saves mobile CSRF data during OAuth flow initiation.

     

       489
       489
       +
       func (w *MobileAwareStoreWrapper) IsMobileAware() bool {

     

       490
       490
       +
       	return true

     

       491
       491
       +
       }

     

       492
       492
       +
       

     

       493
       493
       +
       // NewMobileAwareStoreWrapper creates a wrapper that intercepts SaveAuthRequestInfo

     

       494
       494
       +
       // to also save mobile CSRF data when present in context.

     

       495
       495
       +
       func NewMobileAwareStoreWrapper(store oauth.ClientAuthStore) *MobileAwareStoreWrapper {

     

       496
       496
       +
       	wrapper := &MobileAwareStoreWrapper{

     

       497
       497
       +
       		ClientAuthStore: store,

     

       498
       498
       +
       	}

     

       499
       499
       +
       	// Check if the underlying store implements MobileOAuthStore

     

       500
       500
       +
       	if ms, ok := store.(MobileOAuthStore); ok {

     

       501
       501
       +
       		wrapper.mobileStore = ms

     

       502
       502
       +
       	}

     

       503
       503
       +
       	return wrapper

     

       504
       504
       +
       }

     

       505
       505
       +
       

     

       506
       506
       +
       // SaveAuthRequestInfo saves the auth request and also saves mobile CSRF data

     

       507
       507
       +
       // if mobile flow data is present in the context.

     

       508
       508
       +
       func (w *MobileAwareStoreWrapper) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error {

     

       509
       509
       +
       	// First, save the auth request to the underlying store

     

       510
       510
       +
       	if err := w.ClientAuthStore.SaveAuthRequestInfo(ctx, info); err != nil {

     

       511
       511
       +
       		return err

     

       512
       512
       +
       	}

     

       513
       513
       +
       

     

       514
       514
       +
       	// Check if this is a mobile flow (mobile data in context)

     

       515
       515
       +
       	if mobileData, ok := getMobileFlowDataFromContext(ctx); ok && w.mobileStore != nil {

     

       516
       516
       +
       		// Save mobile CSRF data tied to this OAuth state

     

       517
       517
       +
       		// IMPORTANT: If this fails, we MUST propagate the error. Otherwise:

     

       518
       518
       +
       		// 1. No server-side CSRF record is stored

     

       519
       519
       +
       		// 2. Every mobile callback will "fail closed" to web flow

     

       520
       520
       +
       		// 3. Mobile sign-in silently breaks with no indication

     

       521
       521
       +
       		// Failing loudly here lets the user retry rather than being confused

     

       522
       522
       +
       		// about why they're getting a web flow instead of mobile.

     

       523
       523
       +
       		if err := w.mobileStore.SaveMobileOAuthData(ctx, info.State, mobileData); err != nil {

     

       524
       524
       +
       			slog.Error("failed to save mobile CSRF data - mobile login will fail",

     

       525
       525
       +
       				"state", info.State, "error", err)

     

       526
       526
       +
       			return fmt.Errorf("failed to save mobile OAuth data: %w", err)

     

       527
       527
       +
       		}

     

       528
       528
       +
       	}

     

       529
       529
       +
       

     

       530
       530
       +
       	return nil

     

       531
       531
       +
       }

     

       532
       532
       +
       

     

       533
       533
       +
       // GetMobileOAuthData implements MobileOAuthStore interface by delegating to underlying store

     

       534
       534
       +
       func (w *MobileAwareStoreWrapper) GetMobileOAuthData(ctx context.Context, state string) (*MobileOAuthData, error) {

     

       535
       535
       +
       	if w.mobileStore != nil {

     

       536
       536
       +
       		return w.mobileStore.GetMobileOAuthData(ctx, state)

     

       537
       537
       +
       	}

     

       538
       538
       +
       	return nil, nil

     

       539
       539
       +
       }

     

       540
       540
       +
       

     

       541
       541
       +
       // SaveMobileOAuthData implements MobileOAuthStore interface by delegating to underlying store

     

       542
       542
       +
       func (w *MobileAwareStoreWrapper) SaveMobileOAuthData(ctx context.Context, state string, data MobileOAuthData) error {

     

       543
       543
       +
       	if w.mobileStore != nil {

     

       544
       544
       +
       		return w.mobileStore.SaveMobileOAuthData(ctx, state, data)

     

       545
       545
       +
       	}

     

       546
       546
       +
       	return nil

     

       547
       547
       +
       }

     

       548
       548
       +
       

     

       549
       549
       +
       // UnwrapPostgresStore returns the underlying PostgresOAuthStore if present.

     

       550
       550
       +
       // This is useful for accessing cleanup methods that aren't part of the interface.

     

       551
       551
       +
       func (w *MobileAwareStoreWrapper) UnwrapPostgresStore() *PostgresOAuthStore {

     

       552
       552
       +
       	if ps, ok := w.ClientAuthStore.(*PostgresOAuthStore); ok {

     

       553
       553
       +
       		return ps

     

       554
       554
       +
       	}

     

       555
       555
       +
       	return nil

     

       556
       556
       +
       }

     

       557
       557
       +
       

     

       558
       558
       +
       // SaveMobileOAuthData stores mobile CSRF data tied to an OAuth state

     

       559
       559
       +
       // This ties the CSRF token to the OAuth flow via the state parameter,

     

       560
       560
       +
       // which comes back through the OAuth response for server-side validation.

     

       561
       561
       +
       func (s *PostgresOAuthStore) SaveMobileOAuthData(ctx context.Context, state string, data MobileOAuthData) error {

     

       562
       562
       +
       	query := `

     

       563
       563
       +
       		UPDATE oauth_requests

     

       564
       564
       +
       		SET mobile_csrf_token = $2, mobile_redirect_uri = $3

     

       565
       565
       +
       		WHERE state = $1

     

       566
       566
       +
       	`

     

       567
       567
       +
       

     

       568
       568
       +
       	result, err := s.db.ExecContext(ctx, query, state, data.CSRFToken, data.RedirectURI)

     

       569
       569
       +
       	if err != nil {

     

       570
       570
       +
       		return fmt.Errorf("failed to save mobile OAuth data: %w", err)

     

       571
       571
       +
       	}

     

       572
       572
       +
       

     

       573
       573
       +
       	rows, err := result.RowsAffected()

     

       574
       574
       +
       	if err != nil {

     

       575
       575
       +
       		return fmt.Errorf("failed to get rows affected: %w", err)

     

       576
       576
       +
       	}

     

       577
       577
       +
       

     

       578
       578
       +
       	if rows == 0 {

     

       579
       579
       +
       		return ErrAuthRequestNotFound

     

       580
       580
       +
       	}

     

       581
       581
       +
       

     

       582
       582
       +
       	return nil

     

       583
       583
       +
       }

     

       584
       584
       +
       

     

       585
       585
       +
       // GetMobileOAuthData retrieves mobile CSRF data by OAuth state

     

       586
       586
       +
       // This is called during callback to compare the server-side CSRF token

     

       587
       587
       +
       // (retrieved by state from the OAuth response) against the cookie CSRF.

     

       588
       588
       +
       func (s *PostgresOAuthStore) GetMobileOAuthData(ctx context.Context, state string) (*MobileOAuthData, error) {

     

       589
       589
       +
       	query := `

     

       590
       590
       +
       		SELECT mobile_csrf_token, mobile_redirect_uri

     

       591
       591
       +
       		FROM oauth_requests

     

       592
       592
       +
       		WHERE state = $1

     

       593
       593
       +
       	`

     

       594
       594
       +
       

     

       595
       595
       +
       	var csrfToken, redirectURI sql.NullString

     

       596
       596
       +
       	err := s.db.QueryRowContext(ctx, query, state).Scan(&csrfToken, &redirectURI)

     

       597
       597
       +
       

     

       598
       598
       +
       	if err == sql.ErrNoRows {

     

       599
       599
       +
       		return nil, ErrAuthRequestNotFound

     

       600
       600
       +
       	}

     

       601
       601
       +
       	if err != nil {

     

       602
       602
       +
       		return nil, fmt.Errorf("failed to get mobile OAuth data: %w", err)

     

       603
       603
       +
       	}

     

       604
       604
       +
       

     

       605
       605
       +
       	// Return nil if no mobile data was stored (this was a web flow)

     

       606
       606
       +
       	if !csrfToken.Valid {

     

       607
       607
       +
       		return nil, nil

     

       608
       608
       +
       	}

     

       609
       609
       +
       

     

       610
       610
       +
       	return &MobileOAuthData{

     

       611
       611
       +
       		CSRFToken:   csrfToken.String,

     

       612
       612
       +
       		RedirectURI: redirectURI.String,

     

       613
       613
       +
       	}, nil

     

       614
       614
       +
       }

+522

internal/atproto/oauth/store_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       	"os"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       11
       11
       +
       	_ "github.com/lib/pq"

     

       12
       12
       +
       	"github.com/pressly/goose/v3"

     

       13
       13
       +
       	"github.com/stretchr/testify/assert"

     

       14
       14
       +
       	"github.com/stretchr/testify/require"

     

       15
       15
       +
       )

     

       16
       16
       +
       

     

       17
       17
       +
       // setupTestDB creates a test database connection and runs migrations

     

       18
       18
       +
       func setupTestDB(t *testing.T) *sql.DB {

     

       19
       19
       +
       	dsn := os.Getenv("TEST_DATABASE_URL")

     

       20
       20
       +
       	if dsn == "" {

     

       21
       21
       +
       		dsn = "postgres://test_user:test_password@localhost:5434/coves_test?sslmode=disable"

     

       22
       22
       +
       	}

     

       23
       23
       +
       

     

       24
       24
       +
       	db, err := sql.Open("postgres", dsn)

     

       25
       25
       +
       	require.NoError(t, err, "Failed to connect to test database")

     

       26
       26
       +
       

     

       27
       27
       +
       	// Run migrations

     

       28
       28
       +
       	require.NoError(t, goose.Up(db, "../../db/migrations"), "Failed to run migrations")

     

       29
       29
       +
       

     

       30
       30
       +
       	return db

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       // cleanupOAuth removes all test OAuth data from the database

     

       34
       34
       +
       func cleanupOAuth(t *testing.T, db *sql.DB) {

     

       35
       35
       +
       	_, err := db.Exec("DELETE FROM oauth_sessions WHERE did LIKE 'did:plc:test%'")

     

       36
       36
       +
       	require.NoError(t, err, "Failed to cleanup oauth_sessions")

     

       37
       37
       +
       

     

       38
       38
       +
       	_, err = db.Exec("DELETE FROM oauth_requests WHERE state LIKE 'test%'")

     

       39
       39
       +
       	require.NoError(t, err, "Failed to cleanup oauth_requests")

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       func TestPostgresOAuthStore_SaveAndGetSession(t *testing.T) {

     

       43
       43
       +
       	db := setupTestDB(t)

     

       44
       44
       +
       	defer func() { _ = db.Close() }()

     

       45
       45
       +
       	defer cleanupOAuth(t, db)

     

       46
       46
       +
       

     

       47
       47
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       48
       48
       +
       	ctx := context.Background()

     

       49
       49
       +
       

     

       50
       50
       +
       	did, err := syntax.ParseDID("did:plc:test123abc")

     

       51
       51
       +
       	require.NoError(t, err)

     

       52
       52
       +
       

     

       53
       53
       +
       	session := oauth.ClientSessionData{

     

       54
       54
       +
       		AccountDID:                   did,

     

       55
       55
       +
       		SessionID:                    "session123",

     

       56
       56
       +
       		HostURL:                      "https://pds.example.com",

     

       57
       57
       +
       		AuthServerURL:                "https://auth.example.com",

     

       58
       58
       +
       		AuthServerTokenEndpoint:      "https://auth.example.com/oauth/token",

     

       59
       59
       +
       		AuthServerRevocationEndpoint: "https://auth.example.com/oauth/revoke",

     

       60
       60
       +
       		Scopes:                       []string{"atproto"},

     

       61
       61
       +
       		AccessToken:                  "at_test_token_abc123",

     

       62
       62
       +
       		RefreshToken:                 "rt_test_token_xyz789",

     

       63
       63
       +
       		DPoPAuthServerNonce:          "nonce_auth_123",

     

       64
       64
       +
       		DPoPHostNonce:                "nonce_host_456",

     

       65
       65
       +
       		DPoPPrivateKeyMultibase:      "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       66
       66
       +
       	}

     

       67
       67
       +
       

     

       68
       68
       +
       	// Save session

     

       69
       69
       +
       	err = store.SaveSession(ctx, session)

     

       70
       70
       +
       	assert.NoError(t, err)

     

       71
       71
       +
       

     

       72
       72
       +
       	// Retrieve session

     

       73
       73
       +
       	retrieved, err := store.GetSession(ctx, did, "session123")

     

       74
       74
       +
       	assert.NoError(t, err)

     

       75
       75
       +
       	assert.NotNil(t, retrieved)

     

       76
       76
       +
       	assert.Equal(t, session.AccountDID.String(), retrieved.AccountDID.String())

     

       77
       77
       +
       	assert.Equal(t, session.SessionID, retrieved.SessionID)

     

       78
       78
       +
       	assert.Equal(t, session.HostURL, retrieved.HostURL)

     

       79
       79
       +
       	assert.Equal(t, session.AuthServerURL, retrieved.AuthServerURL)

     

       80
       80
       +
       	assert.Equal(t, session.AuthServerTokenEndpoint, retrieved.AuthServerTokenEndpoint)

     

       81
       81
       +
       	assert.Equal(t, session.AccessToken, retrieved.AccessToken)

     

       82
       82
       +
       	assert.Equal(t, session.RefreshToken, retrieved.RefreshToken)

     

       83
       83
       +
       	assert.Equal(t, session.DPoPAuthServerNonce, retrieved.DPoPAuthServerNonce)

     

       84
       84
       +
       	assert.Equal(t, session.DPoPHostNonce, retrieved.DPoPHostNonce)

     

       85
       85
       +
       	assert.Equal(t, session.DPoPPrivateKeyMultibase, retrieved.DPoPPrivateKeyMultibase)

     

       86
       86
       +
       	assert.Equal(t, session.Scopes, retrieved.Scopes)

     

       87
       87
       +
       }

     

       88
       88
       +
       

     

       89
       89
       +
       func TestPostgresOAuthStore_SaveSession_Upsert(t *testing.T) {

     

       90
       90
       +
       	db := setupTestDB(t)

     

       91
       91
       +
       	defer func() { _ = db.Close() }()

     

       92
       92
       +
       	defer cleanupOAuth(t, db)

     

       93
       93
       +
       

     

       94
       94
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       95
       95
       +
       	ctx := context.Background()

     

       96
       96
       +
       

     

       97
       97
       +
       	did, err := syntax.ParseDID("did:plc:testupsert")

     

       98
       98
       +
       	require.NoError(t, err)

     

       99
       99
       +
       

     

       100
       100
       +
       	// Initial session

     

       101
       101
       +
       	session1 := oauth.ClientSessionData{

     

       102
       102
       +
       		AccountDID:              did,

     

       103
       103
       +
       		SessionID:               "session_upsert",

     

       104
       104
       +
       		HostURL:                 "https://pds1.example.com",

     

       105
       105
       +
       		AuthServerURL:           "https://auth1.example.com",

     

       106
       106
       +
       		AuthServerTokenEndpoint: "https://auth1.example.com/oauth/token",

     

       107
       107
       +
       		Scopes:                  []string{"atproto"},

     

       108
       108
       +
       		AccessToken:             "old_access_token",

     

       109
       109
       +
       		RefreshToken:            "old_refresh_token",

     

       110
       110
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	err = store.SaveSession(ctx, session1)

     

       114
       114
       +
       	require.NoError(t, err)

     

       115
       115
       +
       

     

       116
       116
       +
       	// Updated session (same DID and session ID)

     

       117
       117
       +
       	session2 := oauth.ClientSessionData{

     

       118
       118
       +
       		AccountDID:              did,

     

       119
       119
       +
       		SessionID:               "session_upsert",

     

       120
       120
       +
       		HostURL:                 "https://pds2.example.com",

     

       121
       121
       +
       		AuthServerURL:           "https://auth2.example.com",

     

       122
       122
       +
       		AuthServerTokenEndpoint: "https://auth2.example.com/oauth/token",

     

       123
       123
       +
       		Scopes:                  []string{"atproto", "transition:generic"},

     

       124
       124
       +
       		AccessToken:             "new_access_token",

     

       125
       125
       +
       		RefreshToken:            "new_refresh_token",

     

       126
       126
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktX",

     

       127
       127
       +
       	}

     

       128
       128
       +
       

     

       129
       129
       +
       	// Save again - should update

     

       130
       130
       +
       	err = store.SaveSession(ctx, session2)

     

       131
       131
       +
       	assert.NoError(t, err)

     

       132
       132
       +
       

     

       133
       133
       +
       	// Retrieve should get updated values

     

       134
       134
       +
       	retrieved, err := store.GetSession(ctx, did, "session_upsert")

     

       135
       135
       +
       	assert.NoError(t, err)

     

       136
       136
       +
       	assert.Equal(t, "new_access_token", retrieved.AccessToken)

     

       137
       137
       +
       	assert.Equal(t, "new_refresh_token", retrieved.RefreshToken)

     

       138
       138
       +
       	assert.Equal(t, "https://pds2.example.com", retrieved.HostURL)

     

       139
       139
       +
       	assert.Equal(t, []string{"atproto", "transition:generic"}, retrieved.Scopes)

     

       140
       140
       +
       }

     

       141
       141
       +
       

     

       142
       142
       +
       func TestPostgresOAuthStore_GetSession_NotFound(t *testing.T) {

     

       143
       143
       +
       	db := setupTestDB(t)

     

       144
       144
       +
       	defer func() { _ = db.Close() }()

     

       145
       145
       +
       

     

       146
       146
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       147
       147
       +
       	ctx := context.Background()

     

       148
       148
       +
       

     

       149
       149
       +
       	did, err := syntax.ParseDID("did:plc:nonexistent")

     

       150
       150
       +
       	require.NoError(t, err)

     

       151
       151
       +
       

     

       152
       152
       +
       	_, err = store.GetSession(ctx, did, "nonexistent_session")

     

       153
       153
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       154
       154
       +
       }

     

       155
       155
       +
       

     

       156
       156
       +
       func TestPostgresOAuthStore_DeleteSession(t *testing.T) {

     

       157
       157
       +
       	db := setupTestDB(t)

     

       158
       158
       +
       	defer func() { _ = db.Close() }()

     

       159
       159
       +
       	defer cleanupOAuth(t, db)

     

       160
       160
       +
       

     

       161
       161
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       162
       162
       +
       	ctx := context.Background()

     

       163
       163
       +
       

     

       164
       164
       +
       	did, err := syntax.ParseDID("did:plc:testdelete")

     

       165
       165
       +
       	require.NoError(t, err)

     

       166
       166
       +
       

     

       167
       167
       +
       	session := oauth.ClientSessionData{

     

       168
       168
       +
       		AccountDID:              did,

     

       169
       169
       +
       		SessionID:               "session_delete",

     

       170
       170
       +
       		HostURL:                 "https://pds.example.com",

     

       171
       171
       +
       		AuthServerURL:           "https://auth.example.com",

     

       172
       172
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       173
       173
       +
       		Scopes:                  []string{"atproto"},

     

       174
       174
       +
       		AccessToken:             "test_token",

     

       175
       175
       +
       		RefreshToken:            "test_refresh",

     

       176
       176
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       177
       177
       +
       	}

     

       178
       178
       +
       

     

       179
       179
       +
       	// Save session

     

       180
       180
       +
       	err = store.SaveSession(ctx, session)

     

       181
       181
       +
       	require.NoError(t, err)

     

       182
       182
       +
       

     

       183
       183
       +
       	// Delete session

     

       184
       184
       +
       	err = store.DeleteSession(ctx, did, "session_delete")

     

       185
       185
       +
       	assert.NoError(t, err)

     

       186
       186
       +
       

     

       187
       187
       +
       	// Verify session is gone

     

       188
       188
       +
       	_, err = store.GetSession(ctx, did, "session_delete")

     

       189
       189
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       190
       190
       +
       }

     

       191
       191
       +
       

     

       192
       192
       +
       func TestPostgresOAuthStore_DeleteSession_NotFound(t *testing.T) {

     

       193
       193
       +
       	db := setupTestDB(t)

     

       194
       194
       +
       	defer func() { _ = db.Close() }()

     

       195
       195
       +
       

     

       196
       196
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       197
       197
       +
       	ctx := context.Background()

     

       198
       198
       +
       

     

       199
       199
       +
       	did, err := syntax.ParseDID("did:plc:nonexistent")

     

       200
       200
       +
       	require.NoError(t, err)

     

       201
       201
       +
       

     

       202
       202
       +
       	err = store.DeleteSession(ctx, did, "nonexistent_session")

     

       203
       203
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       204
       204
       +
       }

     

       205
       205
       +
       

     

       206
       206
       +
       func TestPostgresOAuthStore_SaveAndGetAuthRequestInfo(t *testing.T) {

     

       207
       207
       +
       	db := setupTestDB(t)

     

       208
       208
       +
       	defer func() { _ = db.Close() }()

     

       209
       209
       +
       	defer cleanupOAuth(t, db)

     

       210
       210
       +
       

     

       211
       211
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       212
       212
       +
       	ctx := context.Background()

     

       213
       213
       +
       

     

       214
       214
       +
       	did, err := syntax.ParseDID("did:plc:testrequest")

     

       215
       215
       +
       	require.NoError(t, err)

     

       216
       216
       +
       

     

       217
       217
       +
       	info := oauth.AuthRequestData{

     

       218
       218
       +
       		State:                        "test_state_abc123",

     

       219
       219
       +
       		AuthServerURL:                "https://auth.example.com",

     

       220
       220
       +
       		AccountDID:                   &did,

     

       221
       221
       +
       		Scopes:                       []string{"atproto"},

     

       222
       222
       +
       		RequestURI:                   "urn:ietf:params:oauth:request_uri:abc123",

     

       223
       223
       +
       		AuthServerTokenEndpoint:      "https://auth.example.com/oauth/token",

     

       224
       224
       +
       		AuthServerRevocationEndpoint: "https://auth.example.com/oauth/revoke",

     

       225
       225
       +
       		PKCEVerifier:                 "verifier_xyz789",

     

       226
       226
       +
       		DPoPAuthServerNonce:          "nonce_abc",

     

       227
       227
       +
       		DPoPPrivateKeyMultibase:      "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       228
       228
       +
       	}

     

       229
       229
       +
       

     

       230
       230
       +
       	// Save auth request info

     

       231
       231
       +
       	err = store.SaveAuthRequestInfo(ctx, info)

     

       232
       232
       +
       	assert.NoError(t, err)

     

       233
       233
       +
       

     

       234
       234
       +
       	// Retrieve auth request info

     

       235
       235
       +
       	retrieved, err := store.GetAuthRequestInfo(ctx, "test_state_abc123")

     

       236
       236
       +
       	assert.NoError(t, err)

     

       237
       237
       +
       	assert.NotNil(t, retrieved)

     

       238
       238
       +
       	assert.Equal(t, info.State, retrieved.State)

     

       239
       239
       +
       	assert.Equal(t, info.AuthServerURL, retrieved.AuthServerURL)

     

       240
       240
       +
       	assert.NotNil(t, retrieved.AccountDID)

     

       241
       241
       +
       	assert.Equal(t, info.AccountDID.String(), retrieved.AccountDID.String())

     

       242
       242
       +
       	assert.Equal(t, info.Scopes, retrieved.Scopes)

     

       243
       243
       +
       	assert.Equal(t, info.RequestURI, retrieved.RequestURI)

     

       244
       244
       +
       	assert.Equal(t, info.AuthServerTokenEndpoint, retrieved.AuthServerTokenEndpoint)

     

       245
       245
       +
       	assert.Equal(t, info.PKCEVerifier, retrieved.PKCEVerifier)

     

       246
       246
       +
       	assert.Equal(t, info.DPoPAuthServerNonce, retrieved.DPoPAuthServerNonce)

     

       247
       247
       +
       	assert.Equal(t, info.DPoPPrivateKeyMultibase, retrieved.DPoPPrivateKeyMultibase)

     

       248
       248
       +
       }

     

       249
       249
       +
       

     

       250
       250
       +
       func TestPostgresOAuthStore_SaveAuthRequestInfo_NoDID(t *testing.T) {

     

       251
       251
       +
       	db := setupTestDB(t)

     

       252
       252
       +
       	defer func() { _ = db.Close() }()

     

       253
       253
       +
       	defer cleanupOAuth(t, db)

     

       254
       254
       +
       

     

       255
       255
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       256
       256
       +
       	ctx := context.Background()

     

       257
       257
       +
       

     

       258
       258
       +
       	info := oauth.AuthRequestData{

     

       259
       259
       +
       		State:                   "test_state_nodid",

     

       260
       260
       +
       		AuthServerURL:           "https://auth.example.com",

     

       261
       261
       +
       		AccountDID:              nil, // No DID provided

     

       262
       262
       +
       		Scopes:                  []string{"atproto"},

     

       263
       263
       +
       		RequestURI:              "urn:ietf:params:oauth:request_uri:nodid",

     

       264
       264
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       265
       265
       +
       		PKCEVerifier:            "verifier_nodid",

     

       266
       266
       +
       		DPoPAuthServerNonce:     "nonce_nodid",

     

       267
       267
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       268
       268
       +
       	}

     

       269
       269
       +
       

     

       270
       270
       +
       	// Save auth request info without DID

     

       271
       271
       +
       	err := store.SaveAuthRequestInfo(ctx, info)

     

       272
       272
       +
       	assert.NoError(t, err)

     

       273
       273
       +
       

     

       274
       274
       +
       	// Retrieve and verify DID is nil

     

       275
       275
       +
       	retrieved, err := store.GetAuthRequestInfo(ctx, "test_state_nodid")

     

       276
       276
       +
       	assert.NoError(t, err)

     

       277
       277
       +
       	assert.Nil(t, retrieved.AccountDID)

     

       278
       278
       +
       	assert.Equal(t, info.State, retrieved.State)

     

       279
       279
       +
       }

     

       280
       280
       +
       

     

       281
       281
       +
       func TestPostgresOAuthStore_GetAuthRequestInfo_NotFound(t *testing.T) {

     

       282
       282
       +
       	db := setupTestDB(t)

     

       283
       283
       +
       	defer func() { _ = db.Close() }()

     

       284
       284
       +
       

     

       285
       285
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       286
       286
       +
       	ctx := context.Background()

     

       287
       287
       +
       

     

       288
       288
       +
       	_, err := store.GetAuthRequestInfo(ctx, "nonexistent_state")

     

       289
       289
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       290
       290
       +
       }

     

       291
       291
       +
       

     

       292
       292
       +
       func TestPostgresOAuthStore_DeleteAuthRequestInfo(t *testing.T) {

     

       293
       293
       +
       	db := setupTestDB(t)

     

       294
       294
       +
       	defer func() { _ = db.Close() }()

     

       295
       295
       +
       	defer cleanupOAuth(t, db)

     

       296
       296
       +
       

     

       297
       297
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       298
       298
       +
       	ctx := context.Background()

     

       299
       299
       +
       

     

       300
       300
       +
       	info := oauth.AuthRequestData{

     

       301
       301
       +
       		State:                   "test_state_delete",

     

       302
       302
       +
       		AuthServerURL:           "https://auth.example.com",

     

       303
       303
       +
       		Scopes:                  []string{"atproto"},

     

       304
       304
       +
       		RequestURI:              "urn:ietf:params:oauth:request_uri:delete",

     

       305
       305
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       306
       306
       +
       		PKCEVerifier:            "verifier_delete",

     

       307
       307
       +
       		DPoPAuthServerNonce:     "nonce_delete",

     

       308
       308
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       309
       309
       +
       	}

     

       310
       310
       +
       

     

       311
       311
       +
       	// Save auth request info

     

       312
       312
       +
       	err := store.SaveAuthRequestInfo(ctx, info)

     

       313
       313
       +
       	require.NoError(t, err)

     

       314
       314
       +
       

     

       315
       315
       +
       	// Delete auth request info

     

       316
       316
       +
       	err = store.DeleteAuthRequestInfo(ctx, "test_state_delete")

     

       317
       317
       +
       	assert.NoError(t, err)

     

       318
       318
       +
       

     

       319
       319
       +
       	// Verify it's gone

     

       320
       320
       +
       	_, err = store.GetAuthRequestInfo(ctx, "test_state_delete")

     

       321
       321
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       322
       322
       +
       }

     

       323
       323
       +
       

     

       324
       324
       +
       func TestPostgresOAuthStore_DeleteAuthRequestInfo_NotFound(t *testing.T) {

     

       325
       325
       +
       	db := setupTestDB(t)

     

       326
       326
       +
       	defer func() { _ = db.Close() }()

     

       327
       327
       +
       

     

       328
       328
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       329
       329
       +
       	ctx := context.Background()

     

       330
       330
       +
       

     

       331
       331
       +
       	err := store.DeleteAuthRequestInfo(ctx, "nonexistent_state")

     

       332
       332
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       333
       333
       +
       }

     

       334
       334
       +
       

     

       335
       335
       +
       func TestPostgresOAuthStore_CleanupExpiredSessions(t *testing.T) {

     

       336
       336
       +
       	db := setupTestDB(t)

     

       337
       337
       +
       	defer func() { _ = db.Close() }()

     

       338
       338
       +
       	defer cleanupOAuth(t, db)

     

       339
       339
       +
       

     

       340
       340
       +
       	storeInterface := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       341
       341
       +
       	store, ok := storeInterface.(*PostgresOAuthStore)

     

       342
       342
       +
       	require.True(t, ok, "store should be *PostgresOAuthStore")

     

       343
       343
       +
       	ctx := context.Background()

     

       344
       344
       +
       

     

       345
       345
       +
       	did1, err := syntax.ParseDID("did:plc:testexpired1")

     

       346
       346
       +
       	require.NoError(t, err)

     

       347
       347
       +
       	did2, err := syntax.ParseDID("did:plc:testexpired2")

     

       348
       348
       +
       	require.NoError(t, err)

     

       349
       349
       +
       

     

       350
       350
       +
       	// Create an expired session (manually insert with past expiration)

     

       351
       351
       +
       	_, err = db.ExecContext(ctx, `

     

       352
       352
       +
       		INSERT INTO oauth_sessions (

     

       353
       353
       +
       			did, session_id, handle, pds_url, host_url,

     

       354
       354
       +
       			access_token, refresh_token,

     

       355
       355
       +
       			dpop_private_key_multibase, auth_server_iss,

     

       356
       356
       +
       			auth_server_token_endpoint, scopes,

     

       357
       357
       +
       			expires_at, created_at

     

       358
       358
       +
       		) VALUES (

     

       359
       359
       +
       			$1, $2, $3, $4, $5,

     

       360
       360
       +
       			$6, $7,

     

       361
       361
       +
       			$8, $9,

     

       362
       362
       +
       			$10, $11,

     

       363
       363
       +
       			NOW() - INTERVAL '1 day', NOW()

     

       364
       364
       +
       		)

     

       365
       365
       +
       	`, did1.String(), "expired_session", "test.handle", "https://pds.example.com", "https://pds.example.com",

     

       366
       366
       +
       		"expired_token", "expired_refresh",

     

       367
       367
       +
       		"z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH", "https://auth.example.com",

     

       368
       368
       +
       		"https://auth.example.com/oauth/token", `{"atproto"}`)

     

       369
       369
       +
       	require.NoError(t, err)

     

       370
       370
       +
       

     

       371
       371
       +
       	// Create a valid session

     

       372
       372
       +
       	validSession := oauth.ClientSessionData{

     

       373
       373
       +
       		AccountDID:              did2,

     

       374
       374
       +
       		SessionID:               "valid_session",

     

       375
       375
       +
       		HostURL:                 "https://pds.example.com",

     

       376
       376
       +
       		AuthServerURL:           "https://auth.example.com",

     

       377
       377
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       378
       378
       +
       		Scopes:                  []string{"atproto"},

     

       379
       379
       +
       		AccessToken:             "valid_token",

     

       380
       380
       +
       		RefreshToken:            "valid_refresh",

     

       381
       381
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       382
       382
       +
       	}

     

       383
       383
       +
       	err = store.SaveSession(ctx, validSession)

     

       384
       384
       +
       	require.NoError(t, err)

     

       385
       385
       +
       

     

       386
       386
       +
       	// Cleanup expired sessions

     

       387
       387
       +
       	count, err := store.CleanupExpiredSessions(ctx)

     

       388
       388
       +
       	assert.NoError(t, err)

     

       389
       389
       +
       	assert.Equal(t, int64(1), count, "Should delete 1 expired session")

     

       390
       390
       +
       

     

       391
       391
       +
       	// Verify expired session is gone

     

       392
       392
       +
       	_, err = store.GetSession(ctx, did1, "expired_session")

     

       393
       393
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       394
       394
       +
       

     

       395
       395
       +
       	// Verify valid session still exists

     

       396
       396
       +
       	_, err = store.GetSession(ctx, did2, "valid_session")

     

       397
       397
       +
       	assert.NoError(t, err)

     

       398
       398
       +
       }

     

       399
       399
       +
       

     

       400
       400
       +
       func TestPostgresOAuthStore_CleanupExpiredAuthRequests(t *testing.T) {

     

       401
       401
       +
       	db := setupTestDB(t)

     

       402
       402
       +
       	defer func() { _ = db.Close() }()

     

       403
       403
       +
       	defer cleanupOAuth(t, db)

     

       404
       404
       +
       

     

       405
       405
       +
       	storeInterface := NewPostgresOAuthStore(db, 0)

     

       406
       406
       +
       	pgStore, ok := storeInterface.(*PostgresOAuthStore)

     

       407
       407
       +
       	require.True(t, ok, "store should be *PostgresOAuthStore")

     

       408
       408
       +
       	store := oauth.ClientAuthStore(pgStore)

     

       409
       409
       +
       	ctx := context.Background()

     

       410
       410
       +
       

     

       411
       411
       +
       	// Create an old auth request (manually insert with old timestamp)

     

       412
       412
       +
       	_, err := db.ExecContext(ctx, `

     

       413
       413
       +
       		INSERT INTO oauth_requests (

     

       414
       414
       +
       			state, did, handle, pds_url, pkce_verifier,

     

       415
       415
       +
       			dpop_private_key_multibase, dpop_authserver_nonce,

     

       416
       416
       +
       			auth_server_iss, request_uri,

     

       417
       417
       +
       			auth_server_token_endpoint, scopes,

     

       418
       418
       +
       			created_at

     

       419
       419
       +
       		) VALUES (

     

       420
       420
       +
       			$1, $2, $3, $4, $5,

     

       421
       421
       +
       			$6, $7,

     

       422
       422
       +
       			$8, $9,

     

       423
       423
       +
       			$10, $11,

     

       424
       424
       +
       			NOW() - INTERVAL '1 hour'

     

       425
       425
       +
       		)

     

       426
       426
       +
       	`, "test_old_state", "did:plc:testold", "test.handle", "https://pds.example.com",

     

       427
       427
       +
       		"old_verifier", "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       428
       428
       +
       		"nonce_old", "https://auth.example.com", "urn:ietf:params:oauth:request_uri:old",

     

       429
       429
       +
       		"https://auth.example.com/oauth/token", `{"atproto"}`)

     

       430
       430
       +
       	require.NoError(t, err)

     

       431
       431
       +
       

     

       432
       432
       +
       	// Create a recent auth request

     

       433
       433
       +
       	recentInfo := oauth.AuthRequestData{

     

       434
       434
       +
       		State:                   "test_recent_state",

     

       435
       435
       +
       		AuthServerURL:           "https://auth.example.com",

     

       436
       436
       +
       		Scopes:                  []string{"atproto"},

     

       437
       437
       +
       		RequestURI:              "urn:ietf:params:oauth:request_uri:recent",

     

       438
       438
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       439
       439
       +
       		PKCEVerifier:            "recent_verifier",

     

       440
       440
       +
       		DPoPAuthServerNonce:     "nonce_recent",

     

       441
       441
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       442
       442
       +
       	}

     

       443
       443
       +
       	err = store.SaveAuthRequestInfo(ctx, recentInfo)

     

       444
       444
       +
       	require.NoError(t, err)

     

       445
       445
       +
       

     

       446
       446
       +
       	// Cleanup expired auth requests (older than 30 minutes)

     

       447
       447
       +
       	count, err := pgStore.CleanupExpiredAuthRequests(ctx)

     

       448
       448
       +
       	assert.NoError(t, err)

     

       449
       449
       +
       	assert.Equal(t, int64(1), count, "Should delete 1 expired auth request")

     

       450
       450
       +
       

     

       451
       451
       +
       	// Verify old request is gone

     

       452
       452
       +
       	_, err = store.GetAuthRequestInfo(ctx, "test_old_state")

     

       453
       453
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       454
       454
       +
       

     

       455
       455
       +
       	// Verify recent request still exists

     

       456
       456
       +
       	_, err = store.GetAuthRequestInfo(ctx, "test_recent_state")

     

       457
       457
       +
       	assert.NoError(t, err)

     

       458
       458
       +
       }

     

       459
       459
       +
       

     

       460
       460
       +
       func TestPostgresOAuthStore_MultipleSessions(t *testing.T) {

     

       461
       461
       +
       	db := setupTestDB(t)

     

       462
       462
       +
       	defer func() { _ = db.Close() }()

     

       463
       463
       +
       	defer cleanupOAuth(t, db)

     

       464
       464
       +
       

     

       465
       465
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       466
       466
       +
       	ctx := context.Background()

     

       467
       467
       +
       

     

       468
       468
       +
       	did, err := syntax.ParseDID("did:plc:testmulti")

     

       469
       469
       +
       	require.NoError(t, err)

     

       470
       470
       +
       

     

       471
       471
       +
       	// Create multiple sessions for the same DID

     

       472
       472
       +
       	session1 := oauth.ClientSessionData{

     

       473
       473
       +
       		AccountDID:              did,

     

       474
       474
       +
       		SessionID:               "browser1",

     

       475
       475
       +
       		HostURL:                 "https://pds.example.com",

     

       476
       476
       +
       		AuthServerURL:           "https://auth.example.com",

     

       477
       477
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       478
       478
       +
       		Scopes:                  []string{"atproto"},

     

       479
       479
       +
       		AccessToken:             "token_browser1",

     

       480
       480
       +
       		RefreshToken:            "refresh_browser1",

     

       481
       481
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       482
       482
       +
       	}

     

       483
       483
       +
       

     

       484
       484
       +
       	session2 := oauth.ClientSessionData{

     

       485
       485
       +
       		AccountDID:              did,

     

       486
       486
       +
       		SessionID:               "mobile_app",

     

       487
       487
       +
       		HostURL:                 "https://pds.example.com",

     

       488
       488
       +
       		AuthServerURL:           "https://auth.example.com",

     

       489
       489
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       490
       490
       +
       		Scopes:                  []string{"atproto"},

     

       491
       491
       +
       		AccessToken:             "token_mobile",

     

       492
       492
       +
       		RefreshToken:            "refresh_mobile",

     

       493
       493
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktX",

     

       494
       494
       +
       	}

     

       495
       495
       +
       

     

       496
       496
       +
       	// Save both sessions

     

       497
       497
       +
       	err = store.SaveSession(ctx, session1)

     

       498
       498
       +
       	require.NoError(t, err)

     

       499
       499
       +
       	err = store.SaveSession(ctx, session2)

     

       500
       500
       +
       	require.NoError(t, err)

     

       501
       501
       +
       

     

       502
       502
       +
       	// Retrieve both sessions

     

       503
       503
       +
       	retrieved1, err := store.GetSession(ctx, did, "browser1")

     

       504
       504
       +
       	assert.NoError(t, err)

     

       505
       505
       +
       	assert.Equal(t, "token_browser1", retrieved1.AccessToken)

     

       506
       506
       +
       

     

       507
       507
       +
       	retrieved2, err := store.GetSession(ctx, did, "mobile_app")

     

       508
       508
       +
       	assert.NoError(t, err)

     

       509
       509
       +
       	assert.Equal(t, "token_mobile", retrieved2.AccessToken)

     

       510
       510
       +
       

     

       511
       511
       +
       	// Delete one session

     

       512
       512
       +
       	err = store.DeleteSession(ctx, did, "browser1")

     

       513
       513
       +
       	assert.NoError(t, err)

     

       514
       514
       +
       

     

       515
       515
       +
       	// Verify only browser1 is deleted

     

       516
       516
       +
       	_, err = store.GetSession(ctx, did, "browser1")

     

       517
       517
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       518
       518
       +
       

     

       519
       519
       +
       	// mobile_app should still exist

     

       520
       520
       +
       	_, err = store.GetSession(ctx, did, "mobile_app")

     

       521
       521
       +
       	assert.NoError(t, err)

     

       522
       522
       +
       }

+99

internal/atproto/oauth/transport.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"net"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // ssrfSafeTransport wraps http.Transport to prevent SSRF attacks

     

       11
       11
       +
       type ssrfSafeTransport struct {

     

       12
       12
       +
       	base         *http.Transport

     

