comparing f48ccb0f9f47eea86703931033917f7825f5b314 and feat/dpop-token-binding on bretton.dev/coves

+20 -3

Makefile

···

       191
       191
        
       	@go build -o server ./cmd/server

     

       192
       192
        
       	@echo "$(GREEN)✓ Build complete: ./server$(RESET)"

     

       193
       193
        
       

     

       194
       194
       -
       run: ## Run the Coves server (requires database running)

     

       195
       195
       -
       	@echo "$(GREEN)Starting Coves server...$(RESET)"

     

       196
       196
       -
       	@go run ./cmd/server

     

       194
       194
       +
       run: ## Run the Coves server with dev environment (requires database running)

     

       195
       195
       +
       	@./scripts/dev-run.sh

     

       197
       196
        
       

     

       198
       197
        
       ##@ Cleanup

     

       199
       198
        
       

     
···

       226
       225
        
       	@make dev-down

     

       227
       226
        
       	@make dev-up

     

       228
       227
        
       

     

       228
       228
       +
       ##@ Mobile Testing

     

       229
       229
       +
       

     

       230
       230
       +
       mobile-setup: ## Setup Android port forwarding for USB-connected devices (recommended)

     

       231
       231
       +
       	@echo "$(CYAN)Setting up Android mobile testing environment...$(RESET)"

     

       232
       232
       +
       	@./scripts/setup-mobile-ports.sh

     

       233
       233
       +
       

     

       234
       234
       +
       mobile-reset: ## Remove all Android port forwarding

     

       235
       235
       +
       	@echo "$(YELLOW)Removing Android port forwarding...$(RESET)"

     

       236
       236
       +
       	@adb reverse --remove-all || echo "$(YELLOW)No device connected$(RESET)"

     

       237
       237
       +
       	@echo "$(GREEN)✓ Port forwarding removed$(RESET)"

     

       238
       238
       +
       

     

       239
       239
       +
       ngrok-up: ## Start ngrok tunnels (for iOS or WiFi testing - requires paid plan for 3 tunnels)

     

       240
       240
       +
       	@echo "$(GREEN)Starting ngrok tunnels for mobile testing...$(RESET)"

     

       241
       241
       +
       	@./scripts/start-ngrok.sh

     

       242
       242
       +
       

     

       243
       243
       +
       ngrok-down: ## Stop all ngrok tunnels

     

       244
       244
       +
       	@./scripts/stop-ngrok.sh

     

       245
       245
       +
       

     

       229
       246
        
       ##@ Utilities

     

       230
       247
        
       

     

       231
       248
        
       validate-lexicon: ## Validate all Lexicon schemas

+14

scripts/dev-run.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Development server runner - loads .env.dev before starting

     

       3
       3
       +
       

     

       4
       4
       +
       set -a  # automatically export all variables

     

       5
       5
       +
       source .env.dev

     

       6
       6
       +
       set +a

     

       7
       7
       +
       

     

       8
       8
       +
       echo "🚀 Starting Coves server in DEV mode..."

     

       9
       9
       +
       echo "   IS_DEV_ENV: $IS_DEV_ENV"

     

       10
       10
       +
       echo "   PLC_DIRECTORY_URL: $PLC_DIRECTORY_URL"

     

       11
       11
       +
       echo "   JETSTREAM_URL: $JETSTREAM_URL"

     

       12
       12
       +
       echo ""

     

       13
       13
       +
       

     

       14
       14
       +
       go run ./cmd/server

+68

scripts/setup-mobile-ports.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Setup adb reverse port forwarding for mobile testing

     

       3
       3
       +
       # This allows the mobile app to access localhost services on the dev machine

     

       4
       4
       +
       

     

       5
       5
       +
       set -e

     

       6
       6
       +
       

     

       7
       7
       +
       # Colors

     

       8
       8
       +
       GREEN='\033[0;32m'

     

       9
       9
       +
       CYAN='\033[0;36m'

     

       10
       10
       +
       YELLOW='\033[1;33m'

     

       11
       11
       +
       RED='\033[0;31m'

     

       12
       12
       +
       NC='\033[0m' # No Color

     

       13
       13
       +
       

     

       14
       14
       +
       echo -e "${CYAN}📱 Setting up Android port forwarding for Coves mobile testing...${NC}"

     

       15
       15
       +
       echo ""

     

       16
       16
       +
       

     

       17
       17
       +
       # Check if adb is available

     

       18
       18
       +
       if ! command -v adb &> /dev/null; then

     

       19
       19
       +
           echo -e "${RED}✗ adb not found${NC}"

     

       20
       20
       +
           echo "Install Android SDK Platform Tools: https://developer.android.com/studio/releases/platform-tools"

     

       21
       21
       +
           exit 1

     

       22
       22
       +
       fi

     

       23
       23
       +
       

     

       24
       24
       +
       # Check if device is connected

     

       25
       25
       +
       DEVICES=$(adb devices | grep -v "List" | grep "device$" | wc -l)

     

       26
       26
       +
       if [ "$DEVICES" -eq 0 ]; then

     

       27
       27
       +
           echo -e "${RED}✗ No Android devices connected${NC}"

     

       28
       28
       +
           echo "Connect a device via USB or start an emulator"

     

       29
       29
       +
           exit 1

     

       30
       30
       +
       fi

     

       31
       31
       +
       

     

       32
       32
       +
       echo -e "${YELLOW}Setting up port forwarding...${NC}"

     

       33
       33
       +
       

     

       34
       34
       +
       # Forward ports from Android device to localhost

     

       35
       35
       +
       adb reverse tcp:3000 tcp:3001  # PDS (internal port in DID document)

     

       36
       36
       +
       adb reverse tcp:3001 tcp:3001  # PDS (external port)

     

       37
       37
       +
       adb reverse tcp:3002 tcp:3002  # PLC Directory

     

       38
       38
       +
       adb reverse tcp:8081 tcp:8081  # AppView

     

       39
       39
       +
       

     

       40
       40
       +
       echo ""

     

       41
       41
       +
       echo -e "${GREEN}✅ Port forwarding configured successfully!${NC}"

     

       42
       42
       +
       echo ""

     

       43
       43
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       44
       44
       +
       echo -e "${CYAN}                   PORT FORWARDING                         ${NC}"

     

       45
       45
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       46
       46
       +
       echo ""

     

       47
       47
       +
       echo -e "${GREEN}PDS (3000):${NC}      localhost:3001 → device:3000 ${YELLOW}(DID document port)${NC}"

     

       48
       48
       +
       echo -e "${GREEN}PDS (3001):${NC}      localhost:3001 → device:3001"

     

       49
       49
       +
       echo -e "${GREEN}PLC (3002):${NC}      localhost:3002 → device:3002"

     

       50
       50
       +
       echo -e "${GREEN}AppView (8081):${NC}  localhost:8081 → device:8081"

     

       51
       51
       +
       echo ""

     

       52
       52
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       53
       53
       +
       echo ""

     

       54
       54
       +
       echo -e "${CYAN}📱 Next Steps:${NC}"

     

       55
       55
       +
       echo ""

     

       56
       56
       +
       echo -e "1. Mobile app is already configured for localhost (environment_config.dart)"

     

       57
       57
       +
       echo ""

     

       58
       58
       +
       echo -e "2. Run mobile app:"

     

       59
       59
       +
       echo -e "   ${YELLOW}cd /home/bretton/Code/coves-mobile${NC}"

     

       60
       60
       +
       echo -e "   ${YELLOW}flutter run --dart-define=ENVIRONMENT=local${NC}"

     

       61
       61
       +
       echo ""

     

       62
       62
       +
       echo -e "3. Login with:"

     

       63
       63
       +
       echo -e "   Handle:   ${CYAN}charlie.local.coves.dev${NC}"

     

       64
       64
       +
       echo -e "   Password: ${CYAN}charliepass123${NC}"

     

       65
       65
       +
       echo ""

     

       66
       66
       +
       echo -e "${YELLOW}💡 Note: Port forwarding persists until device disconnects or you run:${NC}"

     

       67
       67
       +
       echo -e "${YELLOW}    adb reverse --remove-all${NC}"

     

       68
       68
       +
       echo ""

+116

scripts/start-ngrok.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Automated ngrok tunnel starter for mobile testing

     

       3
       3
       +
       # Starts 3 ngrok tunnels and captures their HTTPS URLs

     

       4
       4
       +
       

     

       5
       5
       +
       set -e

     

       6
       6
       +
       

     

       7
       7
       +
       # Colors

     

       8
       8
       +
       GREEN='\033[0;32m'

     

       9
       9
       +
       CYAN='\033[0;36m'

     

       10
       10
       +
       YELLOW='\033[1;33m'

     

       11
       11
       +
       NC='\033[0m' # No Color

     

       12
       12
       +
       

     

       13
       13
       +
       echo -e "${CYAN}🚀 Starting ngrok tunnels for Coves mobile testing...${NC}"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Kill any existing ngrok processes

     

       17
       17
       +
       pkill -f "ngrok http" || true

     

       18
       18
       +
       sleep 2

     

       19
       19
       +
       

     

       20
       20
       +
       # Start ngrok tunnels using separate processes (simpler, works with any config version)

     

       21
       21
       +
       echo -e "${YELLOW}Starting PDS tunnel (port 3001)...${NC}"

     

       22
       22
       +
       ngrok http 3001 --log=stdout > /tmp/ngrok-pds.log 2>&1 &

     

       23
       23
       +
       sleep 1

     

       24
       24
       +
       

     

       25
       25
       +
       echo -e "${YELLOW}Starting PLC tunnel (port 3002)...${NC}"

     

       26
       26
       +
       ngrok http 3002 --log=stdout > /tmp/ngrok-plc.log 2>&1 &

     

       27
       27
       +
       sleep 1

     

       28
       28
       +
       

     

       29
       29
       +
       echo -e "${YELLOW}Starting AppView tunnel (port 8081)...${NC}"

     

       30
       30
       +
       ngrok http 8081 --log=stdout > /tmp/ngrok-appview.log 2>&1 &

     

       31
       31
       +
       

     

       32
       32
       +
       # Get all PIDs

     

       33
       33
       +
       PIDS=$(pgrep -f "ngrok http")

     

       34
       34
       +
       NGROK_PID=$PIDS

     

       35
       35
       +
       

     

       36
       36
       +
       # Save PID for cleanup

     

       37
       37
       +
       echo "$NGROK_PID" > /tmp/ngrok-pids.txt

     

       38
       38
       +
       

     

       39
       39
       +
       # Wait for ngrok to initialize

     

       40
       40
       +
       echo ""

     

       41
       41
       +
       echo -e "${YELLOW}Waiting for tunnels to initialize...${NC}"

     

       42
       42
       +
       sleep 7

     

       43
       43
       +
       

     

       44
       44
       +
       # Fetch URLs from ngrok API (single API at port 4040)

     

       45
       45
       +
       echo ""

     

       46
       46
       +
       echo -e "${GREEN}✅ Tunnels started successfully!${NC}"

     

       47
       47
       +
       echo ""

     

       48
       48
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       49
       49
       +
       echo -e "${CYAN}                   NGROK TUNNEL URLS                       ${NC}"

     

       50
       50
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       51
       51
       +
       echo ""

     

       52
       52
       +
       

     

       53
       53
       +
       # Get all tunnel info

     

       54
       54
       +
       TUNNELS=$(curl -s http://localhost:4040/api/tunnels 2>/dev/null || echo "")

     

       55
       55
       +
       

     

       56
       56
       +
       # Extract URLs by matching port in config.addr

     

       57
       57
       +
       PDS_URL=$(echo "$TUNNELS" | jq -r '.tunnels[] | select(.config.addr | contains("3001")) | select(.proto=="https") | .public_url' 2>/dev/null | head -1)

     

       58
       58
       +
       PLC_URL=$(echo "$TUNNELS" | jq -r '.tunnels[] | select(.config.addr | contains("3002")) | select(.proto=="https") | .public_url' 2>/dev/null | head -1)

     

       59
       59
       +
       APPVIEW_URL=$(echo "$TUNNELS" | jq -r '.tunnels[] | select(.config.addr | contains("8081")) | select(.proto=="https") | .public_url' 2>/dev/null | head -1)

     

       60
       60
       +
       

     

       61
       61
       +
       # Fallback if jq filtering fails - just get first 3 HTTPS URLs

     

       62
       62
       +
       if [ -z "$PDS_URL" ] || [ -z "$PLC_URL" ] || [ -z "$APPVIEW_URL" ]; then

     

       63
       63
       +
           echo -e "${YELLOW}⚠️  Port-based matching failed, using fallback...${NC}"

     

       64
       64
       +
           URLS=($(echo "$TUNNELS" | jq -r '.tunnels[] | select(.proto=="https") | .public_url' 2>/dev/null))

     

       65
       65
       +
           PDS_URL=${URLS[0]:-ERROR}

     

       66
       66
       +
           PLC_URL=${URLS[1]:-ERROR}

     

       67
       67
       +
           APPVIEW_URL=${URLS[2]:-ERROR}

     

       68
       68
       +
       fi

     

       69
       69
       +
       

     

       70
       70
       +
       echo -e "${GREEN}PDS (3001):${NC}      $PDS_URL"

     

       71
       71
       +
       echo -e "${GREEN}PLC (3002):${NC}      $PLC_URL"

     

       72
       72
       +
       echo -e "${GREEN}AppView (8081):${NC}  $APPVIEW_URL"

     

       73
       73
       +
       

     

       74
       74
       +
       echo ""

     

       75
       75
       +
       echo -e "${CYAN}═══════════════════════════════════════════════════════════${NC}"

     

       76
       76
       +
       echo ""

     

       77
       77
       +
       

     

       78
       78
       +
       # Check if any URLs failed

     

       79
       79
       +
       if [[ "$PDS_URL" == "ERROR" ]] || [[ "$PLC_URL" == "ERROR" ]] || [[ "$APPVIEW_URL" == "ERROR" ]]; then

     

       80
       80
       +
           echo -e "${YELLOW}⚠️  Some tunnels failed to start. Check logs:${NC}"

     

       81
       81
       +
           echo "  tail -f /tmp/ngrok-pds.log"

     

       82
       82
       +
           echo "  tail -f /tmp/ngrok-plc.log"

     

       83
       83
       +
           echo "  tail -f /tmp/ngrok-appview.log"

     

       84
       84
       +
           exit 1

     

       85
       85
       +
       fi

     

       86
       86
       +
       

     

       87
       87
       +
       # Extract clean URLs (remove https://)

     

       88
       88
       +
       PDS_CLEAN=$(echo $PDS_URL | sed 's|https://||')

     

       89
       89
       +
       PLC_CLEAN=$(echo $PLC_URL | sed 's|https://||')

     

       90
       90
       +
       APPVIEW_CLEAN=$(echo $APPVIEW_URL | sed 's|https://||')

     

       91
       91
       +
       

     

       92
       92
       +
       echo -e "${CYAN}📱 Next Steps:${NC}"

     

       93
       93
       +
       echo ""

     

       94
       94
       +
       echo -e "1. Update ${YELLOW}coves-mobile/lib/config/environment_config.dart${NC}:"

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       echo -e "${GREEN}static const local = EnvironmentConfig(${NC}"

     

       97
       97
       +
       echo -e "${GREEN}  environment: Environment.local,${NC}"

     

       98
       98
       +
       echo -e "${GREEN}  apiUrl: '$APPVIEW_URL',${NC}"

     

       99
       99
       +
       echo -e "${GREEN}  handleResolverUrl: '$PDS_URL/xrpc/com.atproto.identity.resolveHandle',${NC}"

     

       100
       100
       +
       echo -e "${GREEN}  plcDirectoryUrl: '$PLC_URL',${NC}"

     

       101
       101
       +
       echo -e "${GREEN});${NC}"

     

       102
       102
       +
       echo ""

     

       103
       103
       +
       echo -e "2. Run mobile app:"

     

       104
       104
       +
       echo -e "   ${YELLOW}cd /home/bretton/Code/coves-mobile${NC}"

     

       105
       105
       +
       echo -e "   ${YELLOW}flutter run --dart-define=ENVIRONMENT=local${NC}"

     

       106
       106
       +
       echo ""

     

       107
       107
       +
       echo -e "3. Login with:"

     

       108
       108
       +
       echo -e "   Handle:   ${CYAN}bob.local.coves.dev${NC}"

     

       109
       109
       +
       echo -e "   Password: ${CYAN}bobpass123${NC}"

     

       110
       110
       +
       echo ""

     

       111
       111
       +
       echo -e "${YELLOW}💡 Tip: Leave this terminal open. Press Ctrl+C to stop tunnels.${NC}"

     

       112
       112
       +
       echo -e "${YELLOW}    Or run: make ngrok-down${NC}"

     

       113
       113
       +
       echo ""

     

       114
       114
       +
       

     

       115
       115
       +
       # Keep script running (can be killed with Ctrl+C or make ngrok-down)

     

       116
       116
       +
       wait

+26

scripts/stop-ngrok.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Stop all ngrok tunnels

     

       3
       3
       +
       

     

       4
       4
       +
       # Colors

     

       5
       5
       +
       GREEN='\033[0;32m'

     

       6
       6
       +
       YELLOW='\033[1;33m'

     

       7
       7
       +
       NC='\033[0m'

     

       8
       8
       +
       

     

       9
       9
       +
       echo -e "${YELLOW}Stopping ngrok tunnels...${NC}"

     

       10
       10
       +
       

     

       11
       11
       +
       # Kill processes by PID if available

     

       12
       12
       +
       if [ -f /tmp/ngrok-pids.txt ]; then

     

       13
       13
       +
           PIDS=$(cat /tmp/ngrok-pids.txt)

     

       14
       14
       +
           for pid in $PIDS; do

     

       15
       15
       +
               kill $pid 2>/dev/null || true

     

       16
       16
       +
           done

     

       17
       17
       +
           rm /tmp/ngrok-pids.txt

     

       18
       18
       +
       fi

     

       19
       19
       +
       

     

       20
       20
       +
       # Fallback: kill all ngrok processes

     

       21
       21
       +
       pkill -f "ngrok http" || true

     

       22
       22
       +
       

     

       23
       23
       +
       # Clean up logs

     

       24
       24
       +
       rm -f /tmp/ngrok-*.log

     

       25
       25
       +
       

     

       26
       26
       +
       echo -e "${GREEN}✓ ngrok tunnels stopped${NC}"

-399

internal/core/votes/service.go

···

       1
       1
       -
       package votes

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/core/posts"

     

       5
       5
       -
       	"bytes"

     

       6
       6
       -
       	"context"

     

       7
       7
       -
       	"encoding/json"

     

       8
       8
       -
       	"fmt"

     

       9
       9
       -
       	"io"

     

       10
       10
       -
       	"log"

     

       11
       11
       -
       	"net/http"

     

       12
       12
       -
       	"strings"

     

       13
       13
       -
       	"time"

     

       14
       14
       -
       )

     

       15
       15
       -
       

     

       16
       16
       -
       type voteService struct {

     

       17
       17
       -
       	repo     Repository

     

       18
       18
       -
       	postRepo posts.Repository

     

       19
       19
       -
       	pdsURL   string

     

       20
       20
       -
       }

     

       21
       21
       -
       

     

       22
       22
       -
       // NewVoteService creates a new vote service

     

       23
       23
       -
       func NewVoteService(

     

       24
       24
       -
       	repo Repository,

     

       25
       25
       -
       	postRepo posts.Repository,

     

       26
       26
       -
       	pdsURL string,

     

       27
       27
       -
       ) Service {

     

       28
       28
       -
       	return &voteService{

     

       29
       29
       -
       		repo:     repo,

     

       30
       30
       -
       		postRepo: postRepo,

     

       31
       31
       -
       		pdsURL:   pdsURL,

     

       32
       32
       -
       	}

     

       33
       33
       -
       }

     

       34
       34
       -
       

     

       35
       35
       -
       // CreateVote creates a new vote or toggles an existing vote

     

       36
       36
       -
       // Toggle logic:

     

       37
       37
       -
       //   - No vote -> Create vote

     

       38
       38
       -
       //   - Same direction -> Delete vote (toggle off)

     

       39
       39
       -
       //   - Different direction -> Delete old + Create new (toggle direction)

     

       40
       40
       -
       func (s *voteService) CreateVote(ctx context.Context, voterDID string, userAccessToken string, req CreateVoteRequest) (*CreateVoteResponse, error) {

     

       41
       41
       -
       	// 1. Validate input

     

       42
       42
       -
       	if voterDID == "" {

     

       43
       43
       -
       		return nil, NewValidationError("voterDid", "required")

     

       44
       44
       -
       	}

     

       45
       45
       -
       	if userAccessToken == "" {

     

       46
       46
       -
       		return nil, NewValidationError("userAccessToken", "required")

     

       47
       47
       -
       	}

     

       48
       48
       -
       	if req.Subject == "" {

     

       49
       49
       -
       		return nil, NewValidationError("subject", "required")

     

       50
       50
       -
       	}

     

       51
       51
       -
       	if req.Direction != "up" && req.Direction != "down" {

     

       52
       52
       -
       		return nil, ErrInvalidDirection

     

       53
       53
       -
       	}

     

       54
       54
       -
       

     

       55
       55
       -
       	// 2. Validate subject URI format (should be at://...)

     

       56
       56
       -
       	if !strings.HasPrefix(req.Subject, "at://") {

     

       57
       57
       -
       		return nil, ErrInvalidSubject

     

       58
       58
       -
       	}

     

       59
       59
       -
       

     

       60
       60
       -
       	// 3. Get subject post/comment to verify it exists and get its CID (for strong reference)

     

       61
       61
       -
       	// For now, we assume the subject is a post. In the future, we'll support comments too.

     

       62
       62
       -
       	post, err := s.postRepo.GetByURI(ctx, req.Subject)

     

       63
       63
       -
       	if err != nil {

     

       64
       64
       -
       		if err == posts.ErrNotFound {

     

       65
       65
       -
       			return nil, ErrSubjectNotFound

     

       66
       66
       -
       		}

     

       67
       67
       -
       		return nil, fmt.Errorf("failed to get subject post: %w", err)

     

       68
       68
       -
       	}

     

       69
       69
       -
       

     

       70
       70
       -
       	// 4. Check for existing vote on PDS (source of truth for toggle logic)

     

       71
       71
       -
       	// IMPORTANT: We query the user's PDS directly instead of AppView to avoid race conditions.

     

       72
       72
       -
       	// AppView is eventually consistent (updated via Jetstream), so querying it can cause

     

       73
       73
       -
       	// duplicate vote records if the user toggles before Jetstream catches up.