       13
       13
       +
       	allowPrivate bool // For dev/testing only

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // isPrivateIP checks if an IP is in a private/reserved range

     

       17
       17
       +
       func isPrivateIP(ip net.IP) bool {

     

       18
       18
       +
       	if ip == nil {

     

       19
       19
       +
       		return false

     

       20
       20
       +
       	}

     

       21
       21
       +
       

     

       22
       22
       +
       	// Check for loopback

     

       23
       23
       +
       	if ip.IsLoopback() {

     

       24
       24
       +
       		return true

     

       25
       25
       +
       	}

     

       26
       26
       +
       

     

       27
       27
       +
       	// Check for link-local

     

       28
       28
       +
       	if ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {

     

       29
       29
       +
       		return true

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	// Check for private ranges

     

       33
       33
       +
       	privateRanges := []string{

     

       34
       34
       +
       		"10.0.0.0/8",

     

       35
       35
       +
       		"172.16.0.0/12",

     

       36
       36
       +
       		"192.168.0.0/16",

     

       37
       37
       +
       		"169.254.0.0/16",

     

       38
       38
       +
       		"::1/128",

     

       39
       39
       +
       		"fc00::/7",

     

       40
       40
       +
       		"fe80::/10",

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	for _, cidr := range privateRanges {

     

       44
       44
       +
       		_, network, err := net.ParseCIDR(cidr)

     

       45
       45
       +
       		if err == nil && network.Contains(ip) {

     

       46
       46
       +
       			return true

     

       47
       47
       +
       		}

     

       48
       48
       +
       	}

     

       49
       49
       +
       

     

       50
       50
       +
       	return false

     

       51
       51
       +
       }

     

       52
       52
       +
       

     

       53
       53
       +
       func (t *ssrfSafeTransport) RoundTrip(req *http.Request) (*http.Response, error) {

     

       54
       54
       +
       	host := req.URL.Hostname()

     

       55
       55
       +
       

     

       56
       56
       +
       	// Resolve hostname to IP

     

       57
       57
       +
       	ips, err := net.LookupIP(host)

     

       58
       58
       +
       	if err != nil {

     

       59
       59
       +
       		return nil, fmt.Errorf("failed to resolve host: %w", err)

     

       60
       60
       +
       	}

     

       61
       61
       +
       

     

       62
       62
       +
       	// Check all resolved IPs

     

       63
       63
       +
       	if !t.allowPrivate {

     

       64
       64
       +
       		for _, ip := range ips {

     

       65
       65
       +
       			if isPrivateIP(ip) {

     

       66
       66
       +
       				return nil, fmt.Errorf("SSRF blocked: %s resolves to private IP %s", host, ip)

     

       67
       67
       +
       			}

     

       68
       68
       +
       		}

     

       69
       69
       +
       	}

     

       70
       70
       +
       

     

       71
       71
       +
       	return t.base.RoundTrip(req)

     

       72
       72
       +
       }

     

       73
       73
       +
       

     

       74
       74
       +
       // NewSSRFSafeHTTPClient creates an HTTP client with SSRF protections

     

       75
       75
       +
       func NewSSRFSafeHTTPClient(allowPrivate bool) *http.Client {

     

       76
       76
       +
       	transport := &ssrfSafeTransport{

     

       77
       77
       +
       		base: &http.Transport{

     

       78
       78
       +
       			DialContext: (&net.Dialer{

     

       79
       79
       +
       				Timeout:   10 * time.Second,

     

       80
       80
       +
       				KeepAlive: 30 * time.Second,

     

       81
       81
       +
       			}).DialContext,

     

       82
       82
       +
       			MaxIdleConns:        100,

     

       83
       83
       +
       			IdleConnTimeout:     90 * time.Second,

     

       84
       84
       +
       			TLSHandshakeTimeout: 10 * time.Second,

     

       85
       85
       +
       		},

     

       86
       86
       +
       		allowPrivate: allowPrivate,

     

       87
       87
       +
       	}

     

       88
       88
       +
       

     

       89
       89
       +
       	return &http.Client{

     

       90
       90
       +
       		Timeout:   15 * time.Second,

     

       91
       91
       +
       		Transport: transport,

     

       92
       92
       +
       		CheckRedirect: func(req *http.Request, via []*http.Request) error {

     

       93
       93
       +
       			if len(via) >= 5 {

     

       94
       94
       +
       				return fmt.Errorf("too many redirects")

     

       95
       95
       +
       			}

     

       96
       96
       +
       			return nil

     

       97
       97
       +
       		},

     

       98
       98
       +
       	}

     

       99
       99
       +
       }

+132

internal/atproto/oauth/transport_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"net"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"testing"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       func TestIsPrivateIP(t *testing.T) {

     

       10
       10
       +
       	tests := []struct {

     

       11
       11
       +
       		name     string

     

       12
       12
       +
       		ip       string

     

       13
       13
       +
       		expected bool

     

       14
       14
       +
       	}{

     

       15
       15
       +
       		// Loopback addresses

     

       16
       16
       +
       		{"IPv4 loopback", "127.0.0.1", true},

     

       17
       17
       +
       		{"IPv6 loopback", "::1", true},

     

       18
       18
       +
       

     

       19
       19
       +
       		// Private IPv4 ranges

     

       20
       20
       +
       		{"Private 10.x.x.x", "10.0.0.1", true},

     

       21
       21
       +
       		{"Private 10.x.x.x edge", "10.255.255.255", true},

     

       22
       22
       +
       		{"Private 172.16.x.x", "172.16.0.1", true},

     

       23
       23
       +
       		{"Private 172.31.x.x edge", "172.31.255.255", true},

     

       24
       24
       +
       		{"Private 192.168.x.x", "192.168.1.1", true},

     

       25
       25
       +
       		{"Private 192.168.x.x edge", "192.168.255.255", true},

     

       26
       26
       +
       

     

       27
       27
       +
       		// Link-local addresses

     

       28
       28
       +
       		{"Link-local IPv4", "169.254.1.1", true},

     

       29
       29
       +
       		{"Link-local IPv6", "fe80::1", true},

     

       30
       30
       +
       

     

       31
       31
       +
       		// IPv6 private ranges

     

       32
       32
       +
       		{"IPv6 unique local fc00", "fc00::1", true},

     

       33
       33
       +
       		{"IPv6 unique local fd00", "fd00::1", true},

     

       34
       34
       +
       

     

       35
       35
       +
       		// Public addresses

     

       36
       36
       +
       		{"Public IP 1.1.1.1", "1.1.1.1", false},

     

       37
       37
       +
       		{"Public IP 8.8.8.8", "8.8.8.8", false},

     

       38
       38
       +
       		{"Public IP 172.15.0.1", "172.15.0.1", false},  // Just before 172.16/12

     

       39
       39
       +
       		{"Public IP 172.32.0.1", "172.32.0.1", false},  // Just after 172.31/12

     

       40
       40
       +
       		{"Public IP 11.0.0.1", "11.0.0.1", false},      // Just after 10/8

     

       41
       41
       +
       		{"Public IPv6", "2001:4860:4860::8888", false}, // Google DNS

     

       42
       42
       +
       	}

     

       43
       43
       +
       

     

       44
       44
       +
       	for _, tt := range tests {

     

       45
       45
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       46
       46
       +
       			ip := net.ParseIP(tt.ip)

     

       47
       47
       +
       			if ip == nil {

     

       48
       48
       +
       				t.Fatalf("Failed to parse IP: %s", tt.ip)

     

       49
       49
       +
       			}

     

       50
       50
       +
       

     

       51
       51
       +
       			result := isPrivateIP(ip)

     

       52
       52
       +
       			if result != tt.expected {

     

       53
       53
       +
       				t.Errorf("isPrivateIP(%s) = %v, expected %v", tt.ip, result, tt.expected)

     

       54
       54
       +
       			}

     

       55
       55
       +
       		})

     

       56
       56
       +
       	}

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       func TestIsPrivateIP_NilIP(t *testing.T) {

     

       60
       60
       +
       	result := isPrivateIP(nil)

     

       61
       61
       +
       	if result != false {

     

       62
       62
       +
       		t.Errorf("isPrivateIP(nil) = %v, expected false", result)

     

       63
       63
       +
       	}

     

       64
       64
       +
       }

     

       65
       65
       +
       

     

       66
       66
       +
       func TestNewSSRFSafeHTTPClient(t *testing.T) {

     

       67
       67
       +
       	tests := []struct {

     

       68
       68
       +
       		name         string

     

       69
       69
       +
       		allowPrivate bool

     

       70
       70
       +
       	}{

     

       71
       71
       +
       		{"Production client (no private IPs)", false},

     

       72
       72
       +
       		{"Development client (allow private IPs)", true},

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	for _, tt := range tests {

     

       76
       76
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       77
       77
       +
       			client := NewSSRFSafeHTTPClient(tt.allowPrivate)

     

       78
       78
       +
       

     

       79
       79
       +
       			if client == nil {

     

       80
       80
       +
       				t.Fatal("NewSSRFSafeHTTPClient returned nil")

     

       81
       81
       +
       			}

     

       82
       82
       +
       

     

       83
       83
       +
       			if client.Timeout == 0 {

     

       84
       84
       +
       				t.Error("Expected timeout to be set")

     

       85
       85
       +
       			}

     

       86
       86
       +
       

     

       87
       87
       +
       			if client.Transport == nil {

     

       88
       88
       +
       				t.Error("Expected transport to be set")

     

       89
       89
       +
       			}

     

       90
       90
       +
       

     

       91
       91
       +
       			transport, ok := client.Transport.(*ssrfSafeTransport)

     

       92
       92
       +
       			if !ok {

     

       93
       93
       +
       				t.Error("Expected ssrfSafeTransport")

     

       94
       94
       +
       			}

     

       95
       95
       +
       

     

       96
       96
       +
       			if transport.allowPrivate != tt.allowPrivate {

     

       97
       97
       +
       				t.Errorf("Expected allowPrivate=%v, got %v", tt.allowPrivate, transport.allowPrivate)

     

       98
       98
       +
       			}

     

       99
       99
       +
       		})

     

       100
       100
       +
       	}

     

       101
       101
       +
       }

     

       102
       102
       +
       

     

       103
       103
       +
       func TestSSRFSafeHTTPClient_RedirectLimit(t *testing.T) {

     

       104
       104
       +
       	client := NewSSRFSafeHTTPClient(false)

     

       105
       105
       +
       

     

       106
       106
       +
       	// Simulate checking redirect limit

     

       107
       107
       +
       	if client.CheckRedirect == nil {

     

       108
       108
       +
       		t.Fatal("Expected CheckRedirect to be set")

     

       109
       109
       +
       	}

     

       110
       110
       +
       

     

       111
       111
       +
       	// Test redirect limit (5 redirects)

     

       112
       112
       +
       	var via []*http.Request

     

       113
       113
       +
       	for i := 0; i < 5; i++ {

     

       114
       114
       +
       		req := &http.Request{}

     

       115
       115
       +
       		via = append(via, req)

     

       116
       116
       +
       	}

     

       117
       117
       +
       

     

       118
       118
       +
       	err := client.CheckRedirect(nil, via)

     

       119
       119
       +
       	if err == nil {

     

       120
       120
       +
       		t.Error("Expected error for too many redirects")

     

       121
       121
       +
       	}

     

       122
       122
       +
       	if err.Error() != "too many redirects" {

     

       123
       123
       +
       		t.Errorf("Expected 'too many redirects' error, got: %v", err)

     

       124
       124
       +
       	}

     

       125
       125
       +
       

     

       126
       126
       +
       	// Test within limit (4 redirects)

     

       127
       127
       +
       	via = via[:4]

     

       128
       128
       +
       	err = client.CheckRedirect(nil, via)

     

       129
       129
       +
       	if err != nil {

     

       130
       130
       +
       		t.Errorf("Expected no error for 4 redirects, got: %v", err)

     

       131
       131
       +
       	}

     

       132
       132
       +
       }

+124

internal/db/migrations/019_update_oauth_for_indigo.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Update OAuth tables to match indigo's ClientAuthStore interface requirements

     

       3
       3
       +
       -- This migration adds columns needed for OAuth client sessions and auth requests

     

       4
       4
       +
       

     

       5
       5
       +
       -- Update oauth_requests table

     

       6
       6
       +
       -- Add columns for request URI, auth server endpoints, scopes, and DPoP key

     

       7
       7
       +
       ALTER TABLE oauth_requests

     

       8
       8
       +
           ADD COLUMN request_uri TEXT,

     

       9
       9
       +
           ADD COLUMN auth_server_token_endpoint TEXT,

     

       10
       10
       +
           ADD COLUMN auth_server_revocation_endpoint TEXT,

     

       11
       11
       +
           ADD COLUMN scopes TEXT[],

     

       12
       12
       +
           ADD COLUMN dpop_private_key_multibase TEXT;

     

       13
       13
       +
       

     

       14
       14
       +
       -- Make original dpop_private_jwk nullable (we now use dpop_private_key_multibase)

     

       15
       15
       +
       ALTER TABLE oauth_requests ALTER COLUMN dpop_private_jwk DROP NOT NULL;

     

       16
       16
       +
       

     

       17
       17
       +
       -- Make did nullable (indigo's AuthRequestData.AccountDID is a pointer - optional)

     

       18
       18
       +
       ALTER TABLE oauth_requests ALTER COLUMN did DROP NOT NULL;

     

       19
       19
       +
       

     

       20
       20
       +
       -- Make handle and pds_url nullable too (derived from DID resolution, not always available at auth request time)

     

       21
       21
       +
       ALTER TABLE oauth_requests ALTER COLUMN handle DROP NOT NULL;

     

       22
       22
       +
       ALTER TABLE oauth_requests ALTER COLUMN pds_url DROP NOT NULL;

     

       23
       23
       +
       

     

       24
       24
       +
       -- Update existing oauth_requests data

     

       25
       25
       +
       -- Convert dpop_private_jwk (JSONB) to multibase format if needed

     

       26
       26
       +
       -- Note: This will leave the multibase column NULL for now since conversion requires crypto logic

     

       27
       27
       +
       -- The application will need to handle NULL values or regenerate keys on next auth flow

     

       28
       28
       +
       UPDATE oauth_requests

     

       29
       29
       +
       SET

     

       30
       30
       +
           auth_server_token_endpoint = auth_server_iss || '/oauth/token',

     

       31
       31
       +
           scopes = ARRAY['atproto']::TEXT[]

     

       32
       32
       +
       WHERE auth_server_token_endpoint IS NULL;

     

       33
       33
       +
       

     

       34
       34
       +
       -- Add indexes for new columns

     

       35
       35
       +
       CREATE INDEX idx_oauth_requests_request_uri ON oauth_requests(request_uri) WHERE request_uri IS NOT NULL;

     

       36
       36
       +
       

     

       37
       37
       +
       -- Update oauth_sessions table

     

       38
       38
       +
       -- Add session_id column (will become part of composite key)

     

       39
       39
       +
       ALTER TABLE oauth_sessions

     

       40
       40
       +
           ADD COLUMN session_id TEXT,

     

       41
       41
       +
           ADD COLUMN host_url TEXT,

     

       42
       42
       +
           ADD COLUMN auth_server_token_endpoint TEXT,

     

       43
       43
       +
           ADD COLUMN auth_server_revocation_endpoint TEXT,

     

       44
       44
       +
           ADD COLUMN scopes TEXT[],

     

       45
       45
       +
           ADD COLUMN dpop_private_key_multibase TEXT;

     

       46
       46
       +
       

     

       47
       47
       +
       -- Make original dpop_private_jwk nullable (we now use dpop_private_key_multibase)

     

       48
       48
       +
       ALTER TABLE oauth_sessions ALTER COLUMN dpop_private_jwk DROP NOT NULL;

     

       49
       49
       +
       

     

       50
       50
       +
       -- Populate session_id for existing sessions (use DID as default for single-session per account)

     

       51
       51
       +
       -- In production, you may want to generate unique session IDs

     

       52
       52
       +
       UPDATE oauth_sessions

     

       53
       53
       +
       SET

     

       54
       54
       +
           session_id = 'default',

     

       55
       55
       +
           host_url = pds_url,

     

       56
       56
       +
           auth_server_token_endpoint = auth_server_iss || '/oauth/token',

     

       57
       57
       +
           scopes = ARRAY['atproto']::TEXT[]

     

       58
       58
       +
       WHERE session_id IS NULL;

     

       59
       59
       +
       

     

       60
       60
       +
       -- Make session_id NOT NULL after populating existing data

     

       61
       61
       +
       ALTER TABLE oauth_sessions

     

       62
       62
       +
           ALTER COLUMN session_id SET NOT NULL;

     

       63
       63
       +
       

     

       64
       64
       +
       -- Drop old unique constraint on did only

     

       65
       65
       +
       ALTER TABLE oauth_sessions

     

       66
       66
       +
           DROP CONSTRAINT IF EXISTS oauth_sessions_did_key;

     

       67
       67
       +
       

     

       68
       68
       +
       -- Create new composite unique constraint for (did, session_id)

     

       69
       69
       +
       -- This allows multiple sessions per account

     

       70
       70
       +
       -- Note: UNIQUE constraint automatically creates an index, so no separate index needed

     

       71
       71
       +
       ALTER TABLE oauth_sessions

     

       72
       72
       +
           ADD CONSTRAINT oauth_sessions_did_session_id_key UNIQUE (did, session_id);

     

       73
       73
       +
       

     

       74
       74
       +
       -- Add comment explaining the schema change

     

       75
       75
       +
       COMMENT ON COLUMN oauth_sessions.session_id IS 'Session identifier to support multiple concurrent sessions per account';

     

       76
       76
       +
       COMMENT ON CONSTRAINT oauth_sessions_did_session_id_key ON oauth_sessions IS 'Composite key allowing multiple sessions per DID';

     

       77
       77
       +
       

     

       78
       78
       +
       -- +goose Down

     

       79
       79
       +
       -- Rollback: Remove added columns and restore original unique constraint

     

       80
       80
       +
       

     

       81
       81
       +
       -- oauth_sessions rollback

     

       82
       82
       +
       -- Drop composite unique constraint (this also drops the associated index)

     

       83
       83
       +
       ALTER TABLE oauth_sessions

     

       84
       84
       +
           DROP CONSTRAINT IF EXISTS oauth_sessions_did_session_id_key;

     

       85
       85
       +
       

     

       86
       86
       +
       -- Delete all but the most recent session per DID before restoring unique constraint

     

       87
       87
       +
       -- This ensures the UNIQUE (did) constraint can be added without conflicts

     

       88
       88
       +
       DELETE FROM oauth_sessions a

     

       89
       89
       +
       USING oauth_sessions b

     

       90
       90
       +
       WHERE a.did = b.did

     

       91
       91
       +
         AND a.created_at < b.created_at;

     

       92
       92
       +
       

     

       93
       93
       +
       -- Restore old unique constraint

     

       94
       94
       +
       ALTER TABLE oauth_sessions

     

       95
       95
       +
           ADD CONSTRAINT oauth_sessions_did_key UNIQUE (did);

     

       96
       96
       +
       

     

       97
       97
       +
       -- Restore NOT NULL constraint on dpop_private_jwk

     

       98
       98
       +
       ALTER TABLE oauth_sessions

     

       99
       99
       +
           ALTER COLUMN dpop_private_jwk SET NOT NULL;

     

       100
       100
       +
       

     

       101
       101
       +
       ALTER TABLE oauth_sessions

     

       102
       102
       +
           DROP COLUMN IF EXISTS dpop_private_key_multibase,

     

       103
       103
       +
           DROP COLUMN IF EXISTS scopes,

     

       104
       104
       +
           DROP COLUMN IF EXISTS auth_server_revocation_endpoint,

     

       105
       105
       +
           DROP COLUMN IF EXISTS auth_server_token_endpoint,

     

       106
       106
       +
           DROP COLUMN IF EXISTS host_url,

     

       107
       107
       +
           DROP COLUMN IF EXISTS session_id;

     

       108
       108
       +
       

     

       109
       109
       +
       -- oauth_requests rollback

     

       110
       110
       +
       DROP INDEX IF EXISTS idx_oauth_requests_request_uri;

     

       111
       111
       +
       

     

       112
       112
       +
       -- Restore NOT NULL constraints

     

       113
       113
       +
       ALTER TABLE oauth_requests

     

       114
       114
       +
           ALTER COLUMN dpop_private_jwk SET NOT NULL,

     

       115
       115
       +
           ALTER COLUMN did SET NOT NULL,

     

       116
       116
       +
           ALTER COLUMN handle SET NOT NULL,

     

       117
       117
       +
           ALTER COLUMN pds_url SET NOT NULL;

     

       118
       118
       +
       

     

       119
       119
       +
       ALTER TABLE oauth_requests

     

       120
       120
       +
           DROP COLUMN IF EXISTS dpop_private_key_multibase,

     

       121
       121
       +
           DROP COLUMN IF EXISTS scopes,

     

       122
       122
       +
           DROP COLUMN IF EXISTS auth_server_revocation_endpoint,

     

       123
       123
       +
           DROP COLUMN IF EXISTS auth_server_token_endpoint,

     

       124
       124
       +
           DROP COLUMN IF EXISTS request_uri;

+23

internal/db/migrations/020_add_mobile_oauth_csrf.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Add columns for mobile OAuth CSRF protection with server-side state

     

       3
       3
       +
       -- This ties the CSRF token to the OAuth state, allowing validation against

     

       4
       4
       +
       -- a value that comes back through the OAuth response (the state parameter)

     

       5
       5
       +
       -- rather than only validating cookies against each other.

     

       6
       6
       +
       

     

       7
       7
       +
       ALTER TABLE oauth_requests

     

       8
       8
       +
           ADD COLUMN mobile_csrf_token TEXT,

     

       9
       9
       +
           ADD COLUMN mobile_redirect_uri TEXT;

     

       10
       10
       +
       

     

       11
       11
       +
       -- Index for quick lookup of mobile data when callback is received

     

       12
       12
       +
       CREATE INDEX idx_oauth_requests_mobile_csrf ON oauth_requests(state)

     

       13
       13
       +
           WHERE mobile_csrf_token IS NOT NULL;

     

       14
       14
       +
       

     

       15
       15
       +
       COMMENT ON COLUMN oauth_requests.mobile_csrf_token IS 'CSRF token for mobile OAuth flows, validated against cookie on callback';

     

       16
       16
       +
       COMMENT ON COLUMN oauth_requests.mobile_redirect_uri IS 'Mobile redirect URI (Universal Link) for this OAuth flow';

     

       17
       17
       +
       

     

       18
       18
       +
       -- +goose Down

     

       19
       19
       +
       DROP INDEX IF EXISTS idx_oauth_requests_mobile_csrf;

     

       20
       20
       +
       

     

       21
       21
       +
       ALTER TABLE oauth_requests

     

       22
       22
       +
           DROP COLUMN IF EXISTS mobile_redirect_uri,

     

       23
       23
       +
           DROP COLUMN IF EXISTS mobile_csrf_token;

+137

internal/api/handlers/wellknown/universal_links.go

···

       1
       1
       +
       package wellknown

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"encoding/json"

     

       5
       5
       +
       	"log/slog"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       	"os"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // HandleAppleAppSiteAssociation serves the iOS Universal Links configuration

     

       11
       11
       +
       // GET /.well-known/apple-app-site-association

     

       12
       12
       +
       //

     

       13
       13
       +
       // Universal Links provide cryptographic binding between the app and domain:

     

       14
       14
       +
       // - Requires apple-app-site-association file served over HTTPS

     

       15
       15
       +
       // - App must have Associated Domains capability configured

     

       16
       16
       +
       // - System verifies domain ownership before routing deep links

     

       17
       17
       +
       // - Prevents malicious apps from intercepting deep links

     

       18
       18
       +
       //

     

       19
       19
       +
       // Spec: https://developer.apple.com/documentation/xcode/supporting-universal-links-in-your-app

     

       20
       20
       +
       func HandleAppleAppSiteAssociation(w http.ResponseWriter, r *http.Request) {

     

       21
       21
       +
       	// Get Apple App ID from environment (format: <Team ID>.<Bundle ID>)

     

       22
       22
       +
       	// Example: "ABCD1234.social.coves.app"

     

       23
       23
       +
       	// Find Team ID in Apple Developer Portal -> Membership

     

       24
       24
       +
       	// Bundle ID is configured in Xcode project

     

       25
       25
       +
       	appleAppID := os.Getenv("APPLE_APP_ID")

     

       26
       26
       +
       	if appleAppID == "" {

     

       27
       27
       +
       		// Development fallback - allows testing without real Team ID

     

       28
       28
       +
       		// IMPORTANT: This MUST be set in production for Universal Links to work

     

       29
       29
       +
       		appleAppID = "DEVELOPMENT.social.coves.app"

     

       30
       30
       +
       		slog.Warn("APPLE_APP_ID not set, using development placeholder",

     

       31
       31
       +
       			"app_id", appleAppID,

     

       32
       32
       +
       			"note", "Set APPLE_APP_ID env var for production Universal Links")

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	// Apple requires application/json content type (no charset)

     

       36
       36
       +
       	w.Header().Set("Content-Type", "application/json")

     

       37
       37
       +
       

     

       38
       38
       +
       	// Construct the response per Apple's spec

     

       39
       39
       +
       	// See: https://developer.apple.com/documentation/bundleresources/applinks

     

       40
       40
       +
       	response := map[string]interface{}{

     

       41
       41
       +
       		"applinks": map[string]interface{}{

     

       42
       42
       +
       			"apps": []string{}, // Must be empty array per Apple spec

     

       43
       43
       +
       			"details": []map[string]interface{}{

     

       44
       44
       +
       				{

     

       45
       45
       +
       					"appID": appleAppID,

     

       46
       46
       +
       					// Paths that trigger Universal Links when opened in Safari/other apps

     

       47
       47
       +
       					// These URLs will open the app instead of the browser

     

       48
       48
       +
       					"paths": []string{

     

       49
       49
       +
       						"/app/oauth/callback",   // Primary Universal Link OAuth callback

     

       50
       50
       +
       						"/app/oauth/callback/*", // Catch-all for query params

     

       51
       51
       +
       					},

     

       52
       52
       +
       				},

     

       53
       53
       +
       			},

     

       54
       54
       +
       		},

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	if err := json.NewEncoder(w).Encode(response); err != nil {

     

       58
       58
       +
       		slog.Error("failed to encode apple-app-site-association", "error", err)

     

       59
       59
       +
       		http.Error(w, "internal server error", http.StatusInternalServerError)

     

       60
       60
       +
       		return

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	slog.Debug("served apple-app-site-association", "app_id", appleAppID)

     

       64
       64
       +
       }

     

       65
       65
       +
       

     

       66
       66
       +
       // HandleAssetLinks serves the Android App Links configuration

     

       67
       67
       +
       // GET /.well-known/assetlinks.json

     

       68
       68
       +
       //

     

       69
       69
       +
       // App Links provide cryptographic binding between the app and domain:

     

       70
       70
       +
       // - Requires assetlinks.json file served over HTTPS

     

       71
       71
       +
       // - App must have intent-filter with android:autoVerify="true"

     

       72
       72
       +
       // - System verifies domain ownership via SHA-256 certificate fingerprint

     

       73
       73
       +
       // - Prevents malicious apps from intercepting deep links

     

       74
       74
       +
       //

     

       75
       75
       +
       // Spec: https://developer.android.com/training/app-links/verify-android-applinks

     

       76
       76
       +
       func HandleAssetLinks(w http.ResponseWriter, r *http.Request) {

     

       77
       77
       +
       	// Get Android package name from environment

     

       78
       78
       +
       	// Example: "social.coves.app"

     

       79
       79
       +
       	androidPackage := os.Getenv("ANDROID_PACKAGE_NAME")

     

       80
       80
       +
       	if androidPackage == "" {

     

       81
       81
       +
       		androidPackage = "social.coves.app" // Default for development

     

       82
       82
       +
       		slog.Warn("ANDROID_PACKAGE_NAME not set, using default",

     

       83
       83
       +
       			"package", androidPackage,

     

       84
       84
       +
       			"note", "Set ANDROID_PACKAGE_NAME env var for production App Links")

     

       85
       85
       +
       	}

     

       86
       86
       +
       

     

       87
       87
       +
       	// Get SHA-256 fingerprint from environment

     

       88
       88
       +
       	// This is the SHA-256 fingerprint of the app's signing certificate

     

       89
       89
       +
       	//

     

       90
       90
       +
       	// To get the fingerprint:

     

       91
       91
       +
       	// Production: keytool -list -v -keystore release.jks -alias release

     

       92
       92
       +
       	// Debug: keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android

     

       93
       93
       +
       	//

     

       94
       94
       +
       	// Look for "SHA256:" in the output

     

       95
       95
       +
       	// Format: AA:BB:CC:DD:...:FF (64 hex characters separated by colons)

     

       96
       96
       +
       	androidFingerprint := os.Getenv("ANDROID_SHA256_FINGERPRINT")

     

       97
       97
       +
       	if androidFingerprint == "" {

     

       98
       98
       +
       		// Development fallback - this won't work for real App Links verification

     

       99
       99
       +
       		// IMPORTANT: This MUST be set in production for App Links to work

     

       100
       100
       +
       		androidFingerprint = "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"

     

       101
       101
       +
       		slog.Warn("ANDROID_SHA256_FINGERPRINT not set, using development placeholder",

     

       102
       102
       +
       			"fingerprint", androidFingerprint,

     

       103
       103
       +
       			"note", "Set ANDROID_SHA256_FINGERPRINT env var for production App Links")

     

       104
       104
       +
       	}

     

       105
       105
       +
       

     

       106
       106
       +
       	w.Header().Set("Content-Type", "application/json")

     

       107
       107
       +
       

     

       108
       108
       +
       	// Construct the response per Google's Digital Asset Links spec

     

       109
       109
       +
       	// See: https://developers.google.com/digital-asset-links/v1/getting-started

     

       110
       110
       +
       	response := []map[string]interface{}{

     

       111
       111
       +
       		{

     

       112
       112
       +
       			// delegate_permission/common.handle_all_urls grants the app permission

     

       113
       113
       +
       			// to handle URLs for this domain

     

       114
       114
       +
       			"relation": []string{"delegate_permission/common.handle_all_urls"},

     

       115
       115
       +
       			"target": map[string]interface{}{

     

       116
       116
       +
       				"namespace":    "android_app",

     

       117
       117
       +
       				"package_name": androidPackage,

     

       118
       118
       +
       				// List of certificate fingerprints that can sign the app

     

       119
       119
       +
       				// Multiple fingerprints can be provided for different signing keys

     

       120
       120
       +
       				// (e.g., debug + release)

     

       121
       121
       +
       				"sha256_cert_fingerprints": []string{

     

       122
       122
       +
       					androidFingerprint,

     

       123
       123
       +
       				},

     

       124
       124
       +
       			},

     

       125
       125
       +
       		},

     

       126
       126
       +
       	}

     

       127
       127
       +
       

     

       128
       128
       +
       	if err := json.NewEncoder(w).Encode(response); err != nil {

     

       129
       129
       +
       		slog.Error("failed to encode assetlinks.json", "error", err)

     

       130
       130
       +
       		http.Error(w, "internal server error", http.StatusInternalServerError)

     

       131
       131
       +
       		return

     

       132
       132
       +
       	}

     

       133
       133
       +
       

     

       134
       134
       +
       	slog.Debug("served assetlinks.json",

     

       135
       135
       +
       		"package", androidPackage,

     

       136
       136
       +
       		"fingerprint", androidFingerprint)

     

       137
       137
       +
       }

+25

internal/api/routes/wellknown.go

···

       1
       1
       +
       package routes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/wellknown"

     

       5
       5
       +
       

     

       6
       6
       +
       	"github.com/go-chi/chi/v5"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       // RegisterWellKnownRoutes registers RFC 8615 well-known URI endpoints

     

       10
       10
       +
       // These endpoints are used for service discovery and mobile app deep linking

     

       11
       11
       +
       //

     

       12
       12
       +
       // Spec: https://www.rfc-editor.org/rfc/rfc8615.html

     

       13
       13
       +
       func RegisterWellKnownRoutes(r chi.Router) {

     

       14
       14
       +
       	// iOS Universal Links configuration

     

       15
       15
       +
       	// Required for cryptographically-bound deep linking on iOS

     

       16
       16
       +
       	// Must be served at exact path /.well-known/apple-app-site-association

     

       17
       17
       +
       	// Content-Type: application/json (no redirects allowed)

     

       18
       18
       +
       	r.Get("/.well-known/apple-app-site-association", wellknown.HandleAppleAppSiteAssociation)

     

       19
       19
       +
       

     

       20
       20
       +
       	// Android App Links configuration

     

       21
       21
       +
       	// Required for cryptographically-bound deep linking on Android

     

       22
       22
       +
       	// Must be served at exact path /.well-known/assetlinks.json

     

       23
       23
       +
       	// Content-Type: application/json (no redirects allowed)

     

       24
       24
       +
       	r.Get("/.well-known/assetlinks.json", wellknown.HandleAssetLinks)

     

       25
       25
       +
       }

+1 -1

internal/api/handlers/comments/middleware.go

···

       17
       17
        
       // The middleware extracts the viewer DID from the Authorization header if present and valid,

     

       18
       18
        
       // making it available via middleware.GetUserDID(r) in the handler.

     

       19
       19
        
       // If no valid token is present, the request continues as anonymous (empty DID).

     

       20
       20
       -
       func OptionalAuthMiddleware(authMiddleware *middleware.AtProtoAuthMiddleware, next http.HandlerFunc) http.Handler {

     

       20
       20
       +
       func OptionalAuthMiddleware(authMiddleware *middleware.OAuthAuthMiddleware, next http.HandlerFunc) http.Handler {

     

       21
       21
        
       	return authMiddleware.OptionalAuth(http.HandlerFunc(next))

     

       22
       22
        
       }

+1 -1

internal/api/routes/community.go

···

       11
       11
        
       // RegisterCommunityRoutes registers community-related XRPC endpoints on the router

     

       12
       12
        
       // Implements social.coves.community.* lexicon endpoints

     

       13
       13
        
       // allowedCommunityCreators restricts who can create communities. If empty, anyone can create.

     

       14
       14
       -
       func RegisterCommunityRoutes(r chi.Router, service communities.Service, authMiddleware *middleware.AtProtoAuthMiddleware, allowedCommunityCreators []string) {

     

       14
       14
       +
       func RegisterCommunityRoutes(r chi.Router, service communities.Service, authMiddleware *middleware.OAuthAuthMiddleware, allowedCommunityCreators []string) {

     

       15
       15
        
       	// Initialize handlers

     

       16
       16
        
       	createHandler := community.NewCreateHandler(service, allowedCommunityCreators)

     

       17
       17
        
       	getHandler := community.NewGetHandler(service)

+1 -1

internal/api/routes/post.go

···

       10
       10
        
       

     

       11
       11
        
       // RegisterPostRoutes registers post-related XRPC endpoints on the router

     

       12
       12
        
       // Implements social.coves.community.post.* lexicon endpoints

     

       13
       13
       -
       func RegisterPostRoutes(r chi.Router, service posts.Service, authMiddleware *middleware.AtProtoAuthMiddleware) {

     

       13
       13
       +
       func RegisterPostRoutes(r chi.Router, service posts.Service, authMiddleware *middleware.OAuthAuthMiddleware) {

     

       14
       14
        
       	// Initialize handlers

     

       15
       15
        
       	createHandler := post.NewCreateHandler(service)

     

       16
       16

+291

tests/e2e/oauth_ratelimit_e2e_test.go

···

       1
       1
       +
       package e2e

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // TestRateLimiting_E2E_OAuthEndpoints tests OAuth-specific rate limiting

     

       14
       14
       +
       // OAuth endpoints have stricter rate limits to prevent:

     

       15
       15
       +
       // - Credential stuffing attacks on login endpoints (10 req/min)

     

       16
       16
       +
       // - OAuth state exhaustion

     

       17
       17
       +
       // - Refresh token abuse (20 req/min)

     

       18
       18
       +
       func TestRateLimiting_E2E_OAuthEndpoints(t *testing.T) {

     

       19
       19
       +
       	t.Run("Login endpoints have 10 req/min limit", func(t *testing.T) {

     

       20
       20
       +
       		// Create rate limiter matching oauth.go config: 10 requests per minute

     

       21
       21
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       22
       22
       +
       

     

       23
       23
       +
       		// Mock OAuth login handler

     

       24
       24
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       25
       25
       +
       			w.WriteHeader(http.StatusOK)

     

       26
       26
       +
       			_, _ = w.Write([]byte("OK"))

     

       27
       27
       +
       		})

     

       28
       28
       +
       

     

       29
       29
       +
       		handler := loginLimiter.Middleware(testHandler)

     

       30
       30
       +
       		clientIP := "192.168.1.200:12345"

     

       31
       31
       +
       

     

       32
       32
       +
       		// Make exactly 10 requests (at limit)

     

       33
       33
       +
       		for i := 0; i < 10; i++ {

     

       34
       34
       +
       			req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       35
       35
       +
       			req.RemoteAddr = clientIP

     

       36
       36
       +
       			rr := httptest.NewRecorder()

     

       37
       37
       +
       

     

       38
       38
       +
       			handler.ServeHTTP(rr, req)

     

       39
       39
       +
       

     

       40
       40
       +
       			assert.Equal(t, http.StatusOK, rr.Code, "Request %d should succeed", i+1)

     

       41
       41
       +
       		}

     

       42
       42
       +
       

     

       43
       43
       +
       		// 11th request should be rate limited

     

       44
       44
       +
       		req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       45
       45
       +
       		req.RemoteAddr = clientIP

     

       46
       46
       +
       		rr := httptest.NewRecorder()

     

       47
       47
       +
       

     

       48
       48
       +
       		handler.ServeHTTP(rr, req)

     

       49
       49
       +
       

     

       50
       50
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Request 11 should be rate limited")

     

       51
       51
       +
       		assert.Contains(t, rr.Body.String(), "Rate limit exceeded", "Should have rate limit error message")

     

       52
       52
       +
       	})

     

       53
       53
       +
       

     

       54
       54
       +
       	t.Run("Mobile login endpoints have 10 req/min limit", func(t *testing.T) {

     

       55
       55
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       56
       56
       +
       

     

       57
       57
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       58
       58
       +
       			w.WriteHeader(http.StatusOK)

     

       59
       59
       +
       		})

     

       60
       60
       +
       

     

       61
       61
       +
       		handler := loginLimiter.Middleware(testHandler)

     

       62
       62
       +
       		clientIP := "192.168.1.201:12345"

     

       63
       63
       +
       

     

       64
       64
       +
       		// Make 10 requests

     

       65
       65
       +
       		for i := 0; i < 10; i++ {

     

       66
       66
       +
       			req := httptest.NewRequest("GET", "/oauth/mobile/login", nil)

     

       67
       67
       +
       			req.RemoteAddr = clientIP

     

       68
       68
       +
       			rr := httptest.NewRecorder()

     

       69
       69
       +
       			handler.ServeHTTP(rr, req)

     

       70
       70
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       71
       71
       +
       		}

     

       72
       72
       +
       

     

       73
       73
       +
       		// 11th request blocked

     

       74
       74
       +
       		req := httptest.NewRequest("GET", "/oauth/mobile/login", nil)

     

       75
       75
       +
       		req.RemoteAddr = clientIP

     

       76
       76
       +
       		rr := httptest.NewRecorder()

     

       77
       77
       +
       		handler.ServeHTTP(rr, req)

     

       78
       78
       +
       

     

       79
       79
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Mobile login should be rate limited at 10 req/min")

     

       80
       80
       +
       	})

     

       81
       81
       +
       

     

       82
       82
       +
       	t.Run("Refresh endpoint has 20 req/min limit", func(t *testing.T) {

     

       83
       83
       +
       		// Refresh has higher limit (20 req/min) for legitimate token refresh

     

       84
       84
       +
       		refreshLimiter := middleware.NewRateLimiter(20, 1*time.Minute)

     

       85
       85
       +
       

     

       86
       86
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       87
       87
       +
       			w.WriteHeader(http.StatusOK)

     

       88
       88
       +
       		})

     

       89
       89
       +
       

     

       90
       90
       +
       		handler := refreshLimiter.Middleware(testHandler)

     

       91
       91
       +
       		clientIP := "192.168.1.202:12345"

     

       92
       92
       +
       

     

       93
       93
       +
       		// Make 20 requests

     

       94
       94
       +
       		for i := 0; i < 20; i++ {

     

       95
       95
       +
       			req := httptest.NewRequest("POST", "/oauth/refresh", nil)

     

       96
       96
       +
       			req.RemoteAddr = clientIP

     

       97
       97
       +
       			rr := httptest.NewRecorder()

     

       98
       98
       +
       			handler.ServeHTTP(rr, req)

     

       99
       99
       +
       			assert.Equal(t, http.StatusOK, rr.Code, "Request %d should succeed", i+1)

     

       100
       100
       +
       		}

     

       101
       101
       +
       

     

       102
       102
       +
       		// 21st request blocked

     

       103
       103
       +
       		req := httptest.NewRequest("POST", "/oauth/refresh", nil)