     

       74
       74
       -
       	existingVoteRecord, err := s.findVoteOnPDS(ctx, voterDID, userAccessToken, req.Subject)

     

       75
       75
       -
       	if err != nil {

     

       76
       76
       -
       		return nil, fmt.Errorf("failed to check existing vote on PDS: %w", err)

     

       77
       77
       -
       	}

     

       78
       78
       -
       

     

       79
       79
       -
       	// 5. Handle toggle logic

     

       80
       80
       -
       	var existingVoteURI *string

     

       81
       81
       -
       

     

       82
       82
       -
       	if existingVoteRecord != nil {

     

       83
       83
       -
       		// Vote exists on PDS - implement toggle logic

     

       84
       84
       -
       		if existingVoteRecord.Direction == req.Direction {

     

       85
       85
       -
       			// Same direction -> Delete vote (toggle off)

     

       86
       86
       -
       			log.Printf("[VOTE-CREATE] Toggle off: deleting existing %s vote on %s", req.Direction, req.Subject)

     

       87
       87
       -
       

     

       88
       88
       -
       			// Delete from user's PDS

     

       89
       89
       -
       			if err := s.deleteRecordOnPDSAs(ctx, voterDID, "social.coves.interaction.vote", existingVoteRecord.RKey, userAccessToken); err != nil {

     

       90
       90
       -
       				return nil, fmt.Errorf("failed to delete vote on PDS: %w", err)

     

       91
       91
       -
       			}

     

       92
       92
       -
       

     

       93
       93
       -
       			// Return empty response (vote was deleted, not created)

     

       94
       94
       -
       			return &CreateVoteResponse{

     

       95
       95
       -
       				URI: "",

     

       96
       96
       -
       				CID: "",

     

       97
       97
       -
       			}, nil

     

       98
       98
       -
       		}

     

       99
       99
       -
       

     

       100
       100
       -
       		// Different direction -> Delete old vote first, then create new one below

     

       101
       101
       -
       		log.Printf("[VOTE-CREATE] Toggle direction: %s -> %s on %s", existingVoteRecord.Direction, req.Direction, req.Subject)

     

       102
       102
       -
       

     

       103
       103
       -
       		if err := s.deleteRecordOnPDSAs(ctx, voterDID, "social.coves.interaction.vote", existingVoteRecord.RKey, userAccessToken); err != nil {

     

       104
       104
       -
       			return nil, fmt.Errorf("failed to delete old vote on PDS: %w", err)

     

       105
       105
       -
       		}

     

       106
       106
       -
       

     

       107
       107
       -
       		existingVoteURI = &existingVoteRecord.URI

     

       108
       108
       -
       	}

     

       109
       109
       -
       

     

       110
       110
       -
       	// 6. Build vote record with strong reference

     

       111
       111
       -
       	voteRecord := map[string]interface{}{

     

       112
       112
       -
       		"$type": "social.coves.interaction.vote",

     

       113
       113
       -
       		"subject": map[string]interface{}{

     

       114
       114
       -
       			"uri": req.Subject,

     

       115
       115
       -
       			"cid": post.CID,

     

       116
       116
       -
       		},

     

       117
       117
       -
       		"direction": req.Direction,

     

       118
       118
       -
       		"createdAt": time.Now().Format(time.RFC3339),

     

       119
       119
       -
       	}

     

       120
       120
       -
       

     

       121
       121
       -
       	// 7. Write to user's PDS repository

     

       122
       122
       -
       	recordURI, recordCID, err := s.createRecordOnPDSAs(ctx, voterDID, "social.coves.interaction.vote", "", voteRecord, userAccessToken)

     

       123
       123
       -
       	if err != nil {

     

       124
       124
       -
       		return nil, fmt.Errorf("failed to create vote on PDS: %w", err)

     

       125
       125
       -
       	}

     

       126
       126
       -
       

     

       127
       127
       -
       	log.Printf("[VOTE-CREATE] Created %s vote: %s (CID: %s)", req.Direction, recordURI, recordCID)

     

       128
       128
       -
       

     

       129
       129
       -
       	// 8. Return response

     

       130
       130
       -
       	return &CreateVoteResponse{

     

       131
       131
       -
       		URI:      recordURI,

     

       132
       132
       -
       		CID:      recordCID,

     

       133
       133
       -
       		Existing: existingVoteURI,

     

       134
       134
       -
       	}, nil

     

       135
       135
       -
       }

     

       136
       136
       -
       

     

       137
       137
       -
       // DeleteVote removes a vote from a post/comment

     

       138
       138
       -
       func (s *voteService) DeleteVote(ctx context.Context, voterDID string, userAccessToken string, req DeleteVoteRequest) error {

     

       139
       139
       -
       	// 1. Validate input

     

       140
       140
       -
       	if voterDID == "" {

     

       141
       141
       -
       		return NewValidationError("voterDid", "required")

     

       142
       142
       -
       	}

     

       143
       143
       -
       	if userAccessToken == "" {

     

       144
       144
       -
       		return NewValidationError("userAccessToken", "required")

     

       145
       145
       -
       	}

     

       146
       146
       -
       	if req.Subject == "" {

     

       147
       147
       -
       		return NewValidationError("subject", "required")

     

       148
       148
       -
       	}

     

       149
       149
       -
       

     

       150
       150
       -
       	// 2. Find existing vote on PDS (source of truth)

     

       151
       151
       -
       	// IMPORTANT: Query PDS directly to avoid race conditions with AppView indexing

     

       152
       152
       -
       	existingVoteRecord, err := s.findVoteOnPDS(ctx, voterDID, userAccessToken, req.Subject)

     

       153
       153
       -
       	if err != nil {

     

       154
       154
       -
       		return fmt.Errorf("failed to check existing vote on PDS: %w", err)

     

       155
       155
       -
       	}

     

       156
       156
       -
       

     

       157
       157
       -
       	if existingVoteRecord == nil {

     

       158
       158
       -
       		return ErrVoteNotFound

     

       159
       159
       -
       	}

     

       160
       160
       -
       

     

       161
       161
       -
       	// 3. Delete from user's PDS

     

       162
       162
       -
       	if err := s.deleteRecordOnPDSAs(ctx, voterDID, "social.coves.interaction.vote", existingVoteRecord.RKey, userAccessToken); err != nil {

     

       163
       163
       -
       		return fmt.Errorf("failed to delete vote on PDS: %w", err)

     

       164
       164
       -
       	}

     

       165
       165
       -
       

     

       166
       166
       -
       	log.Printf("[VOTE-DELETE] Deleted vote: %s", existingVoteRecord.URI)

     

       167
       167
       -
       

     

       168
       168
       -
       	return nil

     

       169
       169
       -
       }

     

       170
       170
       -
       

     

       171
       171
       -
       // GetVote retrieves a user's vote on a specific subject

     

       172
       172
       -
       func (s *voteService) GetVote(ctx context.Context, voterDID string, subjectURI string) (*Vote, error) {

     

       173
       173
       -
       	return s.repo.GetByVoterAndSubject(ctx, voterDID, subjectURI)

     

       174
       174
       -
       }

     

       175
       175
       -
       

     

       176
       176
       -
       // Helper methods for PDS operations

     

       177
       177
       -
       

     

       178
       178
       -
       // createRecordOnPDSAs creates a record on the PDS using the user's access token

     

       179
       179
       -
       func (s *voteService) createRecordOnPDSAs(ctx context.Context, repoDID, collection, rkey string, record map[string]interface{}, accessToken string) (string, string, error) {

     

       180
       180
       -
       	endpoint := fmt.Sprintf("%s/xrpc/com.atproto.repo.createRecord", strings.TrimSuffix(s.pdsURL, "/"))

     

       181
       181
       -
       

     

       182
       182
       -
       	payload := map[string]interface{}{

     

       183
       183
       -
       		"repo":       repoDID,

     

       184
       184
       -
       		"collection": collection,

     

       185
       185
       -
       		"record":     record,

     

       186
       186
       -
       	}

     

       187
       187
       -
       

     

       188
       188
       -
       	if rkey != "" {

     

       189
       189
       -
       		payload["rkey"] = rkey

     

       190
       190
       -
       	}

     

       191
       191
       -
       

     

       192
       192
       -
       	return s.callPDSWithAuth(ctx, "POST", endpoint, payload, accessToken)

     

       193
       193
       -
       }

     

       194
       194
       -
       

     

       195
       195
       -
       // deleteRecordOnPDSAs deletes a record from the PDS using the user's access token

     

       196
       196
       -
       func (s *voteService) deleteRecordOnPDSAs(ctx context.Context, repoDID, collection, rkey, accessToken string) error {

     

       197
       197
       -
       	endpoint := fmt.Sprintf("%s/xrpc/com.atproto.repo.deleteRecord", strings.TrimSuffix(s.pdsURL, "/"))

     

       198
       198
       -
       

     

       199
       199
       -
       	payload := map[string]interface{}{

     

       200
       200
       -
       		"repo":       repoDID,

     

       201
       201
       -
       		"collection": collection,

     

       202
       202
       -
       		"rkey":       rkey,

     

       203
       203
       -
       	}

     

       204
       204
       -
       

     

       205
       205
       -
       	_, _, err := s.callPDSWithAuth(ctx, "POST", endpoint, payload, accessToken)

     

       206
       206
       -
       	return err

     

       207
       207
       -
       }

     

       208
       208
       -
       

     

       209
       209
       -
       // callPDSWithAuth makes a PDS call with a specific access token

     

       210
       210
       -
       func (s *voteService) callPDSWithAuth(ctx context.Context, method, endpoint string, payload map[string]interface{}, accessToken string) (string, string, error) {

     

       211
       211
       -
       	jsonData, err := json.Marshal(payload)

     

       212
       212
       -
       	if err != nil {

     

       213
       213
       -
       		return "", "", fmt.Errorf("failed to marshal payload: %w", err)

     

       214
       214
       -
       	}

     

       215
       215
       -
       

     

       216
       216
       -
       	req, err := http.NewRequestWithContext(ctx, method, endpoint, bytes.NewBuffer(jsonData))

     

       217
       217
       -
       	if err != nil {

     

       218
       218
       -
       		return "", "", fmt.Errorf("failed to create request: %w", err)

     

       219
       219
       -
       	}

     

       220
       220
       -
       	req.Header.Set("Content-Type", "application/json")

     

       221
       221
       -
       

     

       222
       222
       -
       	// Add authentication with provided access token

     

       223
       223
       -
       	if accessToken != "" {

     

       224
       224
       -
       		req.Header.Set("Authorization", "Bearer "+accessToken)

     

       225
       225
       -
       	}

     

       226
       226
       -
       

     

       227
       227
       -
       	// Use 30 second timeout for write operations

     

       228
       228
       -
       	timeout := 30 * time.Second

     

       229
       229
       -
       	client := &http.Client{Timeout: timeout}

     

       230
       230
       -
       	resp, err := client.Do(req)

     

       231
       231
       -
       	if err != nil {

     

       232
       232
       -
       		return "", "", fmt.Errorf("failed to call PDS: %w", err)

     

       233
       233
       -
       	}

     

       234
       234
       -
       	defer func() {

     

       235
       235
       -
       		if closeErr := resp.Body.Close(); closeErr != nil {

     

       236
       236
       -
       			log.Printf("Failed to close response body: %v", closeErr)

     

       237
       237
       -
       		}

     

       238
       238
       -
       	}()

     

       239
       239
       -
       

     

       240
       240
       -
       	body, err := io.ReadAll(resp.Body)

     

       241
       241
       -
       	if err != nil {

     

       242
       242
       -
       		return "", "", fmt.Errorf("failed to read response: %w", err)

     

       243
       243
       -
       	}

     

       244
       244
       -
       

     

       245
       245
       -
       	if resp.StatusCode < 200 || resp.StatusCode >= 300 {

     

       246
       246
       -
       		return "", "", fmt.Errorf("PDS returned error %d: %s", resp.StatusCode, string(body))

     

       247
       247
       -
       	}

     

       248
       248
       -
       

     

       249
       249
       -
       	// Parse response to extract URI and CID

     

       250
       250
       -
       	var result struct {

     

       251
       251
       -
       		URI string `json:"uri"`

     

       252
       252
       -
       		CID string `json:"cid"`

     

       253
       253
       -
       	}

     

       254
       254
       -
       	if err := json.Unmarshal(body, &result); err != nil {

     

       255
       255
       -
       		return "", "", fmt.Errorf("failed to parse PDS response: %w", err)

     

       256
       256
       -
       	}

     

       257
       257
       -
       

     

       258
       258
       -
       	return result.URI, result.CID, nil

     

       259
       259
       -
       }

     

       260
       260
       -
       

     

       261
       261
       -
       // Helper functions

     

       262
       262
       -
       

     

       263
       263
       -
       // PDSVoteRecord represents a vote record returned from PDS listRecords

     

       264
       264
       -
       type PDSVoteRecord struct {

     

       265
       265
       -
       	URI       string

     

       266
       266
       -
       	RKey      string

     

       267
       267
       -
       	Direction string

     

       268
       268
       -
       	Subject   struct {

     

       269
       269
       -
       		URI string

     

       270
       270
       -
       		CID string

     

       271
       271
       -
       	}

     

       272
       272
       -
       }

     

       273
       273
       -
       

     

       274
       274
       -
       // findVoteOnPDS queries the user's PDS to find an existing vote on a specific subject

     

       275
       275
       -
       // This is the source of truth for toggle logic (avoiding AppView race conditions)

     

       276
       276
       -
       //

     

       277
       277
       -
       // IMPORTANT: This function paginates through ALL user votes with reverse=true (newest first)

     

       278
       278
       -
       // to handle users with >100 votes. Without pagination, votes on older posts would not be found,

     

       279
       279
       -
       // causing duplicate vote records and 404 errors on delete operations.

     

       280
       280
       -
       func (s *voteService) findVoteOnPDS(ctx context.Context, voterDID, accessToken, subjectURI string) (*PDSVoteRecord, error) {

     

       281
       281
       -
       	const maxPages = 50 // Safety limit: prevent infinite loops (50 pages * 100 = 5000 votes max)

     

       282
       282
       -
       	var cursor string

     

       283
       283
       -
       	pageCount := 0

     

       284
       284
       -
       

     

       285
       285
       -
       	client := &http.Client{Timeout: 10 * time.Second}

     

       286
       286
       -
       

     

       287
       287
       -
       	for {

     

       288
       288
       -
       		pageCount++

     

       289
       289
       -
       		if pageCount > maxPages {

     

       290
       290
       -
       			log.Printf("[VOTE-PDS] Reached max pagination limit (%d pages) searching for vote on %s", maxPages, subjectURI)

     

       291
       291
       -
       			break

     

       292
       292
       -
       		}

     

       293
       293
       -
       

     

       294
       294
       -
       		// Build endpoint with pagination cursor and reverse=true (newest first)

     

       295
       295
       -
       		endpoint := fmt.Sprintf("%s/xrpc/com.atproto.repo.listRecords?repo=%s&collection=social.coves.interaction.vote&limit=100&reverse=true",

     

       296
       296
       -
       			strings.TrimSuffix(s.pdsURL, "/"), voterDID)

     

       297
       297
       -
       

     

       298
       298
       -
       		if cursor != "" {

     

       299
       299
       -
       			endpoint += fmt.Sprintf("&cursor=%s", cursor)

     

       300
       300
       -
       		}

     

       301
       301
       -
       

     

       302
       302
       -
       		req, err := http.NewRequestWithContext(ctx, "GET", endpoint, nil)

     

       303
       303
       -
       		if err != nil {

     

       304
       304
       -
       			return nil, fmt.Errorf("failed to create request: %w", err)

     

       305
       305
       -
       		}

     

       306
       306
       -
       

     

       307
       307
       -
       		req.Header.Set("Authorization", "Bearer "+accessToken)

     

       308
       308
       -
       

     

       309
       309
       -
       		resp, err := client.Do(req)

     

       310
       310
       -
       		if err != nil {

     

       311
       311
       -
       			return nil, fmt.Errorf("failed to query PDS: %w", err)

     

       312
       312
       -
       		}

     

       313
       313
       -
       

     

       314
       314
       -
       		if resp.StatusCode != http.StatusOK {

     

       315
       315
       -
       			body, _ := io.ReadAll(resp.Body)

     

       316
       316
       -
       			resp.Body.Close()

     

       317
       317
       -
       			return nil, fmt.Errorf("PDS returned error %d: %s", resp.StatusCode, string(body))

     

       318
       318
       -
       		}

     

       319
       319
       -
       

     

       320
       320
       -
       		var result struct {

     

       321
       321
       -
       			Records []struct {

     

       322
       322
       -
       				URI   string `json:"uri"`

     

       323
       323
       -
       				Value struct {

     

       324
       324
       -
       					Subject struct {

     

       325
       325
       -
       						URI string `json:"uri"`

     

       326
       326
       -
       						CID string `json:"cid"`

     

       327
       327
       -
       					} `json:"subject"`

     

       328
       328
       -
       					Direction string `json:"direction"`

     

       329
       329
       -
       				} `json:"value"`

     

       330
       330
       -
       			} `json:"records"`

     

       331
       331
       -
       			Cursor string `json:"cursor,omitempty"` // Pagination cursor for next page

     

       332
       332
       -
       		}

     

       333
       333
       -
       

     

       334
       334
       -
       		if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {

     

       335
       335
       -
       			resp.Body.Close()

     

       336
       336
       -
       			return nil, fmt.Errorf("failed to decode PDS response: %w", err)

     

       337
       337
       -
       		}

     

       338
       338
       -
       		resp.Body.Close()

     

       339
       339
       -
       

     

       340
       340
       -
       		// Find vote on this specific subject in current page

     

       341
       341
       -
       		for _, record := range result.Records {

     

       342
       342
       -
       			if record.Value.Subject.URI == subjectURI {

     

       343
       343
       -
       				rkey := extractRKeyFromURI(record.URI)

     

       344
       344
       -
       				log.Printf("[VOTE-PDS] Found existing vote on page %d: %s (direction: %s)", pageCount, record.URI, record.Value.Direction)

     

       345
       345
       -
       				return &PDSVoteRecord{

     

       346
       346
       -
       					URI:       record.URI,

     

       347
       347
       -
       					RKey:      rkey,

     

       348
       348
       -
       					Direction: record.Value.Direction,

     

       349
       349
       -
       					Subject: struct {

     

       350
       350
       -
       						URI string

     

       351
       351
       -
       						CID string

     

       352
       352
       -
       					}{

     

       353
       353
       -
       						URI: record.Value.Subject.URI,

     

       354
       354
       -
       						CID: record.Value.Subject.CID,

     

       355
       355
       -
       					},

     

       356
       356
       -
       				}, nil

     

       357
       357
       -
       			}

     

       358
       358
       -
       		}

     

       359
       359
       -
       

     

       360
       360
       -
       		// No more pages to check

     

       361
       361
       -
       		if result.Cursor == "" {

     

       362
       362
       -
       			log.Printf("[VOTE-PDS] No existing vote found after checking %d page(s)", pageCount)

     

       363
       363
       -
       			break

     

       364
       364
       -
       		}

     

       365
       365
       -
       

     

       366
       366
       -
       		// Move to next page

     

       367
       367
       -
       		cursor = result.Cursor

     

       368
       368
       -
       	}

     

       369
       369
       -
       

     

       370
       370
       -
       	// No vote found on this subject after paginating through all records

     

       371
       371
       -
       	return nil, nil

     

       372
       372
       -
       }

     

       373
       373
       -
       

     

       374
       374
       -
       // extractRKeyFromURI extracts the rkey from an AT-URI (at://did/collection/rkey)

     

       375
       375
       -
       func extractRKeyFromURI(uri string) string {

     

       376
       376
       -
       	parts := strings.Split(uri, "/")

     

       377
       377
       -
       	if len(parts) >= 4 {

     

       378
       378
       -
       		return parts[len(parts)-1]

     

       379
       379
       -
       	}

     

       380
       380
       -
       	return ""

     

       381
       381
       -
       }

     

       382
       382
       -
       

     

       383
       383
       -
       // ValidationError represents a validation error

     

       384
       384
       -
       type ValidationError struct {

     

       385
       385
       -
       	Field   string

     

       386
       386
       -
       	Message string

     

       387
       387
       -
       }

     

       388
       388
       -
       

     

       389
       389
       -
       func (e *ValidationError) Error() string {

     

       390
       390
       -
       	return fmt.Sprintf("validation error for field '%s': %s", e.Field, e.Message)

     

       391
       391
       -
       }

     

       392
       392
       -
       

     

       393
       393
       -
       // NewValidationError creates a new validation error

     

       394
       394
       -
       func NewValidationError(field, message string) error {

     

       395
       395
       -
       	return &ValidationError{

     

       396
       396
       -
       		Field:   field,

     

       397
       397
       -
       		Message: message,

     

       398
       398
       -
       	}

     

       399
       399
       -
       }

-344

internal/core/votes/service_test.go

···

       1
       1
       -
       package votes

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/core/posts"

     

       5
       5
       -
       	"context"

     

       6
       6
       -
       	"testing"

     

       7
       7
       -
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"github.com/stretchr/testify/assert"

     

       10
       10
       -
       	"github.com/stretchr/testify/mock"

     

       11
       11
       -
       	"github.com/stretchr/testify/require"

     

       12
       12
       -
       )

     

       13
       13
       -
       

     

       14
       14
       -
       // Mock repositories for testing

     

       15
       15
       -
       type mockVoteRepository struct {

     

       16
       16
       -
       	mock.Mock

     

       17
       17
       -
       }

     

       18
       18
       -
       

     

       19
       19
       -
       func (m *mockVoteRepository) Create(ctx context.Context, vote *Vote) error {

     

       20
       20
       -
       	args := m.Called(ctx, vote)

     

       21
       21
       -
       	return args.Error(0)

     

       22
       22
       -
       }

     

       23
       23
       -
       

     

       24
       24
       -
       func (m *mockVoteRepository) GetByURI(ctx context.Context, uri string) (*Vote, error) {

     

       25
       25
       -
       	args := m.Called(ctx, uri)

     

       26
       26
       -
       	if args.Get(0) == nil {

     

       27
       27
       -
       		return nil, args.Error(1)

     

       28
       28
       -
       	}

     

       29
       29
       -
       	return args.Get(0).(*Vote), args.Error(1)

     

       30
       30
       -
       }

     

       31
       31
       -
       

     

       32
       32
       -
       func (m *mockVoteRepository) GetByVoterAndSubject(ctx context.Context, voterDID string, subjectURI string) (*Vote, error) {

     

       33
       33
       -
       	args := m.Called(ctx, voterDID, subjectURI)

     

       34
       34
       -
       	if args.Get(0) == nil {

     

       35
       35
       -
       		return nil, args.Error(1)

     

       36
       36
       -
       	}

     

       37
       37
       -
       	return args.Get(0).(*Vote), args.Error(1)

     

       38
       38
       -
       }

     

       39
       39
       -
       

     

       40
       40
       -
       func (m *mockVoteRepository) Delete(ctx context.Context, uri string) error {

     

       41
       41
       -
       	args := m.Called(ctx, uri)

     

       42
       42
       -
       	return args.Error(0)

     

       43
       43
       -
       }

     

       44
       44
       -
       

     

       45
       45
       -
       func (m *mockVoteRepository) ListBySubject(ctx context.Context, subjectURI string, limit, offset int) ([]*Vote, error) {

     

       46
       46
       -
       	args := m.Called(ctx, subjectURI, limit, offset)

     

       47
       47
       -
       	if args.Get(0) == nil {

     

       48
       48
       -
       		return nil, args.Error(1)

     

       49
       49
       -
       	}

     

       50
       50
       -
       	return args.Get(0).([]*Vote), args.Error(1)

     

       51
       51
       -
       }

     

       52
       52
       -
       

     

       53
       53
       -
       func (m *mockVoteRepository) ListByVoter(ctx context.Context, voterDID string, limit, offset int) ([]*Vote, error) {

     

       54
       54
       -
       	args := m.Called(ctx, voterDID, limit, offset)

     

       55
       55
       -
       	if args.Get(0) == nil {

     

       56
       56
       -
       		return nil, args.Error(1)

     

       57
       57
       -
       	}

     

       58
       58
       -
       	return args.Get(0).([]*Vote), args.Error(1)

     

       59
       59
       -
       }

     

       60
       60
       -
       

     

       61
       61
       -
       type mockPostRepository struct {

     

       62
       62
       -
       	mock.Mock

     

       63
       63
       -
       }

     

       64
       64
       -
       

     

       65
       65
       -
       func (m *mockPostRepository) GetByURI(ctx context.Context, uri string) (*posts.Post, error) {

     

       66
       66
       -
       	args := m.Called(ctx, uri)

     

       67
       67
       -
       	if args.Get(0) == nil {

     

       68
       68
       -
       		return nil, args.Error(1)

     

       69
       69
       -
       	}

     

       70
       70
       -
       	return args.Get(0).(*posts.Post), args.Error(1)

     

       71
       71
       -
       }

     

       72
       72
       -
       

     

       73
       73
       -
       func (m *mockPostRepository) Create(ctx context.Context, post *posts.Post) error {

     

       74
       74
       -
       	args := m.Called(ctx, post)

     

       75
       75
       -
       	return args.Error(0)

     

       76
       76
       -
       }

     

       77
       77
       -
       

     

       78
       78
       -
       func (m *mockPostRepository) GetByRkey(ctx context.Context, communityDID, rkey string) (*posts.Post, error) {

     

       79
       79
       -
       	args := m.Called(ctx, communityDID, rkey)

     

       80
       80
       -
       	if args.Get(0) == nil {

     

       81
       81
       -
       		return nil, args.Error(1)

     

       82
       82
       -
       	}

     

       83
       83
       -
       	return args.Get(0).(*posts.Post), args.Error(1)

     

       84
       84
       -
       }

     

       85
       85
       -
       

     

       86
       86
       -
       func (m *mockPostRepository) ListByCommunity(ctx context.Context, communityDID string, limit, offset int) ([]*posts.Post, error) {

     

       87
       87
       -
       	args := m.Called(ctx, communityDID, limit, offset)

     

       88
       88
       -
       	if args.Get(0) == nil {

     

       89
       89
       -
       		return nil, args.Error(1)

     

       90
       90
       -
       	}

     

       91
       91
       -
       	return args.Get(0).([]*posts.Post), args.Error(1)

     

       92
       92
       -
       }

     

       93
       93
       -
       

     

       94
       94
       -
       func (m *mockPostRepository) Delete(ctx context.Context, uri string) error {

     

       95
       95
       -
       	args := m.Called(ctx, uri)

     

       96
       96
       -
       	return args.Error(0)

     

       97
       97
       -
       }

     

       98
       98
       -
       

     

       99
       99
       -
       // TestVoteService_CreateVote_NoExistingVote tests creating a vote when no vote exists

     

       100
       100
       -
       // NOTE: This test is skipped because we need to refactor service to inject HTTP client

     

       101
       101
       -
       // for testing PDS writes. The full flow is covered by E2E tests.