     

       104
       104
       +
       		req.RemoteAddr = clientIP

     

       105
       105
       +
       		rr := httptest.NewRecorder()

     

       106
       106
       +
       		handler.ServeHTTP(rr, req)

     

       107
       107
       +
       

     

       108
       108
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Refresh should be rate limited at 20 req/min")

     

       109
       109
       +
       	})

     

       110
       110
       +
       

     

       111
       111
       +
       	t.Run("Logout endpoint has 10 req/min limit", func(t *testing.T) {

     

       112
       112
       +
       		logoutLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       113
       113
       +
       

     

       114
       114
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       115
       115
       +
       			w.WriteHeader(http.StatusOK)

     

       116
       116
       +
       		})

     

       117
       117
       +
       

     

       118
       118
       +
       		handler := logoutLimiter.Middleware(testHandler)

     

       119
       119
       +
       		clientIP := "192.168.1.203:12345"

     

       120
       120
       +
       

     

       121
       121
       +
       		// Make 10 requests

     

       122
       122
       +
       		for i := 0; i < 10; i++ {

     

       123
       123
       +
       			req := httptest.NewRequest("POST", "/oauth/logout", nil)

     

       124
       124
       +
       			req.RemoteAddr = clientIP

     

       125
       125
       +
       			rr := httptest.NewRecorder()

     

       126
       126
       +
       			handler.ServeHTTP(rr, req)

     

       127
       127
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       128
       128
       +
       		}

     

       129
       129
       +
       

     

       130
       130
       +
       		// 11th request blocked

     

       131
       131
       +
       		req := httptest.NewRequest("POST", "/oauth/logout", nil)

     

       132
       132
       +
       		req.RemoteAddr = clientIP

     

       133
       133
       +
       		rr := httptest.NewRecorder()

     

       134
       134
       +
       		handler.ServeHTTP(rr, req)

     

       135
       135
       +
       

     

       136
       136
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Logout should be rate limited at 10 req/min")

     

       137
       137
       +
       	})

     

       138
       138
       +
       

     

       139
       139
       +
       	t.Run("OAuth callback has 10 req/min limit", func(t *testing.T) {

     

       140
       140
       +
       		// Callback uses same limiter as login (part of auth flow)

     

       141
       141
       +
       		callbackLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       142
       142
       +
       

     

       143
       143
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       144
       144
       +
       			w.WriteHeader(http.StatusOK)

     

       145
       145
       +
       		})

     

       146
       146
       +
       

     

       147
       147
       +
       		handler := callbackLimiter.Middleware(testHandler)

     

       148
       148
       +
       		clientIP := "192.168.1.204:12345"

     

       149
       149
       +
       

     

       150
       150
       +
       		// Make 10 requests

     

       151
       151
       +
       		for i := 0; i < 10; i++ {

     

       152
       152
       +
       			req := httptest.NewRequest("GET", "/oauth/callback", nil)

     

       153
       153
       +
       			req.RemoteAddr = clientIP

     

       154
       154
       +
       			rr := httptest.NewRecorder()

     

       155
       155
       +
       			handler.ServeHTTP(rr, req)

     

       156
       156
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       157
       157
       +
       		}

     

       158
       158
       +
       

     

       159
       159
       +
       		// 11th request blocked

     

       160
       160
       +
       		req := httptest.NewRequest("GET", "/oauth/callback", nil)

     

       161
       161
       +
       		req.RemoteAddr = clientIP

     

       162
       162
       +
       		rr := httptest.NewRecorder()

     

       163
       163
       +
       		handler.ServeHTTP(rr, req)

     

       164
       164
       +
       

     

       165
       165
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Callback should be rate limited at 10 req/min")

     

       166
       166
       +
       	})

     

       167
       167
       +
       

     

       168
       168
       +
       	t.Run("OAuth rate limits are stricter than global limit", func(t *testing.T) {

     

       169
       169
       +
       		// Verify OAuth limits are more restrictive than global 100 req/min

     

       170
       170
       +
       		const globalLimit = 100

     

       171
       171
       +
       		const oauthLoginLimit = 10

     

       172
       172
       +
       		const oauthRefreshLimit = 20

     

       173
       173
       +
       

     

       174
       174
       +
       		assert.Less(t, oauthLoginLimit, globalLimit, "OAuth login limit should be stricter than global")

     

       175
       175
       +
       		assert.Less(t, oauthRefreshLimit, globalLimit, "OAuth refresh limit should be stricter than global")

     

       176
       176
       +
       		assert.Greater(t, oauthRefreshLimit, oauthLoginLimit, "Refresh limit should be higher than login (legitimate use case)")

     

       177
       177
       +
       	})

     

       178
       178
       +
       

     

       179
       179
       +
       	t.Run("OAuth limits prevent credential stuffing", func(t *testing.T) {

     

       180
       180
       +
       		// Simulate credential stuffing attack

     

       181
       181
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       182
       182
       +
       

     

       183
       183
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       184
       184
       +
       			// Simulate failed login attempts

     

       185
       185
       +
       			w.WriteHeader(http.StatusUnauthorized)

     

       186
       186
       +
       		})

     

       187
       187
       +
       

     

       188
       188
       +
       		handler := loginLimiter.Middleware(testHandler)

     

       189
       189
       +
       		attackerIP := "203.0.113.50:12345"

     

       190
       190
       +
       

     

       191
       191
       +
       		// Attacker tries 15 login attempts (credential stuffing)

     

       192
       192
       +
       		successfulAttempts := 0

     

       193
       193
       +
       		blockedAttempts := 0

     

       194
       194
       +
       

     

       195
       195
       +
       		for i := 0; i < 15; i++ {

     

       196
       196
       +
       			req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       197
       197
       +
       			req.RemoteAddr = attackerIP

     

       198
       198
       +
       			rr := httptest.NewRecorder()

     

       199
       199
       +
       

     

       200
       200
       +
       			handler.ServeHTTP(rr, req)

     

       201
       201
       +
       

     

       202
       202
       +
       			if rr.Code == http.StatusUnauthorized {

     

       203
       203
       +
       				successfulAttempts++ // Reached handler (even if auth failed)

     

       204
       204
       +
       			} else if rr.Code == http.StatusTooManyRequests {

     

       205
       205
       +
       				blockedAttempts++

     

       206
       206
       +
       			}

     

       207
       207
       +
       		}

     

       208
       208
       +
       

     

       209
       209
       +
       		// Rate limiter should block 5 attempts after first 10

     

       210
       210
       +
       		assert.Equal(t, 10, successfulAttempts, "Should allow 10 login attempts")

     

       211
       211
       +
       		assert.Equal(t, 5, blockedAttempts, "Should block 5 attempts after limit reached")

     

       212
       212
       +
       	})

     

       213
       213
       +
       

     

       214
       214
       +
       	t.Run("OAuth limits are per-endpoint", func(t *testing.T) {

     

       215
       215
       +
       		// Each endpoint gets its own rate limiter

     

       216
       216
       +
       		// This test verifies that limits are independent per endpoint

     

       217
       217
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       218
       218
       +
       		refreshLimiter := middleware.NewRateLimiter(20, 1*time.Minute)

     

       219
       219
       +
       

     

       220
       220
       +
       		loginHandler := loginLimiter.Middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       221
       221
       +
       			w.WriteHeader(http.StatusOK)

     

       222
       222
       +
       		}))

     

       223
       223
       +
       

     

       224
       224
       +
       		refreshHandler := refreshLimiter.Middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       225
       225
       +
       			w.WriteHeader(http.StatusOK)

     

       226
       226
       +
       		}))

     

       227
       227
       +
       

     

       228
       228
       +
       		clientIP := "192.168.1.205:12345"

     

       229
       229
       +
       

     

       230
       230
       +
       		// Exhaust login limit

     

       231
       231
       +
       		for i := 0; i < 10; i++ {

     

       232
       232
       +
       			req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       233
       233
       +
       			req.RemoteAddr = clientIP

     

       234
       234
       +
       			rr := httptest.NewRecorder()

     

       235
       235
       +
       			loginHandler.ServeHTTP(rr, req)

     

       236
       236
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       237
       237
       +
       		}

     

       238
       238
       +
       

     

       239
       239
       +
       		// Login limit exhausted

     

       240
       240
       +
       		req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       241
       241
       +
       		req.RemoteAddr = clientIP

     

       242
       242
       +
       		rr := httptest.NewRecorder()

     

       243
       243
       +
       		loginHandler.ServeHTTP(rr, req)

     

       244
       244
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Login should be rate limited")

     

       245
       245
       +
       

     

       246
       246
       +
       		// Refresh endpoint should still work (independent limiter)

     

       247
       247
       +
       		req = httptest.NewRequest("POST", "/oauth/refresh", nil)

     

       248
       248
       +
       		req.RemoteAddr = clientIP

     

       249
       249
       +
       		rr = httptest.NewRecorder()

     

       250
       250
       +
       		refreshHandler.ServeHTTP(rr, req)

     

       251
       251
       +
       		assert.Equal(t, http.StatusOK, rr.Code, "Refresh should not be affected by login rate limit")

     

       252
       252
       +
       	})

     

       253
       253
       +
       }

     

       254
       254
       +
       

     

       255
       255
       +
       // OAuth Rate Limiting Configuration Documentation

     

       256
       256
       +
       // ================================================

     

       257
       257
       +
       // This test file validates OAuth-specific rate limits applied in oauth.go:

     

       258
       258
       +
       //

     

       259
       259
       +
       // 1. Login Endpoints (Credential Stuffing Protection)

     

       260
       260
       +
       //    - Endpoints: /oauth/login, /oauth/mobile/login, /oauth/callback

     

       261
       261
       +
       //    - Limit: 10 requests per minute per IP

     

       262
       262
       +
       //    - Reason: Prevent brute force and credential stuffing attacks

     

       263
       263
       +
       //    - Implementation: internal/api/routes/oauth.go:21

     

       264
       264
       +
       //

     

       265
       265
       +
       // 2. Refresh Endpoint (Token Refresh)

     

       266
       266
       +
       //    - Endpoint: /oauth/refresh

     

       267
       267
       +
       //    - Limit: 20 requests per minute per IP

     

       268
       268
       +
       //    - Reason: Allow legitimate token refresh while preventing abuse

     

       269
       269
       +
       //    - Implementation: internal/api/routes/oauth.go:24

     

       270
       270
       +
       //

     

       271
       271
       +
       // 3. Logout Endpoint

     

       272
       272
       +
       //    - Endpoint: /oauth/logout

     

       273
       273
       +
       //    - Limit: 10 requests per minute per IP

     

       274
       274
       +
       //    - Reason: Prevent session exhaustion attacks

     

       275
       275
       +
       //    - Implementation: internal/api/routes/oauth.go:27

     

       276
       276
       +
       //

     

       277
       277
       +
       // 4. Metadata Endpoints (No Extra Limit)

     

       278
       278
       +
       //    - Endpoints: /oauth/client-metadata.json, /oauth/jwks.json

     

       279
       279
       +
       //    - Limit: Global 100 requests per minute (from main.go)

     

       280
       280
       +
       //    - Reason: Public metadata, not sensitive to rate abuse

     

       281
       281
       +
       //

     

       282
       282
       +
       // Security Benefits:

     

       283
       283
       +
       //    - Credential Stuffing: Limits password guessing to 10 attempts/min

     

       284
       284
       +
       //    - State Exhaustion: Prevents OAuth state generation spam

     

       285
       285
       +
       //    - Token Abuse: Limits refresh token usage while allowing legitimate refresh

     

       286
       286
       +
       //

     

       287
       287
       +
       // Rate Limit Hierarchy:

     

       288
       288
       +
       //    - OAuth login: 10 req/min (most restrictive)

     

       289
       289
       +
       //    - OAuth refresh: 20 req/min (moderate)

     

       290
       290
       +
       //    - Comments: 20 req/min (expensive queries)

     

       291
       291
       +
       //    - Global: 100 req/min (baseline)

-208

tests/integration/jwt_verification_test.go

···

       1
       1
       -
       package integration

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/api/middleware"

     

       5
       5
       -
       	"Coves/internal/atproto/auth"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"net/http"

     

       8
       8
       -
       	"net/http/httptest"

     

       9
       9
       -
       	"os"

     

       10
       10
       -
       	"strings"

     

       11
       11
       -
       	"testing"

     

       12
       12
       -
       	"time"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       // TestJWTSignatureVerification tests end-to-end JWT signature verification

     

       16
       16
       -
       // with a real PDS-issued token. This verifies that AUTH_SKIP_VERIFY=false works.

     

       17
       17
       -
       //

     

       18
       18
       -
       // Flow:

     

       19
       19
       -
       // 1. Create account on local PDS (or use existing)

     

       20
       20
       -
       // 2. Authenticate to get a real signed JWT token

     

       21
       21
       -
       // 3. Verify our auth middleware can fetch JWKS and verify the signature

     

       22
       22
       -
       // 4. Test with AUTH_SKIP_VERIFY=false (production mode)

     

       23
       23
       -
       //

     

       24
       24
       -
       // NOTE: Local dev PDS (docker-compose.dev.yml) uses symmetric JWT_SECRET signing

     

       25
       25
       -
       // instead of asymmetric JWKS keys. This test verifies the code path works, but

     

       26
       26
       -
       // full JWKS verification requires a production PDS or setting up proper keys.

     

       27
       27
       -
       func TestJWTSignatureVerification(t *testing.T) {

     

       28
       28
       -
       	// Skip in short mode since this requires real PDS

     

       29
       29
       -
       	if testing.Short() {

     

       30
       30
       -
       		t.Skip("Skipping JWT verification test in short mode")

     

       31
       31
       -
       	}

     

       32
       32
       -
       

     

       33
       33
       -
       	pdsURL := os.Getenv("PDS_URL")

     

       34
       34
       -
       	if pdsURL == "" {

     

       35
       35
       -
       		pdsURL = "http://localhost:3001"

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	// Check if PDS is running

     

       39
       39
       -
       	healthResp, err := http.Get(pdsURL + "/xrpc/_health")

     

       40
       40
       -
       	if err != nil {

     

       41
       41
       -
       		t.Skipf("PDS not running at %s: %v", pdsURL, err)

     

       42
       42
       -
       	}

     

       43
       43
       -
       	_ = healthResp.Body.Close()

     

       44
       44
       -
       

     

       45
       45
       -
       	// Check if JWKS is available (production PDS) or symmetric secret (dev PDS)

     

       46
       46
       -
       	jwksResp, _ := http.Get(pdsURL + "/oauth/jwks")

     

       47
       47
       -
       	if jwksResp != nil {

     

       48
       48
       -
       		defer func() { _ = jwksResp.Body.Close() }()

     

       49
       49
       -
       	}

     

       50
       50
       -
       

     

       51
       51
       -
       	t.Run("JWT parsing and middleware integration", func(t *testing.T) {

     

       52
       52
       -
       		// Step 1: Create a test account on PDS

     

       53
       53
       -
       		// Keep handle short to avoid PDS validation errors

     

       54
       54
       -
       		timestamp := time.Now().Unix() % 100000 // Last 5 digits

     

       55
       55
       -
       		handle := fmt.Sprintf("jwt%d.local.coves.dev", timestamp)

     

       56
       56
       -
       		password := "testpass123"

     

       57
       57
       -
       		email := fmt.Sprintf("jwt%d@test.com", timestamp)

     

       58
       58
       -
       

     

       59
       59
       -
       		accessToken, did, err := createPDSAccount(pdsURL, handle, email, password)

     

       60
       60
       -
       		if err != nil {

     

       61
       61
       -
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       62
       62
       -
       		}

     

       63
       63
       -
       		t.Logf("✓ Created test account: %s (DID: %s)", handle, did)

     

       64
       64
       -
       		t.Logf("✓ Received JWT token from PDS (length: %d)", len(accessToken))

     

       65
       65
       -
       

     

       66
       66
       -
       		// Step 3: Test JWT parsing (should work regardless of verification)

     

       67
       67
       -
       		claims, err := auth.ParseJWT(accessToken)

     

       68
       68
       -
       		if err != nil {

     

       69
       69
       -
       			t.Fatalf("Failed to parse JWT: %v", err)

     

       70
       70
       -
       		}

     

       71
       71
       -
       		t.Logf("✓ JWT parsed successfully")

     

       72
       72
       -
       		t.Logf("  Subject (DID): %s", claims.Subject)

     

       73
       73
       -
       		t.Logf("  Issuer: %s", claims.Issuer)

     

       74
       74
       -
       		t.Logf("  Scope: %s", claims.Scope)

     

       75
       75
       -
       

     

       76
       76
       -
       		if claims.Subject != did {

     

       77
       77
       -
       			t.Errorf("Token DID mismatch: expected %s, got %s", did, claims.Subject)

     

       78
       78
       -
       		}

     

       79
       79
       -
       

     

       80
       80
       -
       		// Step 4: Test JWKS fetching and signature verification

     

       81
       81
       -
       		// NOTE: Local dev PDS uses symmetric secret, not JWKS

     

       82
       82
       -
       		// For production, we'd verify the full signature here

     

       83
       83
       -
       		t.Log("Checking JWKS availability...")

     

       84
       84
       -
       

     

       85
       85
       -
       		jwksFetcher := auth.NewCachedJWKSFetcher(1 * time.Hour)

     

       86
       86
       -
       		verifiedClaims, err := auth.VerifyJWT(httptest.NewRequest("GET", "/", nil).Context(), accessToken, jwksFetcher)

     

       87
       87
       -
       		if err != nil {

     

       88
       88
       -
       			// Expected for local dev PDS - log and continue

     

       89
       89
       -
       			t.Logf("ℹ️  JWKS verification skipped (expected for local dev PDS): %v", err)

     

       90
       90
       -
       			t.Logf("   Local PDS uses symmetric JWT_SECRET instead of JWKS")

     

       91
       91
       -
       			t.Logf("   In production, this would verify against proper JWKS keys")

     

       92
       92
       -
       		} else {

     

       93
       93
       -
       			// Unexpected success - means we're testing against a production PDS

     

       94
       94
       -
       			t.Logf("✓ JWT signature verified successfully!")

     

       95
       95
       -
       			t.Logf("  Verified DID: %s", verifiedClaims.Subject)

     

       96
       96
       -
       			t.Logf("  Verified Issuer: %s", verifiedClaims.Issuer)

     

       97
       97
       -
       

     

       98
       98
       -
       			if verifiedClaims.Subject != did {

     

       99
       99
       -
       				t.Errorf("Verified token DID mismatch: expected %s, got %s", did, verifiedClaims.Subject)

     

       100
       100
       -
       			}

     

       101
       101
       -
       		}

     

       102
       102
       -
       

     

       103
       103
       -
       		// Step 5: Test auth middleware with skipVerify=true (for dev PDS)

     

       104
       104
       -
       		t.Log("Testing auth middleware with skipVerify=true (dev mode)...")

     

       105
       105
       -
       

     

       106
       106
       -
       		authMiddleware := middleware.NewAtProtoAuthMiddleware(jwksFetcher, true) // skipVerify=true for dev PDS

     

       107
       107
       -
       		defer authMiddleware.Stop()                                               // Clean up DPoP replay cache goroutine

     

       108
       108
       -
       

     

       109
       109
       -
       		handlerCalled := false

     

       110
       110
       -
       		var extractedDID string

     

       111
       111
       -
       

     

       112
       112
       -
       		testHandler := authMiddleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       113
       113
       -
       			handlerCalled = true

     

       114
       114
       -
       			extractedDID = middleware.GetUserDID(r)

     

       115
       115
       -
       			w.WriteHeader(http.StatusOK)

     

       116
       116
       -
       			_, _ = w.Write([]byte(`{"success": true}`))

     

       117
       117
       -
       		}))

     

       118
       118
       -
       

     

       119
       119
       -
       		req := httptest.NewRequest("GET", "/test", nil)

     

       120
       120
       -
       		req.Header.Set("Authorization", "DPoP "+accessToken)

     

       121
       121
       -
       		w := httptest.NewRecorder()

     

       122
       122
       -
       

     

       123
       123
       -
       		testHandler.ServeHTTP(w, req)

     

       124
       124
       -
       

     

       125
       125
       -
       		if !handlerCalled {

     

       126
       126
       -
       			t.Errorf("Handler was not called - auth middleware rejected valid token")

     

       127
       127
       -
       			t.Logf("Response status: %d", w.Code)

     

       128
       128
       -
       			t.Logf("Response body: %s", w.Body.String())

     

       129
       129
       -
       		}

     

       130
       130
       -
       

     

       131
       131
       -
       		if w.Code != http.StatusOK {

     

       132
       132
       -
       			t.Errorf("Expected status 200, got %d", w.Code)

     

       133
       133
       -
       			t.Logf("Response body: %s", w.Body.String())

     

       134
       134
       -
       		}

     

       135
       135
       -
       

     

       136
       136
       -
       		if extractedDID != did {

     

       137
       137
       -
       			t.Errorf("Middleware extracted wrong DID: expected %s, got %s", did, extractedDID)

     

       138
       138
       -
       		}

     

       139
       139
       -
       

     

       140
       140
       -
       		t.Logf("✅ Auth middleware with signature verification working correctly!")

     

       141
       141
       -
       		t.Logf("  Handler called: %v", handlerCalled)

     

       142
       142
       -
       		t.Logf("  Extracted DID: %s", extractedDID)

     

       143
       143
       -
       		t.Logf("  Response status: %d", w.Code)

     

       144
       144
       -
       	})

     

       145
       145
       -
       

     

       146
       146
       -
       	t.Run("Rejects tampered JWT", func(t *testing.T) {

     

       147
       147
       -
       		// Create valid token

     

       148
       148
       -
       		timestamp := time.Now().Unix() % 100000

     

       149
       149
       -
       		handle := fmt.Sprintf("tamp%d.local.coves.dev", timestamp)

     

       150
       150
       -
       		password := "testpass456"

     

       151
       151
       -
       		email := fmt.Sprintf("tamp%d@test.com", timestamp)

     

       152
       152
       -
       

     

       153
       153
       -
       		accessToken, _, err := createPDSAccount(pdsURL, handle, email, password)

     

       154
       154
       -
       		if err != nil {

     

       155
       155
       -
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       156
       156
       -
       		}

     

       157
       157
       -
       

     

       158
       158
       -
       		// Tamper with the token more aggressively to break JWT structure

     

       159
       159
       -
       		parts := splitToken(accessToken)

     

       160
       160
       -
       		if len(parts) != 3 {

     

       161
       161
       -
       			t.Fatalf("Invalid JWT structure: expected 3 parts, got %d", len(parts))

     

       162
       162
       -
       		}

     

       163
       163
       -
       		// Replace the payload with invalid base64 that will fail decoding

     

       164
       164
       -
       		tamperedToken := parts[0] + ".!!!invalid-base64!!!." + parts[2]

     

       165
       165
       -
       

     

       166
       166
       -
       		// Test with middleware (skipVerify=true since dev PDS doesn't use JWKS)

     

       167
       167
       -
       		// Tampered payload should fail JWT parsing even without signature check

     

       168
       168
       -
       		jwksFetcher := auth.NewCachedJWKSFetcher(1 * time.Hour)

     

       169
       169
       -
       		authMiddleware := middleware.NewAtProtoAuthMiddleware(jwksFetcher, true)

     

       170
       170
       -
       		defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine

     

       171
       171
       -
       

     

       172
       172
       -
       		handlerCalled := false

     

       173
       173
       -
       		testHandler := authMiddleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       174
       174
       -
       			handlerCalled = true

     

       175
       175
       -
       			w.WriteHeader(http.StatusOK)

     

       176
       176
       -
       		}))

     

       177
       177
       -
       

     

       178
       178
       -
       		req := httptest.NewRequest("GET", "/test", nil)

     

       179
       179
       -
       		req.Header.Set("Authorization", "DPoP "+tamperedToken)

     

       180
       180
       -
       		w := httptest.NewRecorder()

     

       181
       181
       -
       

     

       182
       182
       -
       		testHandler.ServeHTTP(w, req)

     

       183
       183
       -
       

     

       184
       184
       -
       		if handlerCalled {

     

       185
       185
       -
       			t.Error("Handler was called for tampered token - should have been rejected")

     

       186
       186
       -
       		}

     

       187
       187
       -
       

     

       188
       188
       -
       		if w.Code != http.StatusUnauthorized {

     

       189
       189
       -
       			t.Errorf("Expected status 401 for tampered token, got %d", w.Code)

     

       190
       190
       -
       		}

     

       191
       191
       -
       

     

       192
       192
       -
       		t.Logf("✅ Middleware correctly rejected tampered token with status %d", w.Code)

     

       193
       193
       -
       	})

     

       194
       194
       -
       

     

       195
       195
       -
       	t.Run("Rejects expired JWT with signature verification", func(t *testing.T) {

     

       196
       196
       -
       		// For this test, we'd need to create a token and wait for expiry,

     

       197
       197
       -
       		// or mock the time. For now, we'll just verify the validation logic exists.

     

       198
       198
       -
       		// In production, PDS tokens expire after a certain period.

     

       199
       199
       -
       		t.Log("ℹ️  Expiration test would require waiting for token expiry or time mocking")

     

       200
       200
       -
       		t.Log("   Token expiration validation is covered by unit tests in auth_test.go")

     

       201
       201
       -
       		t.Skip("Skipping expiration test - requires time manipulation")

     

       202
       202
       -
       	})

     

       203
       203
       -
       }

     

       204
       204
       -
       

     

       205
       205
       -
       // splitToken splits a JWT into its three parts (header.payload.signature)

     

       206
       206
       -
       func splitToken(token string) []string {

     

       207
       207
       -
       	return strings.Split(token, ".")

     

       208
       208
       -
       }

+910

tests/integration/oauth_e2e_test.go

···

       1
       1
       +
       package integration

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/oauth"

     

       5
       5
       +
       	"context"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"fmt"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       	"net/http/httptest"

     

       10
       10
       +
       	"strings"

     

       11
       11
       +
       	"testing"

     

       12
       12
       +
       	"time"

     

       13
       13
       +
       

     

       14
       14
       +
       	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       15
       15
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       16
       16
       +
       	"github.com/go-chi/chi/v5"

     

       17
       17
       +
       	_ "github.com/lib/pq"

     

       18
       18
       +
       	"github.com/pressly/goose/v3"

     

       19
       19
       +
       	"github.com/stretchr/testify/assert"

     

       20
       20
       +
       	"github.com/stretchr/testify/require"

     

       21
       21
       +
       )

     

       22
       22
       +
       

     

       23
       23
       +
       // TestOAuth_Components tests OAuth component functionality without requiring PDS.

     

       24
       24
       +
       // This validates all Coves OAuth code:

     

       25
       25
       +
       // - Session storage and retrieval (PostgreSQL)

     

       26
       26
       +
       // - Token sealing (AES-GCM encryption)

     

       27
       27
       +
       // - Token unsealing (decryption + validation)

     

       28
       28
       +
       // - Session cleanup

     

       29
       29
       +
       //

     

       30
       30
       +
       // NOTE: Full OAuth redirect flow testing requires both HTTPS PDS and HTTPS Coves deployment.

     

       31
       31
       +
       // The OAuth redirect flow is handled by indigo's library and enforces OAuth 2.0 spec

     

       32
       32
       +
       // (HTTPS required for authorization servers and redirect URIs).

     

       33
       33
       +
       func TestOAuth_Components(t *testing.T) {

     

       34
       34
       +
       	if testing.Short() {

     

       35
       35
       +
       		t.Skip("Skipping OAuth component test in short mode")

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	// Setup test database

     

       39
       39
       +
       	db := setupTestDB(t)

     

       40
       40
       +
       	defer func() {

     

       41
       41
       +
       		if err := db.Close(); err != nil {

     

       42
       42
       +
       			t.Logf("Failed to close database: %v", err)

     

       43
       43
       +
       		}

     

       44
       44
       +
       	}()

     

       45
       45
       +
       

     

       46
       46
       +
       	// Run migrations to ensure OAuth tables exist

     

       47
       47
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       48
       48
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       49
       49
       +
       

     

       50
       50
       +
       	t.Log("🔧 Testing OAuth Components")

     

       51
       51
       +
       

     

       52
       52
       +
       	ctx := context.Background()

     

       53
       53
       +
       

     

       54
       54
       +
       	// Setup OAuth client and store

     

       55
       55
       +
       	store := SetupOAuthTestStore(t, db)

     

       56
       56
       +
       	client := SetupOAuthTestClient(t, store)

     

       57
       57
       +
       	require.NotNil(t, client, "OAuth client should be initialized")

     

       58
       58
       +
       

     

       59
       59
       +
       	// Use a test DID (doesn't need to exist on PDS for component tests)

     

       60
       60
       +
       	testDID := "did:plc:componenttest123"

     

       61
       61
       +
       

     

       62
       62
       +
       	// Run component tests

     

       63
       63
       +
       	testOAuthComponentsWithMockedSession(t, ctx, nil, store, client, testDID, "")

     

       64
       64
       +
       

     

       65
       65
       +
       	t.Log("")

     

       66
       66
       +
       	t.Log(strings.Repeat("=", 60))

     

       67
       67
       +
       	t.Log("✅ OAuth Component Tests Complete")

     

       68
       68
       +
       	t.Log(strings.Repeat("=", 60))

     

       69
       69
       +
       	t.Log("Components validated:")

     

       70
       70
       +
       	t.Log("  ✓ Session storage (PostgreSQL)")

     

       71
       71
       +
       	t.Log("  ✓ Token sealing (AES-GCM encryption)")

     

       72
       72
       +
       	t.Log("  ✓ Token unsealing (decryption + validation)")

     

       73
       73
       +
       	t.Log("  ✓ Session cleanup")

     

       74
       74
       +
       	t.Log("")

     

       75
       75
       +
       	t.Log("NOTE: Full OAuth redirect flow requires HTTPS PDS + HTTPS Coves")

     

       76
       76
       +
       	t.Log(strings.Repeat("=", 60))

     

       77
       77
       +
       }

     

       78
       78
       +
       

     

       79
       79
       +
       // testOAuthComponentsWithMockedSession tests OAuth components that work without PDS redirect flow.

     

       80
       80
       +
       // This is used when testing with localhost PDS, where the indigo library rejects http:// URLs.

     

       81
       81
       +
       func testOAuthComponentsWithMockedSession(t *testing.T, ctx context.Context, _ interface{}, store oauthlib.ClientAuthStore, client *oauth.OAuthClient, userDID, _ string) {

     

       82
       82
       +
       	t.Helper()

     

       83
       83
       +
       

     

       84
       84
       +
       	t.Log("🔧 Testing OAuth components with mocked session...")

     

       85
       85
       +
       

     

       86
       86
       +
       	// Parse DID

     

       87
       87
       +
       	parsedDID, err := syntax.ParseDID(userDID)

     

       88
       88
       +
       	require.NoError(t, err, "Should parse DID")

     

       89
       89
       +
       

     

       90
       90
       +
       	// Component 1: Session Storage

     

       91
       91
       +
       	t.Log("   📦 Component 1: Testing session storage...")

     

       92
       92
       +
       	testSession := oauthlib.ClientSessionData{

     

       93
       93
       +
       		AccountDID:  parsedDID,

     

       94
       94
       +
       		SessionID:   fmt.Sprintf("localhost-test-%d", time.Now().UnixNano()),

     

       95
       95
       +
       		HostURL:     "http://localhost:3001",

     

       96
       96
       +
       		AccessToken: "mocked-access-token",

     

       97
       97
       +
       		Scopes:      []string{"atproto", "transition:generic"},

     

       98
       98
       +
       	}

     

       99
       99
       +
       

     

       100
       100
       +
       	err = store.SaveSession(ctx, testSession)

     

       101
       101
       +
       	require.NoError(t, err, "Should save session")

     

       102
       102
       +
       

     

       103
       103
       +
       	retrieved, err := store.GetSession(ctx, parsedDID, testSession.SessionID)

     

       104
       104
       +
       	require.NoError(t, err, "Should retrieve session")

     

       105
       105
       +
       	require.Equal(t, testSession.SessionID, retrieved.SessionID)

     

       106
       106
       +
       	require.Equal(t, testSession.AccessToken, retrieved.AccessToken)

     

       107
       107
       +
       	t.Log("   ✅ Session storage working")

     

       108
       108
       +
       

     

       109
       109
       +
       	// Component 2: Token Sealing

     

       110
       110
       +
       	t.Log("   🔐 Component 2: Testing token sealing...")

     

       111
       111
       +
       	sealedToken, err := client.SealSession(parsedDID.String(), testSession.SessionID, time.Hour)

     

       112
       112
       +
       	require.NoError(t, err, "Should seal token")

     

       113
       113
       +
       	require.NotEmpty(t, sealedToken, "Sealed token should not be empty")

     

       114
       114
       +
       	tokenPreview := sealedToken

     

       115
       115
       +
       	if len(tokenPreview) > 50 {

     

       116
       116
       +
       		tokenPreview = tokenPreview[:50]

     

       117
       117
       +
       	}

     

       118
       118
       +
       	t.Logf("   ✅ Token sealed: %s...", tokenPreview)

     

       119
       119
       +
       

     

       120
       120
       +
       	// Component 3: Token Unsealing

     

       121
       121
       +
       	t.Log("   🔓 Component 3: Testing token unsealing...")

     

       122
       122
       +
       	unsealed, err := client.UnsealSession(sealedToken)

     

       123
       123
       +
       	require.NoError(t, err, "Should unseal token")

     

       124
       124
       +
       	require.Equal(t, userDID, unsealed.DID)

     

       125
       125
       +
       	require.Equal(t, testSession.SessionID, unsealed.SessionID)

     

       126
       126
       +
       	t.Log("   ✅ Token unsealing working")

     

       127
       127
       +
       

     

       128
       128
       +
       	// Component 4: Session Cleanup

     

       129
       129
       +
       	t.Log("   🧹 Component 4: Testing session cleanup...")

     

       130
       130
       +
       	err = store.DeleteSession(ctx, parsedDID, testSession.SessionID)

     

       131
       131
       +
       	require.NoError(t, err, "Should delete session")

     

       132
       132
       +
       

     

       133
       133
       +
       	_, err = store.GetSession(ctx, parsedDID, testSession.SessionID)

     

       134
       134
       +
       	require.Error(t, err, "Session should not exist after deletion")

     

       135
       135
       +
       	t.Log("   ✅ Session cleanup working")

     

       136
       136
       +
       

     

       137
       137
       +
       	t.Log("✅ All OAuth components verified!")

     

       138
       138
       +
       	t.Log("")

     

       139
       139
       +
       	t.Log("📝 Summary: OAuth implementation validated with mocked session")

     

       140
       140
       +
       	t.Log("   - Session storage: ✓")

     

       141
       141
       +
       	t.Log("   - Token sealing: ✓")

     

       142
       142
       +
       	t.Log("   - Token unsealing: ✓")

     

       143
       143
       +
       	t.Log("   - Session cleanup: ✓")

     

       144
       144
       +
       	t.Log("")

     

       145
       145
       +
       	t.Log("⚠️  To test full OAuth redirect flow, use a production PDS with HTTPS")

     

       146
       146
       +
       }

     

       147
       147
       +
       

     

       148
       148
       +
       // TestOAuthE2E_TokenExpiration tests that expired sealed tokens are rejected

     

       149
       149
       +
       func TestOAuthE2E_TokenExpiration(t *testing.T) {

     

       150
       150
       +
       	if testing.Short() {

     

       151
       151
       +
       		t.Skip("Skipping OAuth token expiration test in short mode")

     

       152
       152
       +
       	}

     

       153
       153
       +
       

     

       154
       154
       +
       	db := setupTestDB(t)

     

       155
       155
       +
       	defer func() { _ = db.Close() }()

     

       156
       156
       +
       

     

       157
       157
       +
       	// Run migrations

     

       158
       158
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       159
       159
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       160
       160
       +
       

     

       161
       161
       +
       	ctx := context.Background()

     

       162
       162
       +
       

     

       163
       163
       +
       	t.Log("⏰ Testing OAuth token expiration...")

     

       164
       164
       +
       

     

       165
       165
       +
       	// Setup OAuth client and store

     

       166
       166
       +
       	store := SetupOAuthTestStore(t, db)

     

       167
       167
       +
       	client := SetupOAuthTestClient(t, store)

     

       168
       168
       +
       	_ = oauth.NewOAuthHandler(client, store) // Handler created for completeness

     

       169
       169
       +
       

     

       170
       170
       +
       	// Create test session with past expiration

     

       171
       171
       +
       	did, err := syntax.ParseDID("did:plc:expiredtest123")

     

       172
       172
       +
       	require.NoError(t, err)

     

       173
       173
       +
       

     

       174
       174
       +
       	testSession := oauthlib.ClientSessionData{

     

       175
       175
       +
       		AccountDID:  did,

     

       176
       176
       +
       		SessionID:   "expired-session",

     

       177
       177
       +
       		HostURL:     "http://localhost:3001",

     

       178
       178
       +
       		AccessToken: "expired-token",

     

       179
       179
       +
       		Scopes:      []string{"atproto"},

     

       180
       180
       +
       	}

     

       181
       181
       +
       

     

       182
       182
       +
       	// Save session

     

       183
       183
       +
       	err = store.SaveSession(ctx, testSession)

     

       184
       184
       +
       	require.NoError(t, err)

     

       185
       185
       +
       

     

       186
       186
       +
       	// Manually update expiration to the past

     

       187
       187
       +
       	_, err = db.ExecContext(ctx,

     

       188
       188
       +
       		"UPDATE oauth_sessions SET expires_at = NOW() - INTERVAL '1 day' WHERE did = $1 AND session_id = $2",

     

       189
       189
       +
       		did.String(), testSession.SessionID)

     

       190
       190
       +
       	require.NoError(t, err)

     

       191
       191
       +
       

     

       192
       192
       +
       	// Try to retrieve expired session

     

       193
       193
       +
       	_, err = store.GetSession(ctx, did, testSession.SessionID)

     

       194
       194
       +
       	assert.Error(t, err, "Should not be able to retrieve expired session")

     

       195
       195
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "Should return ErrSessionNotFound for expired session")

     

       196
       196
       +
       

     

       197
       197
       +
       	// Test cleanup of expired sessions

     

       198
       198
       +
       	cleaned, err := store.(*oauth.PostgresOAuthStore).CleanupExpiredSessions(ctx)

     

       199
       199
       +
       	require.NoError(t, err, "Cleanup should succeed")

     

       200
       200
       +
       	assert.Greater(t, cleaned, int64(0), "Should have cleaned up at least one session")

     

       201
       201
       +
       

     

       202
       202
       +
       	t.Logf("✅ Expired session handling verified (cleaned %d sessions)", cleaned)

     

       203
       203
       +
       }

     

       204
       204
       +
       

     

       205
       205
       +
       // TestOAuthE2E_InvalidToken tests that invalid/tampered tokens are rejected

     

       206
       206
       +
       func TestOAuthE2E_InvalidToken(t *testing.T) {

     

       207
       207
       +
       	if testing.Short() {

     

       208
       208
       +
       		t.Skip("Skipping OAuth invalid token test in short mode")

     

       209
       209
       +
       	}

     

       210
       210
       +
       

     

       211
       211
       +
       	db := setupTestDB(t)

     

       212
       212
       +
       	defer func() { _ = db.Close() }()

     

       213
       213
       +
       

     

       214
       214
       +
       	// Run migrations

     

       215
       215
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       216
       216
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       217
       217
       +
       

     

       218
       218
       +
       	t.Log("🔒 Testing OAuth invalid token rejection...")

     

       219
       219
       +
       

     

       220
       220
       +
       	// Setup OAuth client and store

     

       221
       221
       +
       	store := SetupOAuthTestStore(t, db)

     

       222
       222
       +
       	client := SetupOAuthTestClient(t, store)

     

       223
       223
       +
       	handler := oauth.NewOAuthHandler(client, store)

     

       224
       224
       +
       

     

       225
       225
       +
       	// Setup test server with protected endpoint

     

       226
       226
       +
       	r := chi.NewRouter()

     

       227
       227
       +
       	r.Get("/api/me", func(w http.ResponseWriter, r *http.Request) {

     

       228
       228
       +
       		sessData, err := handler.GetSessionFromRequest(r)

     

       229
       229
       +
       		if err != nil {

     

       230
       230
       +
       			http.Error(w, "Unauthorized", http.StatusUnauthorized)

     

       231
       231
       +
       			return

     

       232
       232
       +
       		}

     

       233
       233
       +
       		w.Header().Set("Content-Type", "application/json")

     

       234
       234
       +
       		_ = json.NewEncoder(w).Encode(map[string]string{"did": sessData.AccountDID.String()})

     

       235
       235
       +
       	})

     

       236
       236
       +
       

     

       237
       237
       +
       	server := httptest.NewServer(r)

     

       238
       238
       +
       	defer server.Close()

     

       239
       239
       +
       

     

       240
       240
       +
       	// Test with invalid token formats

     

       241
       241
       +
       	testCases := []struct {

     

       242
       242
       +
       		name  string

     

       243
       243
       +
       		token string

     

       244
       244
       +
       	}{

     

       245
       245
       +
       		{"Empty token", ""},

     

       246
       246
       +
       		{"Invalid base64", "not-valid-base64!!!"},

     

       247
       247
       +
       		{"Tampered token", "dGFtcGVyZWQtdG9rZW4tZGF0YQ=="}, // Valid base64 but invalid content

     

       248
       248
       +
       		{"Short token", "abc"},

     

       249
       249
       +
       	}

     

       250
       250
       +
       

     

       251
       251
       +
       	for _, tc := range testCases {

     

       252
       252
       +
       		t.Run(tc.name, func(t *testing.T) {

     

       253
       253
       +
       			req, _ := http.NewRequest("GET", server.URL+"/api/me", nil)

     

       254
       254
       +
       			if tc.token != "" {

     

       255
       255
       +
       				req.Header.Set("Authorization", "Bearer "+tc.token)

     

       256
       256
       +
       			}

     

       257
       257
       +
       

     

       258
       258
       +
       			resp, err := http.DefaultClient.Do(req)

     

       259
       259
       +
       			require.NoError(t, err)

     

       260
       260
       +
       			defer func() { _ = resp.Body.Close() }()

     

       261
       261
       +
       

     

       262
       262
       +
       			assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       263
       263
       +
       				"Invalid token should be rejected with 401")

     

       264
       264
       +
       		})

     

       265
       265
       +
       	}

     

       266
       266
       +
       

     

       267
       267
       +
       	t.Logf("✅ Invalid token rejection verified")

     

       268
       268
       +
       }

     

       269
       269
       +
       

     

       270
       270
       +
       // TestOAuthE2E_SessionNotFound tests behavior when session doesn't exist in DB

     

       271
       271
       +
       func TestOAuthE2E_SessionNotFound(t *testing.T) {

     

       272
       272
       +
       	if testing.Short() {

     

       273
       273
       +
       		t.Skip("Skipping OAuth session not found test in short mode")

     

       274
       274
       +
       	}

     

       275
       275
       +
       

     

       276
       276
       +
       	db := setupTestDB(t)

     

       277
       277
       +
       	defer func() { _ = db.Close() }()

     

       278
       278
       +
       

     

       279
       279
       +
       	// Run migrations

     

       280
       280
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       281
       281
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       282
       282
       +
       

     

       283
       283
       +
       	ctx := context.Background()

     

       284
       284
       +
       

     

       285
       285
       +
       	t.Log("🔍 Testing OAuth session not found behavior...")

     

       286
       286
       +
       

     

       287
       287
       +
       	// Setup OAuth store

     

       288
       288
       +
       	store := SetupOAuthTestStore(t, db)

     

       289
       289
       +
       

     

       290
       290
       +
       	// Try to retrieve non-existent session

     

       291
       291
       +
       	nonExistentDID, err := syntax.ParseDID("did:plc:nonexistent123")

     

       292
       292
       +
       	require.NoError(t, err)

     

       293
       293
       +
       

     

       294
       294
       +
       	_, err = store.GetSession(ctx, nonExistentDID, "nonexistent-session")

     

       295
       295
       +
       	assert.Error(t, err, "Should return error for non-existent session")

     

       296
       296
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "Should return ErrSessionNotFound")

     

       297
       297
       +
       

     

       298
       298
       +
       	// Try to delete non-existent session

     

       299
       299
       +
       	err = store.DeleteSession(ctx, nonExistentDID, "nonexistent-session")

     

       300
       300
       +
       	assert.Error(t, err, "Should return error when deleting non-existent session")

     

       301
       301
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "Should return ErrSessionNotFound")

     

       302
       302
       +
       

     

       303
       303
       +
       	t.Logf("✅ Session not found handling verified")

     

       304
       304
       +
       }

     

       305
       305
       +
       

     

       306
       306
       +
       // TestOAuthE2E_MultipleSessionsPerUser tests that a user can have multiple active sessions

     

       307
       307
       +
       func TestOAuthE2E_MultipleSessionsPerUser(t *testing.T) {

     

       308
       308
       +
       	if testing.Short() {

     

       309
       309
       +
       		t.Skip("Skipping OAuth multiple sessions test in short mode")

     

       310
       310
       +
       	}

     

       311
       311
       +
       

     

       312
       312
       +
       	db := setupTestDB(t)

     

       313
       313
       +
       	defer func() { _ = db.Close() }()

     

       314
       314
       +
       

     

       315
       315
       +
       	// Run migrations

     

       316
       316
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       317
       317
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       318
       318
       +
       

     

       319
       319
       +
       	ctx := context.Background()

     

       320
       320
       +
       

     

       321
       321
       +
       	t.Log("👥 Testing multiple OAuth sessions per user...")

     

       322
       322
       +
       

     

       323
       323
       +
       	// Setup OAuth store

     

       324
       324
       +
       	store := SetupOAuthTestStore(t, db)

     

       325
       325
       +
       

     

       326
       326
       +
       	// Create a test DID

     

       327
       327
       +
       	did, err := syntax.ParseDID("did:plc:multisession123")

     

       328
       328
       +
       	require.NoError(t, err)

     

       329
       329
       +
       

     

       330
       330
       +
       	// Create multiple sessions for the same user

     

       331
       331
       +
       	sessions := []oauthlib.ClientSessionData{

     

       332
       332
       +
       		{

     

       333
       333
       +
       			AccountDID:  did,

     

       334
       334
       +
       			SessionID:   "session-1-web",

     

       335
       335
       +
       			HostURL:     "http://localhost:3001",

     

       336
       336
       +
       			AccessToken: "token-1",

     

       337
       337
       +
       			Scopes:      []string{"atproto"},

     

       338
       338
       +
       		},

     

       339
       339
       +
       		{

     

       340
       340
       +
       			AccountDID:  did,

     

       341
       341
       +
       			SessionID:   "session-2-mobile",

     

       342
       342
       +
       			HostURL:     "http://localhost:3001",

     

       343
       343
       +
       			AccessToken: "token-2",

     

       344
       344
       +
       			Scopes:      []string{"atproto"},

     

       345
       345
       +
       		},

     

       346
       346
       +
       		{

     

       347
       347
       +
       			AccountDID:  did,

     

       348
       348
       +
       			SessionID:   "session-3-tablet",

     

       349
       349
       +
       			HostURL:     "http://localhost:3001",

     

       350
       350
       +
       			AccessToken: "token-3",

     

       351
       351
       +
       			Scopes:      []string{"atproto"},

     

       352
       352
       +
       		},

     

       353
       353
       +
       	}

     

       354
       354
       +
       

     

       355
       355
       +
       	// Save all sessions

     

       356
       356
       +
       	for i, session := range sessions {

     

       357
       357
       +
       		err := store.SaveSession(ctx, session)

     

       358
       358
       +
       		require.NoError(t, err, "Should be able to save session %d", i+1)

     

       359
       359
       +
       	}

     

       360
       360
       +
       

     

       361
       361
       +
       	t.Logf("✅ Created %d sessions for user", len(sessions))

     

       362
       362
       +
       

     

       363
       363
       +
       	// Verify all sessions can be retrieved independently

     

       364
       364
       +
       	for i, session := range sessions {

     

       365
       365
       +
       		retrieved, err := store.GetSession(ctx, did, session.SessionID)

     

       366
       366
       +
       		require.NoError(t, err, "Should be able to retrieve session %d", i+1)

     

       367
       367
       +
       		assert.Equal(t, session.SessionID, retrieved.SessionID, "Session ID should match")

     

       368
       368
       +
       		assert.Equal(t, session.AccessToken, retrieved.AccessToken, "Access token should match")

     

       369
       369
       +
       	}

     

       370
       370
       +
       

     

       371
       371
       +
       	t.Logf("✅ All sessions retrieved independently")

     

       372
       372
       +
       

     

       373
       373
       +
       	// Delete one session and verify others remain

     

       374
       374
       +
       	err = store.DeleteSession(ctx, did, sessions[0].SessionID)

     

       375
       375
       +
       	require.NoError(t, err, "Should be able to delete first session")

     

       376
       376
       +
       

     

       377
       377
       +
       	// Verify first session is deleted

     

       378
       378
       +
       	_, err = store.GetSession(ctx, did, sessions[0].SessionID)

     

       379
       379
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "First session should be deleted")

     

       380
       380
       +
       

     

       381
       381
       +
       	// Verify other sessions still exist

     

       382
       382
       +
       	for i := 1; i < len(sessions); i++ {

     

       383
       383
       +
       		_, err := store.GetSession(ctx, did, sessions[i].SessionID)

     

       384
       384
       +
       		require.NoError(t, err, "Session %d should still exist", i+1)

     

       385
       385
       +
       	}

     

       386
       386
       +
       

     

       387
       387
       +
       	t.Logf("✅ Multiple sessions per user verified")

     

       388
       388
       +
       

     

       389
       389
       +
       	// Cleanup

     

       390
       390
       +
       	for i := 1; i < len(sessions); i++ {

     

       391
       391
       +
       		_ = store.DeleteSession(ctx, did, sessions[i].SessionID)

     

       392
       392
       +
       	}

     

       393
       393
       +
       }

     

       394
       394
       +
       

     

       395
       395
       +
       // TestOAuthE2E_AuthRequestStorage tests OAuth auth request storage and retrieval

     

       396
       396
       +
       func TestOAuthE2E_AuthRequestStorage(t *testing.T) {

     

       397
       397
       +
       	if testing.Short() {

     

       398
       398
       +
       		t.Skip("Skipping OAuth auth request storage test in short mode")

     

       399
       399
       +
       	}

     

       400
       400
       +
       

     

       401
       401
       +
       	db := setupTestDB(t)

     

       402
       402
       +
       	defer func() { _ = db.Close() }()

     

       403
       403
       +
       

     

       404
       404
       +
       	// Run migrations

     

       405
       405
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       406
       406
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       407
       407
       +
       

     

       408
       408
       +
       	ctx := context.Background()

     

       409
       409
       +
       

     

       410
       410
       +
       	t.Log("📝 Testing OAuth auth request storage...")

     

       411
       411
       +
       

     

       412
       412
       +
       	// Setup OAuth store

     

       413
       413
       +
       	store := SetupOAuthTestStore(t, db)

     

       414
       414
       +
       

     

       415
       415
       +
       	// Create test auth request data

     

       416
       416
       +
       	did, err := syntax.ParseDID("did:plc:authrequest123")

     

       417
       417
       +
       	require.NoError(t, err)

     

       418
       418
       +
       

     

       419
       419
       +
       	authRequest := oauthlib.AuthRequestData{

     

       420
       420
       +
       		State:                        "test-state-12345",

     

       421
       421
       +
       		AccountDID:                   &did,

     

       422
       422
       +
       		PKCEVerifier:                 "test-pkce-verifier",

     

       423
       423
       +
       		DPoPPrivateKeyMultibase:      "test-dpop-key",

     

       424
       424
       +
       		DPoPAuthServerNonce:          "test-nonce",

     

       425
       425
       +
       		AuthServerURL:                "http://localhost:3001",

     

       426
       426
       +
       		RequestURI:                   "http://localhost:3001/authorize",

     

       427
       427
       +
       		AuthServerTokenEndpoint:      "http://localhost:3001/oauth/token",

     

       428
       428
       +
       		AuthServerRevocationEndpoint: "http://localhost:3001/oauth/revoke",

     

       429
       429
       +
       		Scopes:                       []string{"atproto", "transition:generic"},

     

       430
       430
       +
       	}

     

       431
       431
       +
       

     

       432
       432
       +
       	// Save auth request

     

       433
       433
       +
       	err = store.SaveAuthRequestInfo(ctx, authRequest)

     

       434
       434
       +
       	require.NoError(t, err, "Should be able to save auth request")

     

       435
       435
       +
       

     

       436
       436
       +
       	t.Logf("✅ Auth request saved")

     

       437
       437
       +
       

     

       438
       438
       +
       	// Retrieve auth request

     

       439
       439
       +
       	retrieved, err := store.GetAuthRequestInfo(ctx, authRequest.State)

     

       440
       440
       +
       	require.NoError(t, err, "Should be able to retrieve auth request")

     

       441
       441
       +
       	assert.Equal(t, authRequest.State, retrieved.State, "State should match")

     

       442
       442
       +
       	assert.Equal(t, authRequest.PKCEVerifier, retrieved.PKCEVerifier, "PKCE verifier should match")

     

       443
       443
       +
       	assert.Equal(t, authRequest.AuthServerURL, retrieved.AuthServerURL, "Auth server URL should match")

     

       444
       444
       +
       	assert.Equal(t, len(authRequest.Scopes), len(retrieved.Scopes), "Scopes length should match")

     

       445
       445
       +
       

     

       446
       446
       +
       	t.Logf("✅ Auth request retrieved and verified")

     

       447
       447
       +
       

     

       448
       448
       +
       	// Test duplicate state error

     

       449
       449
       +
       	err = store.SaveAuthRequestInfo(ctx, authRequest)

     

       450
       450
       +
       	assert.Error(t, err, "Should not allow duplicate state")

     

       451
       451
       +
       	assert.Contains(t, err.Error(), "already exists", "Error should indicate duplicate")

     

       452
       452
       +
       

     

       453
       453
       +
       	t.Logf("✅ Duplicate state prevention verified")

     

       454
       454
       +
       

     

       455
       455
       +
       	// Delete auth request

     

       456
       456
       +
       	err = store.DeleteAuthRequestInfo(ctx, authRequest.State)

     

       457
       457
       +
       	require.NoError(t, err, "Should be able to delete auth request")

     

       458
       458
       +
       

     

       459
       459
       +
       	// Verify deletion

     

       460
       460
       +
       	_, err = store.GetAuthRequestInfo(ctx, authRequest.State)

     

       461
       461
       +
       	assert.Equal(t, oauth.ErrAuthRequestNotFound, err, "Auth request should be deleted")

     

       462
       462
       +
       

     

       463
       463
       +
       	t.Logf("✅ Auth request deletion verified")

     

       464
       464
       +
       

     

       465
       465
       +
       	// Test cleanup of expired auth requests

     

       466
       466
       +
       	// Create an auth request and manually set created_at to the past

     

       467
       467
       +
       	oldAuthRequest := oauthlib.AuthRequestData{

     

       468
       468
       +
       		State:         "old-state-12345",

     

       469
       469
       +
       		PKCEVerifier:  "old-verifier",

     

       470
       470
       +
       		AuthServerURL: "http://localhost:3001",

     

       471
       471
       +
       		Scopes:        []string{"atproto"},

     

       472
       472
       +
       	}

     

       473
       473
       +
       

     

       474
       474
       +
       	err = store.SaveAuthRequestInfo(ctx, oldAuthRequest)

     

       475
       475
       +
       	require.NoError(t, err)

     

       476
       476
       +
       

     

       477
       477
       +
       	// Update created_at to 1 hour ago

     

       478
       478
       +
       	_, err = db.ExecContext(ctx,

     

       479
       479
       +
       		"UPDATE oauth_requests SET created_at = NOW() - INTERVAL '1 hour' WHERE state = $1",

     

       480
       480
       +
       		oldAuthRequest.State)

     

       481
       481
       +
       	require.NoError(t, err)

     

       482
       482
       +
       

     

       483
       483
       +
       	// Cleanup expired requests

     

       484
       484
       +
       	cleaned, err := store.(*oauth.PostgresOAuthStore).CleanupExpiredAuthRequests(ctx)

     

       485
       485
       +
       	require.NoError(t, err, "Cleanup should succeed")

     

       486
       486
       +
       	assert.Greater(t, cleaned, int64(0), "Should have cleaned up at least one auth request")

     

       487
       487
       +
       

     

       488
       488
       +
       	t.Logf("✅ Expired auth request cleanup verified (cleaned %d requests)", cleaned)

     

       489
       489
       +
       }

     

       490
       490
       +
       

     

       491
       491
       +
       // TestOAuthE2E_TokenRefresh tests the refresh token flow

     

       492
       492
       +
       func TestOAuthE2E_TokenRefresh(t *testing.T) {

     

       493
       493
       +
       	if testing.Short() {

     

       494
       494
       +
       		t.Skip("Skipping OAuth token refresh test in short mode")

     

       495
       495
       +
       	}

     

       496
       496
       +
       

     

       497
       497
       +
       	db := setupTestDB(t)

     

       498
       498
       +
       	defer func() { _ = db.Close() }()

     

       499
       499
       +
       

     

       500
       500
       +
       	// Run migrations

     

       501
       501
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       502
       502
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       503
       503
       +
       

     

       504
       504
       +
       	ctx := context.Background()

     

       505
       505
       +
       

     

       506
       506
       +
       	t.Log("🔄 Testing OAuth token refresh flow...")

     

       507
       507
       +
       

     

       508
       508
       +
       	// Setup OAuth client and store

     

       509
       509
       +
       	store := SetupOAuthTestStore(t, db)

     

       510
       510
       +
       	client := SetupOAuthTestClient(t, store)

     

       511
       511
       +
       	handler := oauth.NewOAuthHandler(client, store)

     

       512
       512
       +
       

     

       513
       513
       +
       	// Create a test DID and session

     

       514
       514
       +
       	did, err := syntax.ParseDID("did:plc:refreshtest123")

     

       515
       515
       +
       	require.NoError(t, err)

     

       516
       516
       +
       

     

       517
       517
       +
       	// Create initial session with refresh token

     

       518
       518
       +
       	initialSession := oauthlib.ClientSessionData{

     

       519
       519
       +
       		AccountDID:                   did,

     

       520
       520
       +
       		SessionID:                    "refresh-session-1",

     

       521
       521
       +
       		HostURL:                      "http://localhost:3001",

     

       522
       522
       +
       		AuthServerURL:                "http://localhost:3001",

     

       523
       523
       +
       		AuthServerTokenEndpoint:      "http://localhost:3001/oauth/token",

     

       524
       524
       +
       		AuthServerRevocationEndpoint: "http://localhost:3001/oauth/revoke",

     

       525
       525
       +
       		AccessToken:                  "initial-access-token",

     

       526
       526
       +
       		RefreshToken:                 "initial-refresh-token",

     

       527
       527
       +
       		DPoPPrivateKeyMultibase:      "test-dpop-key",

     

       528
       528
       +
       		DPoPAuthServerNonce:          "test-nonce",

     

       529
       529
       +
       		Scopes:                       []string{"atproto", "transition:generic"},

     

       530
       530
       +
       	}

     

       531
       531
       +
       

     

       532
       532
       +
       	// Save the session

     

       533
       533
       +
       	err = store.SaveSession(ctx, initialSession)

     

       534
       534
       +
       	require.NoError(t, err, "Should save initial session")

     

       535
       535
       +
       

     

       536
       536
       +
       	t.Logf("✅ Initial session created")

     

       537
       537
       +
       

     

       538
       538
       +
       	// Create a sealed token for this session

     

       539
       539
       +
       	sealedToken, err := client.SealSession(did.String(), initialSession.SessionID, time.Hour)

     

       540
       540
       +
       	require.NoError(t, err, "Should seal session token")

     

       541
       541
       +
       	require.NotEmpty(t, sealedToken, "Sealed token should not be empty")

     

       542
       542
       +
       

     

       543
       543
       +
       	t.Logf("✅ Session token sealed")

     

       544
       544
       +
       

     

       545
       545
       +
       	// Setup test server with refresh endpoint

     

       546
       546
       +
       	r := chi.NewRouter()

     

       547
       547
       +
       	r.Post("/oauth/refresh", handler.HandleRefresh)

     

       548
       548
       +
       

     

       549
       549
       +
       	server := httptest.NewServer(r)

     

       550
       550
       +
       	defer server.Close()

     

       551
       551
       +
       

     

       552
       552
       +
       	t.Run("Valid refresh request", func(t *testing.T) {

     

       553
       553
       +
       		// NOTE: This test verifies that the refresh endpoint can be called

     

       554
       554
       +
       		// In a real scenario, the indigo client's RefreshTokens() would call the PDS

     

       555
       555
       +
       		// Since we're in a component test, we're testing the Coves handler logic

     

       556
       556
       +
       

     

       557
       557
       +
       		// Create refresh request

     

       558
       558
       +
       		refreshReq := map[string]interface{}{

     

       559
       559
       +
       			"did":          did.String(),

     

       560
       560
       +
       			"session_id":   initialSession.SessionID,

     

       561
       561
       +
       			"sealed_token": sealedToken,

     

       562
       562
       +
       		}

     

       563
       563
       +
       

     

       564
       564
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       565
       565
       +
       		require.NoError(t, err)

     

       566
       566
       +
       

     

       567
       567
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       568
       568
       +
       		require.NoError(t, err)

     

       569
       569
       +
       		req.Header.Set("Content-Type", "application/json")

     

       570
       570
       +
       

     

       571
       571
       +
       		// NOTE: In component testing mode, the indigo client may not have

     

       572
       572
       +
       		// real PDS credentials, so RefreshTokens() might fail

     

       573
       573
       +
       		// We're testing that the handler correctly processes the request

     

       574
       574
       +
       		resp, err := http.DefaultClient.Do(req)

     

       575
       575
       +
       		require.NoError(t, err)

     

       576
       576
       +
       		defer func() { _ = resp.Body.Close() }()

     

       577
       577
       +
       

     

       578
       578
       +
       		// In component test mode without real PDS, we may get 401

     

       579
       579
       +
       		// In production with real PDS, this would return 200 with new tokens

     

       580
       580
       +
       		t.Logf("Refresh response status: %d", resp.StatusCode)

     

       581
       581
       +
       

     

       582
       582
       +
       		// The important thing is that the handler doesn't crash

     

       583
       583
       +
       		// and properly validates the request structure

     

       584
       584
       +
       		assert.True(t, resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusUnauthorized,

     

       585
       585
       +
       			"Refresh should return either success or auth failure, got %d", resp.StatusCode)

     

       586
       586
       +
       	})

     

       587
       587
       +
       

     

       588
       588
       +
       	t.Run("Invalid DID format (with valid token)", func(t *testing.T) {

     

       589
       589
       +
       		// Create a sealed token with an invalid DID format

     

       590
       590
       +
       		invalidDID := "invalid-did-format"

     

       591
       591
       +
       		// Create the token with a valid DID first, then we'll try to use it with invalid DID in request

     

       592
       592
       +
       		validToken, err := client.SealSession(did.String(), initialSession.SessionID, 30*24*time.Hour)

     

       593
       593
       +
       		require.NoError(t, err)

     

       594
       594
       +
       

     

       595
       595
       +
       		refreshReq := map[string]interface{}{

     

       596
       596
       +
       			"did":          invalidDID, // Invalid DID format in request

     

       597
       597
       +
       			"session_id":   initialSession.SessionID,

     

       598
       598
       +
       			"sealed_token": validToken, // Valid token for different DID

     

       599
       599
       +
       		}

     

       600
       600
       +
       

     

       601
       601
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       602
       602
       +
       		require.NoError(t, err)

     

       603
       603
       +
       

     

       604
       604
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       605
       605
       +
       		require.NoError(t, err)

     

       606
       606
       +
       		req.Header.Set("Content-Type", "application/json")

     

       607
       607
       +
       

     

       608
       608
       +
       		resp, err := http.DefaultClient.Do(req)

     

       609
       609
       +
       		require.NoError(t, err)

     

       610
       610
       +
       		defer func() { _ = resp.Body.Close() }()

     

       611
       611
       +
       

     

       612
       612
       +
       		// Should reject with 401 due to DID mismatch (not 400) since auth happens first

     

       613
       613
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       614
       614
       +
       			"DID mismatch should be rejected with 401 (auth check happens before format validation)")

     

       615
       615
       +
       	})

     

       616
       616
       +
       

     

       617
       617
       +
       	t.Run("Missing sealed_token (security test)", func(t *testing.T) {

     

       618
       618
       +
       		refreshReq := map[string]interface{}{

     

       619
       619
       +
       			"did":        did.String(),

     

       620
       620
       +
       			"session_id": initialSession.SessionID,

     

       621
       621
       +
       			// Missing sealed_token - should be rejected for security

     

       622
       622
       +
       		}

     

       623
       623
       +
       

     

       624
       624
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       625
       625
       +
       		require.NoError(t, err)

     

       626
       626
       +
       

     

       627
       627
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       628
       628
       +
       		require.NoError(t, err)

     

       629
       629
       +
       		req.Header.Set("Content-Type", "application/json")

     

       630
       630
       +
       

     

       631
       631
       +
       		resp, err := http.DefaultClient.Do(req)

     

       632
       632
       +
       		require.NoError(t, err)

     

       633
       633
       +
       		defer func() { _ = resp.Body.Close() }()

     

       634
       634
       +
       

     

       635
       635
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       636
       636
       +
       			"Missing sealed_token should be rejected (proof of possession required)")

     

       637
       637
       +
       	})

     

       638
       638
       +
       

     

       639
       639
       +
       	t.Run("Invalid sealed_token", func(t *testing.T) {

     

       640
       640
       +
       		refreshReq := map[string]interface{}{

     

       641
       641
       +
       			"did":          did.String(),

     

       642
       642
       +
       			"session_id":   initialSession.SessionID,

     

       643
       643
       +
       			"sealed_token": "invalid-token-data",

     

       644
       644
       +
       		}

     

       645
       645
       +
       

     

       646
       646
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       647
       647
       +
       		require.NoError(t, err)

     

       648
       648
       +
       

     

       649
       649
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       650
       650
       +
       		require.NoError(t, err)

     

       651
       651
       +
       		req.Header.Set("Content-Type", "application/json")

     

       652
       652
       +
       

     

       653
       653
       +
       		resp, err := http.DefaultClient.Do(req)

     

       654
       654
       +
       		require.NoError(t, err)

     

       655
       655
       +
       		defer func() { _ = resp.Body.Close() }()

     

       656
       656
       +
       

     

       657
       657
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       658
       658
       +
       			"Invalid sealed_token should be rejected")

     

       659
       659
       +
       	})

     

       660
       660
       +
       

     

       661
       661
       +
       	t.Run("DID mismatch (security test)", func(t *testing.T) {

     

       662
       662
       +
       		// Create a sealed token for a different DID

     

       663
       663
       +
       		wrongDID := "did:plc:wronguser123"

     

       664
       664
       +
       		wrongToken, err := client.SealSession(wrongDID, initialSession.SessionID, 30*24*time.Hour)

     

       665
       665
       +
       		require.NoError(t, err)

     

       666
       666
       +
       

     

       667
       667
       +
       		// Try to use it to refresh the original session

     

       668
       668
       +
       		refreshReq := map[string]interface{}{

     

       669
       669
       +
       			"did":          did.String(), // Claiming original DID

     

       670
       670
       +
       			"session_id":   initialSession.SessionID,

     

       671
       671
       +
       			"sealed_token": wrongToken, // But token is for different DID

     

       672
       672
       +
       		}

     

       673
       673
       +
       

     

       674
       674
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       675
       675
       +
       		require.NoError(t, err)

     

       676
       676
       +
       

     

       677
       677
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       678
       678
       +
       		require.NoError(t, err)

     

       679
       679
       +
       		req.Header.Set("Content-Type", "application/json")

     

       680
       680
       +
       

     

       681
       681
       +
       		resp, err := http.DefaultClient.Do(req)

     

       682
       682
       +
       		require.NoError(t, err)

     

       683
       683
       +
       		defer func() { _ = resp.Body.Close() }()

     

       684
       684
       +
       

     

       685
       685
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       686
       686
       +
       			"DID mismatch should be rejected (prevents session hijacking)")

     

       687
       687
       +
       	})

     

       688
       688
       +
       

     

       689
       689
       +
       	t.Run("Session ID mismatch (security test)", func(t *testing.T) {

     

       690
       690
       +
       		// Create a sealed token with wrong session ID

     

       691
       691
       +
       		wrongSessionID := "wrong-session-id"

     

       692
       692
       +
       		wrongToken, err := client.SealSession(did.String(), wrongSessionID, 30*24*time.Hour)

     

       693
       693
       +
       		require.NoError(t, err)

     

       694
       694
       +
       

     

       695
       695
       +
       		// Try to use it to refresh the original session

     

       696
       696
       +
       		refreshReq := map[string]interface{}{

     

       697
       697
       +
       			"did":          did.String(),

     

       698
       698
       +
       			"session_id":   initialSession.SessionID, // Claiming original session

     

       699
       699
       +
       			"sealed_token": wrongToken,               // But token is for different session

     

       700
       700
       +
       		}

     

       701
       701
       +
       

     

       702
       702
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       703
       703
       +
       		require.NoError(t, err)

     

       704
       704
       +
       

     

       705
       705
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       706
       706
       +
       		require.NoError(t, err)

     

       707
       707
       +
       		req.Header.Set("Content-Type", "application/json")

     

       708
       708
       +
       

     

       709
       709
       +
       		resp, err := http.DefaultClient.Do(req)

     

       710
       710
       +
       		require.NoError(t, err)

     

       711
       711
       +
       		defer func() { _ = resp.Body.Close() }()

     

       712
       712
       +
       

     

       713
       713
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       714
       714
       +
       			"Session ID mismatch should be rejected (prevents session hijacking)")

     

       715
       715
       +
       	})

     

       716
       716
       +
       

     

       717
       717
       +
       	t.Run("Non-existent session", func(t *testing.T) {

     

       718
       718
       +
       		// Create a valid sealed token for a non-existent session

     

       719
       719
       +
       		nonExistentSessionID := "nonexistent-session-id"

     

       720
       720
       +
       		validToken, err := client.SealSession(did.String(), nonExistentSessionID, 30*24*time.Hour)

     

       721
       721
       +
       		require.NoError(t, err)

     

       722
       722
       +
       

     

       723
       723
       +
       		refreshReq := map[string]interface{}{

     

       724
       724
       +
       			"did":          did.String(),

     

       725
       725
       +
       			"session_id":   nonExistentSessionID,

     

       726
       726
       +
       			"sealed_token": validToken, // Valid token but session doesn't exist

     

       727
       727
       +
       		}

     

       728
       728
       +
       

     

       729
       729
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       730
       730
       +
       		require.NoError(t, err)

     

       731
       731
       +
       

     

       732
       732
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       733
       733
       +
       		require.NoError(t, err)

     

       734
       734
       +
       		req.Header.Set("Content-Type", "application/json")

     

       735
       735
       +
       

     

       736
       736
       +
       		resp, err := http.DefaultClient.Do(req)

     

       737
       737
       +
       		require.NoError(t, err)

     

       738
       738
       +
       		defer func() { _ = resp.Body.Close() }()

     

       739
       739
       +
       

     

       740
       740
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       741
       741
       +
       			"Non-existent session should be rejected with 401")

     

       742
       742
       +
       	})

     

       743
       743
       +
       

     

       744
       744
       +
       	t.Logf("✅ Token refresh endpoint validation verified")

     

       745
       745
       +
       }

     

       746
       746
       +
       

     

       747
       747
       +
       // TestOAuthE2E_SessionUpdate tests that refresh updates the session in database

     

       748
       748
       +
       func TestOAuthE2E_SessionUpdate(t *testing.T) {

     

       749
       749
       +
       	if testing.Short() {

     

       750
       750
       +
       		t.Skip("Skipping OAuth session update test in short mode")

     

       751
       751
       +
       	}

     

       752
       752
       +
       

     

       753
       753
       +
       	db := setupTestDB(t)

     

       754
       754
       +
       	defer func() { _ = db.Close() }()

     

       755
       755
       +
       

     

       756
       756
       +
       	// Run migrations

     

       757
       757
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       758
       758
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       759
       759
       +
       

     

       760
       760
       +
       	ctx := context.Background()

     

       761
       761
       +
       

     

       762
       762
       +
       	t.Log("💾 Testing OAuth session update on refresh...")

     

       763
       763
       +
       

     

       764
       764
       +
       	// Setup OAuth store

     

       765
       765
       +
       	store := SetupOAuthTestStore(t, db)

     

       766
       766
       +
       

     

       767
       767
       +
       	// Create a test session

     

       768
       768
       +
       	did, err := syntax.ParseDID("did:plc:sessionupdate123")

     

       769
       769
       +
       	require.NoError(t, err)

     

       770
       770
       +
       

     

       771
       771
       +
       	originalSession := oauthlib.ClientSessionData{

     

       772
       772
       +
       		AccountDID:              did,

     

       773
       773
       +
       		SessionID:               "update-session-1",

     

       774
       774
       +
       		HostURL:                 "http://localhost:3001",

     

       775
       775
       +
       		AuthServerURL:           "http://localhost:3001",

     

       776
       776
       +
       		AuthServerTokenEndpoint: "http://localhost:3001/oauth/token",

     

       777
       777
       +
       		AccessToken:             "original-access-token",

     

       778
       778
       +
       		RefreshToken:            "original-refresh-token",

     

       779
       779
       +
       		DPoPPrivateKeyMultibase: "original-dpop-key",

     

       780
       780
       +
       		Scopes:                  []string{"atproto"},

     

       781
       781
       +
       	}

     

       782
       782
       +
       

     

       783
       783
       +
       	// Save original session

     

       784
       784
       +
       	err = store.SaveSession(ctx, originalSession)

     

       785
       785
       +
       	require.NoError(t, err)

     

       786
       786
       +
       

     

       787
       787
       +
       	t.Logf("✅ Original session saved")

     

       788
       788
       +
       

     

       789
       789
       +
       	// Simulate a token refresh by updating the session with new tokens

     

       790
       790
       +
       	updatedSession := originalSession

     

       791
       791
       +
       	updatedSession.AccessToken = "new-access-token"

     

       792
       792
       +
       	updatedSession.RefreshToken = "new-refresh-token"

     

       793
       793
       +
       	updatedSession.DPoPAuthServerNonce = "new-nonce"

     

       794
       794
       +
       

     

       795
       795
       +
       	// Update the session (upsert)

     

       796
       796
       +
       	err = store.SaveSession(ctx, updatedSession)

     

       797
       797
       +
       	require.NoError(t, err)

     

       798
       798
       +
       

     

       799
       799
       +
       	t.Logf("✅ Session updated with new tokens")

     

       800
       800
       +
       

     

       801
       801
       +
       	// Retrieve the session and verify it was updated

     

       802
       802
       +
       	retrieved, err := store.GetSession(ctx, did, originalSession.SessionID)

     

       803
       803
       +
       	require.NoError(t, err, "Should retrieve updated session")

     

       804
       804
       +
       

     

       805
       805
       +
       	assert.Equal(t, "new-access-token", retrieved.AccessToken,

     

       806
       806
       +
       		"Access token should be updated")

     

       807
       807
       +
       	assert.Equal(t, "new-refresh-token", retrieved.RefreshToken,

     

       808
       808
       +
       		"Refresh token should be updated")

     

       809
       809
       +
       	assert.Equal(t, "new-nonce", retrieved.DPoPAuthServerNonce,

     

       810
       810
       +
       		"DPoP nonce should be updated")

     

       811
       811
       +
       

     

       812
       812
       +
       	// Verify session ID and DID remain the same

     

       813
       813
       +
       	assert.Equal(t, originalSession.SessionID, retrieved.SessionID,

     

       814
       814
       +
       		"Session ID should remain the same")

     

       815
       815
       +
       	assert.Equal(t, did, retrieved.AccountDID,

     

       816
       816
       +
       		"DID should remain the same")

     

       817
       817
       +
       

     

       818
       818
       +
       	t.Logf("✅ Session update verified - tokens refreshed in database")

     

       819
       819
       +
       

     

       820
       820
       +
       	// Verify updated_at was changed

     

       821
       821
       +
       	var updatedAt time.Time

     

       822
       822
       +
       	err = db.QueryRowContext(ctx,

     

       823
       823
       +
       		"SELECT updated_at FROM oauth_sessions WHERE did = $1 AND session_id = $2",

     

       824
       824
       +
       		did.String(), originalSession.SessionID).Scan(&updatedAt)

     

       825
       825
       +
       	require.NoError(t, err)

     

       826
       826
       +
       

     

       827
       827
       +
       	// Updated timestamp should be recent (within last minute)

     

       828
       828
       +
       	assert.WithinDuration(t, time.Now(), updatedAt, time.Minute,

     

       829
       829
       +
       		"Session updated_at should be recent")

     

       830
       830
       +
       

     

       831
       831
       +
       	t.Logf("✅ Session timestamp update verified")

     

       832
       832
       +
       }

     

       833
       833
       +
       

     

       834
       834
       +
       // TestOAuthE2E_RefreshTokenRotation tests refresh token rotation behavior

     

       835
       835
       +
       func TestOAuthE2E_RefreshTokenRotation(t *testing.T) {

     

       836
       836
       +
       	if testing.Short() {

     

       837
       837
       +
       		t.Skip("Skipping OAuth refresh token rotation test in short mode")

     

       838
       838
       +
       	}

     

       839
       839
       +
       

     

       840
       840
       +
       	db := setupTestDB(t)

     

       841
       841
       +
       	defer func() { _ = db.Close() }()

     

       842
       842
       +
       

     

       843
       843
       +
       	// Run migrations

     

       844
       844
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       845
       845
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       846
       846
       +
       

     

       847
       847
       +
       	ctx := context.Background()

     

       848
       848
       +
       

     

       849
       849
       +
       	t.Log("🔄 Testing OAuth refresh token rotation...")

     

       850
       850
       +
       

     

       851
       851
       +
       	// Setup OAuth store

     

       852
       852
       +
       	store := SetupOAuthTestStore(t, db)

     

       853
       853
       +
       

     

       854
       854
       +
       	// Create a test session

     

       855
       855
       +
       	did, err := syntax.ParseDID("did:plc:rotation123")

     

       856
       856
       +
       	require.NoError(t, err)

     

       857
       857
       +
       

     

       858
       858
       +
       	// Simulate multiple refresh cycles

     

       859
       859
       +
       	sessionID := "rotation-session-1"

     

       860
       860
       +
       	tokens := []struct {

     

       861
       861
       +
       		access  string

     

       862
       862
       +
       		refresh string

     

       863
       863
       +
       	}{

     

       864
       864
       +
       		{"access-token-v1", "refresh-token-v1"},

     

       865
       865
       +
       		{"access-token-v2", "refresh-token-v2"},

     

       866
       866
       +
       		{"access-token-v3", "refresh-token-v3"},

     

       867
       867
       +
       	}

     

       868
       868
       +
       

     

       869
       869
       +
       	for i, tokenPair := range tokens {

     

       870
       870
       +
       		session := oauthlib.ClientSessionData{

     

       871
       871
       +
       			AccountDID:              did,

     

       872
       872
       +
       			SessionID:               sessionID,

     

       873
       873
       +
       			HostURL:                 "http://localhost:3001",

     

       874
       874
       +
       			AuthServerURL:           "http://localhost:3001",

     

       875
       875
       +
       			AuthServerTokenEndpoint: "http://localhost:3001/oauth/token",

     

       876
       876
       +
       			AccessToken:             tokenPair.access,

     

       877
       877
       +
       			RefreshToken:            tokenPair.refresh,

     

       878
       878
       +
       			Scopes:                  []string{"atproto"},

     

       879
       879
       +
       		}

     

       880
       880
       +
       

     

       881
       881
       +
       		// Save/update session

     

       882
       882
       +
       		err = store.SaveSession(ctx, session)

     

       883
       883
       +
       		require.NoError(t, err, "Should save session iteration %d", i+1)

     

       884
       884
       +
       

     

       885
       885
       +
       		// Retrieve and verify

     

       886
       886
       +
       		retrieved, err := store.GetSession(ctx, did, sessionID)

     

       887
       887
       +
       		require.NoError(t, err, "Should retrieve session iteration %d", i+1)

     

       888
       888
       +
       

     

       889
       889
       +
       		assert.Equal(t, tokenPair.access, retrieved.AccessToken,

     

       890
       890
       +
       			"Access token should match iteration %d", i+1)

     

       891
       891
       +
       		assert.Equal(t, tokenPair.refresh, retrieved.RefreshToken,

     

       892
       892
       +
       			"Refresh token should match iteration %d", i+1)

     

       893
       893
       +
       

     

       894
       894
       +
       		// Small delay to ensure timestamp differences

     

       895
       895
       +
       		time.Sleep(10 * time.Millisecond)

     

       896
       896
       +
       	}

     

       897
       897
       +
       

     

       898
       898
       +
       	t.Logf("✅ Refresh token rotation verified through %d cycles", len(tokens))

     

       899
       899
       +
       

     

       900
       900
       +
       	// Verify final state

     

       901
       901
       +
       	finalSession, err := store.GetSession(ctx, did, sessionID)

     

       902
       902
       +
       	require.NoError(t, err)

     

       903
       903
       +
       

     

       904
       904
       +
       	assert.Equal(t, "access-token-v3", finalSession.AccessToken,

     

       905
       905
       +
       		"Final access token should be from last rotation")

     

       906
       906
       +
       	assert.Equal(t, "refresh-token-v3", finalSession.RefreshToken,

     

       907
       907
       +
       		"Final refresh token should be from last rotation")

     

       908
       908
       +
       

     

       909
       909
       +
       	t.Logf("✅ Token rotation state verified")

     

       910
       910
       +
       }

+312

tests/integration/oauth_session_fixation_test.go

···

       1
       1
       +
       package integration

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/oauth"

     

       5
       5
       +
       	"context"

     

       6
       6
       +
       	"crypto/sha256"

     

       7
       7
       +
       	"encoding/base64"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       	"net/http/httptest"

     

       10
       10
       +
       	"net/url"

     

       11
       11
       +
       	"testing"

     

       12
       12
       +
       	"time"

     

       13
       13
       +
       

     

       14
       14
       +
       	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       15
       15
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       16
       16
       +
       	"github.com/go-chi/chi/v5"

     

       17
       17
       +
       	"github.com/pressly/goose/v3"

     

       18
       18
       +
       	"github.com/stretchr/testify/assert"

     

       19
       19
       +
       	"github.com/stretchr/testify/require"

     

       20
       20
       +
       )

     

       21
       21
       +
       

     

       22
       22
       +
       // TestOAuth_SessionFixationAttackPrevention tests that the mobile redirect binding

     

       23
       23
       +
       // prevents session fixation attacks where an attacker plants a mobile_redirect_uri

     

       24
       24
       +
       // cookie, then the user does a web login, and credentials get sent to attacker's deep link.