     

       102
       102
       -
       func TestVoteService_CreateVote_NoExistingVote(t *testing.T) {

     

       103
       103
       -
       	t.Skip("Skipping because we need to refactor service to inject HTTP client for testing PDS writes - covered by E2E tests")

     

       104
       104
       -
       

     

       105
       105
       -
       	// This test would verify:

     

       106
       106
       -
       	// - Post exists check

     

       107
       107
       -
       	// - No existing vote

     

       108
       108
       -
       	// - PDS write succeeds

     

       109
       109
       -
       	// - Response contains vote URI and CID

     

       110
       110
       -
       }

     

       111
       111
       -
       

     

       112
       112
       -
       // TestVoteService_ValidateInput tests input validation

     

       113
       113
       -
       func TestVoteService_ValidateInput(t *testing.T) {

     

       114
       114
       -
       	mockVoteRepo := new(mockVoteRepository)

     

       115
       115
       -
       	mockPostRepo := new(mockPostRepository)

     

       116
       116
       -
       

     

       117
       117
       -
       	service := &voteService{

     

       118
       118
       -
       		repo:     mockVoteRepo,

     

       119
       119
       -
       		postRepo: mockPostRepo,

     

       120
       120
       -
       		pdsURL:   "http://mock-pds.test",

     

       121
       121
       -
       	}

     

       122
       122
       -
       

     

       123
       123
       -
       	ctx := context.Background()

     

       124
       124
       -
       

     

       125
       125
       -
       	tests := []struct {

     

       126
       126
       -
       		name          string

     

       127
       127
       -
       		voterDID      string

     

       128
       128
       -
       		accessToken   string

     

       129
       129
       -
       		req           CreateVoteRequest

     

       130
       130
       -
       		expectedError string

     

       131
       131
       -
       	}{

     

       132
       132
       -
       		{

     

       133
       133
       -
       			name:          "missing voter DID",

     

       134
       134
       -
       			voterDID:      "",

     

       135
       135
       -
       			accessToken:   "token123",

     

       136
       136
       -
       			req:           CreateVoteRequest{Subject: "at://test", Direction: "up"},

     

       137
       137
       -
       			expectedError: "voterDid",

     

       138
       138
       -
       		},

     

       139
       139
       -
       		{

     

       140
       140
       -
       			name:          "missing access token",

     

       141
       141
       -
       			voterDID:      "did:plc:test",

     

       142
       142
       -
       			accessToken:   "",

     

       143
       143
       -
       			req:           CreateVoteRequest{Subject: "at://test", Direction: "up"},

     

       144
       144
       -
       			expectedError: "userAccessToken",

     

       145
       145
       -
       		},

     

       146
       146
       -
       		{

     

       147
       147
       -
       			name:          "missing subject",

     

       148
       148
       -
       			voterDID:      "did:plc:test",

     

       149
       149
       -
       			accessToken:   "token123",

     

       150
       150
       -
       			req:           CreateVoteRequest{Subject: "", Direction: "up"},

     

       151
       151
       -
       			expectedError: "subject",

     

       152
       152
       -
       		},

     

       153
       153
       -
       		{

     

       154
       154
       -
       			name:          "invalid direction",

     

       155
       155
       -
       			voterDID:      "did:plc:test",

     

       156
       156
       -
       			accessToken:   "token123",

     

       157
       157
       -
       			req:           CreateVoteRequest{Subject: "at://test", Direction: "invalid"},

     

       158
       158
       -
       			expectedError: "invalid vote direction",

     

       159
       159
       -
       		},

     

       160
       160
       -
       		{

     

       161
       161
       -
       			name:          "invalid subject format",

     

       162
       162
       -
       			voterDID:      "did:plc:test",

     

       163
       163
       -
       			accessToken:   "token123",

     

       164
       164
       -
       			req:           CreateVoteRequest{Subject: "http://not-at-uri", Direction: "up"},

     

       165
       165
       -
       			expectedError: "invalid subject URI",

     

       166
       166
       -
       		},

     

       167
       167
       -
       	}

     

       168
       168
       -
       

     

       169
       169
       -
       	for _, tt := range tests {

     

       170
       170
       -
       		t.Run(tt.name, func(t *testing.T) {

     

       171
       171
       -
       			_, err := service.CreateVote(ctx, tt.voterDID, tt.accessToken, tt.req)

     

       172
       172
       -
       			require.Error(t, err)

     

       173
       173
       -
       			assert.Contains(t, err.Error(), tt.expectedError)

     

       174
       174
       -
       		})

     

       175
       175
       -
       	}

     

       176
       176
       -
       }

     

       177
       177
       -
       

     

       178
       178
       -
       // TestVoteService_GetVote tests retrieving a vote

     

       179
       179
       -
       func TestVoteService_GetVote(t *testing.T) {

     

       180
       180
       -
       	mockVoteRepo := new(mockVoteRepository)

     

       181
       181
       -
       	mockPostRepo := new(mockPostRepository)

     

       182
       182
       -
       

     

       183
       183
       -
       	service := &voteService{

     

       184
       184
       -
       		repo:     mockVoteRepo,

     

       185
       185
       -
       		postRepo: mockPostRepo,

     

       186
       186
       -
       		pdsURL:   "http://mock-pds.test",

     

       187
       187
       -
       	}

     

       188
       188
       -
       

     

       189
       189
       -
       	ctx := context.Background()

     

       190
       190
       -
       	voterDID := "did:plc:voter123"

     

       191
       191
       -
       	subjectURI := "at://did:plc:community/social.coves.post.record/abc123"

     

       192
       192
       -
       

     

       193
       193
       -
       	expectedVote := &Vote{

     

       194
       194
       -
       		ID:         1,

     

       195
       195
       -
       		URI:        "at://did:plc:voter123/social.coves.interaction.vote/xyz789",

     

       196
       196
       -
       		VoterDID:   voterDID,

     

       197
       197
       -
       		SubjectURI: subjectURI,

     

       198
       198
       -
       		Direction:  "up",

     

       199
       199
       -
       		CreatedAt:  time.Now(),

     

       200
       200
       -
       	}

     

       201
       201
       -
       

     

       202
       202
       -
       	mockVoteRepo.On("GetByVoterAndSubject", ctx, voterDID, subjectURI).Return(expectedVote, nil)

     

       203
       203
       -
       

     

       204
       204
       -
       	result, err := service.GetVote(ctx, voterDID, subjectURI)

     

       205
       205
       -
       	assert.NoError(t, err)

     

       206
       206
       -
       	assert.Equal(t, expectedVote.URI, result.URI)

     

       207
       207
       -
       	assert.Equal(t, expectedVote.Direction, result.Direction)

     

       208
       208
       -
       

     

       209
       209
       -
       	mockVoteRepo.AssertExpectations(t)

     

       210
       210
       -
       }

     

       211
       211
       -
       

     

       212
       212
       -
       // TestVoteService_GetVote_NotFound tests getting a non-existent vote

     

       213
       213
       -
       func TestVoteService_GetVote_NotFound(t *testing.T) {

     

       214
       214
       -
       	mockVoteRepo := new(mockVoteRepository)

     

       215
       215
       -
       	mockPostRepo := new(mockPostRepository)

     

       216
       216
       -
       

     

       217
       217
       -
       	service := &voteService{

     

       218
       218
       -
       		repo:     mockVoteRepo,

     

       219
       219
       -
       		postRepo: mockPostRepo,

     

       220
       220
       -
       		pdsURL:   "http://mock-pds.test",

     

       221
       221
       -
       	}

     

       222
       222
       -
       

     

       223
       223
       -
       	ctx := context.Background()

     

       224
       224
       -
       	voterDID := "did:plc:voter123"

     

       225
       225
       -
       	subjectURI := "at://did:plc:community/social.coves.post.record/noexist"

     

       226
       226
       -
       

     

       227
       227
       -
       	mockVoteRepo.On("GetByVoterAndSubject", ctx, voterDID, subjectURI).Return(nil, ErrVoteNotFound)

     

       228
       228
       -
       

     

       229
       229
       -
       	result, err := service.GetVote(ctx, voterDID, subjectURI)

     

       230
       230
       -
       	assert.ErrorIs(t, err, ErrVoteNotFound)

     

       231
       231
       -
       	assert.Nil(t, result)

     

       232
       232
       -
       

     

       233
       233
       -
       	mockVoteRepo.AssertExpectations(t)

     

       234
       234
       -
       }

     

       235
       235
       -
       

     

       236
       236
       -
       // TestVoteService_SubjectNotFound tests voting on non-existent post

     

       237
       237
       -
       func TestVoteService_SubjectNotFound(t *testing.T) {

     

       238
       238
       -
       	mockVoteRepo := new(mockVoteRepository)

     

       239
       239
       -
       	mockPostRepo := new(mockPostRepository)

     

       240
       240
       -
       

     

       241
       241
       -
       	service := &voteService{

     

       242
       242
       -
       		repo:     mockVoteRepo,

     

       243
       243
       -
       		postRepo: mockPostRepo,

     

       244
       244
       -
       		pdsURL:   "http://mock-pds.test",

     

       245
       245
       -
       	}

     

       246
       246
       -
       

     

       247
       247
       -
       	ctx := context.Background()

     

       248
       248
       -
       	voterDID := "did:plc:voter123"

     

       249
       249
       -
       	subjectURI := "at://did:plc:community/social.coves.post.record/noexist"

     

       250
       250
       -
       

     

       251
       251
       -
       	// Mock post not found

     

       252
       252
       -
       	mockPostRepo.On("GetByURI", ctx, subjectURI).Return(nil, posts.ErrNotFound)

     

       253
       253
       -
       

     

       254
       254
       -
       	req := CreateVoteRequest{

     

       255
       255
       -
       		Subject:   subjectURI,

     

       256
       256
       -
       		Direction: "up",

     

       257
       257
       -
       	}

     

       258
       258
       -
       

     

       259
       259
       -
       	_, err := service.CreateVote(ctx, voterDID, "token123", req)

     

       260
       260
       -
       	assert.ErrorIs(t, err, ErrSubjectNotFound)

     

       261
       261
       -
       

     

       262
       262
       -
       	mockPostRepo.AssertExpectations(t)

     

       263
       263
       -
       }

     

       264
       264
       -
       

     

       265
       265
       -
       // NOTE: Testing toggle logic (same direction, different direction) requires mocking HTTP client

     

       266
       266
       -
       // These tests are covered by integration tests in tests/integration/vote_e2e_test.go

     

       267
       267
       -
       // To add unit tests for toggle logic, we would need to:

     

       268
       268
       -
       // 1. Refactor voteService to accept an HTTP client interface

     

       269
       269
       -
       // 2. Mock the PDS createRecord and deleteRecord calls

     

       270
       270
       -
       // 3. Verify the correct sequence of operations

     

       271
       271
       -
       

     

       272
       272
       -
       // Example of what toggle tests would look like (requires refactoring):

     

       273
       273
       -
       /*

     

       274
       274
       -
       func TestVoteService_ToggleSameDirection(t *testing.T) {

     

       275
       275
       -
       	// Setup

     

       276
       276
       -
       	mockVoteRepo := new(mockVoteRepository)

     

       277
       277
       -
       	mockPostRepo := new(mockPostRepository)

     

       278
       278
       -
       	mockPDSClient := new(mockPDSClient)

     

       279
       279
       -
       

     

       280
       280
       -
       	service := &voteService{

     

       281
       281
       -
       		repo:      mockVoteRepo,

     

       282
       282
       -
       		postRepo:  mockPostRepo,

     

       283
       283
       -
       		pdsClient: mockPDSClient, // Would need to refactor to inject this

     

       284
       284
       -
       	}

     

       285
       285
       -
       

     

       286
       286
       -
       	ctx := context.Background()

     

       287
       287
       -
       	voterDID := "did:plc:voter123"

     

       288
       288
       -
       	subjectURI := "at://did:plc:community/social.coves.post.record/abc123"

     

       289
       289
       -
       

     

       290
       290
       -
       	// Mock existing upvote

     

       291
       291
       -
       	existingVote := &Vote{

     

       292
       292
       -
       		URI:        "at://did:plc:voter123/social.coves.interaction.vote/existing",

     

       293
       293
       -
       		VoterDID:   voterDID,

     

       294
       294
       -
       		SubjectURI: subjectURI,

     

       295
       295
       -
       		Direction:  "up",

     

       296
       296
       -
       	}

     

       297
       297
       -
       	mockVoteRepo.On("GetByVoterAndSubject", ctx, voterDID, subjectURI).Return(existingVote, nil)

     

       298
       298
       -
       

     

       299
       299
       -
       	// Mock post exists

     

       300
       300
       -
       	mockPostRepo.On("GetByURI", ctx, subjectURI).Return(&posts.Post{

     

       301
       301
       -
       		URI: subjectURI,

     

       302
       302
       -
       		CID: "bafyreigpost123",

     

       303
       303
       -
       	}, nil)

     

       304
       304
       -
       

     

       305
       305
       -
       	// Mock PDS delete

     

       306
       306
       -
       	mockPDSClient.On("DeleteRecord", voterDID, "social.coves.interaction.vote", "existing").Return(nil)

     

       307
       307
       -
       

     

       308
       308
       -
       	// Execute: Click upvote when already upvoted -> should delete

     

       309
       309
       -
       	req := CreateVoteRequest{

     

       310
       310
       -
       		Subject:   subjectURI,

     

       311
       311
       -
       		Direction: "up", // Same direction

     

       312
       312
       -
       	}

     

       313
       313
       -
       

     

       314
       314
       -
       	response, err := service.CreateVote(ctx, voterDID, "token123", req)

     

       315
       315
       -
       

     

       316
       316
       -
       	// Assert

     

       317
       317
       -
       	assert.NoError(t, err)

     

       318
       318
       -
       	assert.Equal(t, "", response.URI, "Should return empty URI when toggled off")

     

       319
       319
       -
       	mockPDSClient.AssertCalled(t, "DeleteRecord", voterDID, "social.coves.interaction.vote", "existing")

     

       320
       320
       -
       	mockVoteRepo.AssertExpectations(t)

     

       321
       321
       -
       	mockPostRepo.AssertExpectations(t)

     

       322
       322
       -
       }

     

       323
       323
       -
       

     

       324
       324
       -
       func TestVoteService_ToggleDifferentDirection(t *testing.T) {

     

       325
       325
       -
       	// Similar test but existing vote is "up" and new vote is "down"

     

       326
       326
       -
       	// Should delete old vote and create new vote

     

       327
       327
       -
       	// Would verify:

     

       328
       328
       -
       	// 1. DeleteRecord called for old vote

     

       329
       329
       -
       	// 2. CreateRecord called for new vote

     

       330
       330
       -
       	// 3. Response contains new vote URI

     

       331
       331
       -
       }

     

       332
       332
       -
       */

     

       333
       333
       -
       

     

       334
       334
       -
       // Documentation test to explain toggle logic (verified by E2E tests)

     

       335
       335
       -
       func TestVoteService_ToggleLogicDocumentation(t *testing.T) {

     

       336
       336
       -
       	t.Log("Toggle Logic (verified by E2E tests in tests/integration/vote_e2e_test.go):")

     

       337
       337
       -
       	t.Log("1. No existing vote + upvote clicked → Create upvote")

     

       338
       338
       -
       	t.Log("2. Upvote exists + upvote clicked → Delete upvote (toggle off)")

     

       339
       339
       -
       	t.Log("3. Upvote exists + downvote clicked → Delete upvote + Create downvote (switch)")

     

       340
       340
       -
       	t.Log("4. Downvote exists + downvote clicked → Delete downvote (toggle off)")

     

       341
       341
       -
       	t.Log("5. Downvote exists + upvote clicked → Delete downvote + Create upvote (switch)")

     

       342
       342
       -
       	t.Log("")

     

       343
       343
       -
       	t.Log("To add unit tests for toggle logic, refactor service to accept HTTP client interface")

     

       344
       344
       -
       }

+5 -23

internal/core/votes/interfaces.go

···

       2
       2
        
       

     

       3
       3
        
       import "context"

     

       4
       4
        
       

     

       5
       5
       -
       // Service defines the business logic interface for votes

     

       6
       6
       -
       // Coordinates between Repository, user PDS, and vote validation

     

       7
       7
       -
       type Service interface {

     

       8
       8
       -
       	// CreateVote creates a new vote or toggles an existing vote

     

       9
       9
       -
       	// Flow: Validate -> Check existing vote -> Handle toggle logic -> Write to user's PDS -> Return URI/CID

     

       10
       10
       -
       	// AppView indexing happens asynchronously via Jetstream consumer

     

       11
       11
       -
       	// Toggle logic:

     

       12
       12
       -
       	//   - No vote -> Create vote

     

       13
       13
       -
       	//   - Same direction -> Delete vote (toggle off)

     

       14
       14
       -
       	//   - Different direction -> Delete old + Create new (toggle direction)

     

       15
       15
       -
       	CreateVote(ctx context.Context, voterDID string, userAccessToken string, req CreateVoteRequest) (*CreateVoteResponse, error)

     

       16
       16
       -
       

     

       17
       17
       -
       	// DeleteVote removes a vote from a post/comment

     

       18
       18
       -
       	// Flow: Find vote -> Verify ownership -> Delete from user's PDS

     

       19
       19
       -
       	// AppView decrements vote count asynchronously via Jetstream consumer

     

       20
       20
       -
       	DeleteVote(ctx context.Context, voterDID string, userAccessToken string, req DeleteVoteRequest) error

     

       21
       21
       -
       

     

       22
       22
       -
       	// GetVote retrieves a user's vote on a specific subject

     

       23
       23
       -
       	// Used to check vote state before creating/toggling

     

       24
       24
       -
       	GetVote(ctx context.Context, voterDID string, subjectURI string) (*Vote, error)

     

       25
       25
       -
       }

     

       26
       26
       -
       

     

       27
       5
        
       // Repository defines the data access interface for votes

     

       28
       6
        
       // Used by Jetstream consumer to index votes from firehose

     

       7
       7
       +
       //

     

       8
       8
       +
       // Architecture: Votes are written directly by clients to their PDS using

     

       9
       9
       +
       // com.atproto.repo.createRecord/deleteRecord. This AppView indexes votes

     

       10
       10
       +
       // from Jetstream for aggregation and querying.

     

       29
       11
        
       type Repository interface {

     

       30
       12
        
       	// Create inserts a new vote into the AppView database

     

       31
       13
        
       	// Called by Jetstream consumer after vote is created on PDS

     
···

       38
       20
        
       

     

       39
       21
        
       	// GetByVoterAndSubject retrieves a user's vote on a specific subject

     

       40
       22
        
       	// Used to check existing vote state

     

       41
       41
       -
       	GetByVoterAndSubject(ctx context.Context, voterDID string, subjectURI string) (*Vote, error)

     

       23
       23
       +
       	GetByVoterAndSubject(ctx context.Context, voterDID, subjectURI string) (*Vote, error)

     

       42
       24
        
       

     

       43
       25
        
       	// Delete soft-deletes a vote (sets deleted_at)

     

       44
       26
        
       	// Called by Jetstream consumer after vote is deleted from PDS

+10 -31

internal/core/votes/vote.go

···

       7
       7
        
       // Vote represents a vote in the AppView database

     

       8
       8
        
       // Votes are indexed from the firehose after being written to user repositories

     

       9
       9
        
       type Vote struct {

     

       10
       10
       -
       	ID         int64      `json:"id" db:"id"`

     

       10
       10
       +
       	CreatedAt  time.Time  `json:"createdAt" db:"created_at"`

     

       11
       11
       +
       	IndexedAt  time.Time  `json:"indexedAt" db:"indexed_at"`

     

       12
       12
       +
       	DeletedAt  *time.Time `json:"deletedAt,omitempty" db:"deleted_at"`

     

       11
       13
        
       	URI        string     `json:"uri" db:"uri"`

     

       12
       14
        
       	CID        string     `json:"cid" db:"cid"`

     

       13
       15
        
       	RKey       string     `json:"rkey" db:"rkey"`

     

       14
       16
        
       	VoterDID   string     `json:"voterDid" db:"voter_did"`

     

       15
       17
        
       	SubjectURI string     `json:"subjectUri" db:"subject_uri"`

     

       16
       18
        
       	SubjectCID string     `json:"subjectCid" db:"subject_cid"`

     

       17
       17
       -
       	Direction  string     `json:"direction" db:"direction"` // "up" or "down"

     

       18
       18
       -
       	CreatedAt  time.Time  `json:"createdAt" db:"created_at"`

     

       19
       19
       -
       	IndexedAt  time.Time  `json:"indexedAt" db:"indexed_at"`

     

       20
       20
       -
       	DeletedAt  *time.Time `json:"deletedAt,omitempty" db:"deleted_at"`

     

       21
       21
       -
       }

     

       22
       22
       -
       

     

       23
       23
       -
       // CreateVoteRequest represents input for creating a new vote

     

       24
       24
       -
       // Matches social.coves.interaction.createVote lexicon input schema

     

       25
       25
       -
       type CreateVoteRequest struct {

     

       26
       26
       -
       	Subject   string `json:"subject"`   // AT-URI of post/comment

     

       27
       27
       -
       	Direction string `json:"direction"` // "up" or "down"

     

       28
       28
       -
       }

     

       29
       29
       -
       

     

       30
       30
       -
       // CreateVoteResponse represents the response from creating a vote

     

       31
       31
       -
       // Matches social.coves.interaction.createVote lexicon output schema

     

       32
       32
       -
       type CreateVoteResponse struct {

     

       33
       33
       -
       	URI      string  `json:"uri"`                // AT-URI of created vote record

     

       34
       34
       -
       	CID      string  `json:"cid"`                // CID of created vote record

     

       35
       35
       -
       	Existing *string `json:"existing,omitempty"` // AT-URI of existing vote if updating

     

       36
       36
       -
       }

     

       37
       37
       -
       

     

       38
       38
       -
       // DeleteVoteRequest represents input for deleting a vote

     

       39
       39
       -
       // Matches social.coves.interaction.deleteVote lexicon input schema

     

       40
       40
       -
       type DeleteVoteRequest struct {

     

       41
       41
       -
       	Subject string `json:"subject"` // AT-URI of post/comment

     

       19
       19
       +
       	Direction  string     `json:"direction" db:"direction"`

     

       20
       20
       +
       	ID         int64      `json:"id" db:"id"`

     

       42
       21
        
       }

     

       43
       22
        
       

     

       44
       44
       -
       // VoteRecord represents the actual atProto record structure written to PDS

     

       23
       23
       +
       // VoteRecord represents the atProto record structure indexed from Jetstream

     

       45
       24
        
       // This is the data structure that gets stored in the user's repository

     

       46
       25
        
       type VoteRecord struct {

     

       47
       47
       -
       	Type      string            `json:"$type"`

     

       48
       48
       -
       	Subject   StrongRef         `json:"subject"`

     

       49
       49
       -
       	Direction string            `json:"direction"` // "up" or "down"

     

       50
       50
       -
       	CreatedAt string            `json:"createdAt"`

     

       26
       26
       +
       	Type      string    `json:"$type"`

     

       27
       27
       +
       	Subject   StrongRef `json:"subject"`

     

       28
       28
       +
       	Direction string    `json:"direction"` // "up" or "down"

     

       29
       29
       +
       	CreatedAt string    `json:"createdAt"`

     

       51
       30
        
       }

     

       52
       31
        
       

     

       53
       32
        
       // StrongRef represents a strong reference to a record (URI + CID)

-129

internal/api/handlers/vote/create_vote.go

···

       1
       1
       -
       package vote

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/api/handlers"

     

       5
       5
       -
       	"Coves/internal/api/middleware"

     

       6
       6
       -
       	"Coves/internal/core/votes"

     

       7
       7
       -
       	"encoding/json"

     

       8
       8
       -
       	"log"

     

       9
       9
       -
       	"net/http"

     

       10
       10
       -
       )

     

       11
       11
       -
       

     

       12
       12
       -
       // CreateVoteHandler handles vote creation

     

       13
       13
       -
       type CreateVoteHandler struct {

     

       14
       14
       -
       	service votes.Service

     

       15
       15
       -
       }

     

       16
       16
       -
       

     

       17
       17
       -
       // NewCreateVoteHandler creates a new create vote handler

     

       18
       18
       -
       func NewCreateVoteHandler(service votes.Service) *CreateVoteHandler {

     

       19
       19
       -
       	return &CreateVoteHandler{

     

       20
       20
       -
       		service: service,

     

       21
       21
       -
       	}

     

       22
       22
       -
       }

     

       23
       23
       -
       

     

       24
       24
       -
       // HandleCreateVote creates a vote or toggles an existing vote

     

       25
       25
       -
       // POST /xrpc/social.coves.interaction.createVote

     

       26
       26
       -
       //

     

       27
       27
       -
       // Request body: { "subject": "at://...", "direction": "up" | "down" }

     

       28
       28
       -
       func (h *CreateVoteHandler) HandleCreateVote(w http.ResponseWriter, r *http.Request) {

     

       29
       29
       -
       	if r.Method != http.MethodPost {

     

       30
       30
       -
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       31
       31
       -
       		return

     

       32
       32
       -
       	}

     

       33
       33
       -
       

     

       34
       34
       -
       	// Parse request body

     

       35
       35
       -
       	var req votes.CreateVoteRequest

     

       36
       36
       -
       

     

       37
       37
       -
       	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {

     

       38
       38
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       39
       39
       -
       		return

     

       40
       40
       -
       	}

     

       41
       41
       -
       

     

       42
       42
       -
       	if req.Subject == "" {

     

       43
       43
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "subject is required")

     

       44
       44
       -
       		return

     

       45
       45
       -
       	}

     

       46
       46
       -
       

     

       47
       47
       -
       	if req.Direction == "" {

     

       48
       48
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "direction is required")

     

       49
       49
       -
       		return

     

       50
       50
       -
       	}

     

       51
       51
       -
       

     

       52
       52
       -
       	if req.Direction != "up" && req.Direction != "down" {

     

       53
       53
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "direction must be 'up' or 'down'")

     

       54
       54
       -
       		return

     

       55
       55
       -
       	}

     

       56
       56
       -
       

     

       57
       57
       -
       	// Extract authenticated user DID and access token from request context (injected by auth middleware)

     

       58
       58
       -
       	voterDID := middleware.GetUserDID(r)

     

       59
       59
       -
       	if voterDID == "" {

     

       60
       60
       -
       		handlers.WriteError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       61
       61
       -
       		return

     

       62
       62
       -
       	}

     

       63
       63
       -
       

     

       64
       64
       -
       	userAccessToken := middleware.GetUserAccessToken(r)

     

       65
       65
       -
       	if userAccessToken == "" {

     

       66
       66
       -
       		handlers.WriteError(w, http.StatusUnauthorized, "AuthRequired", "Missing access token")

     

       67
       67
       -
       		return

     

       68
       68
       -
       	}

     

       69
       69
       -
       

     

       70
       70
       -
       	// Create vote via service (write-forward to user's PDS)

     

       71
       71
       -
       	response, err := h.service.CreateVote(r.Context(), voterDID, userAccessToken, req)

     

       72
       72
       -
       	if err != nil {

     

       73
       73
       -
       		handleServiceError(w, err)

     

       74
       74
       -
       		return

     

       75
       75
       -
       	}

     

       76
       76
       -
       

     

       77
       77
       -
       	// Handle toggle-off case (vote was deleted, not created)

     

       78
       78
       -
       	if response.URI == "" {

     

       79
       79
       -
       		// Vote was toggled off (deleted)

     

       80
       80
       -
       		w.Header().Set("Content-Type", "application/json")

     

       81
       81
       -
       		w.WriteHeader(http.StatusOK)

     

       82
       82
       -
       		if err := json.NewEncoder(w).Encode(map[string]interface{}{

     

       83
       83
       -
       			"deleted": true,

     

       84
       84
       -
       		}); err != nil {

     

       85
       85
       -
       			log.Printf("Failed to encode response: %v", err)

     

       86
       86
       -
       		}

     

       87
       87
       -
       		return

     

       88
       88
       -
       	}

     

       89
       89
       -
       

     

       90
       90
       -
       	// Return success response

     

       91
       91
       -
       	responseMap := map[string]interface{}{

     

       92
       92
       -
       		"uri": response.URI,

     

       93
       93
       -
       		"cid": response.CID,

     

       94
       94
       -
       	}

     

       95
       95
       -
       

     

       96
       96
       -
       	if response.Existing != nil {

     

       97
       97
       -
       		responseMap["existing"] = *response.Existing

     

       98
       98
       -
       	}

     

       99
       99
       -
       

     

       100
       100
       -
       	w.Header().Set("Content-Type", "application/json")

     

       101
       101
       -
       	w.WriteHeader(http.StatusOK)

     

       102
       102
       -
       	if err := json.NewEncoder(w).Encode(responseMap); err != nil {

     

       103
       103
       -
       		log.Printf("Failed to encode response: %v", err)

     

       104
       104
       -
       	}

     