     

       25
       25
       +
       //

     

       26
       26
       +
       // Attack scenario:

     

       27
       27
       +
       // 1. Attacker tricks user into visiting /oauth/mobile/login?redirect_uri=evil://steal

     

       28
       28
       +
       // 2. This plants a mobile_redirect_uri cookie (lives 10 minutes)

     

       29
       29
       +
       // 3. User later does normal web OAuth login via /oauth/login

     

       30
       30
       +
       // 4. HandleCallback sees the stale mobile_redirect_uri cookie

     

       31
       31
       +
       // 5. WITHOUT THE FIX: Callback sends sealed token, DID, session_id to attacker's deep link

     

       32
       32
       +
       // 6. WITH THE FIX: Binding mismatch is detected, mobile cookies cleared, user gets web session

     

       33
       33
       +
       func TestOAuth_SessionFixationAttackPrevention(t *testing.T) {

     

       34
       34
       +
       	if testing.Short() {

     

       35
       35
       +
       		t.Skip("Skipping OAuth session fixation test in short mode")

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	// Setup test database

     

       39
       39
       +
       	db := setupTestDB(t)

     

       40
       40
       +
       	defer func() {

     

       41
       41
       +
       		if err := db.Close(); err != nil {

     

       42
       42
       +
       			t.Logf("Failed to close database: %v", err)

     

       43
       43
       +
       		}

     

       44
       44
       +
       	}()

     

       45
       45
       +
       

     

       46
       46
       +
       	// Run migrations

     

       47
       47
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       48
       48
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       49
       49
       +
       

     

       50
       50
       +
       	// Setup OAuth client and store

     

       51
       51
       +
       	store := SetupOAuthTestStore(t, db)

     

       52
       52
       +
       	client := SetupOAuthTestClient(t, store)

     

       53
       53
       +
       	require.NotNil(t, client, "OAuth client should be initialized")

     

       54
       54
       +
       

     

       55
       55
       +
       	// Setup handler

     

       56
       56
       +
       	handler := oauth.NewOAuthHandler(client, store)

     

       57
       57
       +
       

     

       58
       58
       +
       	// Setup router

     

       59
       59
       +
       	r := chi.NewRouter()

     

       60
       60
       +
       	r.Get("/oauth/callback", handler.HandleCallback)

     

       61
       61
       +
       

     

       62
       62
       +
       	t.Run("attack scenario - planted mobile cookie without binding", func(t *testing.T) {

     

       63
       63
       +
       		ctx := context.Background()

     

       64
       64
       +
       

     

       65
       65
       +
       		// Step 1: Simulate a successful OAuth callback (like a user did web login)

     

       66
       66
       +
       		// We'll create a mock session to simulate what ProcessCallback would return

     

       67
       67
       +
       		testDID := "did:plc:test123456"

     

       68
       68
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       69
       69
       +
       		require.NoError(t, err)

     

       70
       70
       +
       

     

       71
       71
       +
       		sessionID := "test-session-" + time.Now().Format("20060102150405")

     

       72
       72
       +
       		testSession := oauthlib.ClientSessionData{

     

       73
       73
       +
       			AccountDID:  parsedDID,

     

       74
       74
       +
       			SessionID:   sessionID,

     

       75
       75
       +
       			HostURL:     "http://localhost:3001",

     

       76
       76
       +
       			AccessToken: "test-access-token",

     

       77
       77
       +
       			Scopes:      []string{"atproto"},

     

       78
       78
       +
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		// Save the session (simulating successful OAuth flow)

     

       81
       81
       +
       		err = store.SaveSession(ctx, testSession)

     

       82
       82
       +
       		require.NoError(t, err)

     

       83
       83
       +
       

     

       84
       84
       +
       		// Step 2: Attacker planted a mobile_redirect_uri cookie (without binding)

     

       85
       85
       +
       		// This simulates the cookie being planted earlier by attacker

     

       86
       86
       +
       		attackerRedirectURI := "evil://steal"

     

       87
       87
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       88
       88
       +
       

     

       89
       89
       +
       		// Plant the attacker's cookie (URL escaped as it would be in real scenario)

     

       90
       90
       +
       		req.AddCookie(&http.Cookie{

     

       91
       91
       +
       			Name:  "mobile_redirect_uri",

     

       92
       92
       +
       			Value: url.QueryEscape(attackerRedirectURI),

     

       93
       93
       +
       			Path:  "/oauth",

     

       94
       94
       +
       		})

     

       95
       95
       +
       		// NOTE: No mobile_redirect_binding cookie! This is the attack scenario.

     

       96
       96
       +
       

     

       97
       97
       +
       		rec := httptest.NewRecorder()

     

       98
       98
       +
       

     

       99
       99
       +
       		// Step 3: Try to process the callback

     

       100
       100
       +
       		// This would fail because ProcessCallback needs real OAuth code/state

     

       101
       101
       +
       		// For this test, we're verifying the handler's security checks work

     

       102
       102
       +
       		// even before ProcessCallback is called

     

       103
       103
       +
       

     

       104
       104
       +
       		// The handler will try to call ProcessCallback which will fail

     

       105
       105
       +
       		// But we're testing that even if it succeeded, the mobile redirect

     

       106
       106
       +
       		// validation would prevent the attack

     

       107
       107
       +
       		handler.HandleCallback(rec, req)

     

       108
       108
       +
       

     

       109
       109
       +
       		// Step 4: Verify the attack was prevented

     

       110
       110
       +
       		// The handler should reject the request due to missing binding

     

       111
       111
       +
       		// Since ProcessCallback will fail first (no real OAuth code), we expect

     

       112
       112
       +
       		// a 400 error, but the important thing is it doesn't redirect to evil://steal

     

       113
       113
       +
       

     

       114
       114
       +
       		assert.NotEqual(t, http.StatusFound, rec.Code,

     

       115
       115
       +
       			"Should not redirect when ProcessCallback fails")

     

       116
       116
       +
       		assert.NotContains(t, rec.Header().Get("Location"), "evil://",

     

       117
       117
       +
       			"Should never redirect to attacker's URI")

     

       118
       118
       +
       	})

     

       119
       119
       +
       

     

       120
       120
       +
       	t.Run("legitimate mobile flow - with valid binding", func(t *testing.T) {

     

       121
       121
       +
       		ctx := context.Background()

     

       122
       122
       +
       

     

       123
       123
       +
       		// Setup a legitimate mobile session

     

       124
       124
       +
       		testDID := "did:plc:mobile123"

     

       125
       125
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       126
       126
       +
       		require.NoError(t, err)

     

       127
       127
       +
       

     

       128
       128
       +
       		sessionID := "mobile-session-" + time.Now().Format("20060102150405")

     

       129
       129
       +
       		testSession := oauthlib.ClientSessionData{

     

       130
       130
       +
       			AccountDID:  parsedDID,

     

       131
       131
       +
       			SessionID:   sessionID,

     

       132
       132
       +
       			HostURL:     "http://localhost:3001",

     

       133
       133
       +
       			AccessToken: "mobile-access-token",

     

       134
       134
       +
       			Scopes:      []string{"atproto"},

     

       135
       135
       +
       		}

     

       136
       136
       +
       

     

       137
       137
       +
       		// Save the session

     

       138
       138
       +
       		err = store.SaveSession(ctx, testSession)

     

       139
       139
       +
       		require.NoError(t, err)

     

       140
       140
       +
       

     

       141
       141
       +
       		// Create request with BOTH mobile_redirect_uri AND valid binding

     

       142
       142
       +
       		// Use Universal Link URI that's in the allowlist

     

       143
       143
       +
       		legitRedirectURI := "https://coves.social/app/oauth/callback"

     

       144
       144
       +
       		csrfToken := "valid-csrf-token-for-mobile"

     

       145
       145
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       146
       146
       +
       

     

       147
       147
       +
       		// Add mobile redirect URI cookie

     

       148
       148
       +
       		req.AddCookie(&http.Cookie{

     

       149
       149
       +
       			Name:  "mobile_redirect_uri",

     

       150
       150
       +
       			Value: url.QueryEscape(legitRedirectURI),

     

       151
       151
       +
       			Path:  "/oauth",

     

       152
       152
       +
       		})

     

       153
       153
       +
       

     

       154
       154
       +
       		// Add CSRF token (required for mobile flow)

     

       155
       155
       +
       		req.AddCookie(&http.Cookie{

     

       156
       156
       +
       			Name:  "oauth_csrf",

     

       157
       157
       +
       			Value: csrfToken,

     

       158
       158
       +
       			Path:  "/oauth",

     

       159
       159
       +
       		})

     

       160
       160
       +
       

     

       161
       161
       +
       		// Add VALID binding cookie (this is what prevents the attack)

     

       162
       162
       +
       		// In real flow, this would be set by HandleMobileLogin

     

       163
       163
       +
       		// The binding now includes the CSRF token for double-submit validation

     

       164
       164
       +
       		mobileBinding := generateMobileRedirectBindingForTest(csrfToken, legitRedirectURI)

     

       165
       165
       +
       		req.AddCookie(&http.Cookie{

     

       166
       166
       +
       			Name:  "mobile_redirect_binding",

     

       167
       167
       +
       			Value: mobileBinding,

     

       168
       168
       +
       			Path:  "/oauth",

     

       169
       169
       +
       		})

     

       170
       170
       +
       

     

       171
       171
       +
       		rec := httptest.NewRecorder()

     

       172
       172
       +
       		handler.HandleCallback(rec, req)

     

       173
       173
       +
       

     

       174
       174
       +
       		// This will also fail at ProcessCallback (no real OAuth code)

     

       175
       175
       +
       		// but we're verifying the binding validation logic is in place

     

       176
       176
       +
       		// In a real integration test with PDS, this would succeed

     

       177
       177
       +
       		assert.NotEqual(t, http.StatusFound, rec.Code,

     

       178
       178
       +
       			"Should not redirect when ProcessCallback fails (expected in mock test)")

     

       179
       179
       +
       	})

     

       180
       180
       +
       

     

       181
       181
       +
       	t.Run("binding mismatch - attacker tries wrong binding", func(t *testing.T) {

     

       182
       182
       +
       		ctx := context.Background()

     

       183
       183
       +
       

     

       184
       184
       +
       		// Setup session

     

       185
       185
       +
       		testDID := "did:plc:bindingtest"

     

       186
       186
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       187
       187
       +
       		require.NoError(t, err)

     

       188
       188
       +
       

     

       189
       189
       +
       		sessionID := "binding-test-" + time.Now().Format("20060102150405")

     

       190
       190
       +
       		testSession := oauthlib.ClientSessionData{

     

       191
       191
       +
       			AccountDID:  parsedDID,

     

       192
       192
       +
       			SessionID:   sessionID,

     

       193
       193
       +
       			HostURL:     "http://localhost:3001",

     

       194
       194
       +
       			AccessToken: "binding-test-token",

     

       195
       195
       +
       			Scopes:      []string{"atproto"},

     

       196
       196
       +
       		}

     

       197
       197
       +
       

     

       198
       198
       +
       		err = store.SaveSession(ctx, testSession)

     

       199
       199
       +
       		require.NoError(t, err)

     

       200
       200
       +
       

     

       201
       201
       +
       		// Attacker tries to plant evil redirect with a binding from different URI

     

       202
       202
       +
       		attackerRedirectURI := "evil://steal"

     

       203
       203
       +
       		attackerCSRF := "attacker-csrf-token"

     

       204
       204
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       205
       205
       +
       

     

       206
       206
       +
       		req.AddCookie(&http.Cookie{

     

       207
       207
       +
       			Name:  "mobile_redirect_uri",

     

       208
       208
       +
       			Value: url.QueryEscape(attackerRedirectURI),

     

       209
       209
       +
       			Path:  "/oauth",

     

       210
       210
       +
       		})

     

       211
       211
       +
       

     

       212
       212
       +
       		req.AddCookie(&http.Cookie{

     

       213
       213
       +
       			Name:  "oauth_csrf",

     

       214
       214
       +
       			Value: attackerCSRF,

     

       215
       215
       +
       			Path:  "/oauth",

     

       216
       216
       +
       		})

     

       217
       217
       +
       

     

       218
       218
       +
       		// Use binding from a DIFFERENT CSRF token and URI (attacker's attempt to forge)

     

       219
       219
       +
       		// Even if attacker knows the redirect URI, they don't know the user's CSRF token

     

       220
       220
       +
       		wrongBinding := generateMobileRedirectBindingForTest("different-csrf", "https://coves.social/app/oauth/callback")

     

       221
       221
       +
       		req.AddCookie(&http.Cookie{

     

       222
       222
       +
       			Name:  "mobile_redirect_binding",

     

       223
       223
       +
       			Value: wrongBinding,

     

       224
       224
       +
       			Path:  "/oauth",

     

       225
       225
       +
       		})

     

       226
       226
       +
       

     

       227
       227
       +
       		rec := httptest.NewRecorder()

     

       228
       228
       +
       		handler.HandleCallback(rec, req)

     

       229
       229
       +
       

     

       230
       230
       +
       		// Should fail due to binding mismatch (even before ProcessCallback)

     

       231
       231
       +
       		// The binding validation happens after ProcessCallback in the real code,

     

       232
       232
       +
       		// but the mismatch would be caught and cookies cleared

     

       233
       233
       +
       		assert.NotContains(t, rec.Header().Get("Location"), "evil://",

     

       234
       234
       +
       			"Should never redirect to attacker's URI on binding mismatch")

     

       235
       235
       +
       	})

     

       236
       236
       +
       

     

       237
       237
       +
       	t.Run("CSRF token value mismatch - attacker tries different CSRF", func(t *testing.T) {

     

       238
       238
       +
       		ctx := context.Background()

     

       239
       239
       +
       

     

       240
       240
       +
       		// Setup session

     

       241
       241
       +
       		testDID := "did:plc:csrftest"

     

       242
       242
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       243
       243
       +
       		require.NoError(t, err)

     

       244
       244
       +
       

     

       245
       245
       +
       		sessionID := "csrf-test-" + time.Now().Format("20060102150405")

     

       246
       246
       +
       		testSession := oauthlib.ClientSessionData{

     

       247
       247
       +
       			AccountDID:  parsedDID,

     

       248
       248
       +
       			SessionID:   sessionID,

     

       249
       249
       +
       			HostURL:     "http://localhost:3001",

     

       250
       250
       +
       			AccessToken: "csrf-test-token",

     

       251
       251
       +
       			Scopes:      []string{"atproto"},

     

       252
       252
       +
       		}

     

       253
       253
       +
       

     

       254
       254
       +
       		err = store.SaveSession(ctx, testSession)

     

       255
       255
       +
       		require.NoError(t, err)

     

       256
       256
       +
       

     

       257
       257
       +
       		// This tests the P1 security fix: CSRF token VALUE must be validated, not just presence

     

       258
       258
       +
       		// Attack scenario:

     

       259
       259
       +
       		// 1. User starts mobile login with CSRF token A and redirect URI X

     

       260
       260
       +
       		// 2. Binding = hash(A + X) is stored in cookie

     

       261
       261
       +
       		// 3. Attacker somehow gets user to have CSRF token B in cookie (different from A)

     

       262
       262
       +
       		// 4. Callback receives CSRF token B, redirect URI X, binding = hash(A + X)

     

       263
       263
       +
       		// 5. hash(B + X) != hash(A + X), so attack is detected

     

       264
       264
       +
       

     

       265
       265
       +
       		originalCSRF := "original-csrf-token-set-at-login"

     

       266
       266
       +
       		redirectURI := "https://coves.social/app/oauth/callback"

     

       267
       267
       +
       		// Binding was created with original CSRF token

     

       268
       268
       +
       		originalBinding := generateMobileRedirectBindingForTest(originalCSRF, redirectURI)

     

       269
       269
       +
       

     

       270
       270
       +
       		// But attacker managed to change the CSRF cookie

     

       271
       271
       +
       		attackerCSRF := "attacker-replaced-csrf"

     

       272
       272
       +
       

     

       273
       273
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       274
       274
       +
       

     

       275
       275
       +
       		req.AddCookie(&http.Cookie{

     

       276
       276
       +
       			Name:  "mobile_redirect_uri",

     

       277
       277
       +
       			Value: url.QueryEscape(redirectURI),

     

       278
       278
       +
       			Path:  "/oauth",

     

       279
       279
       +
       		})

     

       280
       280
       +
       

     

       281
       281
       +
       		// Attacker's CSRF token (different from what created the binding)

     

       282
       282
       +
       		req.AddCookie(&http.Cookie{

     

       283
       283
       +
       			Name:  "oauth_csrf",

     

       284
       284
       +
       			Value: attackerCSRF,

     

       285
       285
       +
       			Path:  "/oauth",

     

       286
       286
       +
       		})

     

       287
       287
       +
       

     

       288
       288
       +
       		// Original binding (created with original CSRF token)

     

       289
       289
       +
       		req.AddCookie(&http.Cookie{

     

       290
       290
       +
       			Name:  "mobile_redirect_binding",

     

       291
       291
       +
       			Value: originalBinding,

     

       292
       292
       +
       			Path:  "/oauth",

     

       293
       293
       +
       		})

     

       294
       294
       +
       

     

       295
       295
       +
       		rec := httptest.NewRecorder()

     

       296
       296
       +
       		handler.HandleCallback(rec, req)

     

       297
       297
       +
       

     

       298
       298
       +
       		// Should fail because hash(attackerCSRF + redirectURI) != hash(originalCSRF + redirectURI)

     

       299
       299
       +
       		// This is the key security fix - CSRF token VALUE is now validated

     

       300
       300
       +
       		assert.NotEqual(t, http.StatusFound, rec.Code,

     

       301
       301
       +
       			"Should not redirect when CSRF token doesn't match binding")

     

       302
       302
       +
       	})

     

       303
       303
       +
       }

     

       304
       304
       +
       

     

       305
       305
       +
       // generateMobileRedirectBindingForTest generates a binding for testing

     

       306
       306
       +
       // This mirrors the actual logic in handlers_security.go:

     

       307
       307
       +
       // binding = base64(sha256(csrfToken + "|" + redirectURI)[:16])

     

       308
       308
       +
       func generateMobileRedirectBindingForTest(csrfToken, mobileRedirectURI string) string {

     

       309
       309
       +
       	combined := csrfToken + "|" + mobileRedirectURI

     

       310
       310
       +
       	hash := sha256.Sum256([]byte(combined))

     

       311
       311
       +
       	return base64.URLEncoding.EncodeToString(hash[:16])

     

       312
       312
       +
       }

+169

tests/integration/oauth_token_verification_test.go

···

       1
       1
       +
       package integration

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       	"net/http/httptest"

     

       8
       8
       +
       	"os"

     

       9
       9
       +
       	"testing"

     

       10
       10
       +
       	"time"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // TestOAuthTokenVerification tests end-to-end OAuth token verification

     

       14
       14
       +
       // with real PDS-issued OAuth tokens. This replaces the old JWT verification test

     

       15
       15
       +
       // since we now use OAuth sealed session tokens instead of raw JWTs.

     

       16
       16
       +
       //

     

       17
       17
       +
       // Flow:

     

       18
       18
       +
       // 1. Create account on local PDS (or use existing)

     

       19
       19
       +
       // 2. Authenticate to get OAuth tokens and create sealed session token

     

       20
       20
       +
       // 3. Verify our auth middleware can unseal and validate the token

     

       21
       21
       +
       // 4. Test token validation and session retrieval

     

       22
       22
       +
       //

     

       23
       23
       +
       // NOTE: This test uses the E2E OAuth middleware which mocks the session unsealing

     

       24
       24
       +
       // for testing purposes. Real OAuth tokens from PDS would be sealed using the

     

       25
       25
       +
       // OAuth client's seal secret.

     

       26
       26
       +
       func TestOAuthTokenVerification(t *testing.T) {

     

       27
       27
       +
       	// Skip in short mode since this requires real PDS

     

       28
       28
       +
       	if testing.Short() {

     

       29
       29
       +
       		t.Skip("Skipping OAuth token verification test in short mode")

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	pdsURL := os.Getenv("PDS_URL")

     

       33
       33
       +
       	if pdsURL == "" {

     

       34
       34
       +
       		pdsURL = "http://localhost:3001"

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	// Check if PDS is running

     

       38
       38
       +
       	healthResp, err := http.Get(pdsURL + "/xrpc/_health")

     

       39
       39
       +
       	if err != nil {

     

       40
       40
       +
       		t.Skipf("PDS not running at %s: %v", pdsURL, err)

     

       41
       41
       +
       	}

     

       42
       42
       +
       	_ = healthResp.Body.Close()

     

       43
       43
       +
       

     

       44
       44
       +
       	t.Run("OAuth token validation and middleware integration", func(t *testing.T) {

     

       45
       45
       +
       		// Step 1: Create a test account on PDS

     

       46
       46
       +
       		// Keep handle short to avoid PDS validation errors

     

       47
       47
       +
       		timestamp := time.Now().Unix() % 100000 // Last 5 digits

     

       48
       48
       +
       		handle := fmt.Sprintf("oauth%d.local.coves.dev", timestamp)

     

       49
       49
       +
       		password := "testpass123"

     

       50
       50
       +
       		email := fmt.Sprintf("oauth%d@test.com", timestamp)

     

       51
       51
       +
       

     

       52
       52
       +
       		_, did, err := createPDSAccount(pdsURL, handle, email, password)

     

       53
       53
       +
       		if err != nil {

     

       54
       54
       +
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       55
       55
       +
       		}

     

       56
       56
       +
       		t.Logf("✓ Created test account: %s (DID: %s)", handle, did)

     

       57
       57
       +
       

     

       58
       58
       +
       		// Step 2: Create OAuth middleware with mock unsealer for testing

     

       59
       59
       +
       		// In production, this would unseal real OAuth tokens from PDS

     

       60
       60
       +
       		t.Log("Testing OAuth middleware with sealed session tokens...")

     

       61
       61
       +
       

     

       62
       62
       +
       		e2eAuth := NewE2EOAuthMiddleware()

     

       63
       63
       +
       		testToken := e2eAuth.AddUser(did)

     

       64
       64
       +
       

     

       65
       65
       +
       		handlerCalled := false

     

       66
       66
       +
       		var extractedDID string

     

       67
       67
       +
       

     

       68
       68
       +
       		testHandler := e2eAuth.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       69
       69
       +
       			handlerCalled = true

     

       70
       70
       +
       			extractedDID = middleware.GetUserDID(r)

     

       71
       71
       +
       			w.WriteHeader(http.StatusOK)

     

       72
       72
       +
       			_, _ = w.Write([]byte(`{"success": true}`))

     

       73
       73
       +
       		}))

     

       74
       74
       +
       

     

       75
       75
       +
       		req := httptest.NewRequest("GET", "/test", nil)

     

       76
       76
       +
       		req.Header.Set("Authorization", "Bearer "+testToken)

     

       77
       77
       +
       		w := httptest.NewRecorder()

     

       78
       78
       +
       

     

       79
       79
       +
       		testHandler.ServeHTTP(w, req)

     

       80
       80
       +
       

     

       81
       81
       +
       		if !handlerCalled {

     

       82
       82
       +
       			t.Errorf("Handler was not called - auth middleware rejected valid token")

     

       83
       83
       +
       			t.Logf("Response status: %d", w.Code)

     

       84
       84
       +
       			t.Logf("Response body: %s", w.Body.String())

     

       85
       85
       +
       		}

     

       86
       86
       +
       

     

       87
       87
       +
       		if w.Code != http.StatusOK {

     

       88
       88
       +
       			t.Errorf("Expected status 200, got %d", w.Code)

     

       89
       89
       +
       			t.Logf("Response body: %s", w.Body.String())

     

       90
       90
       +
       		}

     

       91
       91
       +
       

     

       92
       92
       +
       		if extractedDID != did {

     

       93
       93
       +
       			t.Errorf("Middleware extracted wrong DID: expected %s, got %s", did, extractedDID)

     

       94
       94
       +
       		}

     

       95
       95
       +
       

     

       96
       96
       +
       		t.Logf("✅ OAuth middleware with token validation working correctly!")

     

       97
       97
       +
       		t.Logf("  Handler called: %v", handlerCalled)

     

       98
       98
       +
       		t.Logf("  Extracted DID: %s", extractedDID)

     

       99
       99
       +
       		t.Logf("  Response status: %d", w.Code)

     

       100
       100
       +
       	})

     

       101
       101
       +
       

     

       102
       102
       +
       	t.Run("Rejects tampered/invalid sealed tokens", func(t *testing.T) {

     

       103
       103
       +
       		// Create valid user

     

       104
       104
       +
       		timestamp := time.Now().Unix() % 100000

     

       105
       105
       +
       		handle := fmt.Sprintf("tamp%d.local.coves.dev", timestamp)

     

       106
       106
       +
       		password := "testpass456"

     

       107
       107
       +
       		email := fmt.Sprintf("tamp%d@test.com", timestamp)

     

       108
       108
       +
       

     

       109
       109
       +
       		_, did, err := createPDSAccount(pdsURL, handle, email, password)

     

       110
       110
       +
       		if err != nil {

     

       111
       111
       +
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       112
       112
       +
       		}

     

       113
       113
       +
       

     

       114
       114
       +
       		// Create OAuth middleware

     

       115
       115
       +
       		e2eAuth := NewE2EOAuthMiddleware()

     

       116
       116
       +
       		validToken := e2eAuth.AddUser(did)

     

       117
       117
       +
       

     

       118
       118
       +
       		// Create various invalid tokens to test

     

       119
       119
       +
       		testCases := []struct {

     

       120
       120
       +
       			name  string

     

       121
       121
       +
       			token string

     

       122
       122
       +
       		}{

     

       123
       123
       +
       			{"Empty token", ""},

     

       124
       124
       +
       			{"Invalid base64", "not-valid-base64!!!"},

     

       125
       125
       +
       			{"Tampered token", "dGFtcGVyZWQtdG9rZW4tZGF0YQ=="}, // Valid base64 but not a real sealed session

     

       126
       126
       +
       			{"Short token", "abc"},

     

       127
       127
       +
       			{"Modified valid token", validToken + "extra"},

     

       128
       128
       +
       		}

     

       129
       129
       +
       

     

       130
       130
       +
       		for _, tc := range testCases {

     

       131
       131
       +
       			t.Run(tc.name, func(t *testing.T) {

     

       132
       132
       +
       				handlerCalled := false

     

       133
       133
       +
       				testHandler := e2eAuth.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       134
       134
       +
       					handlerCalled = true

     

       135
       135
       +
       					w.WriteHeader(http.StatusOK)

     

       136
       136
       +
       				}))

     

       137
       137
       +
       

     

       138
       138
       +
       				req := httptest.NewRequest("GET", "/test", nil)

     

       139
       139
       +
       				if tc.token != "" {

     

       140
       140
       +
       					req.Header.Set("Authorization", "Bearer "+tc.token)

     

       141
       141
       +
       				}

     

       142
       142
       +
       				w := httptest.NewRecorder()

     

       143
       143
       +
       

     

       144
       144
       +
       				testHandler.ServeHTTP(w, req)

     

       145
       145
       +
       

     

       146
       146
       +
       				if handlerCalled {

     

       147
       147
       +
       					t.Error("Handler was called for invalid token - should have been rejected")

     

       148
       148
       +
       				}

     

       149
       149
       +
       

     

       150
       150
       +
       				if w.Code != http.StatusUnauthorized {

     

       151
       151
       +
       					t.Errorf("Expected status 401 for invalid token, got %d", w.Code)

     

       152
       152
       +
       				}

     

       153
       153
       +
       

     

       154
       154
       +
       				t.Logf("✓ Middleware correctly rejected %s with status %d", tc.name, w.Code)

     

       155
       155
       +
       			})

     

       156
       156
       +
       		}

     

       157
       157
       +
       

     

       158
       158
       +
       		t.Logf("✅ All invalid token types correctly rejected")

     

       159
       159
       +
       	})

     

       160
       160
       +
       

     

       161
       161
       +
       	t.Run("Session expiration handling", func(t *testing.T) {

     

       162
       162
       +
       		// OAuth session expiration is handled at the database level

     

       163
       163
       +
       		// See TestOAuthE2E_TokenExpiration in oauth_e2e_test.go for full expiration testing

     

       164
       164
       +
       		t.Log("ℹ️  Session expiration testing is covered in oauth_e2e_test.go")

     

       165
       165
       +
       		t.Log("   OAuth sessions expire based on database timestamps and are cleaned up periodically")

     

       166
       166
       +
       		t.Log("   This is different from JWT expiration which was timestamp-based in the token itself")

     

       167
       167
       +
       		t.Skip("Session expiration is tested in oauth_e2e_test.go - see TestOAuthE2E_TokenExpiration")

     

       168
       168
       +
       	})

     

       169
       169
       +
       }

+16 -20

tests/integration/community_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"Coves/internal/api/middleware"

     

       5
       4
        
       	"Coves/internal/api/routes"

     

       6
       5
        
       	"Coves/internal/atproto/identity"

     

       7
       6
        
       	"Coves/internal/atproto/jetstream"

     
···

       108
       107
        
       

     

       109
       108
        
       	t.Logf("✅ Authenticated - Instance DID: %s", instanceDID)

     

       110
       109
        
       

     

       111
       111
       -
       	// Initialize auth middleware with skipVerify=true

     

       112
       112
       -
       	// IMPORTANT: PDS password authentication returns Bearer tokens (not DPoP-bound tokens).

     

       113
       113
       -
       	// E2E tests use these Bearer tokens with the DPoP scheme header, which only works

     

       114
       114
       -
       	// because skipVerify=true bypasses signature and DPoP binding verification.

     

       115
       115
       -
       	// In production, skipVerify=false requires proper DPoP-bound tokens from OAuth flow.

     

       116
       116
       -
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true)

     

       117
       117
       -
       	defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine

     

       110
       110
       +
       	// Initialize OAuth auth middleware for E2E testing

     

       111
       111
       +
       	e2eAuth := NewE2EOAuthMiddleware()

     

       112
       112
       +
       	// Register the instance user for OAuth authentication

     

       113
       113
       +
       	token := e2eAuth.AddUser(instanceDID)

     

       118
       114
        
       

     

       119
       115
        
       	// V2.0: Extract instance domain for community provisioning

     

       120
       116
        
       	var instanceDomain string

     
···

       152
       148
        
       

     

       153
       149
        
       	// Setup HTTP server with XRPC routes

     

       154
       150
        
       	r := chi.NewRouter()

     

       155
       155
       -
       	routes.RegisterCommunityRoutes(r, communityService, authMiddleware, nil) // nil = allow all community creators

     

       151
       151
       +
       	routes.RegisterCommunityRoutes(r, communityService, e2eAuth.OAuthAuthMiddleware, nil) // nil = allow all community creators

     

       156
       152
        
       	httpServer := httptest.NewServer(r)

     

       157
       153
        
       	defer httpServer.Close()

     

       158
       154
        
       

     
···

       387
       383
        
       				t.Fatalf("Failed to create request: %v", err)

     

       388
       384
        
       			}

     

       389
       385
        
       			req.Header.Set("Content-Type", "application/json")

     

       390
       390
       -
       			// Use real PDS access token for E2E authentication

     

       391
       391
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       386
       386
       +
       			// Use OAuth token for Coves API authentication

     

       387
       387
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       392
       388
        
       

     

       393
       389
        
       			resp, err := http.DefaultClient.Do(req)

     

       394
       390
        
       			if err != nil {

     
···

       773
       769
        
       				t.Fatalf("Failed to create request: %v", err)

     

       774
       770
        
       			}

     

       775
       771
        
       			req.Header.Set("Content-Type", "application/json")

     

       776
       776
       -
       			// Use real PDS access token for E2E authentication

     

       777
       777
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       772
       772
       +
       			// Use OAuth token for Coves API authentication

     

       773
       773
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       778
       774
        
       

     

       779
       775
        
       			resp, err := http.DefaultClient.Do(req)

     

       780
       776
        
       			if err != nil {

     
···

       1008
       1004
        
       				t.Fatalf("Failed to create request: %v", err)

     

       1009
       1005
        
       			}

     

       1010
       1006
        
       			req.Header.Set("Content-Type", "application/json")

     

       1011
       1011
       -
       			// Use real PDS access token for E2E authentication

     

       1012
       1012
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1007
       1007
       +
       			// Use OAuth token for Coves API authentication

     

       1008
       1008
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1013
       1009
        
       

     

       1014
       1010
        
       			resp, err := http.DefaultClient.Do(req)

     

       1015
       1011
        
       			if err != nil {

     
···

       1141
       1137
        
       				t.Fatalf("Failed to create block request: %v", err)

     

       1142
       1138
        
       			}

     

       1143
       1139
        
       			req.Header.Set("Content-Type", "application/json")

     

       1144
       1144
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1140
       1140
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1145
       1141
        
       

     

       1146
       1142
        
       			resp, err := http.DefaultClient.Do(req)

     

       1147
       1143
        
       			if err != nil {

     
···

       1261
       1257
        
       				t.Fatalf("Failed to create block request: %v", err)

     

       1262
       1258
        
       			}

     

       1263
       1259
        
       			blockHttpReq.Header.Set("Content-Type", "application/json")

     

       1264
       1264
       -
       			blockHttpReq.Header.Set("Authorization", "DPoP "+accessToken)

     

       1260
       1260
       +
       			blockHttpReq.Header.Set("Authorization", "Bearer "+token)

     

       1265
       1261
        
       

     

       1266
       1262
        
       			blockResp, err := http.DefaultClient.Do(blockHttpReq)

     

       1267
       1263
        
       			if err != nil {

     
···

       1321
       1317
        
       				t.Fatalf("Failed to create unblock request: %v", err)

     

       1322
       1318
        
       			}

     

       1323
       1319
        
       			req.Header.Set("Content-Type", "application/json")

     

       1324
       1324
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1320
       1320
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1325
       1321
        
       

     

       1326
       1322
        
       			resp, err := http.DefaultClient.Do(req)

     

       1327
       1323
        
       			if err != nil {

     
···

       1477
       1473
        
       				t.Fatalf("Failed to create request: %v", err)

     

       1478
       1474
        
       			}

     

       1479
       1475
        
       			req.Header.Set("Content-Type", "application/json")

     

       1480
       1480
       -
       			// Use real PDS access token for E2E authentication

     

       1481
       1481
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1476
       1476
       +
       			// Use OAuth token for Coves API authentication

     

       1477
       1477
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1482
       1478
        
       

     

       1483
       1479
        
       			resp, err := http.DefaultClient.Do(req)

     

       1484
       1480
        
       			if err != nil {

+7 -9

tests/integration/post_e2e_test.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/api/handlers/post"

     

       5
       5
       -
       	"Coves/internal/api/middleware"

     

       6
       5
        
       	"Coves/internal/atproto/identity"

     

       7
       6
        
       	"Coves/internal/atproto/jetstream"

     

       8
       7
        
       	"Coves/internal/core/communities"

     
···

       405
       404
        
       

     

       406
       405
        
       	postService := posts.NewPostService(postRepo, communityService, nil, nil, nil, pdsURL) // nil aggregatorService, blobService, unfurlService for user-only tests

     

       407
       406
        
       

     

       408
       408
       -
       	// Setup auth middleware (skip JWT verification for testing)

     

       409
       409
       -
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true)

     

       410
       410
       -
       	defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine

     

       407
       407
       +
       	// Setup OAuth auth middleware for E2E testing

     

       408
       408
       +
       	e2eAuth := NewE2EOAuthMiddleware()

     

       411
       409
        
       

     

       412
       410
        
       	// Setup HTTP handler

     

       413
       411
        
       	createHandler := post.NewCreateHandler(postService)

     
···

       476
       474
        
       		req := httptest.NewRequest("POST", "/xrpc/social.coves.community.post.create", bytes.NewReader(reqJSON))

     

       477
       475
        
       		req.Header.Set("Content-Type", "application/json")

     

       478
       476
        
       

     

       479
       479
       -
       		// Create a simple JWT for testing (Phase 1: no signature verification)

     

       480
       480
       -
       		// In production, this would be a real OAuth token from PDS

     

       481
       481
       -
       		testJWT := createSimpleTestJWT(author.DID)

     

       482
       482
       -
       		req.Header.Set("Authorization", "DPoP "+testJWT)

     

       477
       477
       +
       		// Register the author user with OAuth middleware and get test token

     

       478
       478
       +
       		// For Coves API handlers, use Bearer scheme with OAuth middleware

     

       479
       479
       +
       		token := e2eAuth.AddUser(author.DID)

     

       480
       480
       +
       		req.Header.Set("Authorization", "Bearer "+token)

     

       483
       481
        
       

     

       484
       482
        
       		// Execute request through auth middleware + handler

     

       485
       483
        
       		rr := httptest.NewRecorder()

     

       486
       486
       -
       		handler := authMiddleware.RequireAuth(http.HandlerFunc(createHandler.HandleCreate))

     

       484
       484
       +
       		handler := e2eAuth.RequireAuth(http.HandlerFunc(createHandler.HandleCreate))

     

       487
       485
        
       		handler.ServeHTTP(rr, req)

     

       488
       486
        
       

     

       489
       487
        
       		// Check response

+22 -19

tests/integration/user_journey_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"Coves/internal/api/middleware"

     

       5
       4
        
       	"Coves/internal/api/routes"

     

       6
       5
        
       	"Coves/internal/atproto/identity"

     

       7
       6
        
       	"Coves/internal/atproto/jetstream"

     
···

       22
       21
        
       	"testing"

     

       23
       22
        
       	"time"

     

       24
       23
        
       

     

       25
       25
       -
       	timelineCore "Coves/internal/core/timeline"

     

       26
       26
       -
       

     

       27
       24
        
       	"github.com/go-chi/chi/v5"

     

       28
       25
        
       	"github.com/gorilla/websocket"

     

       29
       26
        
       	_ "github.com/lib/pq"

     

       30
       27
        
       	"github.com/pressly/goose/v3"

     

       31
       28
        
       	"github.com/stretchr/testify/assert"

     

       32
       29
        
       	"github.com/stretchr/testify/require"

     

       30
       30
       +
       

     

       31
       31
       +
       	timelineCore "Coves/internal/core/timeline"

     

       33
       32
        
       )

     

       34
       33
        
       

     

       35
       34
        
       // TestFullUserJourney_E2E tests the complete user experience from signup to interaction:

     
···

       139
       138
        
       	commentConsumer := jetstream.NewCommentEventConsumer(commentRepo, db)

     

       140
       139
        
       	voteConsumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       141
       140
        
       

     

       142
       142
       -
       	// Setup HTTP server with all routes

     

       143
       143
       -
       	// IMPORTANT: skipVerify=true because PDS password auth returns Bearer tokens (not DPoP-bound).

     

       144
       144
       -
       	// E2E tests use Bearer tokens with DPoP scheme header, which only works with skipVerify=true.

     

       145
       145
       -
       	// In production, skipVerify=false requires proper DPoP-bound tokens from OAuth flow.

     

       146
       146
       -
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true)

     

       147
       147
       -
       	defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine

     

       141
       141
       +
       	// Setup HTTP server with all routes using OAuth middleware

     

       142
       142
       +
       	e2eAuth := NewE2EOAuthMiddleware()

     

       148
       143
        
       	r := chi.NewRouter()

     

       149
       149
       -
       	routes.RegisterCommunityRoutes(r, communityService, authMiddleware, nil) // nil = allow all community creators

     

       150
       150
       -
       	routes.RegisterPostRoutes(r, postService, authMiddleware)

     

       151
       151
       -
       	routes.RegisterTimelineRoutes(r, timelineService, authMiddleware)

     

       144
       144
       +
       	routes.RegisterCommunityRoutes(r, communityService, e2eAuth.OAuthAuthMiddleware, nil) // nil = allow all community creators

     

       145
       145
       +
       	routes.RegisterPostRoutes(r, postService, e2eAuth.OAuthAuthMiddleware)

     

       146
       146
       +
       	routes.RegisterTimelineRoutes(r, timelineService, e2eAuth.OAuthAuthMiddleware)

     

       152
       147
        
       	httpServer := httptest.NewServer(r)

     

       153
       148
        
       	defer httpServer.Close()

     

       154
       149
        
       

     
···

       181
       176
        
       	var (

     

       182
       177
        
       		userAHandle     string

     

       183
       178
        
       		userADID        string

     

       184
       184
       -
       		userAToken      string

     

       179
       179
       +
       		userAToken      string // PDS access token for direct PDS requests

     

       180
       180
       +
       		userAAPIToken   string // Coves API token for Coves API requests

     

       185
       181
        
       		userBHandle     string

     

       186
       182
        
       		userBDID        string

     

       187
       187
       -
       		userBToken      string

     

       183
       183
       +
       		userBToken      string // PDS access token for direct PDS requests

     

       184
       184
       +
       		userBAPIToken   string // Coves API token for Coves API requests

     

       188
       185
        
       		communityDID    string

     

       189
       186
        
       		communityHandle string

     

       190
       187
        
       		postURI         string

     
···

       217
       214
        
       		userA := createTestUser(t, db, userAHandle, userADID)

     

       218
       215
        
       		require.NotNil(t, userA)

     

       219
       216
        
       

     

       217
       217
       +
       		// Register user with OAuth middleware for Coves API requests

     

       218
       218
       +
       		userAAPIToken = e2eAuth.AddUser(userADID)

     

       219
       219
       +
       

     

       220
       220
        
       		t.Logf("✅ User A indexed in AppView")

     

       221
       221
        
       	})

     

       222
       222
        
       

     
···

       244
       244
        
       			httpServer.URL+"/xrpc/social.coves.community.create",

     

       245
       245
        
       			bytes.NewBuffer(reqBody))

     

       246
       246
        
       		req.Header.Set("Content-Type", "application/json")

     

       247
       247
       -
       		req.Header.Set("Authorization", "DPoP "+userAToken)

     

       247
       247
       +
       		req.Header.Set("Authorization", "Bearer "+userAAPIToken)

     

       248
       248
        
       

     

       249
       249
        
       		resp, err := http.DefaultClient.Do(req)

     

       250
       250
        
       		require.NoError(t, err)

     
···

       328
       328
        
       			httpServer.URL+"/xrpc/social.coves.community.post.create",

     

       329
       329
        
       			bytes.NewBuffer(reqBody))

     

       330
       330
        
       		req.Header.Set("Content-Type", "application/json")

     

       331
       331
       -
       		req.Header.Set("Authorization", "DPoP "+userAToken)

     

       331
       331
       +
       		req.Header.Set("Authorization", "Bearer "+userAAPIToken)

     

       332
       332
        
       

     

       333
       333
        
       		resp, err := http.DefaultClient.Do(req)

     

       334
       334
        
       		require.NoError(t, err)

     
···

       413
       413
        
       		userB := createTestUser(t, db, userBHandle, userBDID)

     

       414
       414
        
       		require.NotNil(t, userB)

     

       415
       415
        
       

     

       416
       416
       +
       		// Register user with OAuth middleware for Coves API requests

     

       417
       417
       +
       		userBAPIToken = e2eAuth.AddUser(userBDID)

     

       418
       418
       +
       

     

       416
       419
        
       		t.Logf("✅ User B indexed in AppView")

     

       417
       420
        
       	})

     

       418
       421
        
       

     
···

       437
       440
        
       			httpServer.URL+"/xrpc/social.coves.community.subscribe",

     

       438
       441
        
       			bytes.NewBuffer(reqBody))

     

       439
       442
        
       		req.Header.Set("Content-Type", "application/json")

     

       440
       440
       -
       		req.Header.Set("Authorization", "DPoP "+userBToken)

     

       443
       443
       +
       		req.Header.Set("Authorization", "Bearer "+userBAPIToken)

     

       441
       444
        
       

     

       442
       445
        
       		resp, err := http.DefaultClient.Do(req)

     

       443
       446
        
       		require.NoError(t, err)

     
···

       669
       672
        
       	t.Run("9. User B - Verify Timeline Feed Shows Subscribed Community Posts", func(t *testing.T) {

     

       670
       673
        
       		t.Log("\n📰 Part 9: User B checks timeline feed...")

     

       671
       674
        
       

     

       672
       672
       -
       		// Use HTTP client to properly go through auth middleware with DPoP token

     

       675
       675
       +
       		// Use HTTP client to properly go through auth middleware with Bearer token

     

       673
       676
        
       		req, _ := http.NewRequest(http.MethodGet,

     

       674
       677
        
       			httpServer.URL+"/xrpc/social.coves.feed.getTimeline?sort=new&limit=10", nil)

     

       675
       675
       -
       		req.Header.Set("Authorization", "DPoP "+userBToken)

     

       678
       678
       +
       		req.Header.Set("Authorization", "Bearer "+userBAPIToken)

     

       676
       679
        
       

     

       677
       680
        
       		resp, err := http.DefaultClient.Do(req)

     

       678
       681
        
       		require.NoError(t, err)

+2

go.mod

···

       27
       27
        
       	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect

     

       28
       28
        
       	github.com/earthboundkid/versioninfo/v2 v2.24.1 // indirect

     

       29
       29
        
       	github.com/felixge/httpsnoop v1.0.4 // indirect

     

       30
       30
       +
       	github.com/go-chi/cors v1.2.2 // indirect

     

       30
       31
        
       	github.com/go-logr/logr v1.4.1 // indirect

     

       31
       32
        
       	github.com/go-logr/stdr v1.2.2 // indirect

     

       32
       33
        
       	github.com/goccy/go-json v0.10.2 // indirect

     

       33
       34
        
       	github.com/gogo/protobuf v1.3.2 // indirect

     

       35
       35
       +
       	github.com/google/go-querystring v1.1.0 // indirect

     

       34
       36
        
       	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect

     

       35
       37
        
       	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect

     

       36
       38
        
       	github.com/hashicorp/golang-lru v1.0.2 // indirect

+5

go.sum

···

       21
       21
        
       github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

     

       22
       22
        
       github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=

     

       23
       23
        
       github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=

     

       24
       24
       +
       github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=

     

       25
       25
       +
       github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=

     

       24
       26
        
       github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

     

       25
       27
        
       github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=

     

       26
       28
        
       github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

     
···

       33
       35
        
       github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=

     

       34
       36
        
       github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=

     

       35
       37
        
       github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=

     

       38
       38
       +
       github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=

     

       36
       39
        
       github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=

     

       37
       40
        
       github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

     

       41
       41
       +
       github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=

     

       42
       42
       +
       github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=

     

       38
       43
        
       github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=

     

       39
       44
        
       github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

     

       40
       45
        
       github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

+5

.env.dev

···

       115
       115
        
       # Also supports base64: prefix for consistency

     

       116
       116
        
       OAUTH_COOKIE_SECRET=f1132c01b1a625a865c6c455a75ee793572cedb059cebe0c4c1ae4c446598f7d

     

       117
       117
        
       

     

       118
       118
       +
       # Seal secret for OAuth session tokens (AES-256-GCM encryption)

     

       119
       119
       +
       # Generate with: openssl rand -base64 32

     

       120
       120
       +
       # This must be 32 bytes when base64-decoded for AES-256

     

       121
       121
       +
       # OAUTH_SEAL_SECRET=ryW6xNVxYhP6hCDA90NGCmK58Q2ONnkYXbHL0oZN2no=

     

       122
       122
       +
       

     

       118
       123
        
       # AppView public URL (used for OAuth callback and client metadata)

     

       119
       124
        
       # Dev: http://127.0.0.1:8081 (use 127.0.0.1 instead of localhost per RFC 8252)

     

       120
       125
        
       # Prod: https://coves.social

-73

cmd/genjwks/main.go

···

       1
       1
       -
       package main

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"crypto/ecdsa"

     

       5
       5
       -
       	"crypto/elliptic"

     

       6
       6
       -
       	"crypto/rand"

     

       7
       7
       -
       	"encoding/json"

     

       8
       8
       -
       	"fmt"

     

       9
       9
       -
       	"log"

     

       10
       10
       -
       	"os"

     

       11
       11
       -
       

     

       12
       12
       -
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       // genjwks generates an ES256 keypair for OAuth client authentication

     

       16
       16
       -
       // The private key is stored in the config/env, public key is served at /oauth/jwks.json

     

       17
       17
       -
       //

     

       18
       18
       -
       // Usage:

     

       19
       19
       -
       //

     

       20
       20
       -
       //	go run cmd/genjwks/main.go

     

       21
       21
       -
       //

     

       22
       22
       -
       // This will output a JSON private key that should be stored in OAUTH_PRIVATE_JWK

     

       23
       23
       -
       func main() {

     

       24
       24
       -
       	fmt.Println("Generating ES256 keypair for OAuth client authentication...")

     

       25
       25
       -
       

     

       26
       26
       -
       	// Generate ES256 (NIST P-256) private key

     

       27
       27
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       28
       28
       -
       	if err != nil {

     

       29
       29
       -
       		log.Fatalf("Failed to generate private key: %v", err)

     

       30
       30
       -
       	}

     

       31
       31
       -
       

     

       32
       32
       -
       	// Convert to JWK

     

       33
       33
       -
       	jwkKey, err := jwk.FromRaw(privateKey)

     

       34
       34
       -
       	if err != nil {

     

       35
       35
       -
       		log.Fatalf("Failed to create JWK from private key: %v", err)

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	// Set key parameters

     

       39
       39
       -
       	if err = jwkKey.Set(jwk.KeyIDKey, "oauth-client-key"); err != nil {

     

       40
       40
       -
       		log.Fatalf("Failed to set kid: %v", err)

     

       41
       41
       -
       	}

     

       42
       42
       -
       	if err = jwkKey.Set(jwk.AlgorithmKey, "ES256"); err != nil {

     

       43
       43
       -
       		log.Fatalf("Failed to set alg: %v", err)

     

       44
       44
       -
       	}

     

       45
       45
       -
       	if err = jwkKey.Set(jwk.KeyUsageKey, "sig"); err != nil {

     

       46
       46
       -
       		log.Fatalf("Failed to set use: %v", err)

     

       47
       47
       -
       	}

     

       48
       48
       -
       

     

       49
       49
       -
       	// Marshal to JSON

     

       50
       50
       -
       	jsonData, err := json.MarshalIndent(jwkKey, "", "  ")

     

       51
       51
       -
       	if err != nil {

     

       52
       52
       -
       		log.Fatalf("Failed to marshal JWK: %v", err)

     

       53
       53
       -
       	}

     

       54
       54
       -
       

     

       55
       55
       -
       	// Output instructions

     

       56
       56
       -
       	fmt.Println("\n✅ ES256 keypair generated successfully!")

     

       57
       57
       -
       	fmt.Println("\n📝 Add this to your .env.dev file:")

     

       58
       58
       -
       	fmt.Println("\nOAUTH_PRIVATE_JWK='" + string(jsonData) + "'")

     

       59
       59
       -
       	fmt.Println("\n⚠️  IMPORTANT:")

     

       60
       60
       -
       	fmt.Println("   - Keep this private key SECRET")

     

       61
       61
       -
       	fmt.Println("   - Never commit it to version control")

     

       62
       62
       -
       	fmt.Println("   - Generate a new key for production")

     

       63
       63
       -
       	fmt.Println("   - The public key will be automatically derived and served at /oauth/jwks.json")

     

       64
       64
       -
       

     

       65
       65
       -
       	// Optionally write to a file (not committed)

     

       66
       66
       -
       	if len(os.Args) > 1 && os.Args[1] == "--save" {

     

       67
       67
       -
       		filename := "oauth-private-key.json"

     

       68
       68
       -
       		if err := os.WriteFile(filename, jsonData, 0o600); err != nil {

     

       69
       69
       -
       			log.Fatalf("Failed to write key file: %v", err)

     

       70
       70
       -
       		}

     

       71
       71
       -
       		fmt.Printf("\n💾 Private key saved to %s (remember to add to .gitignore!)\n", filename)

     

       72
       72
       -
       	}

     

       73
       73
       -
       }

-122

internal/atproto/auth/did_key_fetcher.go

···

       1
       1
       -
       package auth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"crypto/ecdsa"

     

       6
       6
       -
       	"crypto/elliptic"

     

       7
       7
       -
       	"encoding/base64"

     

       8
       8
       -
       	"fmt"

     

       9
       9
       -
       	"math/big"

     

       10
       10
       -
       	"strings"

     

       11
       11
       -
       

     

       12
       12
       -
       	indigoCrypto "github.com/bluesky-social/indigo/atproto/atcrypto"

     

       13
       13
       -
       	indigoIdentity "github.com/bluesky-social/indigo/atproto/identity"

     

       14
       14
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       15
       15
       -
       )

     

       16
       16
       -
       

     

       17
       17
       -
       // DIDKeyFetcher fetches public keys from DID documents for JWT verification.

     

       18
       18
       -
       // This is the primary method for atproto service authentication, where:

     

       19
       19
       -
       // - The JWT issuer is the user's DID (e.g., did:plc:abc123)

     

       20
       20
       -
       // - The signing key is published in the user's DID document

     

       21
       21
       -
       // - Verification happens by resolving the DID and checking the signature

     

       22
       22
       -
       type DIDKeyFetcher struct {

     

       23
       23
       -
       	directory indigoIdentity.Directory

     

       24
       24
       -
       }

     

       25
       25
       -
       

     

       26
       26
       -
       // NewDIDKeyFetcher creates a new DID-based key fetcher.

     

       27
       27
       -
       func NewDIDKeyFetcher(directory indigoIdentity.Directory) *DIDKeyFetcher {

     

       28
       28
       -
       	return &DIDKeyFetcher{

     

       29
       29
       -
       		directory: directory,

     

       30
       30
       -
       	}

     

       31
       31
       -
       }

     

       32
       32
       -
       

     

       33
       33
       -
       // FetchPublicKey fetches the public key for verifying a JWT from the issuer's DID document.

     

       34
       34
       -
       // For DID issuers (did:plc: or did:web:), resolves the DID and extracts the signing key.

     

       35
       35
       -
       //

     

       36
       36
       -
       // Returns:

     

       37
       37
       -
       //   - indigoCrypto.PublicKey for secp256k1 (ES256K) keys - use indigo for verification

     

       38
       38
       -
       //   - *ecdsa.PublicKey for NIST curves (P-256, P-384, P-521) - compatible with golang-jwt

     

       39
       39
       -
       func (f *DIDKeyFetcher) FetchPublicKey(ctx context.Context, issuer, token string) (interface{}, error) {

     

       40
       40
       -
       	// Only handle DID issuers

     

       41
       41
       -
       	if !strings.HasPrefix(issuer, "did:") {

     

       42
       42
       -
       		return nil, fmt.Errorf("DIDKeyFetcher only handles DID issuers, got: %s", issuer)

     

       43
       43
       -
       	}

     

       44
       44
       -
       

     

       45
       45
       -
       	// Parse the DID

     

       46
       46
       -
       	did, err := syntax.ParseDID(issuer)

     

       47
       47
       -
       	if err != nil {

     

       48
       48
       -
       		return nil, fmt.Errorf("invalid DID format: %w", err)

     

       49
       49
       -
       	}

     

       50
       50
       -
       

     

       51
       51
       -
       	// Resolve the DID to get the identity (includes public keys)

     

       52
       52
       -
       	ident, err := f.directory.LookupDID(ctx, did)

     

       53
       53
       -
       	if err != nil {

     

       54
       54
       -
       		return nil, fmt.Errorf("failed to resolve DID %s: %w", issuer, err)

     

       55
       55
       -
       	}

     

       56
       56
       -
       

     

       57
       57
       -
       	// Get the atproto signing key from the DID document

     

       58
       58
       -
       	pubKey, err := ident.PublicKey()

     

       59
       59
       -
       	if err != nil {

     

       60
       60
       -
       		return nil, fmt.Errorf("failed to get public key from DID document: %w", err)

     

       61
       61
       -
       	}

     

       62
       62
       -
       

     

       63
       63
       -
       	// Convert to JWK format to check curve type

     

       64
       64
       -
       	jwk, err := pubKey.JWK()

     

       65
       65
       -
       	if err != nil {

     

       66
       66
       -
       		return nil, fmt.Errorf("failed to convert public key to JWK: %w", err)

     

       67
       67
       -
       	}

     

       68
       68
       -
       

     

       69
       69
       -
       	// For secp256k1 (ES256K), return indigo's PublicKey directly

     

       70
       70
       -
       	// since Go's crypto/ecdsa doesn't support this curve

     

       71
       71
       -
       	if jwk.Curve == "secp256k1" {

     

       72
       72
       -
       		return pubKey, nil

     

       73
       73
       -
       	}

     

       74
       74
       -
       

     

       75
       75
       -
       	// For NIST curves, convert to Go's ecdsa.PublicKey for golang-jwt compatibility

     

       76
       76
       -
       	return atcryptoJWKToECDSA(jwk)

     

       77
       77
       -
       }

     

       78
       78
       -
       

     

       79
       79
       -
       // atcryptoJWKToECDSA converts an indigoCrypto.JWK to a Go ecdsa.PublicKey.

     

       80
       80
       -
       // Note: secp256k1 is handled separately in FetchPublicKey by returning indigo's PublicKey directly.

     

       81
       81
       -
       func atcryptoJWKToECDSA(jwk *indigoCrypto.JWK) (*ecdsa.PublicKey, error) {

     

       82
       82
       -
       	if jwk.KeyType != "EC" {

     

       83
       83
       -
       		return nil, fmt.Errorf("unsupported JWK key type: %s (expected EC)", jwk.KeyType)

     

       84
       84
       -
       	}

     

       85
       85
       -
       

     

       86
       86
       -
       	// Decode X and Y coordinates (base64url, no padding)

     

       87
       87
       -
       	xBytes, err := base64.RawURLEncoding.DecodeString(jwk.X)

     

       88
       88
       -
       	if err != nil {

     

       89
       89
       -
       		return nil, fmt.Errorf("invalid JWK X coordinate encoding: %w", err)

     

       90
       90
       -
       	}

     

       91
       91
       -
       	yBytes, err := base64.RawURLEncoding.DecodeString(jwk.Y)

     

       92
       92
       -
       	if err != nil {

     

       93
       93
       -
       		return nil, fmt.Errorf("invalid JWK Y coordinate encoding: %w", err)

     

       94
       94
       -
       	}

     

       95
       95
       -
       

     

       96
       96
       -
       	var ecCurve elliptic.Curve

     

       97
       97
       -
       	switch jwk.Curve {

     

       98
       98
       -
       	case "P-256":

     

       99
       99
       -
       		ecCurve = elliptic.P256()

     

       100
       100
       -
       	case "P-384":

     

       101
       101
       -
       		ecCurve = elliptic.P384()

     

       102
       102
       -
       	case "P-521":

     

       103
       103
       -
       		ecCurve = elliptic.P521()

     

       104
       104
       -
       	default:

     

       105
       105
       -
       		// secp256k1 should be handled before calling this function

     

       106
       106
       -
       		return nil, fmt.Errorf("unsupported JWK curve for Go ecdsa: %s (secp256k1 uses indigo)", jwk.Curve)

     

       107
       107
       -
       	}

     

       108
       108
       -
       

     

       109
       109
       -
       	// Create the public key

     

       110
       110
       -
       	pubKey := &ecdsa.PublicKey{

     

       111
       111
       -
       		Curve: ecCurve,

     

       112
       112
       -
       		X:     new(big.Int).SetBytes(xBytes),

     

       113
       113
       -
       		Y:     new(big.Int).SetBytes(yBytes),

     

       114
       114
       -
       	}

     

       115
       115
       -
       

     

       116
       116
       -
       	// Validate point is on curve

     

       117
       117
       -
       	if !ecCurve.IsOnCurve(pubKey.X, pubKey.Y) {

     

       118
       118
       -
       		return nil, fmt.Errorf("invalid public key: point not on curve")

     

       119
       119
       -
       	}

     

       120
       120
       -
       

     

       121
       121
       -
       	return pubKey, nil

     

       122
       122
       -
       }

-1308

internal/atproto/auth/dpop_test.go

···

       1
       1
       -
       package auth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"crypto/ecdsa"

     

       5
       5
       -
       	"crypto/elliptic"

     

       6
       6
       -
       	"crypto/rand"

     

       7
       7
       -
       	"crypto/sha256"

     

       8
       8
       -
       	"encoding/base64"

     

       9
       9
       -
       	"encoding/json"

     

       10
       10
       -
       	"strings"

     

       11
       11
       -
       	"testing"

     

       12
       12
       -
       	"time"

     

       13
       13
       -
       

     

       14
       14
       -
       	indigoCrypto "github.com/bluesky-social/indigo/atproto/atcrypto"

     

       15
       15
       -
       	"github.com/golang-jwt/jwt/v5"

     

       16
       16
       -
       	"github.com/google/uuid"

     

       17
       17
       -
       )

     

       18
       18
       -
       

     

       19
       19
       -
       // === Test Helpers ===

     

       20
       20
       -
       

     

       21
       21
       -
       // testECKey holds a test ES256 key pair

     

       22
       22
       -
       type testECKey struct {

     

       23
       23
       -
       	privateKey *ecdsa.PrivateKey

     

       24
       24
       -
       	publicKey  *ecdsa.PublicKey

     

       25
       25
       -
       	jwk        map[string]interface{}

     

       26
       26
       -
       	thumbprint string

     

       27
       27
       -
       }

     

       28
       28
       -
       

     

       29
       29
       -
       // generateTestES256Key generates a test ES256 key pair and JWK

     

       30
       30
       -
       func generateTestES256Key(t *testing.T) *testECKey {

     

       31
       31
       -
       	t.Helper()

     

       32
       32
       -
       

     

       33
       33
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       34
       34
       -
       	if err != nil {

     

       35
       35
       -
       		t.Fatalf("Failed to generate test key: %v", err)

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	// Encode public key coordinates as base64url

     

       39
       39
       -
       	xBytes := privateKey.PublicKey.X.Bytes()

     

       40
       40
       -
       	yBytes := privateKey.PublicKey.Y.Bytes()

     

       41
       41
       -
       

     

       42
       42
       -
       	// P-256 coordinates must be 32 bytes (pad if needed)

     

       43
       43
       -
       	xBytes = padTo32Bytes(xBytes)

     

       44
       44
       -
       	yBytes = padTo32Bytes(yBytes)

     

       45
       45
       -
       

     

       46
       46
       -
       	x := base64.RawURLEncoding.EncodeToString(xBytes)

     

       47
       47
       -
       	y := base64.RawURLEncoding.EncodeToString(yBytes)

     

       48
       48
       -
       

     

       49
       49
       -
       	jwk := map[string]interface{}{

     

       50
       50
       -
       		"kty": "EC",

     

       51
       51
       -
       		"crv": "P-256",

     

       52
       52
       -
       		"x":   x,

     

       53
       53
       -
       		"y":   y,

     

       54
       54
       -
       	}

     

       55
       55
       -
       

     

       56
       56
       -
       	// Calculate thumbprint

     

       57
       57
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       58
       58
       -
       	if err != nil {

     

       59
       59
       -
       		t.Fatalf("Failed to calculate thumbprint: %v", err)

     

       60
       60
       -
       	}

     

       61
       61
       -
       

     

       62
       62
       -
       	return &testECKey{

     

       63
       63
       -
       		privateKey: privateKey,

     

       64
       64
       -
       		publicKey:  &privateKey.PublicKey,

     

       65
       65
       -
       		jwk:        jwk,

     

       66
       66
       -
       		thumbprint: thumbprint,

     

       67
       67
       -
       	}

     

       68
       68
       -
       }

     

       69
       69
       -
       

     

       70
       70
       -
       // padTo32Bytes pads a byte slice to 32 bytes (required for P-256 coordinates)

     

       71
       71
       -
       func padTo32Bytes(b []byte) []byte {

     

       72
       72
       -
       	if len(b) >= 32 {

     

       73
       73
       -
       		return b

     

       74
       74
       -
       	}

     

       75
       75
       -
       	padded := make([]byte, 32)

     

       76
       76
       -
       	copy(padded[32-len(b):], b)

     

       77
       77
       -
       	return padded

     

       78
       78
       -
       }

     

       79
       79
       -
       

     

       80
       80
       -
       // createDPoPProof creates a DPoP proof JWT for testing

     

       81
       81
       -
       func createDPoPProof(t *testing.T, key *testECKey, method, uri string, iat time.Time, jti string) string {

     

       82
       82
       -
       	t.Helper()

     

       83
       83
       -
       

     

       84
       84
       -
       	claims := &DPoPClaims{

     

       85
       85
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       86
       86
       -
       			ID:       jti,

     

       87
       87
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       88
       88
       -
       		},

     

       89
       89
       -
       		HTTPMethod: method,

     

       90
       90
       -
       		HTTPURI:    uri,

     

       91
       91
       -
       	}

     

       92
       92
       -
       

     

       93
       93
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       94
       94
       -
       	token.Header["typ"] = "dpop+jwt"

     

       95
       95
       -
       	token.Header["jwk"] = key.jwk

     

       96
       96
       -
       

     

       97
       97
       -
       	tokenString, err := token.SignedString(key.privateKey)

     

       98
       98
       -
       	if err != nil {

     

       99
       99
       -
       		t.Fatalf("Failed to create DPoP proof: %v", err)

     

       100
       100
       -
       	}

     

       101
       101
       -
       

     

       102
       102
       -
       	return tokenString

     

       103
       103
       -
       }

     

       104
       104
       -
       

     

       105
       105
       -
       // === JWK Thumbprint Tests (RFC 7638) ===

     

       106
       106
       -
       

     

       107
       107
       -
       func TestCalculateJWKThumbprint_EC_P256(t *testing.T) {

     

       108
       108
       -
       	// Test with known values from RFC 7638 Appendix A (adapted for P-256)

     

       109
       109
       -
       	jwk := map[string]interface{}{

     

       110
       110
       -
       		"kty": "EC",

     

       111
       111
       -
       		"crv": "P-256",

     

       112
       112
       -
       		"x":   "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",

     

       113
       113
       -
       		"y":   "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE",

     

       114
       114
       -
       	}

     

       115
       115
       -
       

     

       116
       116
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       117
       117
       -
       	if err != nil {

     

       118
       118
       -
       		t.Fatalf("CalculateJWKThumbprint failed: %v", err)

     

       119
       119
       -
       	}

     

       120
       120
       -
       

     

       121
       121
       -
       	if thumbprint == "" {

     

       122
       122
       -
       		t.Error("Expected non-empty thumbprint")

     

       123
       123
       -
       	}

     

       124
       124
       -
       

     

       125
       125
       -
       	// Verify it's valid base64url

     

       126
       126
       -
       	_, err = base64.RawURLEncoding.DecodeString(thumbprint)

     

       127
       127
       -
       	if err != nil {

     

       128
       128
       -
       		t.Errorf("Thumbprint is not valid base64url: %v", err)

     

       129
       129
       -
       	}

     

       130
       130
       -
       

     

       131
       131
       -
       	// Verify length (SHA-256 produces 32 bytes = 43 base64url chars)

     

       132
       132
       -
       	if len(thumbprint) != 43 {

     

       133
       133
       -
       		t.Errorf("Expected thumbprint length 43, got %d", len(thumbprint))

     

       134
       134
       -
       	}

     

       135
       135
       -
       }

     

       136
       136
       -
       

     

       137
       137
       -
       func TestCalculateJWKThumbprint_Deterministic(t *testing.T) {

     

       138
       138
       -
       	// Same key should produce same thumbprint

     

       139
       139
       -
       	jwk := map[string]interface{}{

     

       140
       140
       -
       		"kty": "EC",

     

       141
       141
       -
       		"crv": "P-256",

     

       142
       142
       -
       		"x":   "test-x-coordinate",

     

       143
       143
       -
       		"y":   "test-y-coordinate",

     

       144
       144
       -
       	}

     

       145
       145
       -
       

     

       146
       146
       -
       	thumbprint1, err := CalculateJWKThumbprint(jwk)

     

       147
       147
       -
       	if err != nil {

     

       148
       148
       -
       		t.Fatalf("First CalculateJWKThumbprint failed: %v", err)

     

       149
       149
       -
       	}

     

       150
       150
       -
       

     

       151
       151
       -
       	thumbprint2, err := CalculateJWKThumbprint(jwk)

     

       152
       152
       -
       	if err != nil {

     

       153
       153
       -
       		t.Fatalf("Second CalculateJWKThumbprint failed: %v", err)

     

       154
       154
       -
       	}

     

       155
       155
       -
       

     

       156
       156
       -
       	if thumbprint1 != thumbprint2 {

     

       157
       157
       -
       		t.Errorf("Thumbprints are not deterministic: %s != %s", thumbprint1, thumbprint2)

     

       158
       158
       -
       	}

     

       159
       159
       -
       }

     

       160
       160
       -
       

     

       161
       161
       -
       func TestCalculateJWKThumbprint_DifferentKeys(t *testing.T) {

     

       162
       162
       -
       	// Different keys should produce different thumbprints

     

       163
       163
       -
       	jwk1 := map[string]interface{}{

     

       164
       164
       -
       		"kty": "EC",

     

       165
       165
       -
       		"crv": "P-256",

     

       166
       166
       -
       		"x":   "coordinate-x-1",

     

       167
       167
       -
       		"y":   "coordinate-y-1",

     

       168
       168
       -
       	}

     

       169
       169
       -
       

     

       170
       170
       -
       	jwk2 := map[string]interface{}{

     

       171
       171
       -
       		"kty": "EC",

     

       172
       172
       -
       		"crv": "P-256",

     

       173
       173
       -
       		"x":   "coordinate-x-2",

     

       174
       174
       -
       		"y":   "coordinate-y-2",

     

       175
       175
       -
       	}

     

       176
       176
       -
       

     

       177
       177
       -
       	thumbprint1, err := CalculateJWKThumbprint(jwk1)

     

       178
       178
       -
       	if err != nil {

     

       179
       179
       -
       		t.Fatalf("First CalculateJWKThumbprint failed: %v", err)

     

       180
       180
       -
       	}

     

       181
       181
       -
       

     

       182
       182
       -
       	thumbprint2, err := CalculateJWKThumbprint(jwk2)

     

       183
       183
       -
       	if err != nil {

     

       184
       184
       -
       		t.Fatalf("Second CalculateJWKThumbprint failed: %v", err)

     

       185
       185
       -
       	}

     

       186
       186
       -
       

     

       187
       187
       -
       	if thumbprint1 == thumbprint2 {

     

       188
       188
       -
       		t.Error("Different keys produced same thumbprint (collision)")

     

       189
       189
       -
       	}

     

       190
       190
       -
       }

     

       191
       191
       -
       

     

       192
       192
       -
       func TestCalculateJWKThumbprint_MissingKty(t *testing.T) {

     

       193
       193
       -
       	jwk := map[string]interface{}{

     

       194
       194
       -
       		"crv": "P-256",

     

       195
       195
       -
       		"x":   "test-x",

     

       196
       196
       -
       		"y":   "test-y",

     

       197
       197
       -
       	}

     

       198
       198
       -
       

     

       199
       199
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       200
       200
       -
       	if err == nil {

     

       201
       201
       -
       		t.Error("Expected error for missing kty, got nil")

     

       202
       202
       -
       	}

     

       203
       203
       -
       	if err != nil && !contains(err.Error(), "missing kty") {

     

       204
       204
       -
       		t.Errorf("Expected error about missing kty, got: %v", err)

     

       205
       205
       -
       	}

     

       206
       206
       -
       }

     

       207
       207
       -
       

     

       208
       208
       -
       func TestCalculateJWKThumbprint_EC_MissingCrv(t *testing.T) {

     

       209
       209
       -
       	jwk := map[string]interface{}{

     

       210
       210
       -
       		"kty": "EC",

     

       211
       211
       -
       		"x":   "test-x",

     

       212
       212
       -
       		"y":   "test-y",

     

       213
       213
       -
       	}

     

       214
       214
       -
       

     

       215
       215
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       216
       216
       -
       	if err == nil {

     

       217
       217
       -
       		t.Error("Expected error for missing crv, got nil")

     

       218
       218
       -
       	}

     

       219
       219
       -
       	if err != nil && !contains(err.Error(), "missing crv") {

     

       220
       220
       -
       		t.Errorf("Expected error about missing crv, got: %v", err)

     

       221
       221
       -
       	}

     

       222
       222
       -
       }

     

       223
       223
       -
       

     

       224
       224
       -
       func TestCalculateJWKThumbprint_EC_MissingX(t *testing.T) {

     

       225
       225
       -
       	jwk := map[string]interface{}{

     

       226
       226
       -
       		"kty": "EC",

     

       227
       227
       -
       		"crv": "P-256",

     

       228
       228
       -
       		"y":   "test-y",

     

       229
       229
       -
       	}

     

       230
       230
       -
       

     

       231
       231
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       232
       232
       -
       	if err == nil {

     

       233
       233
       -
       		t.Error("Expected error for missing x, got nil")

     

       234
       234
       -
       	}

     

       235
       235
       -
       	if err != nil && !contains(err.Error(), "missing x") {

     

       236
       236
       -
       		t.Errorf("Expected error about missing x, got: %v", err)

     

       237
       237
       -
       	}

     

       238
       238
       -
       }

     

       239
       239
       -
       

     

       240
       240
       -
       func TestCalculateJWKThumbprint_EC_MissingY(t *testing.T) {

     

       241
       241
       -
       	jwk := map[string]interface{}{

     

       242
       242
       -
       		"kty": "EC",

     

       243
       243
       -
       		"crv": "P-256",

     

       244
       244
       -
       		"x":   "test-x",

     

       245
       245
       -
       	}

     

       246
       246
       -
       

     

       247
       247
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       248
       248
       -
       	if err == nil {

     

       249
       249
       -
       		t.Error("Expected error for missing y, got nil")

     

       250
       250
       -
       	}

     

       251
       251
       -
       	if err != nil && !contains(err.Error(), "missing y") {

     

       252
       252
       -
       		t.Errorf("Expected error about missing y, got: %v", err)

     

       253
       253
       -
       	}

     

       254
       254
       -
       }

     

       255
       255
       -
       

     

       256
       256
       -
       func TestCalculateJWKThumbprint_RSA(t *testing.T) {

     

       257
       257
       -
       	// Test RSA key thumbprint calculation

     

       258
       258
       -
       	jwk := map[string]interface{}{

     

       259
       259
       -
       		"kty": "RSA",

     

       260
       260
       -
       		"e":   "AQAB",

     

       261
       261
       -
       		"n":   "test-modulus",

     

       262
       262
       -
       	}

     

       263
       263
       -
       

     

       264
       264
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       265
       265
       -
       	if err != nil {

     

       266
       266
       -
       		t.Fatalf("CalculateJWKThumbprint failed for RSA: %v", err)

     

       267
       267
       -
       	}

     

       268
       268
       -
       

     

       269
       269
       -
       	if thumbprint == "" {

     

       270
       270
       -
       		t.Error("Expected non-empty thumbprint for RSA key")

     

       271
       271
       -
       	}

     

       272
       272
       -
       }

     

       273
       273
       -
       

     

       274
       274
       -
       func TestCalculateJWKThumbprint_OKP(t *testing.T) {

     

       275
       275
       -
       	// Test OKP (Octet Key Pair) thumbprint calculation

     

       276
       276
       -
       	jwk := map[string]interface{}{

     

       277
       277
       -
       		"kty": "OKP",

     

       278
       278
       -
       		"crv": "Ed25519",

     

       279
       279
       -
       		"x":   "test-x-coordinate",

     

       280
       280
       -
       	}

     

       281
       281
       -
       

     

       282
       282
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       283
       283
       -
       	if err != nil {

     

       284
       284
       -
       		t.Fatalf("CalculateJWKThumbprint failed for OKP: %v", err)

     

       285
       285
       -
       	}

     

       286
       286
       -
       

     

       287
       287
       -
       	if thumbprint == "" {

     

       288
       288
       -
       		t.Error("Expected non-empty thumbprint for OKP key")

     

       289
       289
       -
       	}

     

       290
       290
       -
       }

     

       291
       291
       -
       

     

       292
       292
       -
       func TestCalculateJWKThumbprint_UnsupportedKeyType(t *testing.T) {

     

       293
       293
       -
       	jwk := map[string]interface{}{

     

       294
       294
       -
       		"kty": "UNKNOWN",

     

       295
       295
       -
       	}

     

       296
       296
       -
       

     

       297
       297
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       298
       298
       -
       	if err == nil {

     

       299
       299
       -
       		t.Error("Expected error for unsupported key type, got nil")

     

       300
       300
       -
       	}

     

       301
       301
       -
       	if err != nil && !contains(err.Error(), "unsupported JWK key type") {

     

       302
       302
       -
       		t.Errorf("Expected error about unsupported key type, got: %v", err)

     

       303
       303
       -
       	}

     

       304
       304
       -
       }

     

       305
       305
       -
       

     

       306
       306
       -
       func TestCalculateJWKThumbprint_CanonicalJSON(t *testing.T) {

     

       307
       307
       -
       	// RFC 7638 requires lexicographic ordering of keys in canonical JSON

     

       308
       308
       -
       	// This test verifies that the canonical JSON is correctly ordered

     

       309
       309
       -
       

     

       310
       310
       -
       	jwk := map[string]interface{}{

     

       311
       311
       -
       		"kty": "EC",

     

       312
       312
       -
       		"crv": "P-256",

     

       313
       313
       -
       		"x":   "x-coord",

     

       314
       314
       -
       		"y":   "y-coord",

     

       315
       315
       -
       	}

     

       316
       316
       -
       

     

       317
       317
       -
       	// The canonical JSON should be: {"crv":"P-256","kty":"EC","x":"x-coord","y":"y-coord"}

     

       318
       318
       -
       	// (lexicographically ordered: crv, kty, x, y)

     

       319
       319
       -
       

     

       320
       320
       -
       	canonical := map[string]string{

     

       321
       321
       -
       		"crv": "P-256",

     

       322
       322
       -
       		"kty": "EC",

     

       323
       323
       -
       		"x":   "x-coord",

     

       324
       324
       -
       		"y":   "y-coord",

     

       325
       325
       -
       	}

     

       326
       326
       -
       

     

       327
       327
       -
       	canonicalJSON, err := json.Marshal(canonical)

     

       328
       328
       -
       	if err != nil {

     

       329
       329
       -
       		t.Fatalf("Failed to marshal canonical JSON: %v", err)

     

       330
       330
       -
       	}

     

       331
       331
       -
       

     

       332
       332
       -
       	expectedHash := sha256.Sum256(canonicalJSON)

     

       333
       333
       -
       	expectedThumbprint := base64.RawURLEncoding.EncodeToString(expectedHash[:])

     

       334
       334
       -
       

     

       335
       335
       -
       	actualThumbprint, err := CalculateJWKThumbprint(jwk)

     

       336
       336
       -
       	if err != nil {

     

       337
       337
       -
       		t.Fatalf("CalculateJWKThumbprint failed: %v", err)

     

       338
       338
       -
       	}

     

       339
       339
       -
       

     

       340
       340
       -
       	if actualThumbprint != expectedThumbprint {

     

       341
       341
       -
       		t.Errorf("Thumbprint doesn't match expected canonical JSON hash\nExpected: %s\nGot: %s",

     

       342
       342
       -
       			expectedThumbprint, actualThumbprint)

     

       343
       343
       -
       	}

     

       344
       344
       -
       }

     

       345
       345
       -
       

     

       346
       346
       -
       // === DPoP Proof Verification Tests ===

     

       347
       347
       -
       

     

       348
       348
       -
       func TestVerifyDPoPProof_Valid(t *testing.T) {

     

       349
       349
       -
       	verifier := NewDPoPVerifier()

     

       350
       350
       -
       	key := generateTestES256Key(t)

     

       351
       351
       -
       

     

       352
       352
       -
       	method := "POST"

     

       353
       353
       -
       	uri := "https://api.example.com/resource"

     

       354
       354
       -
       	iat := time.Now()

     

       355
       355
       -
       	jti := uuid.New().String()

     

       356
       356
       -
       

     

       357
       357
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       358
       358
       -
       

     

       359
       359
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       360
       360
       -
       	if err != nil {

     

       361
       361
       -
       		t.Fatalf("VerifyDPoPProof failed for valid proof: %v", err)

     

       362
       362
       -
       	}

     

       363
       363
       -
       

     

       364
       364
       -
       	if result == nil {

     

       365
       365
       -
       		t.Fatal("Expected non-nil proof result")

     

       366
       366
       -
       	}

     

       367
       367
       -
       

     

       368
       368
       -
       	if result.Claims.HTTPMethod != method {

     

       369
       369
       -
       		t.Errorf("Expected method %s, got %s", method, result.Claims.HTTPMethod)

     

       370
       370
       -
       	}

     

       371
       371
       -
       

     

       372
       372
       -
       	if result.Claims.HTTPURI != uri {

     

       373
       373
       -
       		t.Errorf("Expected URI %s, got %s", uri, result.Claims.HTTPURI)

     

       374
       374
       -
       	}

     

       375
       375
       -
       

     

       376
       376
       -
       	if result.Claims.ID != jti {

     

       377
       377
       -
       		t.Errorf("Expected jti %s, got %s", jti, result.Claims.ID)

     

       378
       378
       -
       	}

     

       379
       379
       -
       

     