       105
       105
       -
       }

     

       106
       106
       -
       

     

       107
       107
       -
       // handleServiceError converts service errors to HTTP responses

     

       108
       108
       -
       func handleServiceError(w http.ResponseWriter, err error) {

     

       109
       109
       -
       	switch err {

     

       110
       110
       -
       	case votes.ErrVoteNotFound:

     

       111
       111
       -
       		handlers.WriteError(w, http.StatusNotFound, "VoteNotFound", "Vote not found")

     

       112
       112
       -
       	case votes.ErrSubjectNotFound:

     

       113
       113
       -
       		handlers.WriteError(w, http.StatusNotFound, "SubjectNotFound", "Post or comment not found")

     

       114
       114
       -
       	case votes.ErrInvalidDirection:

     

       115
       115
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "Invalid vote direction")

     

       116
       116
       -
       	case votes.ErrInvalidSubject:

     

       117
       117
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "Invalid subject URI")

     

       118
       118
       -
       	case votes.ErrVoteAlreadyExists:

     

       119
       119
       -
       		handlers.WriteError(w, http.StatusConflict, "VoteAlreadyExists", "Vote already exists")

     

       120
       120
       -
       	case votes.ErrNotAuthorized:

     

       121
       121
       -
       		handlers.WriteError(w, http.StatusForbidden, "NotAuthorized", "Not authorized")

     

       122
       122
       -
       	case votes.ErrBanned:

     

       123
       123
       -
       		handlers.WriteError(w, http.StatusForbidden, "Banned", "User is banned from this community")

     

       124
       124
       -
       	default:

     

       125
       125
       -
       		// Check for validation errors

     

       126
       126
       -
       		log.Printf("Vote creation error: %v", err)

     

       127
       127
       -
       		handlers.WriteError(w, http.StatusInternalServerError, "InternalError", "Failed to create vote")

     

       128
       128
       -
       	}

     

       129
       129
       -
       }

-75

internal/api/handlers/vote/delete_vote.go

···

       1
       1
       -
       package vote

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/api/handlers"

     

       5
       5
       -
       	"Coves/internal/api/middleware"

     

       6
       6
       -
       	"Coves/internal/core/votes"

     

       7
       7
       -
       	"encoding/json"

     

       8
       8
       -
       	"log"

     

       9
       9
       -
       	"net/http"

     

       10
       10
       -
       )

     

       11
       11
       -
       

     

       12
       12
       -
       // DeleteVoteHandler handles vote deletion

     

       13
       13
       -
       type DeleteVoteHandler struct {

     

       14
       14
       -
       	service votes.Service

     

       15
       15
       -
       }

     

       16
       16
       -
       

     

       17
       17
       -
       // NewDeleteVoteHandler creates a new delete vote handler

     

       18
       18
       -
       func NewDeleteVoteHandler(service votes.Service) *DeleteVoteHandler {

     

       19
       19
       -
       	return &DeleteVoteHandler{

     

       20
       20
       -
       		service: service,

     

       21
       21
       -
       	}

     

       22
       22
       -
       }

     

       23
       23
       -
       

     

       24
       24
       -
       // HandleDeleteVote removes a vote from a post/comment

     

       25
       25
       -
       // POST /xrpc/social.coves.interaction.deleteVote

     

       26
       26
       -
       //

     

       27
       27
       -
       // Request body: { "subject": "at://..." }

     

       28
       28
       -
       func (h *DeleteVoteHandler) HandleDeleteVote(w http.ResponseWriter, r *http.Request) {

     

       29
       29
       -
       	if r.Method != http.MethodPost {

     

       30
       30
       -
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       31
       31
       -
       		return

     

       32
       32
       -
       	}

     

       33
       33
       -
       

     

       34
       34
       -
       	// Parse request body

     

       35
       35
       -
       	var req votes.DeleteVoteRequest

     

       36
       36
       -
       

     

       37
       37
       -
       	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {

     

       38
       38
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       39
       39
       -
       		return

     

       40
       40
       -
       	}

     

       41
       41
       -
       

     

       42
       42
       -
       	if req.Subject == "" {

     

       43
       43
       -
       		handlers.WriteError(w, http.StatusBadRequest, "InvalidRequest", "subject is required")

     

       44
       44
       -
       		return

     

       45
       45
       -
       	}

     

       46
       46
       -
       

     

       47
       47
       -
       	// Extract authenticated user DID and access token from request context (injected by auth middleware)

     

       48
       48
       -
       	voterDID := middleware.GetUserDID(r)

     

       49
       49
       -
       	if voterDID == "" {

     

       50
       50
       -
       		handlers.WriteError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       51
       51
       -
       		return

     

       52
       52
       -
       	}

     

       53
       53
       -
       

     

       54
       54
       -
       	userAccessToken := middleware.GetUserAccessToken(r)

     

       55
       55
       -
       	if userAccessToken == "" {

     

       56
       56
       -
       		handlers.WriteError(w, http.StatusUnauthorized, "AuthRequired", "Missing access token")

     

       57
       57
       -
       		return

     

       58
       58
       -
       	}

     

       59
       59
       -
       

     

       60
       60
       -
       	// Delete vote via service (delete record on PDS)

     

       61
       61
       -
       	err := h.service.DeleteVote(r.Context(), voterDID, userAccessToken, req)

     

       62
       62
       -
       	if err != nil {

     

       63
       63
       -
       		handleServiceError(w, err)

     

       64
       64
       -
       		return

     

       65
       65
       -
       	}

     

       66
       66
       -
       

     

       67
       67
       -
       	// Return success response

     

       68
       68
       -
       	w.Header().Set("Content-Type", "application/json")

     

       69
       69
       -
       	w.WriteHeader(http.StatusOK)

     

       70
       70
       -
       	if err := json.NewEncoder(w).Encode(map[string]interface{}{

     

       71
       71
       -
       		"success": true,

     

       72
       72
       -
       	}); err != nil {

     

       73
       73
       -
       		log.Printf("Failed to encode response: %v", err)

     

       74
       74
       -
       	}

     

       75
       75
       -
       }

-24

internal/api/routes/vote.go

···

       1
       1
       -
       package routes

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/api/handlers/vote"

     

       5
       5
       -
       	"Coves/internal/api/middleware"

     

       6
       6
       -
       	"Coves/internal/core/votes"

     

       7
       7
       -
       

     

       8
       8
       -
       	"github.com/go-chi/chi/v5"

     

       9
       9
       -
       )

     

       10
       10
       -
       

     

       11
       11
       -
       // RegisterVoteRoutes registers vote-related XRPC endpoints on the router

     

       12
       12
       -
       // Implements social.coves.interaction.* lexicon endpoints for voting

     

       13
       13
       -
       func RegisterVoteRoutes(r chi.Router, service votes.Service, authMiddleware *middleware.AtProtoAuthMiddleware) {

     

       14
       14
       -
       	// Initialize handlers

     

       15
       15
       -
       	createVoteHandler := vote.NewCreateVoteHandler(service)

     

       16
       16
       -
       	deleteVoteHandler := vote.NewDeleteVoteHandler(service)

     

       17
       17
       -
       

     

       18
       18
       -
       	// Procedure endpoints (POST) - require authentication

     

       19
       19
       -
       	// social.coves.interaction.createVote - create or toggle a vote on a post/comment

     

       20
       20
       -
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.interaction.createVote", createVoteHandler.HandleCreateVote)

     

       21
       21
       -
       

     

       22
       22
       -
       	// social.coves.interaction.deleteVote - delete a vote from a post/comment

     

       23
       23
       -
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.interaction.deleteVote", deleteVoteHandler.HandleDeleteVote)

     

       24
       24
       -
       }

-789

tests/integration/vote_e2e_test.go

···

       1
       1
       -
       package integration

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/api/handlers/vote"

     

       5
       5
       -
       	"Coves/internal/api/middleware"

     

       6
       6
       -
       	"Coves/internal/atproto/identity"

     

       7
       7
       -
       	"Coves/internal/atproto/jetstream"

     

       8
       8
       -
       	"Coves/internal/core/communities"

     

       9
       9
       -
       	"Coves/internal/core/posts"

     

       10
       10
       -
       	"Coves/internal/core/users"

     

       11
       11
       -
       	"Coves/internal/core/votes"

     

       12
       12
       -
       	"Coves/internal/db/postgres"

     

       13
       13
       -
       	"bytes"

     

       14
       14
       -
       	"context"

     

       15
       15
       -
       	"database/sql"

     

       16
       16
       -
       	"encoding/json"

     

       17
       17
       -
       	"fmt"

     

       18
       18
       -
       	"net"

     

       19
       19
       -
       	"net/http"

     

       20
       20
       -
       	"net/http/httptest"

     

       21
       21
       -
       	"os"

     

       22
       22
       -
       	"strings"

     

       23
       23
       -
       	"testing"

     

       24
       24
       -
       	"time"

     

       25
       25
       -
       

     

       26
       26
       -
       	"github.com/gorilla/websocket"

     

       27
       27
       -
       	_ "github.com/lib/pq"

     

       28
       28
       -
       	"github.com/pressly/goose/v3"

     

       29
       29
       -
       	"github.com/stretchr/testify/assert"

     

       30
       30
       -
       	"github.com/stretchr/testify/require"

     

       31
       31
       -
       )

     

       32
       32
       -
       

     

       33
       33
       -
       // TestVote_E2E_WithJetstream tests the full vote flow with simulated Jetstream:

     

       34
       34
       -
       // XRPC endpoint → AppView Service → PDS write → (Simulated) Jetstream consumer → DB indexing

     

       35
       35
       -
       //

     

       36
       36
       -
       // This is a fast integration test that simulates what happens in production:

     

       37
       37
       -
       // 1. Client calls POST /xrpc/social.coves.interaction.createVote with auth token

     

       38
       38
       -
       // 2. Handler validates and calls VoteService.CreateVote()

     

       39
       39
       -
       // 3. Service writes vote to user's PDS repository

     

       40
       40
       -
       // 4. (Simulated) PDS broadcasts event to Jetstream

     

       41
       41
       -
       // 5. Jetstream consumer receives event and indexes vote in AppView DB

     

       42
       42
       -
       // 6. Vote is now queryable from AppView + post counts updated

     

       43
       43
       -
       //

     

       44
       44
       -
       // NOTE: This test simulates the Jetstream event (step 4-5) since we don't have

     

       45
       45
       -
       // a live PDS/Jetstream in test environment. For true live testing, use TestVote_E2E_LivePDS.

     

       46
       46
       -
       func TestVote_E2E_WithJetstream(t *testing.T) {

     

       47
       47
       -
       	db := setupTestDB(t)

     

       48
       48
       -
       	defer func() {

     

       49
       49
       -
       		if err := db.Close(); err != nil {

     

       50
       50
       -
       			t.Logf("Failed to close database: %v", err)

     

       51
       51
       -
       		}

     

       52
       52
       -
       	}()

     

       53
       53
       -
       

     

       54
       54
       -
       	// Cleanup old test data first

     

       55
       55
       -
       	_, _ = db.Exec("DELETE FROM votes WHERE voter_did LIKE 'did:plc:votee2e%'")

     

       56
       56
       -
       	_, _ = db.Exec("DELETE FROM posts WHERE community_did = 'did:plc:votecommunity123'")

     

       57
       57
       -
       	_, _ = db.Exec("DELETE FROM communities WHERE did = 'did:plc:votecommunity123'")

     

       58
       58
       -
       	_, _ = db.Exec("DELETE FROM users WHERE did LIKE 'did:plc:votee2e%'")

     

       59
       59
       -
       

     

       60
       60
       -
       	// Setup repositories

     

       61
       61
       -
       	userRepo := postgres.NewUserRepository(db)

     

       62
       62
       -
       	communityRepo := postgres.NewCommunityRepository(db)

     

       63
       63
       -
       	postRepo := postgres.NewPostRepository(db)

     

       64
       64
       -
       	voteRepo := postgres.NewVoteRepository(db)

     

       65
       65
       -
       

     

       66
       66
       -
       	// Setup user service for consumers

     

       67
       67
       -
       	identityConfig := identity.DefaultConfig()

     

       68
       68
       -
       	identityResolver := identity.NewResolver(db, identityConfig)

     

       69
       69
       -
       	userService := users.NewUserService(userRepo, identityResolver, "http://localhost:3001")

     

       70
       70
       -
       

     

       71
       71
       -
       	// Create test users (voter and author)

     

       72
       72
       -
       	voter := createTestUser(t, db, "voter.test", "did:plc:votee2evoter123")

     

       73
       73
       -
       	author := createTestUser(t, db, "author.test", "did:plc:votee2eauthor123")

     

       74
       74
       -
       

     

       75
       75
       -
       	// Create test community

     

       76
       76
       -
       	community := &communities.Community{

     

       77
       77
       -
       		DID:             "did:plc:votecommunity123",

     

       78
       78
       -
       		Handle:          "votecommunity.test.coves.social",

     

       79
       79
       -
       		Name:            "votecommunity",

     

       80
       80
       -
       		DisplayName:     "Vote Test Community",

     

       81
       81
       -
       		OwnerDID:        "did:plc:votecommunity123",

     

       82
       82
       -
       		CreatedByDID:    author.DID,

     

       83
       83
       -
       		HostedByDID:     "did:web:coves.test",

     

       84
       84
       -
       		Visibility:      "public",

     

       85
       85
       -
       		ModerationType:  "moderator",

     

       86
       86
       -
       		RecordURI:       "at://did:plc:votecommunity123/social.coves.community.profile/self",

     

       87
       87
       -
       		RecordCID:       "fakecid123",

     

       88
       88
       -
       		PDSAccessToken:  "fake_token_for_testing",

     

       89
       89
       -
       		PDSRefreshToken: "fake_refresh_token",

     

       90
       90
       -
       	}

     

       91
       91
       -
       	_, err := communityRepo.Create(context.Background(), community)

     

       92
       92
       -
       	if err != nil {

     

       93
       93
       -
       		t.Fatalf("Failed to create test community: %v", err)

     

       94
       94
       -
       	}

     

       95
       95
       -
       

     

       96
       96
       -
       	// Create test post (subject of votes)

     

       97
       97
       -
       	postRkey := generateTID()

     

       98
       98
       -
       	postURI := fmt.Sprintf("at://%s/social.coves.post.record/%s", community.DID, postRkey)

     

       99
       99
       -
       	postCID := "bafy2bzacepostcid123"

     

       100
       100
       -
       	post := &posts.Post{

     

       101
       101
       -
       		URI:          postURI,

     

       102
       102
       -
       		CID:          postCID,

     

       103
       103
       -
       		RKey:         postRkey,

     

       104
       104
       -
       		AuthorDID:    author.DID,

     

       105
       105
       -
       		CommunityDID: community.DID,

     

       106
       106
       -
       		Title:        stringPtr("Test Post for Voting"),

     

       107
       107
       -
       		Content:      stringPtr("This post will receive votes"),

     

       108
       108
       -
       		CreatedAt:    time.Now(),

     

       109
       109
       -
       		UpvoteCount:  0,

     

       110
       110
       -
       		DownvoteCount: 0,

     

       111
       111
       -
       		Score:        0,

     

       112
       112
       -
       	}

     

       113
       113
       -
       	err = postRepo.Create(context.Background(), post)

     

       114
       114
       -
       	if err != nil {

     

       115
       115
       -
       		t.Fatalf("Failed to create test post: %v", err)

     

       116
       116
       -
       	}

     

       117
       117
       -
       

     

       118
       118
       -
       	t.Run("Full E2E flow - Create upvote via Jetstream", func(t *testing.T) {

     

       119
       119
       -
       		ctx := context.Background()

     

       120
       120
       -
       

     

       121
       121
       -
       		// STEP 1: Simulate Jetstream consumer receiving a vote CREATE event

     

       122
       122
       -
       		// In real production, this event comes from PDS via Jetstream WebSocket

     

       123
       123
       -
       		voteRkey := generateTID()

     

       124
       124
       -
       		voteURI := fmt.Sprintf("at://%s/social.coves.interaction.vote/%s", voter.DID, voteRkey)

     

       125
       125
       -
       

     

       126
       126
       -
       		jetstreamEvent := jetstream.JetstreamEvent{

     

       127
       127
       -
       			Did:  voter.DID, // Vote comes from voter's repo

     

       128
       128
       -
       			Kind: "commit",

     

       129
       129
       -
       			Commit: &jetstream.CommitEvent{

     

       130
       130
       -
       				Operation:  "create",

     

       131
       131
       -
       				Collection: "social.coves.interaction.vote",

     

       132
       132
       -
       				RKey:       voteRkey,

     

       133
       133
       -
       				CID:        "bafy2bzacevotecid123",

     

       134
       134
       -
       				Record: map[string]interface{}{

     

       135
       135
       -
       					"$type": "social.coves.interaction.vote",

     

       136
       136
       -
       					"subject": map[string]interface{}{

     

       137
       137
       -
       						"uri": postURI,

     

       138
       138
       -
       						"cid": postCID,

     

       139
       139
       -
       					},

     

       140
       140
       -
       					"direction": "up",

     

       141
       141
       -
       					"createdAt": time.Now().Format(time.RFC3339),

     

       142
       142
       -
       				},

     

       143
       143
       -
       			},

     

       144
       144
       -
       		}

     

       145
       145
       -
       

     

       146
       146
       -
       		// STEP 2: Process event through Jetstream consumer

     

       147
       147
       -
       		consumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       148
       148
       -
       		err := consumer.HandleEvent(ctx, &jetstreamEvent)

     

       149
       149
       -
       		if err != nil {

     

       150
       150
       -
       			t.Fatalf("Jetstream consumer failed to process event: %v", err)

     

       151
       151
       -
       		}

     

       152
       152
       -
       

     

       153
       153
       -
       		// STEP 3: Verify vote was indexed in AppView database

     

       154
       154
       -
       		indexedVote, err := voteRepo.GetByURI(ctx, voteURI)

     

       155
       155
       -
       		if err != nil {

     

       156
       156
       -
       			t.Fatalf("Vote not indexed in AppView: %v", err)

     

       157
       157
       -
       		}

     

       158
       158
       -
       

     

       159
       159
       -
       		// STEP 4: Verify vote fields are correct

     

       160
       160
       -
       		assert.Equal(t, voteURI, indexedVote.URI, "Vote URI should match")

     

       161
       161
       -
       		assert.Equal(t, voter.DID, indexedVote.VoterDID, "Voter DID should match")

     

       162
       162
       -
       		assert.Equal(t, postURI, indexedVote.SubjectURI, "Subject URI should match")

     

       163
       163
       -
       		assert.Equal(t, postCID, indexedVote.SubjectCID, "Subject CID should match (strong reference)")

     

       164
       164
       -
       		assert.Equal(t, "up", indexedVote.Direction, "Direction should be 'up'")

     

       165
       165
       -
       

     

       166
       166
       -
       		// STEP 5: Verify post vote counts were updated atomically

     

       167
       167
       -
       		updatedPost, err := postRepo.GetByURI(ctx, postURI)

     

       168
       168
       -
       		require.NoError(t, err, "Post should still exist")

     

       169
       169
       -
       		assert.Equal(t, 1, updatedPost.UpvoteCount, "Post upvote_count should be 1")

     

       170
       170
       -
       		assert.Equal(t, 0, updatedPost.DownvoteCount, "Post downvote_count should be 0")

     

       171
       171
       -
       		assert.Equal(t, 1, updatedPost.Score, "Post score should be 1 (upvotes - downvotes)")

     

       172
       172
       -
       

     

       173
       173
       -
       		t.Logf("✓ E2E test passed! Vote indexed with URI: %s, post upvotes: %d", indexedVote.URI, updatedPost.UpvoteCount)

     

       174
       174
       -
       	})

     

       175
       175
       -
       

     

       176
       176
       -
       	t.Run("Create downvote and verify counts", func(t *testing.T) {

     

       177
       177
       -
       		ctx := context.Background()

     

       178
       178
       -
       

     

       179
       179
       -
       		// Create a different voter for this test to avoid unique constraint violation

     

       180
       180
       -
       		downvoter := createTestUser(t, db, "downvoter.test", "did:plc:votee2edownvoter")

     

       181
       181
       -
       

     

       182
       182
       -
       		// Create downvote

     

       183
       183
       -
       		voteRkey := generateTID()

     

       184
       184
       -
       		voteURI := fmt.Sprintf("at://%s/social.coves.interaction.vote/%s", downvoter.DID, voteRkey)

     

       185
       185
       -
       

     

       186
       186
       -
       		jetstreamEvent := jetstream.JetstreamEvent{

     

       187
       187
       -
       			Did:  downvoter.DID,

     

       188
       188
       -
       			Kind: "commit",

     

       189
       189
       -
       			Commit: &jetstream.CommitEvent{

     

       190
       190
       -
       				Operation:  "create",

     

       191
       191
       -
       				Collection: "social.coves.interaction.vote",

     

       192
       192
       -
       				RKey:       voteRkey,

     

       193
       193
       -
       				CID:        "bafy2bzacedownvotecid",

     

       194
       194
       -
       				Record: map[string]interface{}{

     

       195
       195
       -
       					"$type": "social.coves.interaction.vote",

     

       196
       196
       -
       					"subject": map[string]interface{}{

     

       197
       197
       -
       						"uri": postURI,

     

       198
       198
       -
       						"cid": postCID,

     

       199
       199
       -
       					},

     

       200
       200
       -
       					"direction": "down",

     

       201
       201
       -
       					"createdAt": time.Now().Format(time.RFC3339),

     

       202
       202
       -
       				},

     

       203
       203
       -
       			},

     

       204
       204
       -
       		}

     

       205
       205
       -
       

     

       206
       206
       -
       		consumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       207
       207
       -
       		err := consumer.HandleEvent(ctx, &jetstreamEvent)

     

       208
       208
       -
       		require.NoError(t, err, "Consumer should process downvote")

     

       209
       209
       -
       

     

       210
       210
       -
       		// Verify vote indexed

     

       211
       211
       -
       		indexedVote, err := voteRepo.GetByURI(ctx, voteURI)

     

       212
       212
       -
       		require.NoError(t, err, "Downvote should be indexed")

     

       213
       213
       -
       		assert.Equal(t, "down", indexedVote.Direction, "Direction should be 'down'")

     

       214
       214
       -
       

     

       215
       215
       -
       		// Verify post counts (now has 1 upvote + 1 downvote from previous test)

     

       216
       216
       -
       		updatedPost, err := postRepo.GetByURI(ctx, postURI)

     

       217
       217
       -
       		require.NoError(t, err)

     

       218
       218
       -
       		assert.Equal(t, 1, updatedPost.UpvoteCount, "Upvote count should still be 1")

     

       219
       219
       -
       		assert.Equal(t, 1, updatedPost.DownvoteCount, "Downvote count should be 1")

     

       220
       220
       -
       		assert.Equal(t, 0, updatedPost.Score, "Score should be 0 (1 up - 1 down)")

     

       221
       221
       -
       

     

       222
       222
       -
       		t.Logf("✓ Downvote indexed, post counts: up=%d down=%d score=%d",

     

       223
       223
       -
       			updatedPost.UpvoteCount, updatedPost.DownvoteCount, updatedPost.Score)

     

       224
       224
       -
       	})

     

       225
       225
       -
       

     

       226
       226
       -
       	t.Run("Delete vote and verify counts decremented", func(t *testing.T) {

     

       227
       227
       -
       		ctx := context.Background()

     

       228
       228
       -
       

     

       229
       229
       -
       		// Create a different voter for this test

     

       230
       230
       -
       		deletevoter := createTestUser(t, db, "deletevoter.test", "did:plc:votee2edeletevoter")

     

       231
       231
       -
       

     

       232
       232
       -
       		// Get current counts

     

       233
       233
       -
       		beforePost, _ := postRepo.GetByURI(ctx, postURI)

     

       234
       234
       -
       

     

       235
       235
       -
       		// Create a vote first

     

       236
       236
       -
       		voteRkey := generateTID()

     

       237
       237
       -
       		voteURI := fmt.Sprintf("at://%s/social.coves.interaction.vote/%s", deletevoter.DID, voteRkey)

     

       238
       238
       -
       

     

       239
       239
       -
       		createEvent := jetstream.JetstreamEvent{

     

       240
       240
       -
       			Did:  deletevoter.DID,

     

       241
       241
       -
       			Kind: "commit",

     

       242
       242
       -
       			Commit: &jetstream.CommitEvent{

     

       243
       243
       -
       				Operation:  "create",

     

       244
       244
       -
       				Collection: "social.coves.interaction.vote",

     

       245
       245
       -
       				RKey:       voteRkey,

     

       246
       246
       -
       				CID:        "bafy2bzacedeleteme",

     

       247
       247
       -
       				Record: map[string]interface{}{

     

       248
       248
       -
       					"$type": "social.coves.interaction.vote",

     

       249
       249
       -
       					"subject": map[string]interface{}{

     

       250
       250
       -
       						"uri": postURI,

     

       251
       251
       -
       						"cid": postCID,

     

       252
       252
       -
       					},

     

       253
       253
       -
       					"direction": "up",

     

       254
       254
       -
       					"createdAt": time.Now().Format(time.RFC3339),

     

       255
       255
       -
       				},

     

       256
       256
       -
       			},

     

       257
       257
       -
       		}

     

       258
       258
       -
       

     

       259
       259
       -
       		consumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       260
       260
       -
       		err := consumer.HandleEvent(ctx, &createEvent)

     

       261
       261
       -
       		require.NoError(t, err)

     

       262
       262
       -
       

     

       263
       263
       -
       		// Now delete it

     

       264
       264
       -
       		deleteEvent := jetstream.JetstreamEvent{

     

       265
       265
       -
       			Did:  deletevoter.DID,

     

       266
       266
       -
       			Kind: "commit",

     

       267
       267
       -
       			Commit: &jetstream.CommitEvent{

     

       268
       268
       -
       				Operation:  "delete",

     

       269
       269
       -
       				Collection: "social.coves.interaction.vote",

     

       270
       270
       -
       				RKey:       voteRkey,

     

       271
       271
       -
       			},

     

       272
       272
       -
       		}

     

       273
       273
       -
       

     