       380
       380
       -
       	if result.Thumbprint != key.thumbprint {

     

       381
       381
       -
       		t.Errorf("Expected thumbprint %s, got %s", key.thumbprint, result.Thumbprint)

     

       382
       382
       -
       	}

     

       383
       383
       -
       }

     

       384
       384
       -
       

     

       385
       385
       -
       func TestVerifyDPoPProof_InvalidSignature(t *testing.T) {

     

       386
       386
       -
       	verifier := NewDPoPVerifier()

     

       387
       387
       -
       	key := generateTestES256Key(t)

     

       388
       388
       -
       	wrongKey := generateTestES256Key(t)

     

       389
       389
       -
       

     

       390
       390
       -
       	method := "POST"

     

       391
       391
       -
       	uri := "https://api.example.com/resource"

     

       392
       392
       -
       	iat := time.Now()

     

       393
       393
       -
       	jti := uuid.New().String()

     

       394
       394
       -
       

     

       395
       395
       -
       	// Create proof with one key

     

       396
       396
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       397
       397
       -
       

     

       398
       398
       -
       	// Parse and modify to use wrong key's JWK in header (signature won't match)

     

       399
       399
       -
       	parts := splitJWT(proof)

     

       400
       400
       -
       	header := parseJWTHeader(t, parts[0])

     

       401
       401
       -
       	header["jwk"] = wrongKey.jwk

     

       402
       402
       -
       	modifiedHeader := encodeJSON(t, header)

     

       403
       403
       -
       	tamperedProof := modifiedHeader + "." + parts[1] + "." + parts[2]

     

       404
       404
       -
       

     

       405
       405
       -
       	_, err := verifier.VerifyDPoPProof(tamperedProof, method, uri)

     

       406
       406
       -
       	if err == nil {

     

       407
       407
       -
       		t.Error("Expected error for invalid signature, got nil")

     

       408
       408
       -
       	}

     

       409
       409
       -
       	if err != nil && !contains(err.Error(), "signature verification failed") {

     

       410
       410
       -
       		t.Errorf("Expected signature verification error, got: %v", err)

     

       411
       411
       -
       	}

     

       412
       412
       -
       }

     

       413
       413
       -
       

     

       414
       414
       -
       func TestVerifyDPoPProof_WrongHTTPMethod(t *testing.T) {

     

       415
       415
       -
       	verifier := NewDPoPVerifier()

     

       416
       416
       -
       	key := generateTestES256Key(t)

     

       417
       417
       -
       

     

       418
       418
       -
       	method := "POST"

     

       419
       419
       -
       	wrongMethod := "GET"

     

       420
       420
       -
       	uri := "https://api.example.com/resource"

     

       421
       421
       -
       	iat := time.Now()

     

       422
       422
       -
       	jti := uuid.New().String()

     

       423
       423
       -
       

     

       424
       424
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       425
       425
       -
       

     

       426
       426
       -
       	_, err := verifier.VerifyDPoPProof(proof, wrongMethod, uri)

     

       427
       427
       -
       	if err == nil {

     

       428
       428
       -
       		t.Error("Expected error for HTTP method mismatch, got nil")

     

       429
       429
       -
       	}

     

       430
       430
       -
       	if err != nil && !contains(err.Error(), "htm mismatch") {

     

       431
       431
       -
       		t.Errorf("Expected htm mismatch error, got: %v", err)

     

       432
       432
       -
       	}

     

       433
       433
       -
       }

     

       434
       434
       -
       

     

       435
       435
       -
       func TestVerifyDPoPProof_WrongURI(t *testing.T) {

     

       436
       436
       -
       	verifier := NewDPoPVerifier()

     

       437
       437
       -
       	key := generateTestES256Key(t)

     

       438
       438
       -
       

     

       439
       439
       -
       	method := "POST"

     

       440
       440
       -
       	uri := "https://api.example.com/resource"

     

       441
       441
       -
       	wrongURI := "https://api.example.com/different"

     

       442
       442
       -
       	iat := time.Now()

     

       443
       443
       -
       	jti := uuid.New().String()

     

       444
       444
       -
       

     

       445
       445
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       446
       446
       -
       

     

       447
       447
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, wrongURI)

     

       448
       448
       -
       	if err == nil {

     

       449
       449
       -
       		t.Error("Expected error for URI mismatch, got nil")

     

       450
       450
       -
       	}

     

       451
       451
       -
       	if err != nil && !contains(err.Error(), "htu mismatch") {

     

       452
       452
       -
       		t.Errorf("Expected htu mismatch error, got: %v", err)

     

       453
       453
       -
       	}

     

       454
       454
       -
       }

     

       455
       455
       -
       

     

       456
       456
       -
       func TestVerifyDPoPProof_URIWithQuery(t *testing.T) {

     

       457
       457
       -
       	// URI comparison should strip query and fragment

     

       458
       458
       -
       	verifier := NewDPoPVerifier()

     

       459
       459
       -
       	key := generateTestES256Key(t)

     

       460
       460
       -
       

     

       461
       461
       -
       	method := "POST"

     

       462
       462
       -
       	baseURI := "https://api.example.com/resource"

     

       463
       463
       -
       	uriWithQuery := baseURI + "?param=value"

     

       464
       464
       -
       	iat := time.Now()

     

       465
       465
       -
       	jti := uuid.New().String()

     

       466
       466
       -
       

     

       467
       467
       -
       	proof := createDPoPProof(t, key, method, baseURI, iat, jti)

     

       468
       468
       -
       

     

       469
       469
       -
       	// Should succeed because query is stripped

     

       470
       470
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uriWithQuery)

     

       471
       471
       -
       	if err != nil {

     

       472
       472
       -
       		t.Fatalf("VerifyDPoPProof failed for URI with query: %v", err)

     

       473
       473
       -
       	}

     

       474
       474
       -
       }

     

       475
       475
       -
       

     

       476
       476
       -
       func TestVerifyDPoPProof_URIWithFragment(t *testing.T) {

     

       477
       477
       -
       	// URI comparison should strip query and fragment

     

       478
       478
       -
       	verifier := NewDPoPVerifier()

     

       479
       479
       -
       	key := generateTestES256Key(t)

     

       480
       480
       -
       

     

       481
       481
       -
       	method := "POST"

     

       482
       482
       -
       	baseURI := "https://api.example.com/resource"

     

       483
       483
       -
       	uriWithFragment := baseURI + "#section"

     

       484
       484
       -
       	iat := time.Now()

     

       485
       485
       -
       	jti := uuid.New().String()

     

       486
       486
       -
       

     

       487
       487
       -
       	proof := createDPoPProof(t, key, method, baseURI, iat, jti)

     

       488
       488
       -
       

     

       489
       489
       -
       	// Should succeed because fragment is stripped

     

       490
       490
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uriWithFragment)

     

       491
       491
       -
       	if err != nil {

     

       492
       492
       -
       		t.Fatalf("VerifyDPoPProof failed for URI with fragment: %v", err)

     

       493
       493
       -
       	}

     

       494
       494
       -
       }

     

       495
       495
       -
       

     

       496
       496
       -
       func TestVerifyDPoPProof_ExpiredProof(t *testing.T) {

     

       497
       497
       -
       	verifier := NewDPoPVerifier()

     

       498
       498
       -
       	key := generateTestES256Key(t)

     

       499
       499
       -
       

     

       500
       500
       -
       	method := "POST"

     

       501
       501
       -
       	uri := "https://api.example.com/resource"

     

       502
       502
       -
       	// Proof issued 10 minutes ago (exceeds default MaxProofAge of 5 minutes)

     

       503
       503
       -
       	iat := time.Now().Add(-10 * time.Minute)

     

       504
       504
       -
       	jti := uuid.New().String()

     

       505
       505
       -
       

     

       506
       506
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       507
       507
       -
       

     

       508
       508
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       509
       509
       -
       	if err == nil {

     

       510
       510
       -
       		t.Error("Expected error for expired proof, got nil")

     

       511
       511
       -
       	}

     

       512
       512
       -
       	if err != nil && !contains(err.Error(), "too old") {

     

       513
       513
       -
       		t.Errorf("Expected 'too old' error, got: %v", err)

     

       514
       514
       -
       	}

     

       515
       515
       -
       }

     

       516
       516
       -
       

     

       517
       517
       -
       func TestVerifyDPoPProof_FutureProof(t *testing.T) {

     

       518
       518
       -
       	verifier := NewDPoPVerifier()

     

       519
       519
       -
       	key := generateTestES256Key(t)

     

       520
       520
       -
       

     

       521
       521
       -
       	method := "POST"

     

       522
       522
       -
       	uri := "https://api.example.com/resource"

     

       523
       523
       -
       	// Proof issued 1 minute in the future (exceeds MaxClockSkew)

     

       524
       524
       -
       	iat := time.Now().Add(1 * time.Minute)

     

       525
       525
       -
       	jti := uuid.New().String()

     

       526
       526
       -
       

     

       527
       527
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       528
       528
       -
       

     

       529
       529
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       530
       530
       -
       	if err == nil {

     

       531
       531
       -
       		t.Error("Expected error for future proof, got nil")

     

       532
       532
       -
       	}

     

       533
       533
       -
       	if err != nil && !contains(err.Error(), "in the future") {

     

       534
       534
       -
       		t.Errorf("Expected 'in the future' error, got: %v", err)

     

       535
       535
       -
       	}

     

       536
       536
       -
       }

     

       537
       537
       -
       

     

       538
       538
       -
       func TestVerifyDPoPProof_WithinClockSkew(t *testing.T) {

     

       539
       539
       -
       	verifier := NewDPoPVerifier()

     

       540
       540
       -
       	key := generateTestES256Key(t)

     

       541
       541
       -
       

     

       542
       542
       -
       	method := "POST"

     

       543
       543
       -
       	uri := "https://api.example.com/resource"

     

       544
       544
       -
       	// Proof issued 15 seconds in the future (within MaxClockSkew of 30s)

     

       545
       545
       -
       	iat := time.Now().Add(15 * time.Second)

     

       546
       546
       -
       	jti := uuid.New().String()

     

       547
       547
       -
       

     

       548
       548
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       549
       549
       -
       

     

       550
       550
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       551
       551
       -
       	if err != nil {

     

       552
       552
       -
       		t.Fatalf("VerifyDPoPProof failed for proof within clock skew: %v", err)

     

       553
       553
       -
       	}

     

       554
       554
       -
       }

     

       555
       555
       -
       

     

       556
       556
       -
       func TestVerifyDPoPProof_MissingJti(t *testing.T) {

     

       557
       557
       -
       	verifier := NewDPoPVerifier()

     

       558
       558
       -
       	key := generateTestES256Key(t)

     

       559
       559
       -
       

     

       560
       560
       -
       	method := "POST"

     

       561
       561
       -
       	uri := "https://api.example.com/resource"

     

       562
       562
       -
       	iat := time.Now()

     

       563
       563
       -
       

     

       564
       564
       -
       	claims := &DPoPClaims{

     

       565
       565
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       566
       566
       -
       			// No ID (jti)

     

       567
       567
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       568
       568
       -
       		},

     

       569
       569
       -
       		HTTPMethod: method,

     

       570
       570
       -
       		HTTPURI:    uri,

     

       571
       571
       -
       	}

     

       572
       572
       -
       

     

       573
       573
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       574
       574
       -
       	token.Header["typ"] = "dpop+jwt"

     

       575
       575
       -
       	token.Header["jwk"] = key.jwk

     

       576
       576
       -
       

     

       577
       577
       -
       	proof, err := token.SignedString(key.privateKey)

     

       578
       578
       -
       	if err != nil {

     

       579
       579
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       580
       580
       -
       	}

     

       581
       581
       -
       

     

       582
       582
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       583
       583
       -
       	if err == nil {

     

       584
       584
       -
       		t.Error("Expected error for missing jti, got nil")

     

       585
       585
       -
       	}

     

       586
       586
       -
       	if err != nil && !contains(err.Error(), "missing jti") {

     

       587
       587
       -
       		t.Errorf("Expected missing jti error, got: %v", err)

     

       588
       588
       -
       	}

     

       589
       589
       -
       }

     

       590
       590
       -
       

     

       591
       591
       -
       func TestVerifyDPoPProof_MissingTypHeader(t *testing.T) {

     

       592
       592
       -
       	verifier := NewDPoPVerifier()

     

       593
       593
       -
       	key := generateTestES256Key(t)

     

       594
       594
       -
       

     

       595
       595
       -
       	method := "POST"

     

       596
       596
       -
       	uri := "https://api.example.com/resource"

     

       597
       597
       -
       	iat := time.Now()

     

       598
       598
       -
       	jti := uuid.New().String()

     

       599
       599
       -
       

     

       600
       600
       -
       	claims := &DPoPClaims{

     

       601
       601
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       602
       602
       -
       			ID:       jti,

     

       603
       603
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       604
       604
       -
       		},

     

       605
       605
       -
       		HTTPMethod: method,

     

       606
       606
       -
       		HTTPURI:    uri,

     

       607
       607
       -
       	}

     

       608
       608
       -
       

     

       609
       609
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       610
       610
       -
       	// Don't set typ header

     

       611
       611
       -
       	token.Header["jwk"] = key.jwk

     

       612
       612
       -
       

     

       613
       613
       -
       	proof, err := token.SignedString(key.privateKey)

     

       614
       614
       -
       	if err != nil {

     

       615
       615
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       616
       616
       -
       	}

     

       617
       617
       -
       

     

       618
       618
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       619
       619
       -
       	if err == nil {

     

       620
       620
       -
       		t.Error("Expected error for missing typ header, got nil")

     

       621
       621
       -
       	}

     

       622
       622
       -
       	if err != nil && !contains(err.Error(), "typ must be 'dpop+jwt'") {

     

       623
       623
       -
       		t.Errorf("Expected typ header error, got: %v", err)

     

       624
       624
       -
       	}

     

       625
       625
       -
       }

     

       626
       626
       -
       

     

       627
       627
       -
       func TestVerifyDPoPProof_WrongTypHeader(t *testing.T) {

     

       628
       628
       -
       	verifier := NewDPoPVerifier()

     

       629
       629
       -
       	key := generateTestES256Key(t)

     

       630
       630
       -
       

     

       631
       631
       -
       	method := "POST"

     

       632
       632
       -
       	uri := "https://api.example.com/resource"

     

       633
       633
       -
       	iat := time.Now()

     

       634
       634
       -
       	jti := uuid.New().String()

     

       635
       635
       -
       

     

       636
       636
       -
       	claims := &DPoPClaims{

     

       637
       637
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       638
       638
       -
       			ID:       jti,

     

       639
       639
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       640
       640
       -
       		},

     

       641
       641
       -
       		HTTPMethod: method,

     

       642
       642
       -
       		HTTPURI:    uri,

     

       643
       643
       -
       	}

     

       644
       644
       -
       

     

       645
       645
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       646
       646
       -
       	token.Header["typ"] = "JWT" // Wrong typ

     

       647
       647
       -
       	token.Header["jwk"] = key.jwk

     

       648
       648
       -
       

     

       649
       649
       -
       	proof, err := token.SignedString(key.privateKey)

     

       650
       650
       -
       	if err != nil {

     

       651
       651
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       652
       652
       -
       	}

     

       653
       653
       -
       

     

       654
       654
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       655
       655
       -
       	if err == nil {

     

       656
       656
       -
       		t.Error("Expected error for wrong typ header, got nil")

     

       657
       657
       -
       	}

     

       658
       658
       -
       	if err != nil && !contains(err.Error(), "typ must be 'dpop+jwt'") {

     

       659
       659
       -
       		t.Errorf("Expected typ header error, got: %v", err)

     

       660
       660
       -
       	}

     

       661
       661
       -
       }

     

       662
       662
       -
       

     

       663
       663
       -
       func TestVerifyDPoPProof_MissingJWK(t *testing.T) {

     

       664
       664
       -
       	verifier := NewDPoPVerifier()

     

       665
       665
       -
       	key := generateTestES256Key(t)

     

       666
       666
       -
       

     

       667
       667
       -
       	method := "POST"

     

       668
       668
       -
       	uri := "https://api.example.com/resource"

     

       669
       669
       -
       	iat := time.Now()

     

       670
       670
       -
       	jti := uuid.New().String()

     

       671
       671
       -
       

     

       672
       672
       -
       	claims := &DPoPClaims{

     

       673
       673
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       674
       674
       -
       			ID:       jti,

     

       675
       675
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       676
       676
       -
       		},

     

       677
       677
       -
       		HTTPMethod: method,

     

       678
       678
       -
       		HTTPURI:    uri,

     

       679
       679
       -
       	}

     

       680
       680
       -
       

     

       681
       681
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       682
       682
       -
       	token.Header["typ"] = "dpop+jwt"

     

       683
       683
       -
       	// Don't include JWK

     

       684
       684
       -
       

     

       685
       685
       -
       	proof, err := token.SignedString(key.privateKey)

     

       686
       686
       -
       	if err != nil {

     

       687
       687
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       688
       688
       -
       	}

     

       689
       689
       -
       

     

       690
       690
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       691
       691
       -
       	if err == nil {

     

       692
       692
       -
       		t.Error("Expected error for missing jwk header, got nil")

     

       693
       693
       -
       	}

     

       694
       694
       -
       	if err != nil && !contains(err.Error(), "missing jwk") {

     

       695
       695
       -
       		t.Errorf("Expected missing jwk error, got: %v", err)

     

       696
       696
       -
       	}

     

       697
       697
       -
       }

     

       698
       698
       -
       

     

       699
       699
       -
       func TestVerifyDPoPProof_CustomTimeSettings(t *testing.T) {

     

       700
       700
       -
       	verifier := &DPoPVerifier{

     

       701
       701
       -
       		MaxClockSkew: 1 * time.Minute,

     

       702
       702
       -
       		MaxProofAge:  10 * time.Minute,

     

       703
       703
       -
       	}

     

       704
       704
       -
       	key := generateTestES256Key(t)

     

       705
       705
       -
       

     

       706
       706
       -
       	method := "POST"

     

       707
       707
       -
       	uri := "https://api.example.com/resource"

     

       708
       708
       -
       	// Proof issued 50 seconds in the future (within custom MaxClockSkew)

     

       709
       709
       -
       	iat := time.Now().Add(50 * time.Second)

     

       710
       710
       -
       	jti := uuid.New().String()

     

       711
       711
       -
       

     

       712
       712
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       713
       713
       -
       

     

       714
       714
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       715
       715
       -
       	if err != nil {

     

       716
       716
       -
       		t.Fatalf("VerifyDPoPProof failed with custom time settings: %v", err)

     

       717
       717
       -
       	}

     

       718
       718
       -
       }

     

       719
       719
       -
       

     

       720
       720
       -
       func TestVerifyDPoPProof_HTTPMethodCaseInsensitive(t *testing.T) {

     

       721
       721
       -
       	// HTTP method comparison should be case-insensitive per spec

     

       722
       722
       -
       	verifier := NewDPoPVerifier()

     

       723
       723
       -
       	key := generateTestES256Key(t)

     

       724
       724
       -
       

     

       725
       725
       -
       	method := "post"

     

       726
       726
       -
       	uri := "https://api.example.com/resource"

     

       727
       727
       -
       	iat := time.Now()

     

       728
       728
       -
       	jti := uuid.New().String()

     

       729
       729
       -
       

     

       730
       730
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       731
       731
       -
       

     

       732
       732
       -
       	// Verify with uppercase method

     

       733
       733
       -
       	_, err := verifier.VerifyDPoPProof(proof, "POST", uri)

     

       734
       734
       -
       	if err != nil {

     

       735
       735
       -
       		t.Fatalf("VerifyDPoPProof failed for case-insensitive method: %v", err)

     

       736
       736
       -
       	}

     

       737
       737
       -
       }

     

       738
       738
       -
       

     

       739
       739
       -
       // === Token Binding Verification Tests ===

     

       740
       740
       -
       

     

       741
       741
       -
       func TestVerifyTokenBinding_Matching(t *testing.T) {

     

       742
       742
       -
       	verifier := NewDPoPVerifier()

     

       743
       743
       -
       	key := generateTestES256Key(t)

     

       744
       744
       -
       

     

       745
       745
       -
       	method := "POST"

     

       746
       746
       -
       	uri := "https://api.example.com/resource"

     

       747
       747
       -
       	iat := time.Now()

     

       748
       748
       -
       	jti := uuid.New().String()

     

       749
       749
       -
       

     

       750
       750
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       751
       751
       -
       

     

       752
       752
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       753
       753
       -
       	if err != nil {

     

       754
       754
       -
       		t.Fatalf("VerifyDPoPProof failed: %v", err)

     

       755
       755
       -
       	}

     

       756
       756
       -
       

     

       757
       757
       -
       	// Verify token binding with matching thumbprint

     

       758
       758
       -
       	err = verifier.VerifyTokenBinding(result, key.thumbprint)

     

       759
       759
       -
       	if err != nil {

     

       760
       760
       -
       		t.Fatalf("VerifyTokenBinding failed for matching thumbprint: %v", err)

     

       761
       761
       -
       	}

     

       762
       762
       -
       }

     

       763
       763
       -
       

     

       764
       764
       -
       func TestVerifyTokenBinding_Mismatch(t *testing.T) {

     

       765
       765
       -
       	verifier := NewDPoPVerifier()

     

       766
       766
       -
       	key := generateTestES256Key(t)

     

       767
       767
       -
       	wrongKey := generateTestES256Key(t)

     

       768
       768
       -
       

     

       769
       769
       -
       	method := "POST"

     

       770
       770
       -
       	uri := "https://api.example.com/resource"

     

       771
       771
       -
       	iat := time.Now()

     

       772
       772
       -
       	jti := uuid.New().String()

     

       773
       773
       -
       

     

       774
       774
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       775
       775
       -
       

     

       776
       776
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       777
       777
       -
       	if err != nil {

     

       778
       778
       -
       		t.Fatalf("VerifyDPoPProof failed: %v", err)

     

       779
       779
       -
       	}

     

       780
       780
       -
       

     

       781
       781
       -
       	// Verify token binding with wrong thumbprint

     

       782
       782
       -
       	err = verifier.VerifyTokenBinding(result, wrongKey.thumbprint)

     

       783
       783
       -
       	if err == nil {

     

       784
       784
       -
       		t.Error("Expected error for thumbprint mismatch, got nil")

     

       785
       785
       -
       	}

     

       786
       786
       -
       	if err != nil && !contains(err.Error(), "thumbprint mismatch") {

     

       787
       787
       -
       		t.Errorf("Expected thumbprint mismatch error, got: %v", err)

     

       788
       788
       -
       	}

     

       789
       789
       -
       }

     

       790
       790
       -
       

     

       791
       791
       -
       // === ExtractCnfJkt Tests ===

     

       792
       792
       -
       

     

       793
       793
       -
       func TestExtractCnfJkt_Valid(t *testing.T) {

     

       794
       794
       -
       	expectedJkt := "test-thumbprint-123"

     

       795
       795
       -
       	claims := &Claims{

     

       796
       796
       -
       		Confirmation: map[string]interface{}{

     

       797
       797
       -
       			"jkt": expectedJkt,

     

       798
       798
       -
       		},

     

       799
       799
       -
       	}

     

       800
       800
       -
       

     

       801
       801
       -
       	jkt, err := ExtractCnfJkt(claims)

     

       802
       802
       -
       	if err != nil {

     

       803
       803
       -
       		t.Fatalf("ExtractCnfJkt failed for valid claims: %v", err)

     

       804
       804
       -
       	}

     

       805
       805
       -
       

     

       806
       806
       -
       	if jkt != expectedJkt {

     

       807
       807
       -
       		t.Errorf("Expected jkt %s, got %s", expectedJkt, jkt)

     

       808
       808
       -
       	}

     

       809
       809
       -
       }

     

       810
       810
       -
       

     

       811
       811
       -
       func TestExtractCnfJkt_MissingCnf(t *testing.T) {

     

       812
       812
       -
       	claims := &Claims{

     

       813
       813
       -
       		// No Confirmation

     

       814
       814
       -
       	}

     

       815
       815
       -
       

     

       816
       816
       -
       	_, err := ExtractCnfJkt(claims)

     

       817
       817
       -
       	if err == nil {

     

       818
       818
       -
       		t.Error("Expected error for missing cnf, got nil")

     

       819
       819
       -
       	}

     

       820
       820
       -
       	if err != nil && !contains(err.Error(), "missing cnf claim") {

     

       821
       821
       -
       		t.Errorf("Expected missing cnf error, got: %v", err)

     

       822
       822
       -
       	}

     

       823
       823
       -
       }

     

       824
       824
       -
       

     

       825
       825
       -
       func TestExtractCnfJkt_NilCnf(t *testing.T) {

     

       826
       826
       -
       	claims := &Claims{

     

       827
       827
       -
       		Confirmation: nil,

     

       828
       828
       -
       	}

     

       829
       829
       -
       

     

       830
       830
       -
       	_, err := ExtractCnfJkt(claims)

     

       831
       831
       -
       	if err == nil {

     

       832
       832
       -
       		t.Error("Expected error for nil cnf, got nil")

     

       833
       833
       -
       	}

     

       834
       834
       -
       	if err != nil && !contains(err.Error(), "missing cnf claim") {

     

       835
       835
       -
       		t.Errorf("Expected missing cnf error, got: %v", err)

     

       836
       836
       -
       	}

     

       837
       837
       -
       }

     

       838
       838
       -
       

     

       839
       839
       -
       func TestExtractCnfJkt_MissingJkt(t *testing.T) {

     

       840
       840
       -
       	claims := &Claims{

     

       841
       841
       -
       		Confirmation: map[string]interface{}{

     

       842
       842
       -
       			"other": "value",

     

       843
       843
       -
       		},

     

       844
       844
       -
       	}

     

       845
       845
       -
       

     

       846
       846
       -
       	_, err := ExtractCnfJkt(claims)

     

       847
       847
       -
       	if err == nil {

     

       848
       848
       -
       		t.Error("Expected error for missing jkt, got nil")

     

       849
       849
       -
       	}

     

       850
       850
       -
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       851
       851
       -
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       852
       852
       -
       	}

     

       853
       853
       -
       }

     

       854
       854
       -
       

     

       855
       855
       -
       func TestExtractCnfJkt_EmptyJkt(t *testing.T) {

     

       856
       856
       -
       	claims := &Claims{

     

       857
       857
       -
       		Confirmation: map[string]interface{}{

     

       858
       858
       -
       			"jkt": "",

     

       859
       859
       -
       		},

     

       860
       860
       -
       	}

     

       861
       861
       -
       

     

       862
       862
       -
       	_, err := ExtractCnfJkt(claims)

     

       863
       863
       -
       	if err == nil {

     

       864
       864
       -
       		t.Error("Expected error for empty jkt, got nil")

     

       865
       865
       -
       	}

     

       866
       866
       -
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       867
       867
       -
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       868
       868
       -
       	}

     

       869
       869
       -
       }

     

       870
       870
       -
       

     

       871
       871
       -
       func TestExtractCnfJkt_WrongType(t *testing.T) {

     

       872
       872
       -
       	claims := &Claims{

     

       873
       873
       -
       		Confirmation: map[string]interface{}{

     

       874
       874
       -
       			"jkt": 123, // Not a string

     

       875
       875
       -
       		},

     

       876
       876
       -
       	}

     

       877
       877
       -
       

     

       878
       878
       -
       	_, err := ExtractCnfJkt(claims)

     

       879
       879
       -
       	if err == nil {

     

       880
       880
       -
       		t.Error("Expected error for wrong type jkt, got nil")

     

       881
       881
       -
       	}

     

       882
       882
       -
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       883
       883
       -
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       884
       884
       -
       	}

     

       885
       885
       -
       }

     

       886
       886
       -
       

     

       887
       887
       -
       // === Helper Functions for Tests ===

     

       888
       888
       -
       

     

       889
       889
       -
       // splitJWT splits a JWT into its three parts

     

       890
       890
       -
       func splitJWT(token string) []string {

     

       891
       891
       -
       	return []string{

     

       892
       892
       -
       		token[:strings.IndexByte(token, '.')],

     

       893
       893
       -
       		token[strings.IndexByte(token, '.')+1 : strings.LastIndexByte(token, '.')],

     

       894
       894
       -
       		token[strings.LastIndexByte(token, '.')+1:],

     

       895
       895
       -
       	}

     

       896
       896
       -
       }

     

       897
       897
       -
       

     

       898
       898
       -
       // parseJWTHeader parses a base64url-encoded JWT header

     

       899
       899
       -
       func parseJWTHeader(t *testing.T, encoded string) map[string]interface{} {

     

       900
       900
       -
       	t.Helper()

     

       901
       901
       -
       	decoded, err := base64.RawURLEncoding.DecodeString(encoded)

     

       902
       902
       -
       	if err != nil {

     

       903
       903
       -
       		t.Fatalf("Failed to decode header: %v", err)

     

       904
       904
       -
       	}

     

       905
       905
       -
       

     

       906
       906
       -
       	var header map[string]interface{}

     

       907
       907
       -
       	if err := json.Unmarshal(decoded, &header); err != nil {

     

       908
       908
       -
       		t.Fatalf("Failed to unmarshal header: %v", err)

     

       909
       909
       -
       	}

     

       910
       910
       -
       

     

       911
       911
       -
       	return header

     

       912
       912
       -
       }

     

       913
       913
       -
       

     

       914
       914
       -
       // encodeJSON encodes a value to base64url-encoded JSON

     

       915
       915
       -
       func encodeJSON(t *testing.T, v interface{}) string {

     

       916
       916
       -
       	t.Helper()

     

       917
       917
       -
       	data, err := json.Marshal(v)

     

       918
       918
       -
       	if err != nil {

     

       919
       919
       -
       		t.Fatalf("Failed to marshal JSON: %v", err)

     

       920
       920
       -
       	}

     

       921
       921
       -
       	return base64.RawURLEncoding.EncodeToString(data)

     

       922
       922
       -
       }

     

       923
       923
       -
       

     

       924
       924
       -
       // === ES256K (secp256k1) Test Helpers ===

     

       925
       925
       -
       

     

       926
       926
       -
       // testES256KKey holds a test ES256K key pair using indigo

     

       927
       927
       -
       type testES256KKey struct {

     

       928
       928
       -
       	privateKey indigoCrypto.PrivateKey

     

       929
       929
       -
       	publicKey  indigoCrypto.PublicKey

     

       930
       930
       -
       	jwk        map[string]interface{}

     

       931
       931
       -
       	thumbprint string

     

       932
       932
       -
       }

     

       933
       933
       -
       

     

       934
       934
       -
       // generateTestES256KKey generates a test ES256K (secp256k1) key pair and JWK

     

       935
       935
       -
       func generateTestES256KKey(t *testing.T) *testES256KKey {

     

       936
       936
       -
       	t.Helper()

     

       937
       937
       -
       

     

       938
       938
       -
       	privateKey, err := indigoCrypto.GeneratePrivateKeyK256()

     

       939
       939
       -
       	if err != nil {

     

       940
       940
       -
       		t.Fatalf("Failed to generate ES256K test key: %v", err)

     

       941
       941
       -
       	}

     

       942
       942
       -
       

     

       943
       943
       -
       	publicKey, err := privateKey.PublicKey()

     

       944
       944
       -
       	if err != nil {

     

       945
       945
       -
       		t.Fatalf("Failed to get public key from ES256K private key: %v", err)

     

       946
       946
       -
       	}

     

       947
       947
       -
       

     

       948
       948
       -
       	// Get the JWK representation

     

       949
       949
       -
       	jwkStruct, err := publicKey.JWK()

     

       950
       950
       -
       	if err != nil {

     

       951
       951
       -
       		t.Fatalf("Failed to get JWK from ES256K public key: %v", err)

     

       952
       952
       -
       	}

     

       953
       953
       -
       	jwk := map[string]interface{}{

     

       954
       954
       -
       		"kty": jwkStruct.KeyType,

     

       955
       955
       -
       		"crv": jwkStruct.Curve,

     

       956
       956
       -
       		"x":   jwkStruct.X,

     

       957
       957
       -
       		"y":   jwkStruct.Y,

     

       958
       958
       -
       	}

     

       959
       959
       -
       

     

       960
       960
       -
       	// Calculate thumbprint

     

       961
       961
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       962
       962
       -
       	if err != nil {

     

       963
       963
       -
       		t.Fatalf("Failed to calculate ES256K thumbprint: %v", err)

     

       964
       964
       -
       	}

     

       965
       965
       -
       

     

       966
       966
       -
       	return &testES256KKey{

     

       967
       967
       -
       		privateKey: privateKey,

     

       968
       968
       -
       		publicKey:  publicKey,

     

       969
       969
       -
       		jwk:        jwk,

     

       970
       970
       -
       		thumbprint: thumbprint,

     

       971
       971
       -
       	}

     

       972
       972
       -
       }

     

       973
       973
       -
       

     

       974
       974
       -
       // createES256KDPoPProof creates a DPoP proof JWT using ES256K for testing

     

       975
       975
       -
       func createES256KDPoPProof(t *testing.T, key *testES256KKey, method, uri string, iat time.Time, jti string) string {

     

       976
       976
       -
       	t.Helper()

     

       977
       977
       -
       

     

       978
       978
       -
       	// Build claims

     

       979
       979
       -
       	claims := map[string]interface{}{

     

       980
       980
       -
       		"jti": jti,

     

       981
       981
       -
       		"iat": iat.Unix(),

     

       982
       982
       -
       		"htm": method,

     

       983
       983
       -
       		"htu": uri,

     

       984
       984
       -
       	}

     

       985
       985
       -
       

     

       986
       986
       -
       	// Build header

     

       987
       987
       -
       	header := map[string]interface{}{

     

       988
       988
       -
       		"typ": "dpop+jwt",

     

       989
       989
       -
       		"alg": "ES256K",

     

       990
       990
       -
       		"jwk": key.jwk,

     

       991
       991
       -
       	}

     

       992
       992
       -
       

     

       993
       993
       -
       	// Encode header and claims

     

       994
       994
       -
       	headerJSON, err := json.Marshal(header)

     

       995
       995
       -
       	if err != nil {

     

       996
       996
       -
       		t.Fatalf("Failed to marshal header: %v", err)

     

       997
       997
       -
       	}

     

       998
       998
       -
       	claimsJSON, err := json.Marshal(claims)

     

       999
       999
       -
       	if err != nil {

     

       1000
       1000
       -
       		t.Fatalf("Failed to marshal claims: %v", err)

     

       1001
       1001
       -
       	}

     

       1002
       1002
       -
       

     

       1003
       1003
       -
       	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)

     

       1004
       1004
       -
       	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)

     

       1005
       1005
       -
       

     

       1006
       1006
       -
       	// Sign with indigo

     

       1007
       1007
       -
       	signingInput := headerB64 + "." + claimsB64

     

       1008
       1008
       -
       	signature, err := key.privateKey.HashAndSign([]byte(signingInput))

     

       1009
       1009
       -
       	if err != nil {

     

       1010
       1010
       -
       		t.Fatalf("Failed to sign ES256K proof: %v", err)

     

       1011
       1011
       -
       	}

     

       1012
       1012
       -
       

     

       1013
       1013
       -
       	signatureB64 := base64.RawURLEncoding.EncodeToString(signature)

     

       1014
       1014
       -
       	return signingInput + "." + signatureB64

     

       1015
       1015
       -
       }

     

       1016
       1016
       -
       

     

       1017
       1017
       -
       // === ES256K Tests ===

     

       1018
       1018
       -
       

     

       1019
       1019
       -
       func TestVerifyDPoPProof_ES256K_Valid(t *testing.T) {

     

       1020
       1020
       -
       	verifier := NewDPoPVerifier()

     

       1021
       1021
       -
       	key := generateTestES256KKey(t)

     

       1022
       1022
       -
       

     

       1023
       1023
       -
       	method := "POST"

     

       1024
       1024
       -
       	uri := "https://api.example.com/resource"

     

       1025
       1025
       -
       	iat := time.Now()

     

       1026
       1026
       -
       	jti := uuid.New().String()

     

       1027
       1027
       -
       

     

       1028
       1028
       -
       	proof := createES256KDPoPProof(t, key, method, uri, iat, jti)

     

       1029
       1029
       -
       

     

       1030
       1030
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       1031
       1031
       -
       	if err != nil {

     

       1032
       1032
       -
       		t.Fatalf("VerifyDPoPProof failed for valid ES256K proof: %v", err)

     

       1033
       1033
       -
       	}

     

       1034
       1034
       -
       

     

       1035
       1035
       -
       	if result == nil {

     

       1036
       1036
       -
       		t.Fatal("Expected non-nil proof result")

     

       1037
       1037
       -
       	}

     

       1038
       1038
       -
       

     

       1039
       1039
       -
       	if result.Claims.HTTPMethod != method {

     

       1040
       1040
       -
       		t.Errorf("Expected method %s, got %s", method, result.Claims.HTTPMethod)

     

       1041
       1041
       -
       	}

     

       1042
       1042
       -
       

     

       1043
       1043
       -
       	if result.Claims.HTTPURI != uri {

     

       1044
       1044
       -
       		t.Errorf("Expected URI %s, got %s", uri, result.Claims.HTTPURI)

     

       1045
       1045
       -
       	}

     

       1046
       1046
       -
       

     

       1047
       1047
       -
       	if result.Thumbprint != key.thumbprint {

     

       1048
       1048
       -
       		t.Errorf("Expected thumbprint %s, got %s", key.thumbprint, result.Thumbprint)

     

       1049
       1049
       -
       	}

     

       1050
       1050
       -
       }

     

       1051
       1051
       -
       

     

       1052
       1052
       -
       func TestVerifyDPoPProof_ES256K_InvalidSignature(t *testing.T) {

     

       1053
       1053
       -
       	verifier := NewDPoPVerifier()

     

       1054
       1054
       -
       	key := generateTestES256KKey(t)

     

       1055
       1055
       -
       	wrongKey := generateTestES256KKey(t)

     

       1056
       1056
       -
       

     

       1057
       1057
       -
       	method := "POST"

     

       1058
       1058
       -
       	uri := "https://api.example.com/resource"

     

       1059
       1059
       -
       	iat := time.Now()

     

       1060
       1060
       -
       	jti := uuid.New().String()

     

       1061
       1061
       -
       

     

       1062
       1062
       -
       	// Create proof with one key

     

       1063
       1063
       -
       	proof := createES256KDPoPProof(t, key, method, uri, iat, jti)

     

       1064
       1064
       -
       

     

       1065
       1065
       -
       	// Tamper by replacing JWK with wrong key

     

       1066
       1066
       -
       	parts := splitJWT(proof)

     

       1067
       1067
       -
       	header := parseJWTHeader(t, parts[0])

     

       1068
       1068
       -
       	header["jwk"] = wrongKey.jwk

     

       1069
       1069
       -
       	modifiedHeader := encodeJSON(t, header)

     

       1070
       1070
       -
       	tamperedProof := modifiedHeader + "." + parts[1] + "." + parts[2]

     

       1071
       1071
       -
       

     

       1072
       1072
       -
       	_, err := verifier.VerifyDPoPProof(tamperedProof, method, uri)

     

       1073
       1073
       -
       	if err == nil {

     

       1074
       1074
       -
       		t.Error("Expected error for invalid ES256K signature, got nil")

     

       1075
       1075
       -
       	}

     

       1076
       1076
       -
       	if err != nil && !contains(err.Error(), "signature verification failed") {

     

       1077
       1077
       -
       		t.Errorf("Expected signature verification error, got: %v", err)

     

       1078
       1078
       -
       	}

     

       1079
       1079
       -
       }

     

       1080
       1080
       -
       

     

       1081
       1081
       -
       func TestCalculateJWKThumbprint_ES256K(t *testing.T) {

     

       1082
       1082
       -
       	// Test thumbprint calculation for secp256k1 keys

     

       1083
       1083
       -
       	key := generateTestES256KKey(t)

     

       1084
       1084
       -
       

     

       1085
       1085
       -
       	thumbprint, err := CalculateJWKThumbprint(key.jwk)

     

       1086
       1086
       -
       	if err != nil {

     

       1087
       1087
       -
       		t.Fatalf("CalculateJWKThumbprint failed for ES256K: %v", err)

     

       1088
       1088
       -
       	}

     

       1089
       1089
       -
       

     

       1090
       1090
       -
       	if thumbprint == "" {

     

       1091
       1091
       -
       		t.Error("Expected non-empty thumbprint for ES256K key")

     

       1092
       1092
       -
       	}

     

       1093
       1093
       -
       

     

       1094
       1094
       -
       	// Verify it's valid base64url

     

       1095
       1095
       -
       	_, err = base64.RawURLEncoding.DecodeString(thumbprint)

     

       1096
       1096
       -
       	if err != nil {

     

       1097
       1097
       -
       		t.Errorf("ES256K thumbprint is not valid base64url: %v", err)

     

       1098
       1098
       -
       	}

     

       1099
       1099
       -
       

     

       1100
       1100
       -
       	// Verify length (SHA-256 produces 32 bytes = 43 base64url chars)

     

       1101
       1101
       -
       	if len(thumbprint) != 43 {

     

       1102
       1102
       -
       		t.Errorf("Expected ES256K thumbprint length 43, got %d", len(thumbprint))

     

       1103
       1103
       -
       	}

     

       1104
       1104
       -
       }

     

       1105
       1105
       -
       

     

       1106
       1106
       -
       // === Algorithm-Curve Binding Tests ===

     

       1107
       1107
       -
       

     

       1108
       1108
       -
       func TestVerifyDPoPProof_AlgorithmCurveMismatch_ES256KWithP256Key(t *testing.T) {

     

       1109
       1109
       -
       	verifier := NewDPoPVerifier()

     

       1110
       1110
       -
       	key := generateTestES256Key(t) // P-256 key

     

       1111
       1111
       -
       

     

       1112
       1112
       -
       	method := "POST"

     

       1113
       1113
       -
       	uri := "https://api.example.com/resource"

     

       1114
       1114
       -
       	iat := time.Now()

     

       1115
       1115
       -
       	jti := uuid.New().String()

     

       1116
       1116
       -
       

     

       1117
       1117
       -
       	// Create a proof claiming ES256K but using P-256 key

     

       1118
       1118
       -
       	claims := &DPoPClaims{

     

       1119
       1119
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1120
       1120
       -
       			ID:       jti,

     

       1121
       1121
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       1122
       1122
       -
       		},

     

       1123
       1123
       -
       		HTTPMethod: method,

     

       1124
       1124
       -
       		HTTPURI:    uri,

     

       1125
       1125
       -
       	}

     

       1126
       1126
       -
       

     

       1127
       1127
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1128
       1128
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1129
       1129
       -
       	token.Header["alg"] = "ES256K" // Claim ES256K

     

       1130
       1130
       -
       	token.Header["jwk"] = key.jwk  // But use P-256 key

     

       1131
       1131
       -
       

     

       1132
       1132
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1133
       1133
       -
       	if err != nil {

     

       1134
       1134
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1135
       1135
       -
       	}

     

       1136
       1136
       -
       

     

       1137
       1137
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1138
       1138
       -
       	if err == nil {

     

       1139
       1139
       -
       		t.Error("Expected error for ES256K algorithm with P-256 curve, got nil")

     

       1140
       1140
       -
       	}

     

       1141
       1141
       -
       	if err != nil && !contains(err.Error(), "requires curve secp256k1") {

     

       1142
       1142
       -
       		t.Errorf("Expected curve mismatch error, got: %v", err)

     

       1143
       1143
       -
       	}

     

       1144
       1144
       -
       }

     

       1145
       1145
       -
       

     

       1146
       1146
       -
       func TestVerifyDPoPProof_AlgorithmCurveMismatch_ES256WithSecp256k1Key(t *testing.T) {

     

       1147
       1147
       -
       	verifier := NewDPoPVerifier()

     

       1148
       1148
       -
       	key := generateTestES256KKey(t) // secp256k1 key

     

       1149
       1149
       -
       

     

       1150
       1150
       -
       	method := "POST"

     

       1151
       1151
       -
       	uri := "https://api.example.com/resource"

     

       1152
       1152
       -
       	iat := time.Now()

     

       1153
       1153
       -
       	jti := uuid.New().String()

     

       1154
       1154
       -
       

     

       1155
       1155
       -
       	// Build claims

     

       1156
       1156
       -
       	claims := map[string]interface{}{

     

       1157
       1157
       -
       		"jti": jti,

     

       1158
       1158
       -
       		"iat": iat.Unix(),

     

       1159
       1159
       -
       		"htm": method,

     

       1160
       1160
       -
       		"htu": uri,

     

       1161
       1161
       -
       	}

     

       1162
       1162
       -
       

     

       1163
       1163
       -
       	// Build header claiming ES256 but using secp256k1 key

     

       1164
       1164
       -
       	header := map[string]interface{}{

     

       1165
       1165
       -
       		"typ": "dpop+jwt",

     

       1166
       1166
       -
       		"alg": "ES256", // Claim ES256

     

       1167
       1167
       -
       		"jwk": key.jwk, // But use secp256k1 key

     

       1168
       1168
       -
       	}

     

       1169
       1169
       -
       

     

       1170
       1170
       -
       	headerJSON, _ := json.Marshal(header)

     

       1171
       1171
       -
       	claimsJSON, _ := json.Marshal(claims)

     

       1172
       1172
       -
       

     

       1173
       1173
       -
       	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)

     

       1174
       1174
       -
       	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)

     

       1175
       1175
       -
       

     

       1176
       1176
       -
       	signingInput := headerB64 + "." + claimsB64

     

       1177
       1177
       -
       	signature, err := key.privateKey.HashAndSign([]byte(signingInput))

     

       1178
       1178
       -
       	if err != nil {

     

       1179
       1179
       -
       		t.Fatalf("Failed to sign: %v", err)

     

       1180
       1180
       -
       	}

     

       1181
       1181
       -
       

     

       1182
       1182
       -
       	proof := signingInput + "." + base64.RawURLEncoding.EncodeToString(signature)

     

       1183
       1183
       -
       

     

       1184
       1184
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1185
       1185
       -
       	if err == nil {

     

       1186
       1186
       -
       		t.Error("Expected error for ES256 algorithm with secp256k1 curve, got nil")

     

       1187
       1187
       -
       	}

     

       1188
       1188
       -
       	if err != nil && !contains(err.Error(), "requires curve P-256") {

     

       1189
       1189
       -
       		t.Errorf("Expected curve mismatch error, got: %v", err)

     

       1190
       1190
       -
       	}

     

       1191
       1191
       -
       }

     

       1192
       1192
       -
       

     

       1193
       1193
       -
       // === exp/nbf Validation Tests ===

     

       1194
       1194
       -
       

     

       1195
       1195
       -
       func TestVerifyDPoPProof_ExpiredWithExpClaim(t *testing.T) {

     

       1196
       1196
       -
       	verifier := NewDPoPVerifier()

     

       1197
       1197
       -
       	key := generateTestES256Key(t)

     

       1198
       1198
       -
       

     

       1199
       1199
       -
       	method := "POST"

     

       1200
       1200
       -
       	uri := "https://api.example.com/resource"

     

       1201
       1201
       -
       	iat := time.Now().Add(-2 * time.Minute)

     

       1202
       1202
       -
       	exp := time.Now().Add(-1 * time.Minute) // Expired 1 minute ago

     

       1203
       1203
       -
       	jti := uuid.New().String()

     

       1204
       1204
       -
       

     

       1205
       1205
       -
       	claims := &DPoPClaims{

     

       1206
       1206
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1207
       1207
       -
       			ID:        jti,

     

       1208
       1208
       -
       			IssuedAt:  jwt.NewNumericDate(iat),

     

       1209
       1209
       -
       			ExpiresAt: jwt.NewNumericDate(exp),

     

       1210
       1210
       -
       		},

     

       1211
       1211
       -
       		HTTPMethod: method,

     

       1212
       1212
       -
       		HTTPURI:    uri,

     

       1213
       1213
       -
       	}

     

       1214
       1214
       -
       

     

       1215
       1215
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1216
       1216
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1217
       1217
       -
       	token.Header["jwk"] = key.jwk

     

       1218
       1218
       -
       

     

       1219
       1219
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1220
       1220
       -
       	if err != nil {

     

       1221
       1221
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1222
       1222
       -
       	}

     

       1223
       1223
       -
       

     

       1224
       1224
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1225
       1225
       -
       	if err == nil {

     

       1226
       1226
       -
       		t.Error("Expected error for expired proof with exp claim, got nil")

     

       1227
       1227
       -
       	}

     

       1228
       1228
       -
       	if err != nil && !contains(err.Error(), "expired") {

     

       1229
       1229
       -
       		t.Errorf("Expected expiration error, got: %v", err)

     

       1230
       1230
       -
       	}

     

       1231
       1231
       -
       }

     

       1232
       1232
       -
       

     

       1233
       1233
       -
       func TestVerifyDPoPProof_NotYetValidWithNbfClaim(t *testing.T) {

     

       1234
       1234
       -
       	verifier := NewDPoPVerifier()

     

       1235
       1235
       -
       	key := generateTestES256Key(t)

     

       1236
       1236
       -
       

     

       1237
       1237
       -
       	method := "POST"

     

       1238
       1238
       -
       	uri := "https://api.example.com/resource"

     

       1239
       1239
       -
       	iat := time.Now()

     

       1240
       1240
       -
       	nbf := time.Now().Add(5 * time.Minute) // Not valid for another 5 minutes

     

       1241
       1241
       -
       	jti := uuid.New().String()

     

       1242
       1242
       -
       

     

       1243
       1243
       -
       	claims := &DPoPClaims{

     

       1244
       1244
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1245
       1245
       -
       			ID:        jti,

     

       1246
       1246
       -
       			IssuedAt:  jwt.NewNumericDate(iat),

     

       1247
       1247
       -
       			NotBefore: jwt.NewNumericDate(nbf),

     

       1248
       1248
       -
       		},

     

       1249
       1249
       -
       		HTTPMethod: method,

     

       1250
       1250
       -
       		HTTPURI:    uri,

     

       1251
       1251
       -
       	}

     

       1252
       1252
       -
       

     

       1253
       1253
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1254
       1254
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1255
       1255
       -
       	token.Header["jwk"] = key.jwk

     

       1256
       1256
       -
       

     

       1257
       1257
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1258
       1258
       -
       	if err != nil {

     

       1259
       1259
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1260
       1260
       -
       	}

     

       1261
       1261
       -
       

     

       1262
       1262
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1263
       1263
       -
       	if err == nil {

     

       1264
       1264
       -
       		t.Error("Expected error for not-yet-valid proof with nbf claim, got nil")

     

       1265
       1265
       -
       	}

     

       1266
       1266
       -
       	if err != nil && !contains(err.Error(), "not valid before") {

     

       1267
       1267
       -
       		t.Errorf("Expected not-before error, got: %v", err)

     

       1268
       1268
       -
       	}

     

       1269
       1269
       -
       }

     

       1270
       1270
       -
       

     

       1271
       1271
       -
       func TestVerifyDPoPProof_ValidWithExpClaimInFuture(t *testing.T) {

     

       1272
       1272
       -
       	verifier := NewDPoPVerifier()

     

       1273
       1273
       -
       	key := generateTestES256Key(t)

     

       1274
       1274
       -
       

     

       1275
       1275
       -
       	method := "POST"

     

       1276
       1276
       -
       	uri := "https://api.example.com/resource"

     

       1277
       1277
       -
       	iat := time.Now()

     

       1278
       1278
       -
       	exp := time.Now().Add(5 * time.Minute) // Valid for 5 more minutes

     

       1279
       1279
       -
       	jti := uuid.New().String()

     

       1280
       1280
       -
       

     

       1281
       1281
       -
       	claims := &DPoPClaims{

     

       1282
       1282
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1283
       1283
       -
       			ID:        jti,

     

       1284
       1284
       -
       			IssuedAt:  jwt.NewNumericDate(iat),

     

       1285
       1285
       -
       			ExpiresAt: jwt.NewNumericDate(exp),

     

       1286
       1286
       -
       		},

     

       1287
       1287
       -
       		HTTPMethod: method,

     

       1288
       1288
       -
       		HTTPURI:    uri,

     

       1289
       1289
       -
       	}

     

       1290
       1290
       -
       

     

       1291
       1291
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1292
       1292
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1293
       1293
       -
       	token.Header["jwk"] = key.jwk

     

       1294
       1294
       -
       

     

       1295
       1295
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1296
       1296
       -
       	if err != nil {

     

       1297
       1297
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1298
       1298
       -
       	}

     

       1299
       1299
       -
       

     

       1300
       1300
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       1301
       1301
       -
       	if err != nil {

     

       1302
       1302
       -
       		t.Fatalf("VerifyDPoPProof failed for valid proof with exp in future: %v", err)

     

       1303
       1303
       -
       	}

     

       1304
       1304
       -
       

     

       1305
       1305
       -
       	if result == nil {

     

       1306
       1306
       -
       		t.Error("Expected non-nil result for valid proof")

     

       1307
       1307
       -
       	}

     

       1308
       1308
       -
       }

+1

docker-compose.prod.yml

···

       62
       62
        
             # Instance identity

     

       63
       63
        
             INSTANCE_DID: did:web:coves.social

     

       64
       64
        
             INSTANCE_DOMAIN: coves.social

     

       65
       65
       +
             APPVIEW_PUBLIC_URL: https://coves.social

     

       65
       66
        
       

     

       66
       67
        
             # PDS connection (separate domain!)

     

       67
       68
        
             PDS_URL: https://coves.me

+6 -5

internal/api/routes/oauth.go

···

       38
       38
        
       	// Use login limiter since callback completes the authentication flow

     

       39
       39
        
       	r.With(corsMiddleware(allowedOrigins), loginLimiter.Middleware).Get("/oauth/callback", handler.HandleCallback)

     

       40
       40
        
       

     

       41
       41
       -
       	// Mobile Universal Link callback route

     

       42
       42
       -
       	// This route is used for iOS Universal Links and Android App Links

     

       43
       43
       -
       	// Path must match the path in .well-known/apple-app-site-association

     

       44
       44
       -
       	// Uses the same handler as web callback - the system routes it to the mobile app

     

       45
       45
       -
       	r.With(loginLimiter.Middleware).Get("/app/oauth/callback", handler.HandleCallback)

     

       41
       41
       +
       	// Mobile Universal Link callback route (fallback when app doesn't intercept)

     

       42
       42
       +
       	// This route exists for iOS Universal Links and Android App Links.

     

       43
       43
       +
       	// When properly configured, the mobile OS intercepts this URL and opens the app

     

       44
       44
       +
       	// BEFORE the request reaches the server. If this handler is reached, it means

     

       45
       45
       +
       	// Universal Links failed to intercept.

     

       46
       46
       +
       	r.With(loginLimiter.Middleware).Get("/app/oauth/callback", handler.HandleMobileDeepLinkFallback)

     

       46
       47
        
       

     

       47
       48
        
       	// Session management - dedicated rate limits

     

       48
       49
        
       	r.With(logoutLimiter.Middleware).Post("/oauth/logout", handler.HandleLogout)

+11

static/.well-known/apple-app-site-association

···

       1
       1
       +
       {

     

       2
       2
       +
         "applinks": {

     

       3
       3
       +
           "apps": [],

     

       4
       4
       +
           "details": [

     

       5
       5
       +
             {

     

       6
       6
       +
               "appID": "TEAM_ID.social.coves",

     

       7
       7
       +
               "paths": ["/app/oauth/callback"]

     

       8
       8
       +
             }

     

       9
       9
       +
           ]

     

       10
       10
       +
         }

     

       11
       11
       +
       }

+10

static/.well-known/assetlinks.json

···

       1
       1
       +
       [{

     

       2
       2
       +
         "relation": ["delegate_permission/common.handle_all_urls"],

     

       3
       3
       +
         "target": {

     

       4
       4
       +
           "namespace": "android_app",

     

       5
       5
       +
           "package_name": "social.coves",

     

       6
       6
       +
           "sha256_cert_fingerprints": [

     

       7
       7
       +
             "0B:D8:8C:99:66:25:E5:CD:06:54:80:88:01:6F:B7:38:B9:F4:5B:41:71:F7:95:C8:68:94:87:AD:EA:9F:D9:ED"

     

       8
       8
       +
           ]

     

       9
       9
       +
         }

     

       10
       10
       +
       }]

+16 -9

internal/atproto/oauth/handlers_test.go

···

       171
       171
        
       }

     

       172
       172
        
       

     

       173
       173
        
       // TestIsMobileRedirectURI tests mobile redirect URI validation with EXACT URI matching

     

       174
       174
       -
       // Only Universal Links (HTTPS) are allowed - custom schemes are blocked for security

     

       174
       174
       +
       // Per atproto spec, custom schemes must match client_id hostname in reverse-domain order

     

       175
       175
        
       func TestIsMobileRedirectURI(t *testing.T) {

     

       176
       176
        
       	tests := []struct {

     

       177
       177
        
       		uri      string

     

       178
       178
        
       		expected bool

     

       179
       179
        
       	}{

     

       180
       180
       -
       		{"https://coves.social/app/oauth/callback", true}, // Universal Link - allowed

     

       181
       181
       -
       		{"coves-app://oauth/callback", false},             // Custom scheme - blocked (insecure)

     

       182
       182
       -
       		{"coves://oauth/callback", false},                 // Custom scheme - blocked (insecure)

     

       183
       183
       -
       		{"coves-app://callback", false},                   // Custom scheme - blocked

     

       184
       184
       -
       		{"coves://oauth", false},                          // Custom scheme - blocked

     

       185
       185
       -
       		{"myapp://oauth", false},                          // Not in allowlist

     

       186
       186
       -
       		{"https://example.com", false},                    // Wrong domain

     

       187
       187
       -
       		{"http://localhost", false},                       // HTTP not allowed

     

       180
       180
       +
       		// Custom scheme per atproto spec (reverse domain of coves.social)

     

       181
       181
       +
       		{"social.coves:/callback", true},

     

       182
       182
       +
       		{"social.coves://callback", true},

     

       183
       183
       +
       		{"social.coves:/oauth/callback", true},

     

       184
       184
       +
       		{"social.coves://oauth/callback", true},

     

       185
       185
       +
       		// Universal Link - allowed (strongest security)

     

       186
       186
       +
       		{"https://coves.social/app/oauth/callback", true},

     

       187
       187
       +
       		// Wrong custom schemes - not reverse-domain of coves.social

     

       188
       188
       +
       		{"coves-app://oauth/callback", false},

     

       189
       189
       +
       		{"coves://oauth/callback", false},

     

       190
       190
       +
       		{"coves.social://callback", false}, // Not reversed

     

       191
       191
       +
       		{"myapp://oauth", false},

     

       192
       192
       +
       		// Wrong domain/scheme

     

       193
       193
       +
       		{"https://example.com", false},

     

       194
       194
       +
       		{"http://localhost", false},

     

       188
       195
        
       		{"", false},

     

       189
       196
        
       		{"not-a-uri", false},

     

       190
       197
        
       	}

+41

internal/atproto/lexicon/social/coves/feed/vote/delete.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.feed.vote.delete",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Delete a vote on a post or comment",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["subject"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "subject": {

     

       15
       15
       +
                     "type": "ref",

     

       16
       16
       +
                     "ref": "com.atproto.repo.strongRef",

     

       17
       17
       +
                     "description": "Strong reference to the post or comment to remove the vote from"

     

       18
       18
       +
                   }

     

       19
       19
       +
                 }

     

       20
       20
       +
               }

     

       21
       21
       +
             },

     

       22
       22
       +
             "output": {

     

       23
       23
       +
               "encoding": "application/json",

     

       24
       24
       +
               "schema": {

     

       25
       25
       +
                 "type": "object",

     

       26
       26
       +
                 "properties": {}

     

       27
       27
       +
               }

     

       28
       28
       +
             },

     

       29
       29
       +
             "errors": [

     

       30
       30
       +
               {

     

       31
       31
       +
                 "name": "VoteNotFound",

     

       32
       32
       +
                 "description": "No vote found for this subject"

     

       33
       33
       +
               },

     

       34
       34
       +
               {

     

       35
       35
       +
                 "name": "NotAuthorized",

     

       36
       36
       +
                 "description": "User is not authorized to delete this vote"

     

       37
       37
       +
               }

     

       38
       38
       +
             ]

     

       39
       39
       +
           }

     

       40
       40
       +
         }

     

       41
       41
       +
       }

+115

internal/api/handlers/vote/create_vote.go

···

       1
       1
       +
       package vote

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/votes"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // CreateVoteHandler handles vote creation

     

       12
       12
       +
       type CreateVoteHandler struct {

     

       13
       13
       +
       	service votes.Service

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // NewCreateVoteHandler creates a new create vote handler

     

       17
       17
       +
       func NewCreateVoteHandler(service votes.Service) *CreateVoteHandler {

     

       18
       18
       +
       	return &CreateVoteHandler{

     

       19
       19
       +
       		service: service,

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // CreateVoteInput represents the request body for creating a vote

     

       24
       24
       +
       type CreateVoteInput struct {

     

       25
       25
       +
       	Subject struct {

     

       26
       26
       +
       		URI string `json:"uri"`

     

       27
       27
       +
       		CID string `json:"cid"`

     

       28
       28
       +
       	} `json:"subject"`

     

       29
       29
       +
       	Direction string `json:"direction"`

     

       30
       30
       +
       }

     

       31
       31
       +
       

     

       32
       32
       +
       // CreateVoteOutput represents the response body for creating a vote

     

       33
       33
       +
       type CreateVoteOutput struct {

     

       34
       34
       +
       	URI string `json:"uri"`

     

       35
       35
       +
       	CID string `json:"cid"`

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       // HandleCreateVote creates a vote on a post or comment

     

       39
       39
       +
       // POST /xrpc/social.coves.vote.create

     

       40
       40
       +
       //

     

       41
       41
       +
       // Request body: { "subject": { "uri": "at://...", "cid": "..." }, "direction": "up" }

     

       42
       42
       +
       // Response: { "uri": "at://...", "cid": "..." }

     

       43
       43
       +
       //

     

       44
       44
       +
       // Behavior:

     

       45
       45
       +
       // - If no vote exists: creates new vote with given direction

     

       46
       46
       +
       // - If vote exists with same direction: deletes vote (toggle off)

     

       47
       47
       +
       // - If vote exists with different direction: updates to new direction

     

       48
       48
       +
       func (h *CreateVoteHandler) HandleCreateVote(w http.ResponseWriter, r *http.Request) {

     

       49
       49
       +
       	if r.Method != http.MethodPost {

     

       50
       50
       +
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       51
       51
       +
       		return

     

       52
       52
       +
       	}

     

       53
       53
       +
       

     

       54
       54
       +
       	// Parse request body

     

       55
       55
       +
       	var input CreateVoteInput

     

       56
       56
       +
       	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {

     

       57
       57
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       58
       58
       +
       		return

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	// Validate required fields

     

       62
       62
       +
       	if input.Subject.URI == "" {

     

       63
       63
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.uri is required")

     

       64
       64
       +
       		return

     

       65
       65
       +
       	}

     

       66
       66
       +
       	if input.Subject.CID == "" {

     

       67
       67
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.cid is required")

     

       68
       68
       +
       		return

     

       69
       69
       +
       	}

     

       70
       70
       +
       	if input.Direction == "" {

     

       71
       71
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "direction is required")

     

       72
       72
       +
       		return

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Validate direction

     

       76
       76
       +
       	if input.Direction != "up" && input.Direction != "down" {

     

       77
       77
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "direction must be 'up' or 'down'")

     

       78
       78
       +
       		return

     

       79
       79
       +
       	}

     

       80
       80
       +
       

     

       81
       81
       +
       	// Get OAuth session from context (injected by auth middleware)

     

       82
       82
       +
       	session := middleware.GetOAuthSession(r)

     

       83
       83
       +
       	if session == nil {

     

       84
       84
       +
       		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       85
       85
       +
       		return

     

       86
       86
       +
       	}

     

       87
       87
       +
       

     

       88
       88
       +
       	// Create vote request

     

       89
       89
       +
       	req := votes.CreateVoteRequest{

     

       90
       90
       +
       		Subject: votes.StrongRef{

     

       91
       91
       +
       			URI: input.Subject.URI,

     

       92
       92
       +
       			CID: input.Subject.CID,

     

       93
       93
       +
       		},

     

       94
       94
       +
       		Direction: input.Direction,

     

       95
       95
       +
       	}

     

       96
       96
       +
       

     

       97
       97
       +
       	// Call service to create vote

     

       98
       98
       +
       	response, err := h.service.CreateVote(r.Context(), session, req)

     

       99
       99
       +
       	if err != nil {

     

       100
       100
       +
       		handleServiceError(w, err)

     

       101
       101
       +
       		return

     

       102
       102
       +
       	}

     

       103
       103
       +
       

     

       104
       104
       +
       	// Return success response

     

       105
       105
       +
       	output := CreateVoteOutput{

     

       106
       106
       +
       		URI: response.URI,

     

       107
       107
       +
       		CID: response.CID,

     

       108
       108
       +
       	}

     

       109
       109
       +
       

     

       110
       110
       +
       	w.Header().Set("Content-Type", "application/json")

     

       111
       111
       +
       	w.WriteHeader(http.StatusOK)

     

       112
       112
       +
       	if err := json.NewEncoder(w).Encode(output); err != nil {

     

       113
       113
       +
       		log.Printf("Failed to encode response: %v", err)

     

       114
       114
       +
       	}

     

       115
       115
       +
       }

+93

internal/api/handlers/vote/delete_vote.go

···

       1
       1
       +
       package vote

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/votes"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // DeleteVoteHandler handles vote deletion

     

       12
       12
       +
       type DeleteVoteHandler struct {

     

       13
       13
       +
       	service votes.Service

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // NewDeleteVoteHandler creates a new delete vote handler

     

       17
       17
       +
       func NewDeleteVoteHandler(service votes.Service) *DeleteVoteHandler {

     

       18
       18
       +
       	return &DeleteVoteHandler{

     

       19
       19
       +
       		service: service,

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // DeleteVoteInput represents the request body for deleting a vote

     

       24
       24
       +
       type DeleteVoteInput struct {

     

       25
       25
       +
       	Subject struct {

     

       26
       26
       +
       		URI string `json:"uri"`

     

       27
       27
       +
       		CID string `json:"cid"`

     

       28
       28
       +
       	} `json:"subject"`

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       // DeleteVoteOutput represents the response body for deleting a vote

     

       32
       32
       +
       // Per lexicon: output is an empty object

     

       33
       33
       +
       type DeleteVoteOutput struct{}

     

       34
       34
       +
       

     

       35
       35
       +
       // HandleDeleteVote removes a vote from a post or comment

     

       36
       36
       +
       // POST /xrpc/social.coves.vote.delete

     

       37
       37
       +
       //

     

       38
       38
       +
       // Request body: { "subject": { "uri": "at://...", "cid": "..." } }

     

       39
       39
       +
       // Response: { "success": true }

     

       40
       40
       +
       func (h *DeleteVoteHandler) HandleDeleteVote(w http.ResponseWriter, r *http.Request) {

     

       41
       41
       +
       	if r.Method != http.MethodPost {

     

       42
       42
       +
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       43
       43
       +
       		return

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	// Parse request body

     

       47
       47
       +
       	var input DeleteVoteInput

     

       48
       48
       +
       	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {

     

       49
       49
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       50
       50
       +
       		return

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	// Validate required fields

     

       54
       54
       +
       	if input.Subject.URI == "" {

     

       55
       55
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.uri is required")

     

       56
       56
       +
       		return

     

       57
       57
       +
       	}

     

       58
       58
       +
       	if input.Subject.CID == "" {

     

       59
       59
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.cid is required")

     

       60
       60
       +
       		return

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Get OAuth session from context (injected by auth middleware)

     

       64
       64
       +
       	session := middleware.GetOAuthSession(r)

     

       65
       65
       +
       	if session == nil {

     

       66
       66
       +
       		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       67
       67
       +
       		return

     

       68
       68
       +
       	}

     

       69
       69
       +
       

     

       70
       70
       +
       	// Create delete vote request

     

       71
       71
       +
       	req := votes.DeleteVoteRequest{

     

       72
       72
       +
       		Subject: votes.StrongRef{

     

       73
       73
       +
       			URI: input.Subject.URI,

     

       74
       74
       +
       			CID: input.Subject.CID,

     

       75
       75
       +
       		},

     

       76
       76
       +
       	}

     

       77
       77
       +
       

     

       78
       78
       +
       	// Call service to delete vote

     

       79
       79
       +
       	err := h.service.DeleteVote(r.Context(), session, req)

     

       80
       80
       +
       	if err != nil {

     

       81
       81
       +
       		handleServiceError(w, err)

     

       82
       82
       +
       		return

     

       83
       83
       +
       	}

     

       84
       84
       +
       

     

       85
       85
       +
       	// Return success response (empty object per lexicon)

     

       86
       86
       +
       	output := DeleteVoteOutput{}

     

       87
       87
       +
       

     

       88
       88
       +
       	w.Header().Set("Content-Type", "application/json")

     

       89
       89
       +
       	w.WriteHeader(http.StatusOK)

     

       90
       90
       +
       	if err := json.NewEncoder(w).Encode(output); err != nil {

     

       91
       91
       +
       		log.Printf("Failed to encode response: %v", err)

     

       92
       92
       +
       	}

     

       93
       93
       +
       }

+24

internal/api/routes/vote.go

···

       1
       1
       +
       package routes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/vote"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/votes"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/go-chi/chi/v5"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // RegisterVoteRoutes registers vote-related XRPC endpoints on the router

     

       12
       12
       +
       // Implements social.coves.feed.vote.* lexicon endpoints

     

       13
       13
       +
       func RegisterVoteRoutes(r chi.Router, voteService votes.Service, authMiddleware *middleware.OAuthAuthMiddleware) {

     

       14
       14
       +
       	// Initialize handlers

     

       15
       15
       +
       	createHandler := vote.NewCreateVoteHandler(voteService)

     

       16
       16
       +
       	deleteHandler := vote.NewDeleteVoteHandler(voteService)

     

       17
       17
       +
       

     

       18
       18
       +
       	// Procedure endpoints (POST) - require authentication

     

       19
       19
       +
       	// social.coves.feed.vote.create - create or update a vote on a post/comment

     

       20
       20
       +
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.feed.vote.create", createHandler.HandleCreateVote)

     

       21
       21
       +
       

     

       22
       22
       +
       	// social.coves.feed.vote.delete - delete a vote from a post/comment

     

       23
       23
       +
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.feed.vote.delete", deleteHandler.HandleDeleteVote)

     

       24
       24
       +
       }

+16

tests/integration/helpers.go

···

       322
       322
        
       

     

       323
       323
        
       // AddSession adds a session to the store

     

       324
       324
        
       func (m *MockOAuthStore) AddSession(did, sessionID, accessToken string) {

     

       325
       325
       +
       	m.AddSessionWithPDS(did, sessionID, accessToken, getTestPDSURL())

     

       326
       326
       +
       }

     

       327
       327
       +
       

     

       328
       328
       +
       // AddSessionWithPDS adds a session to the store with a specific PDS URL

     

       329
       329
       +
       func (m *MockOAuthStore) AddSessionWithPDS(did, sessionID, accessToken, pdsURL string) {

     

       325
       330
        
       	key := did + ":" + sessionID

     

       326
       331
        
       	parsedDID, _ := syntax.ParseDID(did)

     

       327
       332
        
       	m.sessions[key] = &oauthlib.ClientSessionData{

     

       328
       333
        
       		AccountDID:  parsedDID,

     

       329
       334
        
       		SessionID:   sessionID,

     

       330
       335
        
       		AccessToken: accessToken,

     

       336
       336
       +
       		HostURL:     pdsURL,

     

       331
       337
        
       	}

     

       332
       338
        
       }

     

       333
       339
        
       

     
···

       409
       415
        
       	e.store.AddSession(did, sessionID, "access-token-"+did)

     

       410
       416
        
       	return token

     

       411
       417
        
       }

     

       418
       418
       +
       

     

       419
       419
       +
       // AddUserWithPDSToken registers a user with their real PDS access token

     

       420
       420
       +
       // Use this for E2E tests that need to write to the real PDS

     

       421
       421
       +
       func (e *E2EOAuthMiddleware) AddUserWithPDSToken(did, pdsAccessToken, pdsURL string) string {

     

       422
       422
       +
       	token := "test-token-" + did

     

       423
       423
       +
       	sessionID := "session-" + did

     

       424
       424
       +
       	e.unsealer.AddSession(token, did, sessionID)

     

       425
       425
       +
       	e.store.AddSessionWithPDS(did, sessionID, pdsAccessToken, pdsURL)

     

       426
       426
       +
       	return token

     

       427
       427
       +
       }

+3

.beads/beads.left.jsonl

···

       1
       1
       +
       {"id":"Coves-95q","content_hash":"8ec99d598f067780436b985f9ad57f0fa19632026981038df4f65f192186620b","title":"Add comprehensive API documentation","description":"","status":"open","priority":2,"issue_type":"task","created_at":"2025-11-17T20:30:34.835721854-08:00","updated_at":"2025-11-17T20:30:34.835721854-08:00","source_repo":".","dependencies":[{"issue_id":"Coves-95q","depends_on_id":"Coves-e16","type":"blocks","created_at":"2025-11-17T20:30:46.273899399-08:00","created_by":"daemon"}]}

     

       2
       2
       +
       {"id":"Coves-e16","content_hash":"7c5d0fc8f0e7f626be3dad62af0e8412467330bad01a244e5a7e52ac5afff1c1","title":"Complete post creation and moderation features","description":"","status":"open","priority":1,"issue_type":"feature","created_at":"2025-11-17T20:30:12.885991306-08:00","updated_at":"2025-11-17T20:30:12.885991306-08:00","source_repo":"."}

     

       3
       3
       +
       {"id":"Coves-fce","content_hash":"26b3e16b99f827316ee0d741cc959464bd0c813446c95aef8105c7fd1e6b09ff","title":"Implement aggregator feed federation","description":"","status":"open","priority":1,"issue_type":"feature","created_at":"2025-11-17T20:30:21.453326012-08:00","updated_at":"2025-11-17T20:30:21.453326012-08:00","source_repo":"."}

+1

.beads/beads.left.meta.json

···

       1
       1
       +
       {"version":"0.23.1","timestamp":"2025-12-02T18:25:24.009187871-08:00","commit":"00d7d8d"}

-3

internal/api/handlers/vote/errors.go

···

       34
       34
        
       	case errors.Is(err, votes.ErrVoteNotFound):

     

       35
       35
        
       		// Matches: social.coves.feed.vote.delete#VoteNotFound

     

       36
       36
        
       		writeError(w, http.StatusNotFound, "VoteNotFound", "No vote found for this subject")

     

       37
       37
       -
       	case errors.Is(err, votes.ErrSubjectNotFound):

     

       38
       38
       -
       		// Matches: social.coves.feed.vote.create#SubjectNotFound

     

       39
       39
       -
       		writeError(w, http.StatusNotFound, "SubjectNotFound", "The subject post or comment was not found")

     

       40
       37
        
       	case errors.Is(err, votes.ErrInvalidDirection):

     

       41
       38
        
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Vote direction must be 'up' or 'down'")

     

       42
       39
        
       	case errors.Is(err, votes.ErrInvalidSubject):

+4 -4

internal/atproto/oauth/handlers_security.go

···

       25
       25
        
       // - Android: Verified via /.well-known/assetlinks.json

     

       26
       26
        
       var allowedMobileRedirectURIs = map[string]bool{

     

       27
       27
        
       	// Custom scheme per atproto spec (reverse-domain of coves.social)

     

       28
       28
       -
       	"social.coves:/callback":                  true,

     

       29
       29
       -
       	"social.coves://callback":                 true, // Some platforms add double slash

     

       30
       30
       -
       	"social.coves:/oauth/callback":            true, // Alternative path

     

       31
       31
       -
       	"social.coves://oauth/callback":           true,

     

       28
       28
       +
       	"social.coves:/callback":        true,

     

       29
       29
       +
       	"social.coves://callback":       true, // Some platforms add double slash

     

       30
       30
       +
       	"social.coves:/oauth/callback":  true, // Alternative path

     

       31
       31
       +
       	"social.coves://oauth/callback": true,

     

       32
       32
        
       	// Universal Links - cryptographically bound to app (preferred for security)

     

       33
       33
        
       	"https://coves.social/app/oauth/callback": true,

     

       34
       34
        
       }

+14 -27

internal/core/votes/service_impl.go

···

       19
       19
        
       

     

       20
       20
        
       // voteService implements the Service interface for vote operations

     

       21
       21
        
       type voteService struct {

     

       22
       22
       -
       	repo             Repository

     

       23
       23
       -
       	subjectValidator SubjectValidator

     

       24
       24
       -
       	oauthClient      *oauthclient.OAuthClient

     

       25
       25
       -
       	oauthStore       oauth.ClientAuthStore

     

       26
       26
       -
       	logger           *slog.Logger

     

       22
       22
       +
       	repo        Repository

     

       23
       23
       +
       	oauthClient *oauthclient.OAuthClient

     

       24
       24
       +
       	oauthStore  oauth.ClientAuthStore

     

       25
       25
       +
       	logger      *slog.Logger

     

       27
       26
        
       }

     

       28
       27
        
       

     

       29
       28
        
       // NewService creates a new vote service instance

     

       30
       30
       -
       // subjectValidator can be nil to skip subject existence checks (not recommended for production)

     

       31
       31
       -
       func NewService(repo Repository, subjectValidator SubjectValidator, oauthClient *oauthclient.OAuthClient, oauthStore oauth.ClientAuthStore, logger *slog.Logger) Service {

     

       29
       29
       +
       func NewService(repo Repository, oauthClient *oauthclient.OAuthClient, oauthStore oauth.ClientAuthStore, logger *slog.Logger) Service {

     

       32
       30
        
       	if logger == nil {

     

       33
       31
        
       		logger = slog.Default()

     

       34
       32
        
       	}

     

       35
       33
        
       	return &voteService{

     

       36
       36
       -
       		repo:             repo,

     

       37
       37
       -
       		subjectValidator: subjectValidator,

     

       38
       38
       -
       		oauthClient:      oauthClient,

     

       39
       39
       -
       		oauthStore:       oauthStore,

     

       40
       40
       -
       		logger:           logger,

     

       34
       34
       +
       		repo:        repo,

     

       35
       35
       +
       		oauthClient: oauthClient,

     

       36
       36
       +
       		oauthStore:  oauthStore,

     

       37
       37
       +
       		logger:      logger,

     

       41
       38
        
       	}

     

       42
       39
        
       }

     

       43
       40
        
       

     
···

       65
       62
        
       		return nil, ErrInvalidSubject

     

       66
       63
        
       	}

     

       67
       64
        
       

     

       68
       68
       -
       	// Validate subject exists in AppView (post or comment)

     

       69
       69
       -
       	// This prevents creating votes on non-existent content

     

       70
       70
       -
       	if s.subjectValidator != nil {

     

       71
       71
       -
       		exists, err := s.subjectValidator.SubjectExists(ctx, req.Subject.URI)

     

       72
       72
       -
       		if err != nil {

     

       73
       73
       -
       			s.logger.Error("failed to validate subject existence",

     

       74
       74
       -
       				"error", err,

     

       75
       75
       -
       				"subject", req.Subject.URI)

     

       76
       76
       -
       			return nil, fmt.Errorf("failed to validate subject: %w", err)

     

       77
       77
       -
       		}

     

       78
       78
       -
       		if !exists {

     

       79
       79
       -
       			return nil, ErrSubjectNotFound

     

       80
       80
       -
       		}

     

       81
       81
       -
       	}

     

       65
       65
       +
       	// Note: We intentionally don't validate subject existence here.

     

       66
       66
       +
       	// The vote record goes to the user's PDS regardless. The Jetstream consumer

     

       67
       67
       +
       	// handles orphaned votes correctly by only updating counts for non-deleted subjects.

     

       68
       68
       +
       	// This avoids race conditions and eventual consistency issues.

     

       82
       69
        
       

     

       83
       70
        
       	// Check for existing vote by querying PDS directly (source of truth)

     

       84
       71
        
       	// This avoids eventual consistency issues with the AppView database

     
···

       284
       271
        
       

     

       285
       272
        
       		// Parse the listRecords response

     

       286
       273
        
       		var result struct {

     

       274
       274
       +
       			Cursor  string `json:"cursor"`

     

       287
       275
        
       			Records []struct {

     

       288
       276
        
       				URI   string `json:"uri"`

     

       289
       277
        
       				CID   string `json:"cid"`

     
···

       297
       285
        
       					CreatedAt string `json:"createdAt"`

     

       298
       286
        
       				} `json:"value"`

     

       299
       287
        
       			} `json:"records"`

     

       300
       300
       -
       			Cursor string `json:"cursor"`

     

       301
       288
        
       		}

     

       302
       289
        
       

     

       303
       290
        
       		if err := json.Unmarshal(body, &result); err != nil {

+3 -2

internal/db/postgres/vote_repo.go

···

       64
       64
        
       	return nil

     

       65
       65
        
       }

     

       66
       66
        
       

     

       67
       67
       -
       // GetByURI retrieves a vote by its AT-URI

     

       67
       67
       +
       // GetByURI retrieves an active vote by its AT-URI

     

       68
       68
        
       // Used by Jetstream consumer for DELETE operations

     

       69
       69
       +
       // Returns ErrVoteNotFound for soft-deleted votes

     

       69
       70
        
       func (r *postgresVoteRepo) GetByURI(ctx context.Context, uri string) (*votes.Vote, error) {

     

       70
       71
        
       	query := `

     

       71
       72
        
       		SELECT

     
···

       73
       74
        
       			subject_uri, subject_cid, direction,

     

       74
       75
        
       			created_at, indexed_at, deleted_at

     

       75
       76
        
       		FROM votes

     

       76
       76
       -
       		WHERE uri = $1

     

       77
       77
       +
       		WHERE uri = $1 AND deleted_at IS NULL

     

       77
       78
        
       	`

     

       78
       79
        
       

     

       79
       80
        
       	var vote votes.Vote

Compare changes