       274
       274
       -
       		err = consumer.HandleEvent(ctx, &deleteEvent)

     

       275
       275
       -
       		require.NoError(t, err, "Consumer should process delete")

     

       276
       276
       -
       

     

       277
       277
       -
       		// Verify vote is soft-deleted

     

       278
       278
       -
       		deletedVote, err := voteRepo.GetByURI(ctx, voteURI)

     

       279
       279
       -
       		require.NoError(t, err, "Vote should still exist (soft delete)")

     

       280
       280
       -
       		assert.NotNil(t, deletedVote.DeletedAt, "Vote should have deleted_at timestamp")

     

       281
       281
       -
       

     

       282
       282
       -
       		// Verify post counts decremented

     

       283
       283
       -
       		afterPost, err := postRepo.GetByURI(ctx, postURI)

     

       284
       284
       -
       		require.NoError(t, err)

     

       285
       285
       -
       		assert.Equal(t, beforePost.UpvoteCount, afterPost.UpvoteCount,

     

       286
       286
       -
       			"Upvote count should be back to original (delete decremented)")

     

       287
       287
       -
       

     

       288
       288
       -
       		t.Logf("✓ Vote deleted, counts decremented correctly")

     

       289
       289
       -
       	})

     

       290
       290
       -
       

     

       291
       291
       -
       	t.Run("Idempotent indexing - duplicate events", func(t *testing.T) {

     

       292
       292
       -
       		ctx := context.Background()

     

       293
       293
       -
       

     

       294
       294
       -
       		// Create a different voter for this test

     

       295
       295
       -
       		idempotentvoter := createTestUser(t, db, "idempotentvoter.test", "did:plc:votee2eidempotent")

     

       296
       296
       -
       

     

       297
       297
       -
       		// Create a vote

     

       298
       298
       -
       		voteRkey := generateTID()

     

       299
       299
       -
       		voteURI := fmt.Sprintf("at://%s/social.coves.interaction.vote/%s", idempotentvoter.DID, voteRkey)

     

       300
       300
       -
       

     

       301
       301
       -
       		event := jetstream.JetstreamEvent{

     

       302
       302
       -
       			Did:  idempotentvoter.DID,

     

       303
       303
       -
       			Kind: "commit",

     

       304
       304
       -
       			Commit: &jetstream.CommitEvent{

     

       305
       305
       -
       				Operation:  "create",

     

       306
       306
       -
       				Collection: "social.coves.interaction.vote",

     

       307
       307
       -
       				RKey:       voteRkey,

     

       308
       308
       -
       				CID:        "bafy2bzaceidempotent",

     

       309
       309
       -
       				Record: map[string]interface{}{

     

       310
       310
       -
       					"$type": "social.coves.interaction.vote",

     

       311
       311
       -
       					"subject": map[string]interface{}{

     

       312
       312
       -
       						"uri": postURI,

     

       313
       313
       -
       						"cid": postCID,

     

       314
       314
       -
       					},

     

       315
       315
       -
       					"direction": "up",

     

       316
       316
       -
       					"createdAt": time.Now().Format(time.RFC3339),

     

       317
       317
       -
       				},

     

       318
       318
       -
       			},

     

       319
       319
       -
       		}

     

       320
       320
       -
       

     

       321
       321
       -
       		consumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       322
       322
       -
       

     

       323
       323
       -
       		// First event - should succeed

     

       324
       324
       -
       		err := consumer.HandleEvent(ctx, &event)

     

       325
       325
       -
       		require.NoError(t, err, "First event should succeed")

     

       326
       326
       -
       

     

       327
       327
       -
       		// Get counts after first event

     

       328
       328
       -
       		firstPost, _ := postRepo.GetByURI(ctx, postURI)

     

       329
       329
       -
       

     

       330
       330
       -
       		// Second event (duplicate) - should be handled gracefully

     

       331
       331
       -
       		err = consumer.HandleEvent(ctx, &event)

     

       332
       332
       -
       		require.NoError(t, err, "Duplicate event should be handled gracefully")

     

       333
       333
       -
       

     

       334
       334
       -
       		// Verify counts NOT incremented again (idempotent)

     

       335
       335
       -
       		secondPost, err := postRepo.GetByURI(ctx, postURI)

     

       336
       336
       -
       		require.NoError(t, err)

     

       337
       337
       -
       		assert.Equal(t, firstPost.UpvoteCount, secondPost.UpvoteCount,

     

       338
       338
       -
       			"Duplicate event should not increment count again")

     

       339
       339
       -
       

     

       340
       340
       -
       		// Verify only one vote in database

     

       341
       341
       -
       		vote, err := voteRepo.GetByURI(ctx, voteURI)

     

       342
       342
       -
       		require.NoError(t, err)

     

       343
       343
       -
       		assert.Equal(t, voteURI, vote.URI, "Should still be the same vote")

     

       344
       344
       -
       

     

       345
       345
       -
       		t.Logf("✓ Idempotency test passed - duplicate event handled correctly")

     

       346
       346
       -
       	})

     

       347
       347
       -
       

     

       348
       348
       -
       	t.Run("Security: Vote from wrong repository rejected", func(t *testing.T) {

     

       349
       349
       -
       		ctx := context.Background()

     

       350
       350
       -
       

     

       351
       351
       -
       		// SECURITY TEST: Try to create a vote that claims to be from the voter

     

       352
       352
       -
       		// but actually comes from a different user's repository

     

       353
       353
       -
       		// This should be REJECTED by the consumer

     

       354
       354
       -
       

     

       355
       355
       -
       		maliciousUser := createTestUser(t, db, "hacker.test", "did:plc:hacker123")

     

       356
       356
       -
       

     

       357
       357
       -
       		maliciousEvent := jetstream.JetstreamEvent{

     

       358
       358
       -
       			Did:  maliciousUser.DID, // Event from hacker's repo

     

       359
       359
       -
       			Kind: "commit",

     

       360
       360
       -
       			Commit: &jetstream.CommitEvent{

     

       361
       361
       -
       				Operation:  "create",

     

       362
       362
       -
       				Collection: "social.coves.interaction.vote",

     

       363
       363
       -
       				RKey:       generateTID(),

     

       364
       364
       -
       				CID:        "bafy2bzacefake",

     

       365
       365
       -
       				Record: map[string]interface{}{

     

       366
       366
       -
       					"$type": "social.coves.interaction.vote",

     

       367
       367
       -
       					"subject": map[string]interface{}{

     

       368
       368
       -
       						"uri": postURI,

     

       369
       369
       -
       						"cid": postCID,

     

       370
       370
       -
       					},

     

       371
       371
       -
       					"direction": "up",

     

       372
       372
       -
       					"createdAt": time.Now().Format(time.RFC3339),

     

       373
       373
       -
       				},

     

       374
       374
       -
       			},

     

       375
       375
       -
       		}

     

       376
       376
       -
       

     

       377
       377
       -
       		consumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       378
       378
       -
       		err := consumer.HandleEvent(ctx, &maliciousEvent)

     

       379
       379
       -
       

     

       380
       380
       -
       		// Should succeed (vote is created in hacker's repo, which is valid)

     

       381
       381
       -
       		// The vote record itself is FROM their repo, so it's legitimate

     

       382
       382
       -
       		// This is different from posts which must come from community repo

     

       383
       383
       -
       		assert.NoError(t, err, "Votes in user repos are valid")

     

       384
       384
       -
       

     

       385
       385
       -
       		t.Logf("✓ Security validation passed - user repo votes are allowed")

     

       386
       386
       -
       	})

     

       387
       387
       -
       }

     

       388
       388
       -
       

     

       389
       389
       -
       // TestVote_E2E_LivePDS tests the COMPLETE end-to-end flow with a live PDS:

     

       390
       390
       -
       // 1. HTTP POST to /xrpc/social.coves.interaction.createVote (with auth)

     

       391
       391
       -
       // 2. Handler → Service → Write to user's PDS repository

     

       392
       392
       -
       // 3. PDS → Jetstream firehose event

     

       393
       393
       -
       // 4. Jetstream consumer → Index in AppView database

     

       394
       394
       -
       // 5. Verify vote appears in database + post counts updated

     

       395
       395
       -
       //

     

       396
       396
       -
       // This is a TRUE E2E test that requires:

     

       397
       397
       -
       // - Live PDS running at PDS_URL (default: http://localhost:3001)

     

       398
       398
       -
       // - Live Jetstream running at JETSTREAM_URL (default: ws://localhost:6008/subscribe)

     

       399
       399
       -
       // - Test database running

     

       400
       400
       -
       func TestVote_E2E_LivePDS(t *testing.T) {

     

       401
       401
       -
       	if testing.Short() {

     

       402
       402
       -
       		t.Skip("Skipping live PDS E2E test in short mode")

     

       403
       403
       -
       	}

     

       404
       404
       -
       

     

       405
       405
       -
       	// Setup test database

     

       406
       406
       -
       	dbURL := os.Getenv("TEST_DATABASE_URL")

     

       407
       407
       -
       	if dbURL == "" {

     

       408
       408
       -
       		dbURL = "postgres://test_user:test_password@localhost:5434/coves_test?sslmode=disable"

     

       409
       409
       -
       	}

     

       410
       410
       -
       

     

       411
       411
       -
       	db, err := sql.Open("postgres", dbURL)

     

       412
       412
       -
       	require.NoError(t, err, "Failed to connect to test database")

     

       413
       413
       -
       	defer func() {

     

       414
       414
       -
       		if closeErr := db.Close(); closeErr != nil {

     

       415
       415
       -
       			t.Logf("Failed to close database: %v", closeErr)

     

       416
       416
       -
       		}

     

       417
       417
       -
       	}()

     

       418
       418
       -
       

     

       419
       419
       -
       	// Run migrations

     

       420
       420
       -
       	require.NoError(t, goose.SetDialect("postgres"))

     

       421
       421
       -
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       422
       422
       -
       

     

       423
       423
       -
       	// Check if PDS is running

     

       424
       424
       -
       	pdsURL := os.Getenv("PDS_URL")

     

       425
       425
       -
       	if pdsURL == "" {

     

       426
       426
       -
       		pdsURL = "http://localhost:3001"

     

       427
       427
       -
       	}

     

       428
       428
       -
       

     

       429
       429
       -
       	healthResp, err := http.Get(pdsURL + "/xrpc/_health")

     

       430
       430
       -
       	if err != nil {

     

       431
       431
       -
       		t.Skipf("PDS not running at %s: %v", pdsURL, err)

     

       432
       432
       -
       	}

     

       433
       433
       -
       	_ = healthResp.Body.Close()

     

       434
       434
       -
       

     

       435
       435
       -
       	// Check if Jetstream is running

     

       436
       436
       -
       	jetstreamHealthURL := "http://127.0.0.1:6009/metrics" // Use 127.0.0.1 for IPv4

     

       437
       437
       -
       	jetstreamResp, err := http.Get(jetstreamHealthURL)

     

       438
       438
       -
       	if err != nil {

     

       439
       439
       -
       		t.Skipf("Jetstream not running: %v", err)

     

       440
       440
       -
       	}

     

       441
       441
       -
       	_ = jetstreamResp.Body.Close()

     

       442
       442
       -
       

     

       443
       443
       -
       	ctx := context.Background()

     

       444
       444
       -
       

     

       445
       445
       -
       	// Cleanup old test data

     

       446
       446
       -
       	_, _ = db.Exec("DELETE FROM votes WHERE voter_did LIKE 'did:plc:votee2elive%' OR voter_did IN (SELECT did FROM users WHERE handle LIKE '%votee2elive%')")

     

       447
       447
       -
       	_, _ = db.Exec("DELETE FROM posts WHERE community_did LIKE 'did:plc:votee2elive%'")

     

       448
       448
       -
       	_, _ = db.Exec("DELETE FROM communities WHERE did LIKE 'did:plc:votee2elive%'")

     

       449
       449
       -
       	_, _ = db.Exec("DELETE FROM users WHERE did LIKE 'did:plc:votee2elive%' OR handle LIKE '%votee2elive%' OR handle LIKE '%authore2e%'")

     

       450
       450
       -
       

     

       451
       451
       -
       	// Setup repositories and services

     

       452
       452
       -
       	userRepo := postgres.NewUserRepository(db)

     

       453
       453
       -
       	communityRepo := postgres.NewCommunityRepository(db)

     

       454
       454
       -
       	postRepo := postgres.NewPostRepository(db)

     

       455
       455
       -
       	voteRepo := postgres.NewVoteRepository(db)

     

       456
       456
       -
       

     

       457
       457
       -
       	identityConfig := identity.DefaultConfig()

     

       458
       458
       -
       	identityResolver := identity.NewResolver(db, identityConfig)

     

       459
       459
       -
       	userService := users.NewUserService(userRepo, identityResolver, pdsURL)

     

       460
       460
       -
       

     

       461
       461
       -
       	// Create test voter

     

       462
       462
       -
       	voter := createTestUser(t, db, "votee2elive.bsky.social", "did:plc:votee2elive123")

     

       463
       463
       -
       

     

       464
       464
       -
       	// Create test community and post (simplified - using fake credentials)

     

       465
       465
       -
       	author := createTestUser(t, db, "authore2e.bsky.social", "did:plc:votee2eliveauthor")

     

       466
       466
       -
       	community := &communities.Community{

     

       467
       467
       -
       		DID:             "did:plc:votee2elivecommunity",

     

       468
       468
       -
       		Handle:          "votee2elivecommunity.test.coves.social",

     

       469
       469
       -
       		Name:            "votee2elivecommunity",

     

       470
       470
       -
       		DisplayName:     "Vote E2E Live Community",

     

       471
       471
       -
       		OwnerDID:        author.DID,

     

       472
       472
       -
       		CreatedByDID:    author.DID,

     

       473
       473
       -
       		HostedByDID:     "did:web:coves.test",

     

       474
       474
       -
       		Visibility:      "public",

     

       475
       475
       -
       		ModerationType:  "moderator",

     

       476
       476
       -
       		RecordURI:       "at://did:plc:votee2elivecommunity/social.coves.community.profile/self",

     

       477
       477
       -
       		RecordCID:       "fakecid",

     

       478
       478
       -
       		PDSAccessToken:  "fake_token",

     

       479
       479
       -
       		PDSRefreshToken: "fake_refresh",

     

       480
       480
       -
       	}

     

       481
       481
       -
       	_, err = communityRepo.Create(ctx, community)

     

       482
       482
       -
       	require.NoError(t, err)

     

       483
       483
       -
       

     

       484
       484
       -
       	postRkey := generateTID()

     

       485
       485
       -
       	postURI := fmt.Sprintf("at://%s/social.coves.post.record/%s", community.DID, postRkey)

     

       486
       486
       -
       	postCID := "bafy2bzaceposte2e"

     

       487
       487
       -
       	post := &posts.Post{

     

       488
       488
       -
       		URI:           postURI,

     

       489
       489
       -
       		CID:           postCID,

     

       490
       490
       -
       		RKey:          postRkey,

     

       491
       491
       -
       		AuthorDID:     author.DID,

     

       492
       492
       -
       		CommunityDID:  community.DID,

     

       493
       493
       -
       		Title:         stringPtr("E2E Vote Test Post"),

     

       494
       494
       -
       		Content:       stringPtr("This post will receive live votes"),

     

       495
       495
       -
       		CreatedAt:     time.Now(),

     

       496
       496
       -
       		UpvoteCount:   0,

     

       497
       497
       -
       		DownvoteCount: 0,

     

       498
       498
       -
       		Score:         0,

     

       499
       499
       -
       	}

     

       500
       500
       -
       	err = postRepo.Create(ctx, post)

     

       501
       501
       -
       	require.NoError(t, err)

     

       502
       502
       -
       

     

       503
       503
       -
       	// Setup vote service and handler

     

       504
       504
       -
       	voteService := votes.NewVoteService(voteRepo, postRepo, pdsURL)

     

       505
       505
       -
       	voteHandler := vote.NewCreateVoteHandler(voteService)

     

       506
       506
       -
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true) // Skip JWT verification for testing

     

       507
       507
       -
       

     

       508
       508
       -
       	t.Run("Live E2E: Create vote and verify via Jetstream", func(t *testing.T) {

     

       509
       509
       -
       		t.Logf("\n🔄 TRUE E2E: Creating vote via XRPC endpoint...")

     

       510
       510
       -
       

     

       511
       511
       -
       		// Authenticate voter with PDS to get real access token

     

       512
       512
       -
       		// Note: This assumes the voter account already exists on PDS

     

       513
       513
       -
       		// For a complete test, you'd create the account first via com.atproto.server.createAccount

     

       514
       514
       -
       		instanceHandle := os.Getenv("PDS_INSTANCE_HANDLE")

     

       515
       515
       -
       		instancePassword := os.Getenv("PDS_INSTANCE_PASSWORD")

     

       516
       516
       -
       		if instanceHandle == "" {

     

       517
       517
       -
       			instanceHandle = "testuser123.local.coves.dev"

     

       518
       518
       -
       		}

     

       519
       519
       -
       		if instancePassword == "" {

     

       520
       520
       -
       			instancePassword = "test-password-123"

     

       521
       521
       -
       		}

     

       522
       522
       -
       

     

       523
       523
       -
       		t.Logf("🔐 Authenticating voter with PDS as: %s", instanceHandle)

     

       524
       524
       -
       		voterAccessToken, voterDID, err := authenticateWithPDS(pdsURL, instanceHandle, instancePassword)

     

       525
       525
       -
       		if err != nil {

     

       526
       526
       -
       			t.Skipf("Failed to authenticate voter with PDS (account may not exist): %v", err)

     

       527
       527
       -
       		}

     

       528
       528
       -
       		t.Logf("✅ Authenticated - Voter DID: %s", voterDID)

     

       529
       529
       -
       

     

       530
       530
       -
       		// Update voter record to match authenticated DID

     

       531
       531
       -
       		_, err = db.Exec("UPDATE users SET did = $1 WHERE did = $2", voterDID, voter.DID)

     

       532
       532
       -
       		require.NoError(t, err)

     

       533
       533
       -
       		voter.DID = voterDID

     

       534
       534
       -
       

     

       535
       535
       -
       		// Build HTTP request for vote creation

     

       536
       536
       -
       		reqBody := map[string]interface{}{

     

       537
       537
       -
       			"subject":   postURI,

     

       538
       538
       -
       			"direction": "up",

     

       539
       539
       -
       		}

     

       540
       540
       -
       		reqJSON, err := json.Marshal(reqBody)

     

       541
       541
       -
       		require.NoError(t, err)

     

       542
       542
       -
       

     

       543
       543
       -
       		// Create HTTP request

     

       544
       544
       -
       		req := httptest.NewRequest("POST", "/xrpc/social.coves.interaction.createVote", bytes.NewReader(reqJSON))

     

       545
       545
       -
       		req.Header.Set("Content-Type", "application/json")

     

       546
       546
       -
       

     

       547
       547
       -
       		// Use REAL PDS access token (not mock JWT)

     

       548
       548
       -
       		req.Header.Set("Authorization", "Bearer "+voterAccessToken)

     

       549
       549
       -
       

     

       550
       550
       -
       		// Execute request through auth middleware + handler

     

       551
       551
       -
       		rr := httptest.NewRecorder()

     

       552
       552
       -
       		handler := authMiddleware.RequireAuth(http.HandlerFunc(voteHandler.HandleCreateVote))

     

       553
       553
       -
       		handler.ServeHTTP(rr, req)

     

       554
       554
       -
       

     

       555
       555
       -
       		// Check response

     

       556
       556
       -
       		require.Equal(t, http.StatusOK, rr.Code, "Handler should return 200 OK, body: %s", rr.Body.String())

     

       557
       557
       -
       

     

       558
       558
       -
       		// Parse response

     

       559
       559
       -
       		var response map[string]interface{}

     

       560
       560
       -
       		err = json.NewDecoder(rr.Body).Decode(&response)

     

       561
       561
       -
       		require.NoError(t, err, "Failed to parse response")

     

       562
       562
       -
       

     

       563
       563
       -
       		voteURI := response["uri"].(string)

     

       564
       564
       -
       		voteCID := response["cid"].(string)

     

       565
       565
       -
       

     

       566
       566
       -
       		t.Logf("✅ Vote created on PDS:")

     

       567
       567
       -
       		t.Logf("   URI: %s", voteURI)

     

       568
       568
       -
       		t.Logf("   CID: %s", voteCID)

     

       569
       569
       -
       

     

       570
       570
       -
       		// ====================================================================================

     

       571
       571
       -
       		// Part 2: Query the PDS to verify the vote record exists

     

       572
       572
       -
       		// ====================================================================================

     

       573
       573
       -
       		t.Run("2a. Verify vote record on PDS", func(t *testing.T) {

     

       574
       574
       -
       			t.Logf("\n📡 Querying PDS for vote record...")

     

       575
       575
       -
       

     

       576
       576
       -
       			// Extract rkey from vote URI (at://did/collection/rkey)

     

       577
       577
       -
       			parts := strings.Split(voteURI, "/")

     

       578
       578
       -
       			rkey := parts[len(parts)-1]

     

       579
       579
       -
       

     

       580
       580
       -
       			// Query PDS for the vote record

     

       581
       581
       -
       			getRecordURL := fmt.Sprintf("%s/xrpc/com.atproto.repo.getRecord?repo=%s&collection=%s&rkey=%s",

     

       582
       582
       -
       				pdsURL, voterDID, "social.coves.interaction.vote", rkey)

     

       583
       583
       -
       

     

       584
       584
       -
       			t.Logf("   GET %s", getRecordURL)

     

       585
       585
       -
       

     

       586
       586
       -
       			pdsResp, err := http.Get(getRecordURL)

     

       587
       587
       -
       			require.NoError(t, err, "Failed to query PDS")

     

       588
       588
       -
       			defer pdsResp.Body.Close()

     

       589
       589
       -
       

     

       590
       590
       -
       			require.Equal(t, http.StatusOK, pdsResp.StatusCode, "Vote record should exist on PDS")

     

       591
       591
       -
       

     

       592
       592
       -
       			var pdsRecord struct {

     

       593
       593
       -
       				Value map[string]interface{} `json:"value"`

     

       594
       594
       -
       				URI   string                 `json:"uri"`

     

       595
       595
       -
       				CID   string                 `json:"cid"`

     

       596
       596
       -
       			}

     

       597
       597
       -
       

     

       598
       598
       -
       			err = json.NewDecoder(pdsResp.Body).Decode(&pdsRecord)

     

       599
       599
       -
       			require.NoError(t, err, "Failed to decode PDS response")

     

       600
       600
       -
       

     

       601
       601
       -
       			t.Logf("✅ Vote record found on PDS!")

     

       602
       602
       -
       			t.Logf("   URI:       %s", pdsRecord.URI)

     

       603
       603
       -
       			t.Logf("   CID:       %s", pdsRecord.CID)

     

       604
       604
       -
       			t.Logf("   Direction: %v", pdsRecord.Value["direction"])

     

       605
       605
       -
       			t.Logf("   Subject:   %v", pdsRecord.Value["subject"])

     

       606
       606
       -
       

     

       607
       607
       -
       			// Verify the record matches what we created

     

       608
       608
       -
       			assert.Equal(t, voteURI, pdsRecord.URI, "PDS URI should match")

     

       609
       609
       -
       			assert.Equal(t, voteCID, pdsRecord.CID, "PDS CID should match")

     

       610
       610
       -
       			assert.Equal(t, "up", pdsRecord.Value["direction"], "Direction should be 'up'")

     

       611
       611
       -
       

     

       612
       612
       -
       			// Print full record for inspection

     

       613
       613
       -
       			recordJSON, _ := json.MarshalIndent(pdsRecord.Value, "   ", "  ")

     

       614
       614
       -
       			t.Logf("   Full record:\n   %s", string(recordJSON))

     

       615
       615
       -
       		})

     

       616
       616
       -
       

     

       617
       617
       -
       		// ====================================================================================

     

       618
       618
       -
       		// Part 2b: TRUE E2E - Real Jetstream Firehose Consumer

     

       619
       619
       -
       		// ====================================================================================

     

       620
       620
       -
       		t.Run("2b. Real Jetstream Firehose Consumption", func(t *testing.T) {

     

       621
       621
       -
       			t.Logf("\n🔄 TRUE E2E: Subscribing to real Jetstream firehose...")

     

       622
       622
       -
       

     

       623
       623
       -
       			// Get PDS hostname for Jetstream filtering

     

       624
       624
       -
       			pdsHostname := strings.TrimPrefix(pdsURL, "http://")

     

       625
       625
       -
       			pdsHostname = strings.TrimPrefix(pdsHostname, "https://")

     

       626
       626
       -
       			pdsHostname = strings.Split(pdsHostname, ":")[0] // Remove port

     

       627
       627
       -
       

     

       628
       628
       -
       			// Build Jetstream URL with filters for vote records

     

       629
       629
       -
       			jetstreamURL := fmt.Sprintf("ws://%s:6008/subscribe?wantedCollections=social.coves.interaction.vote",

     

       630
       630
       -
       				pdsHostname)

     

       631
       631
       -
       

     

       632
       632
       -
       			t.Logf("   Jetstream URL: %s", jetstreamURL)

     

       633
       633
       -
       			t.Logf("   Looking for vote URI: %s", voteURI)

     

       634
       634
       -
       			t.Logf("   Voter DID: %s", voterDID)

     

       635
       635
       -
       

     

       636
       636
       -
       			// Create vote consumer (same as main.go)

     

       637
       637
       -
       			consumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       638
       638
       -
       

     

       639
       639
       -
       			// Channels to receive the event

     

       640
       640
       -
       			eventChan := make(chan *jetstream.JetstreamEvent, 10)

     

       641
       641
       -
       			errorChan := make(chan error, 1)

     

       642
       642
       -
       			done := make(chan bool)

     

       643
       643
       -
       

     

       644
       644
       -
       			// Start Jetstream WebSocket subscriber in background

     

       645
       645
       -
       			go func() {

     

       646
       646
       -
       				err := subscribeToJetstreamForVote(ctx, jetstreamURL, voterDID, postURI, consumer, eventChan, errorChan, done)

     

       647
       647
       -
       				if err != nil {

     

       648
       648
       -
       					errorChan <- err

     

       649
       649
       -
       				}

     

       650
       650
       -
       			}()

     

       651
       651
       -
       

     

       652
       652
       -
       			// Wait for event or timeout

     

       653
       653
       -
       			t.Logf("⏳ Waiting for Jetstream event (max 30 seconds)...")

     

       654
       654
       -
       

     

       655
       655
       -
       			select {

     

       656
       656
       -
       			case event := <-eventChan:

     

       657
       657
       -
       				t.Logf("✅ Received real Jetstream event!")

     

       658
       658
       -
       				t.Logf("   Event DID:    %s", event.Did)

     

       659
       659
       -
       				t.Logf("   Collection:   %s", event.Commit.Collection)

     

       660
       660
       -
       				t.Logf("   Operation:    %s", event.Commit.Operation)

     

       661
       661
       -
       				t.Logf("   RKey:         %s", event.Commit.RKey)

     

       662
       662
       -
       

     

       663
       663
       -
       				// Verify it's for our voter

     

       664
       664
       -
       				assert.Equal(t, voterDID, event.Did, "Event should be from voter's repo")

     

       665
       665
       -
       

     

       666
       666
       -
       				// Verify vote was indexed in AppView database

     

       667
       667
       -
       				t.Logf("\n🔍 Querying AppView database for indexed vote...")

     

       668
       668
       -
       

     

       669
       669
       -
       				indexedVote, err := voteRepo.GetByVoterAndSubject(ctx, voterDID, postURI)

     

       670
       670
       -
       				require.NoError(t, err, "Vote should be indexed in AppView")

     

       671
       671
       -
       

     

       672
       672
       -
       				t.Logf("✅ Vote indexed in AppView:")

     

       673
       673
       -
       				t.Logf("   URI:        %s", indexedVote.URI)

     

       674
       674
       -
       				t.Logf("   CID:        %s", indexedVote.CID)

     

       675
       675
       -
       				t.Logf("   Voter DID:  %s", indexedVote.VoterDID)

     

       676
       676
       -
       				t.Logf("   Subject:    %s", indexedVote.SubjectURI)

     

       677
       677
       -
       				t.Logf("   Direction:  %s", indexedVote.Direction)

     

       678
       678
       -
       

     

       679
       679
       -
       				// Verify all fields match

     

       680
       680
       -
       				assert.Equal(t, voteURI, indexedVote.URI, "URI should match")

     

       681
       681
       -
       				assert.Equal(t, voteCID, indexedVote.CID, "CID should match")

     

       682
       682
       -
       				assert.Equal(t, voterDID, indexedVote.VoterDID, "Voter DID should match")

     

       683
       683
       -
       				assert.Equal(t, postURI, indexedVote.SubjectURI, "Subject URI should match")

     

       684
       684
       -
       				assert.Equal(t, "up", indexedVote.Direction, "Direction should be 'up'")

     

       685
       685
       -
       

     

       686
       686
       -
       				// Verify post counts were updated

     

       687
       687
       -
       				t.Logf("\n🔍 Verifying post vote counts updated...")

     

       688
       688
       -
       				updatedPost, err := postRepo.GetByURI(ctx, postURI)

     

       689
       689
       -
       				require.NoError(t, err, "Post should exist")

     

       690
       690
       -
       

     

       691
       691
       -
       				t.Logf("✅ Post vote counts updated:")

     

       692
       692
       -
       				t.Logf("   Upvotes:   %d", updatedPost.UpvoteCount)

     

       693
       693
       -
       				t.Logf("   Downvotes: %d", updatedPost.DownvoteCount)

     

       694
       694
       -
       				t.Logf("   Score:     %d", updatedPost.Score)

     

       695
       695
       -
       

     

       696
       696
       -
       				assert.Equal(t, 1, updatedPost.UpvoteCount, "Upvote count should be 1")

     

       697
       697
       -
       				assert.Equal(t, 0, updatedPost.DownvoteCount, "Downvote count should be 0")

     

       698
       698
       -
       				assert.Equal(t, 1, updatedPost.Score, "Score should be 1")

     

       699
       699
       -
       

     

       700
       700
       -
       				// Signal to stop Jetstream consumer

     

       701
       701
       -
       				close(done)

     

       702
       702
       -
       

     

       703
       703
       -
       				t.Log("\n✅ TRUE E2E COMPLETE: PDS → Jetstream → Consumer → AppView ✓")

     

       704
       704
       -
       

     

       705
       705
       -
       			case err := <-errorChan:

     

       706
       706
       -
       				t.Fatalf("❌ Jetstream error: %v", err)

     

       707
       707
       -
       

     

       708
       708
       -
       			case <-time.After(30 * time.Second):

     

       709
       709
       -
       				t.Fatalf("❌ Timeout: No Jetstream event received within 30 seconds")

     

       710
       710
       -
       			}

     

       711
       711
       -
       		})

     

       712
       712
       -
       	})

     

       713
       713
       -
       }

     

       714
       714
       -
       

     

       715
       715
       -
       // subscribeToJetstreamForVote subscribes to real Jetstream firehose and processes vote events

     

       716
       716
       -
       // This helper creates a WebSocket connection to Jetstream and waits for vote events

     

       717
       717
       -
       func subscribeToJetstreamForVote(

     

       718
       718
       -
       	ctx context.Context,

     

       719
       719
       -
       	jetstreamURL string,

     

       720
       720
       -
       	targetVoterDID string,

     

       721
       721
       -
       	targetSubjectURI string,

     

       722
       722
       -
       	consumer *jetstream.VoteEventConsumer,

     

       723
       723
       -
       	eventChan chan<- *jetstream.JetstreamEvent,

     

       724
       724
       -
       	errorChan chan<- error,

     

       725
       725
       -
       	done <-chan bool,

     

       726
       726
       -
       ) error {

     

       727
       727
       -
       	conn, _, err := websocket.DefaultDialer.Dial(jetstreamURL, nil)

     

       728
       728
       -
       	if err != nil {

     

       729
       729
       -
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       730
       730
       -
       	}

     

       731
       731
       -
       	defer func() { _ = conn.Close() }()

     

       732
       732
       -
       

     

       733
       733
       -
       	// Read messages until we find our event or receive done signal

     

       734
       734
       -
       	for {

     

       735
       735
       -
       		select {

     

       736
       736
       -
       		case <-done:

     

       737
       737
       -
       			return nil

     

       738
       738
       -
       		case <-ctx.Done():

     

       739
       739
       -
       			return ctx.Err()

     

       740
       740
       -
       		default:

     

       741
       741
       -
       			// Set read deadline to avoid blocking forever

     

       742
       742
       -
       			if err := conn.SetReadDeadline(time.Now().Add(5 * time.Second)); err != nil {

     

       743
       743
       -
       				return fmt.Errorf("failed to set read deadline: %w", err)

     

       744
       744
       -
       			}

     

       745
       745
       -
       

     

       746
       746
       -
       			var event jetstream.JetstreamEvent

     

       747
       747
       -
       			err := conn.ReadJSON(&event)

     

       748
       748
       -
       			if err != nil {

     

       749
       749
       -
       				// Check if it's a timeout (expected)

     

       750
       750
       -
       				if websocket.IsCloseError(err, websocket.CloseNormalClosure) {

     

       751
       751
       -
       					return nil

     

       752
       752
       -
       				}

     

       753
       753
       -
       				if netErr, ok := err.(net.Error); ok && netErr.Timeout() {

     

       754
       754
       -
       					continue // Timeout is expected, keep listening

     

       755
       755
       -
       				}

     

       756
       756
       -
       				return fmt.Errorf("failed to read Jetstream message: %w", err)

     

       757
       757
       -
       			}

     

       758
       758
       -
       

     

       759
       759
       -
       			// Check if this is a vote event for the target voter + subject

     

       760
       760
       -
       			if event.Did == targetVoterDID && event.Kind == "commit" &&

     

       761
       761
       -
       				event.Commit != nil && event.Commit.Collection == "social.coves.interaction.vote" {

     

       762
       762
       -
       

     

       763
       763
       -
       				// Verify it's for the target subject

     

       764
       764
       -
       				record := event.Commit.Record

     

       765
       765
       -
       				if subject, ok := record["subject"].(map[string]interface{}); ok {

     

       766
       766
       -
       					if subjectURI, ok := subject["uri"].(string); ok && subjectURI == targetSubjectURI {

     

       767
       767
       -
       						// This is our vote! Process it

     

       768
       768
       -
       						if err := consumer.HandleEvent(ctx, &event); err != nil {

     

       769
       769
       -
       							return fmt.Errorf("failed to process event: %w", err)

     

       770
       770
       -
       						}

     

       771
       771
       -
       

     

       772
       772
       -
       						// Send to channel so test can verify

     

       773
       773
       -
       						select {

     

       774
       774
       -
       						case eventChan <- &event:

     

       775
       775
       -
       							return nil

     

       776
       776
       -
       						case <-time.After(1 * time.Second):

     

       777
       777
       -
       							return fmt.Errorf("timeout sending event to channel")

     

       778
       778
       -
       						}

     

       779
       779
       -
       					}

     

       780
       780
       -
       				}

     

       781
       781
       -
       			}

     

       782
       782
       -
       		}

     

       783
       783
       -
       	}

     

       784
       784
       -
       }

     

       785
       785
       -
       

     

       786
       786
       -
       // Helper function

     

       787
       787
       -
       func stringPtr(s string) *string {

     

       788
       788
       -
       	return &s

     

       789
       789
       -
       }

-67

internal/atproto/lexicon/social/coves/interaction/createVote.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.createVote",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Vote on a post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject", "direction"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to vote on"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "direction": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "enum": ["up", "down"],

     

       22
       22
       -
                     "description": "Vote direction"

     

       23
       23
       -
                   }

     

       24
       24
       -
                 }

     

       25
       25
       -
               }

     

       26
       26
       -
             },

     

       27
       27
       -
             "output": {

     

       28
       28
       -
               "encoding": "application/json",

     

       29
       29
       -
               "schema": {

     

       30
       30
       -
                 "type": "object",

     

       31
       31
       -
                 "required": ["uri", "cid"],

     

       32
       32
       -
                 "properties": {

     

       33
       33
       -
                   "uri": {

     

       34
       34
       -
                     "type": "string",

     

       35
       35
       -
                     "format": "at-uri",

     

       36
       36
       -
                     "description": "AT-URI of the created vote record"

     

       37
       37
       -
                   },

     

       38
       38
       -
                   "cid": {

     

       39
       39
       -
                     "type": "string",

     

       40
       40
       -
                     "format": "cid",

     

       41
       41
       -
                     "description": "CID of the created vote record"

     

       42
       42
       -
                   },

     

       43
       43
       -
                   "existing": {

     

       44
       44
       -
                     "type": "string",

     

       45
       45
       -
                     "format": "at-uri",

     

       46
       46
       -
                     "description": "AT-URI of existing vote if updating"

     

       47
       47
       -
                   }

     

       48
       48
       -
                 }

     

       49
       49
       -
               }

     

       50
       50
       -
             },

     

       51
       51
       -
             "errors": [

     

       52
       52
       -
               {

     

       53
       53
       -
                 "name": "SubjectNotFound",

     

       54
       54
       -
                 "description": "Post or comment not found"

     

       55
       55
       -
               },

     

       56
       56
       -
               {

     

       57
       57
       -
                 "name": "NotAuthorized",

     

       58
       58
       -
                 "description": "User is not authorized to vote"

     

       59
       59
       -
               },

     

       60
       60
       -
               {

     

       61
       61
       -
                 "name": "Banned",

     

       62
       62
       -
                 "description": "User is banned from this community"

     

       63
       63
       -
               }

     

       64
       64
       -
             ]

     

       65
       65
       -
           }

     

       66
       66
       -
         }

     

       67
       67
       -
       }

-37

internal/atproto/lexicon/social/coves/interaction/deleteVote.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.deleteVote",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Remove a vote from a post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to remove vote from"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "VoteNotFound",

     

       32
       32
       -
                 "description": "No vote found on this subject"

     

       33
       33
       -
               }

     

       34
       34
       -
             ]

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

+27 -27

internal/core/aggregators/aggregator.go

···

       6
       6
        
       // Aggregators are autonomous services that can post content to communities after authorization

     

       7
       7
        
       // Following Bluesky's pattern: app.bsky.feed.generator and app.bsky.labeler.service

     

       8
       8
        
       type Aggregator struct {

     

       9
       9
       -
       	DID              string    `json:"did" db:"did"`                                // Aggregator's DID (primary key)

     

       10
       10
       -
       	DisplayName      string    `json:"displayName" db:"display_name"`               // Human-readable name

     

       11
       11
       -
       	Description      string    `json:"description,omitempty" db:"description"`      // What the aggregator does

     

       12
       12
       -
       	AvatarURL        string    `json:"avatarUrl,omitempty" db:"avatar_url"`         // Optional avatar image URL

     

       13
       13
       -
       	ConfigSchema     []byte    `json:"configSchema,omitempty" db:"config_schema"`   // JSON Schema for configuration (JSONB)

     

       14
       14
       -
       	MaintainerDID    string    `json:"maintainerDid,omitempty" db:"maintainer_did"` // Contact for support/issues

     

       15
       15
       -
       	SourceURL        string    `json:"sourceUrl,omitempty" db:"source_url"`         // Source code URL (transparency)

     

       16
       16
       -
       	CommunitiesUsing int       `json:"communitiesUsing" db:"communities_using"`     // Auto-updated by trigger

     

       17
       17
       -
       	PostsCreated     int       `json:"postsCreated" db:"posts_created"`             // Auto-updated by trigger

     

       18
       18
       -
       	CreatedAt        time.Time `json:"createdAt" db:"created_at"`                   // When aggregator was created (from lexicon)

     

       19
       19
       -
       	IndexedAt        time.Time `json:"indexedAt" db:"indexed_at"`                   // When we indexed this record

     

       20
       20
       -
       	RecordURI        string    `json:"recordUri,omitempty" db:"record_uri"`         // at://did/social.coves.aggregator.service/self

     

       21
       21
       -
       	RecordCID        string    `json:"recordCid,omitempty" db:"record_cid"`         // Content hash

     

       9
       9
       +
       	CreatedAt        time.Time `json:"createdAt" db:"created_at"`

     

       10
       10
       +
       	IndexedAt        time.Time `json:"indexedAt" db:"indexed_at"`

     

       11
       11
       +
       	AvatarURL        string    `json:"avatarUrl,omitempty" db:"avatar_url"`

     

       12
       12
       +
       	DID              string    `json:"did" db:"did"`

     

       13
       13
       +
       	MaintainerDID    string    `json:"maintainerDid,omitempty" db:"maintainer_did"`

     

       14
       14
       +
       	SourceURL        string    `json:"sourceUrl,omitempty" db:"source_url"`

     

       15
       15
       +
       	Description      string    `json:"description,omitempty" db:"description"`

     

       16
       16
       +
       	DisplayName      string    `json:"displayName" db:"display_name"`

     

       17
       17
       +
       	RecordURI        string    `json:"recordUri,omitempty" db:"record_uri"`

     

       18
       18
       +
       	RecordCID        string    `json:"recordCid,omitempty" db:"record_cid"`

     

       19
       19
       +
       	ConfigSchema     []byte    `json:"configSchema,omitempty" db:"config_schema"`

     

       20
       20
       +
       	CommunitiesUsing int       `json:"communitiesUsing" db:"communities_using"`

     

       21
       21
       +
       	PostsCreated     int       `json:"postsCreated" db:"posts_created"`

     

       22
       22
        
       }

     

       23
       23
        
       

     

       24
       24
        
       // Authorization represents a community's authorization for an aggregator

     

       25
       25
        
       // Stored in community's repository: at://community_did/social.coves.aggregator.authorization/{rkey}

     

       26
       26
        
       type Authorization struct {

     

       27
       27
       -
       	ID            int        `json:"id" db:"id"`                            // Database ID

     

       28
       28
       -
       	AggregatorDID string     `json:"aggregatorDid" db:"aggregator_did"`     // Which aggregator

     

       29
       29
       -
       	CommunityDID  string     `json:"communityDid" db:"community_did"`       // Which community

     

       30
       30
       -
       	Enabled       bool       `json:"enabled" db:"enabled"`                  // Current status

     

       31
       31
       -
       	Config        []byte     `json:"config,omitempty" db:"config"`          // Aggregator-specific config (JSONB)

     

       32
       32
       -
       	CreatedBy     string     `json:"createdBy,omitempty" db:"created_by"`   // Moderator DID who enabled it

     

       33
       33
       -
       	DisabledBy    string     `json:"disabledBy,omitempty" db:"disabled_by"` // Moderator DID who disabled it

     

       34
       34
       -
       	CreatedAt     time.Time  `json:"createdAt" db:"created_at"`             // When authorization was created

     

       35
       35
       -
       	DisabledAt    *time.Time `json:"disabledAt,omitempty" db:"disabled_at"` // When authorization was disabled (for modlog/audit)

     

       36
       36
       -
       	IndexedAt     time.Time  `json:"indexedAt" db:"indexed_at"`             // When we indexed this record

     

       37
       37
       -
       	RecordURI     string     `json:"recordUri,omitempty" db:"record_uri"`   // at://community_did/social.coves.aggregator.authorization/{rkey}

     

       38
       38
       -
       	RecordCID     string     `json:"recordCid,omitempty" db:"record_cid"`   // Content hash

     

       27
       27
       +
       	CreatedAt     time.Time  `json:"createdAt" db:"created_at"`

     

       28
       28
       +
       	IndexedAt     time.Time  `json:"indexedAt" db:"indexed_at"`

     

       29
       29
       +
       	DisabledAt    *time.Time `json:"disabledAt,omitempty" db:"disabled_at"`

     

       30
       30
       +
       	AggregatorDID string     `json:"aggregatorDid" db:"aggregator_did"`

     

       31
       31
       +
       	CommunityDID  string     `json:"communityDid" db:"community_did"`

     

       32
       32
       +
       	CreatedBy     string     `json:"createdBy,omitempty" db:"created_by"`

     

       33
       33
       +
       	DisabledBy    string     `json:"disabledBy,omitempty" db:"disabled_by"`

     

       34
       34
       +
       	RecordURI     string     `json:"recordUri,omitempty" db:"record_uri"`

     

       35
       35
       +
       	RecordCID     string     `json:"recordCid,omitempty" db:"record_cid"`

     

       36
       36
       +
       	Config        []byte     `json:"config,omitempty" db:"config"`

     

       37
       37
       +
       	ID            int        `json:"id" db:"id"`

     

       38
       38
       +
       	Enabled       bool       `json:"enabled" db:"enabled"`

     

       39
       39
        
       }

     

       40
       40
        
       

     

       41
       41
        
       // AggregatorPost represents tracking of posts created by aggregators

     

       42
       42
        
       // AppView-only table for rate limiting and statistics

     

       43
       43
        
       type AggregatorPost struct {

     

       44
       44
       -
       	ID            int       `json:"id" db:"id"`

     

       44
       44
       +
       	CreatedAt     time.Time `json:"createdAt" db:"created_at"`

     

       45
       45
        
       	AggregatorDID string    `json:"aggregatorDid" db:"aggregator_did"`

     

       46
       46
        
       	CommunityDID  string    `json:"communityDid" db:"community_did"`

     

       47
       47
        
       	PostURI       string    `json:"postUri" db:"post_uri"`

     

       48
       48
        
       	PostCID       string    `json:"postCid" db:"post_cid"`

     

       49
       49
       -
       	CreatedAt     time.Time `json:"createdAt" db:"created_at"`

     

       49
       49
       +
       	ID            int       `json:"id" db:"id"`

     

       50
       50
        
       }

     

       51
       51
        
       

     

       52
       52
        
       // EnableAggregatorRequest represents input for enabling an aggregator in a community

+100

internal/atproto/lexicon/social/coves/community/post.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.post",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "record",

     

       7
       7
       +
             "description": "A post in a Coves community. Posts live in community repositories and persist independently of the author.",

     

       8
       8
       +
             "key": "tid",

     

       9
       9
       +
             "record": {

     

       10
       10
       +
               "type": "object",

     

       11
       11
       +
               "required": ["community", "author", "createdAt"],

     

       12
       12
       +
               "properties": {

     

       13
       13
       +
                 "community": {

     

       14
       14
       +
                   "type": "string",

     

       15
       15
       +
                   "format": "at-identifier",

     

       16
       16
       +
                   "description": "DID or handle of the community this was posted to"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "author": {

     

       19
       19
       +
                   "type": "string",

     

       20
       20
       +
                   "format": "did",

     

       21
       21
       +
                   "description": "DID of the user who created this post"

     

       22
       22
       +
                 },

     

       23
       23
       +
                 "title": {

     

       24
       24
       +
                   "type": "string",

     

       25
       25
       +
                   "maxGraphemes": 300,

     

       26
       26
       +
                   "maxLength": 3000,

     

       27
       27
       +
                   "description": "Post title (optional for media-only posts)"

     

       28
       28
       +
                 },

     

       29
       29
       +
                 "content": {

     

       30
       30
       +
                   "type": "string",

     

       31
       31
       +
                   "maxGraphemes": 10000,

     

       32
       32
       +
                   "maxLength": 100000,

     

       33
       33
       +
                   "description": "Post content - supports rich text via facets"

     

       34
       34
       +
                 },

     

       35
       35
       +
                 "facets": {

     

       36
       36
       +
                   "type": "array",

     

       37
       37
       +
                   "description": "Annotations for rich text (mentions, links, tags)",

     

       38
       38
       +
                   "items": {

     

       39
       39
       +
                     "type": "ref",

     

       40
       40
       +
                     "ref": "social.coves.richtext.facet"

     

       41
       41
       +
                   }

     

       42
       42
       +
                 },

     

       43
       43
       +
                 "embed": {

     

       44
       44
       +
                   "type": "union",

     

       45
       45
       +
                   "description": "Embedded media, external links, or quoted posts",

     

       46
       46
       +
                   "refs": [

     

       47
       47
       +
                     "social.coves.embed.images",

     

       48
       48
       +
                     "social.coves.embed.video",

     

       49
       49
       +
                     "social.coves.embed.external",

     

       50
       50
       +
                     "social.coves.embed.post"

     

       51
       51
       +
                   ]

     

       52
       52
       +
                 },

     

       53
       53
       +
                 "langs": {

     

       54
       54
       +
                   "type": "array",

     

       55
       55
       +
                   "description": "Languages used in the post content (ISO 639-1)",

     

       56
       56
       +
                   "maxLength": 3,

     

       57
       57
       +
                   "items": {

     

       58
       58
       +
                     "type": "string",

     

       59
       59
       +
                     "format": "language"

     

       60
       60
       +
                   }

     

       61
       61
       +
                 },

     

       62
       62
       +
                 "labels": {

     

       63
       63
       +
                   "type": "ref",

     

       64
       64
       +
                   "ref": "com.atproto.label.defs#selfLabels",

     

       65
       65
       +
                   "description": "Self-applied content labels (NSFW, spoilers, etc.)"

     

       66
       66
       +
                 },

     

       67
       67
       +
                 "tags": {

     

       68
       68
       +
                   "type": "array",

     

       69
       69
       +
                   "description": "User-applied topic tags",

     

       70
       70
       +
                   "maxLength": 8,

     

       71
       71
       +
                   "items": {

     

       72
       72
       +
                     "type": "string",

     

       73
       73
       +
                     "maxLength": 64,

     

       74
       74
       +
                     "maxGraphemes": 64

     

       75
       75
       +
                   }

     

       76
       76
       +
                 },

     

       77
       77
       +
                 "crosspostOf": {

     

       78
       78
       +
                   "type": "ref",

     

       79
       79
       +
                   "ref": "com.atproto.repo.strongRef",

     

       80
       80
       +
                   "description": "If this is a crosspost, strong reference to the immediate parent post"

     

       81
       81
       +
                 },

     

       82
       82
       +
                 "crosspostChain": {

     

       83
       83
       +
                   "type": "array",

     

       84
       84
       +
                   "description": "Full chain of crossposts with version pinning. First element is original, last is immediate parent.",

     

       85
       85
       +
                   "maxLength": 25,

     

       86
       86
       +
                   "items": {

     

       87
       87
       +
                     "type": "ref",

     

       88
       88
       +
                     "ref": "com.atproto.repo.strongRef"

     

       89
       89
       +
                   }

     

       90
       90
       +
                 },

     

       91
       91
       +
                 "createdAt": {

     

       92
       92
       +
                   "type": "string",

     

       93
       93
       +
                   "format": "datetime",

     

       94
       94
       +
                   "description": "Timestamp of post creation"

     

       95
       95
       +
                 }

     

       96
       96
       +
               }

     

       97
       97
       +
             }

     

       98
       98
       +
           }

     

       99
       99
       +
         }

     

       100
       100
       +
       }

+119

internal/atproto/lexicon/social/coves/community/post/create.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.post.create",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Create a new post in a community",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["community"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "community": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-identifier",

     

       17
       17
       +
                     "description": "DID or handle of the community to post in"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "title": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "maxGraphemes": 300,

     

       22
       22
       +
                     "maxLength": 3000,

     

       23
       23
       +
                     "description": "Post title (optional for media-only posts)"

     

       24
       24
       +
                   },

     

       25
       25
       +
                   "content": {

     

       26
       26
       +
                     "type": "string",

     

       27
       27
       +
                     "maxGraphemes": 10000,

     

       28
       28
       +
                     "maxLength": 100000,

     

       29
       29
       +
                     "description": "Post content - supports rich text via facets"

     

       30
       30
       +
                   },

     

       31
       31
       +
                   "facets": {

     

       32
       32
       +
                     "type": "array",

     

       33
       33
       +
                     "description": "Annotations for rich text (mentions, links, tags)",

     

       34
       34
       +
                     "items": {

     

       35
       35
       +
                       "type": "ref",

     

       36
       36
       +
                       "ref": "social.coves.richtext.facet"

     

       37
       37
       +
                     }

     

       38
       38
       +
                   },

     

       39
       39
       +
                   "embed": {

     

       40
       40
       +
                     "type": "union",

     

       41
       41
       +
                     "description": "Embedded media, external links, or quoted posts",

     

       42
       42
       +
                     "refs": [

     

       43
       43
       +
                       "social.coves.embed.images",

     

       44
       44
       +
                       "social.coves.embed.video",

     

       45
       45
       +
                       "social.coves.embed.external",

     

       46
       46
       +
                       "social.coves.embed.post"

     

       47
       47
       +
                     ]

     

       48
       48
       +
                   },

     

       49
       49
       +
                   "langs": {

     

       50
       50
       +
                     "type": "array",

     

       51
       51
       +
                     "description": "Languages used in the post content (ISO 639-1)",

     

       52
       52
       +
                     "maxLength": 3,

     

       53
       53
       +
                     "items": {

     

       54
       54
       +
                       "type": "string",

     

       55
       55
       +
                       "format": "language"

     

       56
       56
       +
                     }

     

       57
       57
       +
                   },

     

       58
       58
       +
                   "labels": {

     

       59
       59
       +
                     "type": "ref",

     

       60
       60
       +
                     "ref": "com.atproto.label.defs#selfLabels",

     

       61
       61
       +
                     "description": "Self-applied content labels (NSFW, spoilers, etc.)"

     

       62
       62
       +
                   },

     

       63
       63
       +
                   "tags": {

     

       64
       64
       +
                     "type": "array",

     

       65
       65
       +
                     "description": "User-applied topic tags",

     

       66
       66
       +
                     "maxLength": 8,

     

       67
       67
       +
                     "items": {

     

       68
       68
       +
                       "type": "string",

     

       69
       69
       +
                       "maxLength": 64,

     

       70
       70
       +
                       "maxGraphemes": 64

     

       71
       71
       +
                     }

     

       72
       72
       +
                   }

     

       73
       73
       +
                 }

     

       74
       74
       +
               }

     

       75
       75
       +
             },

     

       76
       76
       +
             "output": {

     

       77
       77
       +
               "encoding": "application/json",

     

       78
       78
       +
               "schema": {

     

       79
       79
       +
                 "type": "object",

     

       80
       80
       +
                 "required": ["uri", "cid"],

     

       81
       81
       +
                 "properties": {

     

       82
       82
       +
                   "uri": {

     

       83
       83
       +
                     "type": "string",

     

       84
       84
       +
                     "format": "at-uri",

     

       85
       85
       +
                     "description": "AT-URI of the created post"

     

       86
       86
       +
                   },

     

       87
       87
       +
                   "cid": {

     

       88
       88
       +
                     "type": "string",

     

       89
       89
       +
                     "format": "cid",

     

       90
       90
       +
                     "description": "CID of the created post"

     

       91
       91
       +
                   }

     

       92
       92
       +
                 }

     

       93
       93
       +
               }

     

       94
       94
       +
             },

     

       95
       95
       +
             "errors": [

     

       96
       96
       +
               {

     

       97
       97
       +
                 "name": "CommunityNotFound",

     

       98
       98
       +
                 "description": "Community not found"

     

       99
       99
       +
               },

     

       100
       100
       +
               {

     

       101
       101
       +
                 "name": "NotAuthorized",

     

       102
       102
       +
                 "description": "User is not authorized to post in this community"

     

       103
       103
       +
               },

     

       104
       104
       +
               {

     

       105
       105
       +
                 "name": "Banned",

     

       106
       106
       +
                 "description": "User is banned from this community"

     

       107
       107
       +
               },

     

       108
       108
       +
               {

     

       109
       109
       +
                 "name": "InvalidContent",

     

       110
       110
       +
                 "description": "Post content violates community rules"

     

       111
       111
       +
               },

     

       112
       112
       +
               {

     

       113
       113
       +
                 "name": "ContentRuleViolation",

     

       114
       114
       +
                 "description": "Post violates community content rules (e.g., embeds not allowed, text too short)"

     

       115
       115
       +
               }

     

       116
       116
       +
             ]

     

       117
       117
       +
           }

     

       118
       118
       +
         }

     

       119
       119
       +
       }

+41

internal/atproto/lexicon/social/coves/community/post/delete.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.post.delete",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Delete a post",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["uri"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "uri": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "at-uri",

     

       17
       17
       +
                     "description": "AT-URI of the post to delete"

     

       18
       18
       +
                   }

     

       19
       19
       +
                 }

     

       20
       20
       +
               }

     

       21
       21
       +
             },

     

       22
       22
       +
             "output": {

     

       23
       23
       +
               "encoding": "application/json",

     

       24
       24
       +
               "schema": {

     

       25
       25
       +
                 "type": "object",

     

       26
       26
       +
                 "properties": {}

     

       27
       27
       +
               }

     

       28
       28
       +
             },

     

       29
       29
       +
             "errors": [

     

       30
       30
       +
               {

     

       31
       31
       +
                 "name": "PostNotFound",

     

       32
       32
       +
                 "description": "Post not found"

     

       33
       33
       +
               },

     

       34
       34
       +
               {

     

       35
       35
       +
                 "name": "NotAuthorized",

     

       36
       36
       +
                 "description": "User is not authorized to delete this post"

     

       37
       37
       +
               }

     

       38
       38
       +
             ]

     

       39
       39
       +
           }

     

       40
       40
       +
         }

     

       41
       41
       +
       }

+6 -6

internal/atproto/lexicon/social/coves/embed/post.json

···

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "object",

     

       7
       7
       -
             "description": "Embedded reference to another post",

     

       8
       8
       -
             "required": ["uri"],

     

       7
       7
       +
             "description": "Embedded reference to another post (quoted post)",

     

       8
       8
       +
             "required": ["post"],

     

       9
       9
        
             "properties": {

     

       10
       10
       -
               "uri": {

     

       11
       11
       -
                 "type": "string",

     

       12
       12
       -
                 "format": "at-uri",

     

       13
       13
       -
                 "description": "AT-URI of the post being embedded"

     

       10
       10
       +
               "post": {

     

       11
       11
       +
                 "type": "ref",

     

       12
       12
       +
                 "ref": "com.atproto.repo.strongRef",

     

       13
       13
       +
                 "description": "Strong reference to the embedded post (includes URI and CID)"

     

       14
       14
        
               }

     

       15
       15
        
             }

     

       16
       16
        
           }

+3 -3

internal/atproto/lexicon/social/coves/feed/defs.json

···

       9
       9
        
             "properties": {

     

       10
       10
        
               "post": {

     

       11
       11
        
                 "type": "ref",

     

       12
       12
       -
                 "ref": "social.coves.post.get#postView"

     

       12
       12
       +
                 "ref": "social.coves.community.post.get#postView"

     

       13
       13
        
               },

     

       14
       14
        
               "reason": {

     

       15
       15
        
                 "type": "union",

     
···

       29
       29
        
             "properties": {

     

       30
       30
        
               "by": {

     

       31
       31
        
                 "type": "ref",

     

       32
       32
       -
                 "ref": "social.coves.post.get#authorView"

     

       32
       32
       +
                 "ref": "social.coves.community.post.get#authorView"

     

       33
       33
        
               },

     

       34
       34
        
               "indexedAt": {

     

       35
       35
        
                 "type": "string",

     
···

       44
       44
        
             "properties": {

     

       45
       45
        
               "community": {

     

       46
       46
        
                 "type": "ref",

     

       47
       47
       -
                 "ref": "social.coves.post.get#communityRef"

     

       47
       47
       +
                 "ref": "social.coves.community.post.get#communityRef"

     

       48
       48
        
               }

     

       49
       49
        
             }

     

       50
       50
        
           },

+47

internal/db/migrations/015_alter_content_labels_to_jsonb.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Change content_labels from TEXT[] to JSONB to preserve full com.atproto.label.defs#selfLabels structure

     

       3
       3
       +
       -- This allows storing the optional 'neg' field and future extensions

     

       4
       4
       +
       

     

       5
       5
       +
       -- Create temporary function to convert TEXT[] to selfLabels JSONB

     

       6
       6
       +
       -- +goose StatementBegin

     

       7
       7
       +
       CREATE OR REPLACE FUNCTION convert_labels_to_jsonb(labels TEXT[])

     

       8
       8
       +
       RETURNS JSONB AS $$

     

       9
       9
       +
       BEGIN

     

       10
       10
       +
         IF labels IS NULL OR array_length(labels, 1) = 0 THEN

     

       11
       11
       +
           RETURN NULL;

     

       12
       12
       +
         END IF;

     

       13
       13
       +
       

     

       14
       14
       +
         RETURN jsonb_build_object(

     

       15
       15
       +
           'values',

     

       16
       16
       +
           (SELECT jsonb_agg(jsonb_build_object('val', label))

     

       17
       17
       +
            FROM unnest(labels) AS label)

     

       18
       18
       +
         );

     

       19
       19
       +
       END;

     

       20
       20
       +
       $$ LANGUAGE plpgsql IMMUTABLE;

     

       21
       21
       +
       -- +goose StatementEnd

     

       22
       22
       +
       

     

       23
       23
       +
       -- Convert column type using the function

     

       24
       24
       +
       ALTER TABLE posts

     

       25
       25
       +
         ALTER COLUMN content_labels TYPE JSONB

     

       26
       26
       +
         USING convert_labels_to_jsonb(content_labels);

     

       27
       27
       +
       

     

       28
       28
       +
       -- Drop the temporary function

     

       29
       29
       +
       DROP FUNCTION convert_labels_to_jsonb(TEXT[]);

     

       30
       30
       +
       

     

       31
       31
       +
       -- Update column comment

     

       32
       32
       +
       COMMENT ON COLUMN posts.content_labels IS 'Self-applied labels per com.atproto.label.defs#selfLabels (JSONB: {"values":[{"val":"nsfw","neg":false}]})';

     

       33
       33
       +
       

     

       34
       34
       +
       -- +goose Down

     

       35
       35
       +
       -- Revert JSONB back to TEXT[] (lossy - drops 'neg' field)

     

       36
       36
       +
       ALTER TABLE posts

     

       37
       37
       +
         ALTER COLUMN content_labels TYPE TEXT[]

     

       38
       38
       +
         USING CASE

     

       39
       39
       +
           WHEN content_labels IS NULL THEN NULL

     

       40
       40
       +
           ELSE ARRAY(

     

       41
       41
       +
             SELECT value->>'val'

     

       42
       42
       +
             FROM jsonb_array_elements(content_labels->'values') AS value

     

       43
       43
       +
           )

     

       44
       44
       +
         END;

     

       45
       45
       +
       

     

       46
       46
       +
       -- Restore original comment

     

       47
       47
       +
       COMMENT ON COLUMN posts.content_labels IS 'Self-applied labels (nsfw, spoiler, violence)';

+1 -1

tests/lexicon-test-data/moderation/tribunal-vote-invalid-decision.json

···

       1
       1
        
       {

     

       2
       2
        
         "$type": "social.coves.moderation.tribunalVote",

     

       3
       3
        
         "tribunal": "at://did:plc:community123/social.coves.moderation.tribunal/3k7a3dmb5bk2c",

     

       4
       4
       -
         "subject": "at://did:plc:user123/social.coves.post.record/3k7a2clb4bj2b",

     

       4
       4
       +
         "subject": "at://$1/social.coves.community.post/3k7a2clb4bj2b",

     

       5
       5
        
         "decision": "maybe",

     

       6
       6
        
         "createdAt": "2025-01-09T18:00:00Z"

     

       7
       7
        
       }

+5 -6

tests/lexicon-test-data/post/post-invalid-missing-community.json

···

       1
       1
        
       {

     

       2
       2
       -
         "$type": "social.coves.post.record",

     

       3
       3
       -
         "postType": "text",

     

       2
       2
       +
         "$type": "social.coves.community.post",

     

       3
       3
       +
         "author": "did:plc:testauthor123",

     

       4
       4
        
         "title": "Test Post",

     

       5
       5
       -
         "text": "This post is missing the required community field",

     

       5
       5
       +
         "content": "This post is missing the required community field",

     

       6
       6
        
         "tags": ["test"],

     

       7
       7
       -
         "language": "en",

     

       8
       8
       -
         "contentWarnings": [],

     

       7
       7
       +
         "langs": ["en"],

     

       9
       8
        
         "createdAt": "2025-01-09T14:30:00Z"

     

       10
       10
       -
       }
     

       9
       9
       +
       }

+6 -7

tests/lexicon-test-data/post/post-valid-text.json

···

       1
       1
        
       {

     

       2
       2
       -
         "$type": "social.coves.post.record",

     

       2
       2
       +
         "$type": "social.coves.community.post",

     

       3
       3
        
         "community": "did:plc:programming123",

     

       4
       4
       -
         "postType": "text",

     

       4
       4
       +
         "author": "did:plc:testauthor123",

     

       5
       5
        
         "title": "Best practices for error handling in Go",

     

       6
       6
       -
         "text": "I've been working with Go for a while now and wanted to share some thoughts on error handling patterns...",

     

       7
       7
       -
         "textFacets": [

     

       6
       6
       +
         "content": "I've been working with Go for a while now and wanted to share some thoughts on error handling patterns...",

     

       7
       7
       +
         "facets": [

     

       8
       8
        
           {

     

       9
       9
        
             "index": {

     

       10
       10
        
               "byteStart": 20,

     
···

       18
       18
        
           }

     

       19
       19
        
         ],

     

       20
       20
        
         "tags": ["golang", "error-handling", "best-practices"],

     

       21
       21
       -
         "language": "en",

     

       22
       22
       -
         "contentWarnings": [],

     

       21
       21
       +
         "langs": ["en"],

     

       23
       22
        
         "createdAt": "2025-01-09T14:30:00Z"

     

       24
       24
       -
       }
     

       23
       23
       +
       }

+5 -5

docs/COMMUNITY_FEEDS.md

···

       182
       182
        
       

     

       183
       183
        
       ```go

     

       184
       184
        
       type PostView struct {

     

       185
       185
       -
           URI        string         // at://did:plc:abc/social.coves.post.record/123

     

       185
       185
       +
           URI        string         // at://did:plc:abc/social.coves.community.post.record/123

     

       186
       186
        
           CID        string         // Content ID

     

       187
       187
        
           RKey       string         // Record key (TID)

     

       188
       188
        
           Author     *AuthorView    // Author with handle, avatar, reputation

     
···

       247
       247
        
         "feed": [

     

       248
       248
        
           {

     

       249
       249
        
             "post": {

     

       250
       250
       -
               "uri": "at://did:plc:gaming123/social.coves.post.record/abc",

     

       250
       250
       +
               "uri": "at://did:plc:gaming123/social.coves.community.post.record/abc",

     

       251
       251
        
               "cid": "bafyrei...",

     

       252
       252
        
               "author": {

     

       253
       253
        
                 "did": "did:plc:alice",

     
···

       473
       473
        
       GET /xrpc/social.coves.feed.getSkeleton?feed=at://alice/feed/best-memes

     

       474
       474
        
         → Returns: [uri1, uri2, uri3, ...]

     

       475
       475
        
       

     

       476
       476
       -
       GET /xrpc/social.coves.post.get?uris=[...]

     

       476
       476
       +
       GET /xrpc/social.coves.community.post.get?uris=[...]

     

       477
       477
        
         → Returns: [full posts]

     

       478
       478
        
       ```

     

       479
       479
        
       

     
···

       556
       556
        
       

     

       557
       557
        
       ## Lexicon Updates

     

       558
       558
        
       

     

       559
       559
       -
       ### Updated: `social.coves.post.get`

     

       559
       559
       +
       ### Updated: `social.coves.community.post.get`

     

       560
       560
        
       

     

       561
       561
        
       **Changes:**

     

       562
       562
        
       1. ✅ Batch URIs: `uri` → `uris[]` (max 25)

     
···

       638
       638
        
       // Custom feed (power users)

     

       639
       639
        
       GET /xrpc/social.coves.feed.getSkeleton?feed=at://alice/feed/best-memes

     

       640
       640
        
         → Returns URIs

     

       641
       641
       -
       GET /xrpc/social.coves.post.get?uris=[...]

     

       641
       641
       +
       GET /xrpc/social.coves.community.post.get?uris=[...]

     

       642
       642
        
         → Hydrates posts

     

       643
       643
        
       ```

     

       644
       644

+1 -1

docs/PRD_GOVERNANCE.md

···

       291
       291
        
       - [ ] Go structs: `ContentRules` type in community models

     

       292
       292
        
       - [ ] Repository: Parse and store `contentRules` from community profiles

     

       293
       293
        
       - [ ] Service: `ValidatePostAgainstRules(post, community)` function

     

       294
       294
       -
       - [ ] Handler: Integrate validation into `social.coves.post.create`

     

       294
       294
       +
       - [ ] Handler: Integrate validation into `social.coves.community.post.create`

     

       295
       295
        
       - [ ] AppView indexing: Index post characteristics (embed_type, text_length, etc.)

     

       296
       296
        
       - [ ] Tests: Comprehensive rule validation tests

     

       297
       297
        
       - [ ] Documentation: Content rules guide for community creators

+17 -17

docs/PRD_POSTS.md

···

       45
       45
        
       

     

       46
       46
        
       **Repository Structure:**

     

       47
       47
        
       ```

     

       48
       48
       -
       Repository:  at://did:plc:community789/social.coves.post.record/3k2a4b5c6d7e

     

       48
       48
       +
       Repository:  at://did:plc:community789/social.coves.community.post.record/3k2a4b5c6d7e

     

       49
       49
        
       Owner:       did:plc:community789 (community owns the post)

     

       50
       50
        
       Author:      did:plc:user123 (tracked in record metadata)

     

       51
       51
        
       Hosted By:   did:web:coves.social (instance manages community credentials)

     
···

       77
       77
        
       

     

       78
       78
        
       **Implementation checklist:**

     

       79
       79
        
       - [x] Lexicon: `contentRules` in `social.coves.community.profile` ✅

     

       80
       80
       -
       - [x] Lexicon: `postType` removed from `social.coves.post.create` ✅

     

       80
       80
       +
       - [x] Lexicon: `postType` removed from `social.coves.community.post.create` ✅

     

       81
       81
        
       - [ ] Validation: `ValidatePostAgainstRules()` service function

     

       82
       82
        
       - [ ] Handler: Integrate validation in post creation endpoint

     

       83
       83
        
       - [ ] AppView: Index derived characteristics (embed_type, text_length, etc.)

     
···

       90
       90
        
       **Priority:** CRITICAL - Posts are the foundation of the platform

     

       91
       91
        
       

     

       92
       92
        
       #### Create Post

     

       93
       93
       -
       - [x] Lexicon: `social.coves.post.record` ✅

     

       94
       94
       -
       - [x] Lexicon: `social.coves.post.create` ✅

     

       93
       93
       +
       - [x] Lexicon: `social.coves.community.post.record` ✅

     

       94
       94
       +
       - [x] Lexicon: `social.coves.community.post.create` ✅

     

       95
       95
        
       - [x] Removed `postType` enum in favor of content rules ✅ (2025-10-18)

     

       96
       96
        
       - [x] Removed `postType` from record and get lexicons ✅ (2025-10-18)

     

       97
       97
       -
       - [x] **Handler:** `POST /xrpc/social.coves.post.create` ✅ (Alpha - see IMPLEMENTATION_POST_CREATION.md)

     

       97
       97
       +
       - [x] **Handler:** `POST /xrpc/social.coves.community.post.create` ✅ (Alpha - see IMPLEMENTATION_POST_CREATION.md)

     

       98
       98
        
         - ✅ Accept: community (DID/handle), title (optional), content, facets, embed, contentLabels

     

       99
       99
        
         - ✅ Validate: User is authenticated, community exists, content within limits

     

       100
       100
        
         - ✅ Write: Create record in **community's PDS repository**

     
···

       124
       124
        
       - [x] **E2E Test:** Create text post → Write to **community's PDS** → Index via Jetstream → Verify in AppView ✅

     

       125
       125
        
       

     

       126
       126
        
       #### Get Post

     

       127
       127
       -
       - [x] Lexicon: `social.coves.post.get` ✅

     

       128
       128
       -
       - [ ] **Handler:** `GET /xrpc/social.coves.post.get?uri=at://...`

     

       127
       127
       +
       - [x] Lexicon: `social.coves.community.post.get` ✅

     

       128
       128
       +
       - [ ] **Handler:** `GET /xrpc/social.coves.community.post.get?uri=at://...`

     

       129
       129
        
         - Accept: AT-URI of post

     

       130
       130
        
         - Return: Full post view with author, community, stats, viewer state

     

       131
       131
        
       - [ ] **Service Layer:** `PostService.Get(uri, viewerDID)`

     
···

       139
       139
        
       - [ ] **E2E Test:** Get post by URI → Verify all fields populated

     

       140
       140
        
       

     

       141
       141
        
       #### Update Post

     

       142
       142
       -
       - [x] Lexicon: `social.coves.post.update` ✅

     

       143
       143
       -
       - [ ] **Handler:** `POST /xrpc/social.coves.post.update`

     

       142
       142
       +
       - [x] Lexicon: `social.coves.community.post.update` ✅

     

       143
       143
       +
       - [ ] **Handler:** `POST /xrpc/social.coves.community.post.update`

     

       144
       144
        
         - Accept: uri, title, content, facets, embed, contentLabels, editNote

     

       145
       145
        
         - Validate: User is post author, within 24-hour edit window

     

       146
       146
        
         - Write: Update record in **community's PDS**

     
···

       157
       157
        
       - [ ] **E2E Test:** Update post → Verify edit reflected in AppView

     

       158
       158
        
       

     

       159
       159
        
       #### Delete Post

     

       160
       160
       -
       - [x] Lexicon: `social.coves.post.delete` ✅

     

       161
       161
       -
       - [ ] **Handler:** `POST /xrpc/social.coves.post.delete`

     

       160
       160
       +
       - [x] Lexicon: `social.coves.community.post.delete` ✅

     

       161
       161
       +
       - [ ] **Handler:** `POST /xrpc/social.coves.community.post.delete`

     

       162
       162
        
         - Accept: uri

     

       163
       163
        
         - Validate: User is post author OR community moderator

     

       164
       164
        
         - Write: Delete record from **community's PDS**

     
···

       251
       251
        
       

     

       252
       252
        
       #### Post Event Handling

     

       253
       253
        
       - [x] **Consumer:** `PostConsumer.HandlePostEvent()` ✅ (2025-10-19)

     

       254
       254
       -
         - ✅ Listen for `social.coves.post.record` CREATE from **community repositories**

     

       254
       254
       +
         - ✅ Listen for `social.coves.community.post.record` CREATE from **community repositories**

     

       255
       255
        
         - ✅ Parse post record, extract author DID and community DID (from AT-URI owner)

     

       256
       256
        
         - ⚠️ **Derive post characteristics:** DEFERRED (embed_type, text_length, has_title, has_embed for content rules filtering)

     

       257
       257
        
         - ✅ Insert in AppView PostgreSQL (CREATE only - UPDATE/DELETE deferred)

     
···

       447
       447
        
       - [ ] **Tag Storage:** Tags live in **user's repository** (users own their tags)

     

       448
       448
        
       

     

       449
       449
        
       #### Crossposting

     

       450
       450
       -
       - [x] Lexicon: `social.coves.post.crosspost` ✅

     

       450
       450
       +
       - [x] Lexicon: `social.coves.community.post.crosspost` ✅

     

       451
       451
        
       - [ ] **Crosspost Tracking:** Share post to multiple communities

     

       452
       452
        
       - [ ] **Implementation:** Create new post record in each community's repository

     

       453
       453
        
       - [ ] **Crosspost Chain:** Track all crosspost relationships

     
···

       461
       461
        
       - [ ] **AppView Query:** Endpoint to fetch user's saved posts

     

       462
       462
        
       

     

       463
       463
        
       ### Post Search

     

       464
       464
       -
       - [x] Lexicon: `social.coves.post.search` ✅

     

       464
       464
       +
       - [x] Lexicon: `social.coves.community.post.search` ✅

     

       465
       465
        
       - [ ] **Search Parameters:**

     

       466
       466
        
         - Query string (q)

     

       467
       467
        
         - Filter by community

     
···

       583
       583
        
       - **Reuses Token Refresh:** Can leverage existing community credential management

     

       584
       584
        
       

     

       585
       585
        
       **Implementation Details:**

     

       586
       586
       -
       - Post AT-URI: `at://community_did/social.coves.post.record/tid`

     

       586
       586
       +
       - Post AT-URI: `at://community_did/social.coves.community.post.record/tid`

     

       587
       587
        
       - Write operations use community's PDS credentials (encrypted, stored in AppView)

     

       588
       588
        
       - Author tracked in post record's `author` field (DID)

     

       589
       589
        
       - Moderators can delete any post in their community

     
···

       756
       756
        
       

     

       757
       757
        
       ## Lexicon Summary

     

       758
       758
        
       

     

       759
       759
       -
       ### `social.coves.post.record`

     

       759
       759
       +
       ### `social.coves.community.post.record`

     

       760
       760
        
       **Status:** ✅ Defined, implementation TODO

     

       761
       761
        
       **Last Updated:** 2025-10-18 (removed `postType` enum)

     

       762
       762
        
       

     
···

       781
       781
        
       - Post "type" is derived from structure (has embed? what embed type? has title? text length?)

     

       782
       782
        
       - Community's `contentRules` validate post structure at creation time

     

       783
       783
        
       

     

       784
       784
       -
       ### `social.coves.post.create` (Procedure)

     

       784
       784
       +
       ### `social.coves.community.post.create` (Procedure)

     

       785
       785
        
       **Status:** ✅ Defined, implementation TODO

     

       786
       786
        
       **Last Updated:** 2025-10-18 (removed `postType` parameter)

     

       787
       787

+4 -4

docs/aggregators/PRD_AGGREGATORS.md

···

       23
       23
        
       1. **Aggregators are Actors, Not a Separate System**

     

       24
       24
        
          - Each aggregator has its own DID

     

       25
       25
        
          - Authenticate as themselves via JWT

     

       26
       26
       -
          - Use existing `social.coves.post.create` endpoint

     

       26
       26
       +
          - Use existing `social.coves.community.post.create` endpoint

     

       27
       27
        
          - Post record's `author` field = aggregator DID (server-populated)

     

       28
       28
        
          - No separate posting API needed

     

       29
       29
        
       

     
···

       89
       89
        
       Aggregator Service (External)

     

       90
       90
        
         │

     

       91
       91
        
         │ 1. Authenticates as aggregator DID (JWT)

     

       92
       92
       -
         │ 2. Calls social.coves.post.create

     

       92
       92
       +
         │ 2. Calls social.coves.community.post.create

     

       93
       93
        
         ▼

     

       94
       94
        
       Coves AppView Handler

     

       95
       95
        
         │

     
···

       120
       120
        
       

     

       121
       121
        
       ### For Aggregators

     

       122
       122
        
       

     

       123
       123
       -
       - **`social.coves.post.create`** - Modified to handle aggregator auth

     

       123
       123
       +
       - **`social.coves.community.post.create`** - Modified to handle aggregator auth

     

       124
       124
        
       - **`social.coves.aggregator.getAuthorizations`** - Query authorized communities

     

       125
       125
        
       

     

       126
       126
        
       ### For Discovery

     
···

       312
       312
        
       

     

       313
       313
        
       ---

     

       314
       314
        
       

     

       315
       315
       -
       ### 2025-10-19: Reuse `social.coves.post.create` Endpoint

     

       315
       315
       +
       ### 2025-10-19: Reuse `social.coves.community.post.create` Endpoint

     

       316
       316
        
       **Decision:** Aggregators use existing post creation endpoint.

     

       317
       317
        
       

     

       318
       318
        
       **Rationale:**

+3 -3

docs/aggregators/PRD_KAGI_NEWS_RSS.md

···

       172
       172
        
       │  3. Deduplication: Tracks posted items via JSON state file  │

     

       173
       173
        
       │  4. Feed Mapper: Maps feed URLs to community handles        │

     

       174
       174
        
       │  5. Post Formatter: Converts to Coves post format           │

     

       175
       175
       -
       │  6. Post Publisher: Calls social.coves.post.create via XRPC │

     

       175
       175
       +
       │  6. Post Publisher: Calls social.coves.community.post.create via XRPC │

     

       176
       176
        
       │  7. Blob Uploader: Handles image upload to ATProto          │

     

       177
       177
        
       └─────────────────────────────────────────────────────────────┘

     

       178
       178
        
                                   │

     

       179
       179
        
                                   │ Authenticated XRPC calls

     

       180
       180
        
                                   ▼

     

       181
       181
        
       ┌─────────────────────────────────────────────────────────────┐

     

       182
       182
       -
       │  Coves AppView (social.coves.post.create)                   │

     

       182
       182
       +
       │  Coves AppView (social.coves.community.post.create)                   │

     

       183
       183
        
       │  - Validates aggregator authorization                        │

     

       184
       184
        
       │  - Creates post with author = did:plc:[aggregator-did]      │

     

       185
       185
        
       │  - Indexes to community feeds                                │

     
···

       271
       271
        
       

     

       272
       272
        
       ```json

     

       273
       273
        
       {

     

       274
       274
       -
         "$type": "social.coves.post.record",

     

       274
       274
       +
         "$type": "social.coves.community.post.record",

     

       275
       275
        
         "author": "did:plc:[aggregator-did]",

     

       276
       276
        
         "community": "world-news.coves.social",

     

       277
       277
        
         "title": "{Kagi story title}",

+7 -7

internal/api/routes/post.go

···

       9
       9
        
       )

     

       10
       10
        
       

     

       11
       11
        
       // RegisterPostRoutes registers post-related XRPC endpoints on the router

     

       12
       12
       -
       // Implements social.coves.post.* lexicon endpoints

     

       12
       12
       +
       // Implements social.coves.community.post.* lexicon endpoints

     

       13
       13
        
       func RegisterPostRoutes(r chi.Router, service posts.Service, authMiddleware *middleware.AtProtoAuthMiddleware) {

     

       14
       14
        
       	// Initialize handlers

     

       15
       15
        
       	createHandler := post.NewCreateHandler(service)

     

       16
       16
        
       

     

       17
       17
        
       	// Procedure endpoints (POST) - require authentication

     

       18
       18
       -
       	// social.coves.post.create - create a new post in a community

     

       19
       19
       -
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.post.create", createHandler.HandleCreate)

     

       18
       18
       +
       	// social.coves.community.post.create - create a new post in a community

     

       19
       19
       +
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.community.post.create", createHandler.HandleCreate)

     

       20
       20
        
       

     

       21
       21
        
       	// Future endpoints (Beta):

     

       22
       22
       -
       	// r.Get("/xrpc/social.coves.post.get", getHandler.HandleGet)

     

       23
       23
       -
       	// r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.post.update", updateHandler.HandleUpdate)

     

       24
       24
       -
       	// r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.post.delete", deleteHandler.HandleDelete)

     

       25
       25
       -
       	// r.Get("/xrpc/social.coves.post.list", listHandler.HandleList)

     

       22
       22
       +
       	// r.Get("/xrpc/social.coves.community.post.get", getHandler.HandleGet)

     

       23
       23
       +
       	// r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.community.post.update", updateHandler.HandleUpdate)

     

       24
       24
       +
       	// r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.community.post.delete", deleteHandler.HandleDelete)

     

       25
       25
       +
       	// r.Get("/xrpc/social.coves.community.post.list", listHandler.HandleList)

     

       26
       26
        
       }

+80

internal/atproto/lexicon/social/coves/feed/comment.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.feed.comment",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "record",

     

       7
       7
       +
             "description": "A comment on a post or another comment. Comments live in user repositories and support nested threading.",

     

       8
       8
       +
             "key": "tid",

     

       9
       9
       +
             "record": {

     

       10
       10
       +
               "type": "object",

     

       11
       11
       +
               "required": ["reply", "content", "createdAt"],

     

       12
       12
       +
               "properties": {

     

       13
       13
       +
                 "reply": {

     

       14
       14
       +
                   "type": "ref",

     

       15
       15
       +
                   "ref": "#replyRef",

     

       16
       16
       +
                   "description": "Reference to the post and parent being replied to"

     

       17
       17
       +
                 },

     

       18
       18
       +
                 "content": {

     

       19
       19
       +
                   "type": "string",

     

       20
       20
       +
                   "maxGraphemes": 3000,

     

       21
       21
       +
                   "maxLength": 30000,

     

       22
       22
       +
                   "description": "Comment text content"

     

       23
       23
       +
                 },

     

       24
       24
       +
                 "facets": {

     

       25
       25
       +
                   "type": "array",

     

       26
       26
       +
                   "description": "Annotations for rich text (mentions, links, etc.)",

     

       27
       27
       +
                   "items": {

     

       28
       28
       +
                     "type": "ref",

     

       29
       29
       +
                     "ref": "social.coves.richtext.facet"

     

       30
       30
       +
                   }

     

       31
       31
       +
                 },

     

       32
       32
       +
                 "embed": {

     

       33
       33
       +
                   "type": "union",

     

       34
       34
       +
                   "description": "Embedded media or quoted posts",

     

       35
       35
       +
                   "refs": [

     

       36
       36
       +
                     "social.coves.embed.images",

     

       37
       37
       +
                     "social.coves.embed.post"

     

       38
       38
       +
                   ]

     

       39
       39
       +
                 },

     

       40
       40
       +
                 "langs": {

     

       41
       41
       +
                   "type": "array",

     

       42
       42
       +
                   "description": "Languages used in the comment content (ISO 639-1)",

     

       43
       43
       +
                   "maxLength": 3,

     

       44
       44
       +
                   "items": {

     

       45
       45
       +
                     "type": "string",

     

       46
       46
       +
                     "format": "language"

     

       47
       47
       +
                   }

     

       48
       48
       +
                 },

     

       49
       49
       +
                 "labels": {

     

       50
       50
       +
                   "type": "ref",

     

       51
       51
       +
                   "ref": "com.atproto.label.defs#selfLabels",

     

       52
       52
       +
                   "description": "Self-applied content labels"

     

       53
       53
       +
                 },

     

       54
       54
       +
                 "createdAt": {

     

       55
       55
       +
                   "type": "string",

     

       56
       56
       +
                   "format": "datetime",

     

       57
       57
       +
                   "description": "Timestamp of comment creation"

     

       58
       58
       +
                 }

     

       59
       59
       +
               }

     

       60
       60
       +
             }

     

       61
       61
       +
           },

     

       62
       62
       +
           "replyRef": {

     

       63
       63
       +
             "type": "object",

     

       64
       64
       +
             "description": "References for maintaining thread structure. Root always points to the original post, parent points to the immediate parent (post or comment).",

     

       65
       65
       +
             "required": ["root", "parent"],

     

       66
       66
       +
             "properties": {

     

       67
       67
       +
               "root": {

     

       68
       68
       +
                 "type": "ref",

     

       69
       69
       +
                 "ref": "com.atproto.repo.strongRef",

     

       70
       70
       +
                 "description": "Strong reference to the original post that started the thread"

     

       71
       71
       +
               },

     

       72
       72
       +
               "parent": {

     

       73
       73
       +
                 "type": "ref",

     

       74
       74
       +
                 "ref": "com.atproto.repo.strongRef",

     

       75
       75
       +
                 "description": "Strong reference to the immediate parent (post or comment) being replied to"

     

       76
       76
       +
               }

     

       77
       77
       +
             }

     

       78
       78
       +
           }

     

       79
       79
       +
         }

     

       80
       80
       +
       }

-86

internal/atproto/lexicon/social/coves/interaction/comment.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.comment",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A comment on a post or another comment",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "content", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of post or comment being replied to"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "content": {

     

       19
       19
       -
                   "type": "union",

     

       20
       20
       -
                   "refs": ["#textContent", "#imageContent", "#stickerContent"]

     

       21
       21
       -
                 },

     

       22
       22
       -
                 "location": {

     

       23
       23
       -
                   "type": "ref",

     

       24
       24
       -
                   "ref": "social.coves.actor.profile#geoLocation"

     

       25
       25
       -
                 },

     

       26
       26
       -
                 "translatedFrom": {

     

       27
       27
       -
                   "type": "string",

     

       28
       28
       -
                   "maxLength": 10,

     

       29
       29
       -
                   "description": "Language code if auto-translated (ISO 639-1)"

     

       30
       30
       -
                 },

     

       31
       31
       -
                 "createdAt": {

     

       32
       32
       -
                   "type": "string",

     

       33
       33
       -
                   "format": "datetime"

     

       34
       34
       -
                 }

     

       35
       35
       -
               }

     

       36
       36
       -
             }

     

       37
       37
       -
           },

     

       38
       38
       -
           "textContent": {

     

       39
       39
       -
             "type": "object",

     

       40
       40
       -
             "required": ["text"],

     

       41
       41
       -
             "properties": {

     

       42
       42
       -
               "text": {

     

       43
       43
       -
                 "type": "string",

     

       44
       44
       -
                 "maxLength": 10000,

     

       45
       45
       -
                 "description": "Comment text"

     

       46
       46
       -
               },

     

       47
       47
       -
               "facets": {

     

       48
       48
       -
                 "type": "array",

     

       49
       49
       -
                 "description": "Rich text annotations",

     

       50
       50
       -
                 "items": {

     

       51
       51
       -
                   "type": "ref",

     

       52
       52
       -
                   "ref": "social.coves.richtext.facet"

     

       53
       53
       -
                 }

     

       54
       54
       -
               }

     

       55
       55
       -
             }

     

       56
       56
       -
           },

     

       57
       57
       -
           "imageContent": {

     

       58
       58
       -
             "type": "object",

     

       59
       59
       -
             "required": ["image"],

     

       60
       60
       -
             "properties": {

     

       61
       61
       -
               "image": {

     

       62
       62
       -
                 "type": "ref",

     

       63
       63
       -
                 "ref": "social.coves.embed.images#image"

     

       64
       64
       -
               },

     

       65
       65
       -
               "caption": {

     

       66
       66
       -
                 "type": "string",

     

       67
       67
       -
                 "maxLength": 1000

     

       68
       68
       -
               }

     

       69
       69
       -
             }

     

       70
       70
       -
           },

     

       71
       71
       -
           "stickerContent": {

     

       72
       72
       -
             "type": "object",

     

       73
       73
       -
             "required": ["stickerId"],

     

       74
       74
       -
             "properties": {

     

       75
       75
       -
               "stickerId": {

     

       76
       76
       -
                 "type": "string",

     

       77
       77
       -
                 "description": "Reference to a sticker in a sticker pack"

     

       78
       78
       -
               },

     

       79
       79
       -
               "stickerPackId": {

     

       80
       80
       -
                 "type": "string",

     

       81
       81
       -
                 "description": "Reference to the sticker pack"

     

       82
       82
       -
               }

     

       83
       83
       -
             }

     

       84
       84
       -
           }

     

       85
       85
       -
         }

     

       86
       86
       -
       }

-75

internal/atproto/lexicon/social/coves/interaction/createComment.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.createComment",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Create a comment on a post or another comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["parent", "text"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "parent": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment being replied to"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "text": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "maxGraphemes": 3000,

     

       22
       22
       -
                     "maxLength": 30000,

     

       23
       23
       -
                     "description": "Comment text"

     

       24
       24
       -
                   },

     

       25
       25
       -
                   "textFacets": {

     

       26
       26
       -
                     "type": "array",

     

       27
       27
       -
                     "description": "Rich text annotations",

     

       28
       28
       -
                     "items": {

     

       29
       29
       -
                       "type": "ref",

     

       30
       30
       -
                       "ref": "social.coves.richtext.facet"

     

       31
       31
       -
                     }

     

       32
       32
       -
                   }

     

       33
       33
       -
                 }

     

       34
       34
       -
               }

     

       35
       35
       -
             },

     

       36
       36
       -
             "output": {

     

       37
       37
       -
               "encoding": "application/json",

     

       38
       38
       -
               "schema": {

     

       39
       39
       -
                 "type": "object",

     

       40
       40
       -
                 "required": ["uri", "cid"],

     

       41
       41
       -
                 "properties": {

     

       42
       42
       -
                   "uri": {

     

       43
       43
       -
                     "type": "string",

     

       44
       44
       -
                     "format": "at-uri",

     

       45
       45
       -
                     "description": "AT-URI of the created comment"

     

       46
       46
       -
                   },

     

       47
       47
       -
                   "cid": {

     

       48
       48
       -
                     "type": "string",

     

       49
       49
       -
                     "format": "cid",

     

       50
       50
       -
                     "description": "CID of the created comment"

     

       51
       51
       -
                   }

     

       52
       52
       -
                 }

     

       53
       53
       -
               }

     

       54
       54
       -
             },

     

       55
       55
       -
             "errors": [

     

       56
       56
       -
               {

     

       57
       57
       -
                 "name": "ParentNotFound",

     

       58
       58
       -
                 "description": "Parent post or comment not found"

     

       59
       59
       -
               },

     

       60
       60
       -
               {

     

       61
       61
       -
                 "name": "NotAuthorized",

     

       62
       62
       -
                 "description": "User is not authorized to comment"

     

       63
       63
       -
               },

     

       64
       64
       -
               {

     

       65
       65
       -
                 "name": "ThreadLocked",

     

       66
       66
       -
                 "description": "Comment thread is locked"

     

       67
       67
       -
               },

     

       68
       68
       -
               {

     

       69
       69
       -
                 "name": "Banned",

     

       70
       70
       -
                 "description": "User is banned from this community"

     

       71
       71
       -
               }

     

       72
       72
       -
             ]

     

       73
       73
       -
           }

     

       74
       74
       -
         }

     

       75
       75
       -
       }

-41

internal/atproto/lexicon/social/coves/interaction/deleteComment.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.deleteComment",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Delete a comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the comment to delete"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "CommentNotFound",

     

       32
       32
       -
                 "description": "Comment not found"

     

       33
       33
       -
               },

     

       34
       34
       -
               {

     

       35
       35
       -
                 "name": "NotAuthorized",

     

       36
       36
       -
                 "description": "User is not authorized to delete this comment"

     

       37
       37
       -
               }

     

       38
       38
       -
             ]

     

       39
       39
       -
           }

     

       40
       40
       -
         }

     

       41
       41
       -
       }

-118

internal/atproto/lexicon/social/coves/post/create.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.create",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Create a new post in a community",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["community"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "community": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-identifier",

     

       17
       17
       -
                     "description": "DID or handle of the community to post in"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "title": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "maxGraphemes": 300,

     

       22
       22
       -
                     "maxLength": 3000,

     

       23
       23
       -
                     "description": "Post title (optional for microblog, image, and video posts)"

     

       24
       24
       -
                   },

     

       25
       25
       -
                   "content": {

     

       26
       26
       -
                     "type": "string",

     

       27
       27
       -
                     "maxLength": 50000,

     

       28
       28
       -
                     "description": "Post content - main text for text posts, description for media, etc."

     

       29
       29
       -
                   },

     

       30
       30
       -
                   "facets": {

     

       31
       31
       -
                     "type": "array",

     

       32
       32
       -
                     "description": "Rich text annotations for content",

     

       33
       33
       -
                     "items": {

     

       34
       34
       -
                       "type": "ref",

     

       35
       35
       -
                       "ref": "social.coves.richtext.facet"

     

       36
       36
       -
                     }

     

       37
       37
       -
                   },

     

       38
       38
       -
                   "embed": {

     

       39
       39
       -
                     "type": "union",

     

       40
       40
       -
                     "description": "Embedded content - images, videos, external links, or quoted posts",

     

       41
       41
       -
                     "refs": [

     

       42
       42
       -
                       "social.coves.embed.images",

     

       43
       43
       -
                       "social.coves.embed.video",

     

       44
       44
       -
                       "social.coves.embed.external",

     

       45
       45
       -
                       "social.coves.embed.post"

     

       46
       46
       -
                     ]

     

       47
       47
       -
                   },

     

       48
       48
       -
                   "originalAuthor": {

     

       49
       49
       -
                     "type": "ref",

     

       50
       50
       -
                     "ref": "social.coves.post.record#originalAuthor",

     

       51
       51
       -
                     "description": "For microblog posts - information about the original author"

     

       52
       52
       -
                   },

     

       53
       53
       -
                   "federatedFrom": {

     

       54
       54
       -
                     "type": "ref",

     

       55
       55
       -
                     "ref": "social.coves.federation.post",

     

       56
       56
       -
                     "description": "Reference to original federated post (for microblog posts)"

     

       57
       57
       -
                   },

     

       58
       58
       -
                   "contentLabels": {

     

       59
       59
       -
                     "type": "array",

     

       60
       60
       -
                     "description": "Self-applied content labels",

     

       61
       61
       -
                     "items": {

     

       62
       62
       -
                       "type": "string",

     

       63
       63
       -
                       "knownValues": ["nsfw", "spoiler", "violence"],

     

       64
       64
       -
                       "maxLength": 32

     

       65
       65
       -
                     }

     

       66
       66
       -
                   },

     

       67
       67
       -
                   "location": {

     

       68
       68
       -
                     "type": "ref",

     

       69
       69
       -
                     "ref": "social.coves.actor.profile#geoLocation",

     

       70
       70
       -
                     "description": "Geographic location where post was created"

     

       71
       71
       -
                   }

     

       72
       72
       -
                 }

     

       73
       73
       -
               }

     

       74
       74
       -
             },

     

       75
       75
       -
             "output": {

     

       76
       76
       -
               "encoding": "application/json",

     

       77
       77
       -
               "schema": {

     

       78
       78
       -
                 "type": "object",

     

       79
       79
       -
                 "required": ["uri", "cid"],

     

       80
       80
       -
                 "properties": {

     

       81
       81
       -
                   "uri": {

     

       82
       82
       -
                     "type": "string",

     

       83
       83
       -
                     "format": "at-uri",

     

       84
       84
       -
                     "description": "AT-URI of the created post"

     

       85
       85
       -
                   },

     

       86
       86
       -
                   "cid": {

     

       87
       87
       -
                     "type": "string",

     

       88
       88
       -
                     "format": "cid",

     

       89
       89
       -
                     "description": "CID of the created post"

     

       90
       90
       -
                   }

     

       91
       91
       -
                 }

     

       92
       92
       -
               }

     

       93
       93
       -
             },

     

       94
       94
       -
             "errors": [

     

       95
       95
       -
               {

     

       96
       96
       -
                 "name": "CommunityNotFound",

     

       97
       97
       -
                 "description": "Community not found"

     

       98
       98
       -
               },

     

       99
       99
       -
               {

     

       100
       100
       -
                 "name": "NotAuthorized",

     

       101
       101
       -
                 "description": "User is not authorized to post in this community"

     

       102
       102
       -
               },

     

       103
       103
       -
               {

     

       104
       104
       -
                 "name": "Banned",

     

       105
       105
       -
                 "description": "User is banned from this community"

     

       106
       106
       -
               },

     

       107
       107
       -
               {

     

       108
       108
       -
                 "name": "InvalidContent",

     

       109
       109
       -
                 "description": "Post content violates community rules"

     

       110
       110
       -
               },

     

       111
       111
       -
               {

     

       112
       112
       -
                 "name": "ContentRuleViolation",

     

       113
       113
       -
                 "description": "Post violates community content rules (e.g., embeds not allowed, text too short)"

     

       114
       114
       -
               }

     

       115
       115
       -
             ]

     

       116
       116
       -
           }

     

       117
       117
       -
         }

     

       118
       118
       -
       }

-39

internal/atproto/lexicon/social/coves/post/crosspost.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.crosspost",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A record tracking crosspost relationships between posts",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["originalPost", "crosspostOf", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "originalPost": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the original post in the crosspost chain"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "crosspostOf": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "at-uri",

     

       21
       21
       -
                   "description": "AT-URI of the immediate parent this is a crosspost of"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "allCrossposts": {

     

       24
       24
       -
                   "type": "array",

     

       25
       25
       -
                   "description": "Array of AT-URIs of all posts in the crosspost chain",

     

       26
       26
       -
                   "items": {

     

       27
       27
       -
                     "type": "string",

     

       28
       28
       -
                     "format": "at-uri"

     

       29
       29
       -
                   }

     

       30
       30
       -
                 },

     

       31
       31
       -
                 "createdAt": {

     

       32
       32
       -
                   "type": "string",

     

       33
       33
       -
                   "format": "datetime"

     

       34
       34
       -
                 }

     

       35
       35
       -
               }

     

       36
       36
       -
             }

     

       37
       37
       -
           }

     

       38
       38
       -
         }

     

       39
       39
       -
       }

-41

internal/atproto/lexicon/social/coves/post/delete.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.delete",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Delete a post",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post to delete"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "PostNotFound",

     

       32
       32
       -
                 "description": "Post not found"

     

       33
       33
       -
               },

     

       34
       34
       -
               {

     

       35
       35
       -
                 "name": "NotAuthorized",

     

       36
       36
       -
                 "description": "User is not authorized to delete this post"

     

       37
       37
       -
               }

     

       38
       38
       -
             ]

     

       39
       39
       -
           }

     

       40
       40
       -
         }

     

       41
       41
       -
       }

-294

internal/atproto/lexicon/social/coves/post/get.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.get",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "query",

     

       7
       7
       -
             "description": "Get posts by AT-URI. Supports batch fetching for feed hydration. Returns posts in same order as input URIs.",

     

       8
       8
       -
             "parameters": {

     

       9
       9
       -
               "type": "params",

     

       10
       10
       -
               "required": ["uris"],

     

       11
       11
       -
               "properties": {

     

       12
       12
       -
                 "uris": {

     

       13
       13
       -
                   "type": "array",

     

       14
       14
       -
                   "description": "List of post AT-URIs to fetch (max 25)",

     

       15
       15
       -
                   "items": {

     

       16
       16
       -
                     "type": "string",

     

       17
       17
       -
                     "format": "at-uri"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "maxLength": 25,

     

       20
       20
       -
                   "minLength": 1

     

       21
       21
       -
                 }

     

       22
       22
       -
               }

     

       23
       23
       -
             },

     

       24
       24
       -
             "output": {

     

       25
       25
       -
               "encoding": "application/json",

     

       26
       26
       -
               "schema": {

     

       27
       27
       -
                 "type": "object",

     

       28
       28
       -
                 "required": ["posts"],

     

       29
       29
       -
                 "properties": {

     

       30
       30
       -
                   "posts": {

     

       31
       31
       -
                     "type": "array",

     

       32
       32
       -
                     "description": "Array of post views. May include notFound/blocked entries for missing posts.",

     

       33
       33
       -
                     "items": {

     

       34
       34
       -
                       "type": "union",

     

       35
       35
       -
                       "refs": ["#postView", "#notFoundPost", "#blockedPost"]

     

       36
       36
       -
                     }

     

       37
       37
       -
                   }

     

       38
       38
       -
                 }

     

       39
       39
       -
               }

     

       40
       40
       -
             },

     

       41
       41
       -
             "errors": [

     

       42
       42
       -
               {"name": "InvalidRequest", "description": "Invalid URI format or empty array"}

     

       43
       43
       -
             ]

     

       44
       44
       -
           },

     

       45
       45
       -
           "postView": {

     

       46
       46
       -
             "type": "object",

     

       47
       47
       -
             "required": ["uri", "cid", "author", "record", "community", "createdAt", "indexedAt"],

     

       48
       48
       -
             "properties": {

     

       49
       49
       -
               "uri": {

     

       50
       50
       -
                 "type": "string",

     

       51
       51
       -
                 "format": "at-uri"

     

       52
       52
       -
               },

     

       53
       53
       -
               "cid": {

     

       54
       54
       -
                 "type": "string",

     

       55
       55
       -
                 "format": "cid"

     

       56
       56
       -
               },

     

       57
       57
       -
               "author": {

     

       58
       58
       -
                 "type": "ref",

     

       59
       59
       -
                 "ref": "#authorView"

     

       60
       60
       -
               },

     

       61
       61
       -
               "record": {

     

       62
       62
       -
                 "type": "unknown",

     

       63
       63
       -
                 "description": "The actual post record (text, image, video, etc.)"

     

       64
       64
       -
               },

     

       65
       65
       -
               "community": {

     

       66
       66
       -
                 "type": "ref",

     

       67
       67
       -
                 "ref": "#communityRef"

     

       68
       68
       -
               },

     

       69
       69
       -
               "title": {

     

       70
       70
       -
                 "type": "string"

     

       71
       71
       -
               },

     

       72
       72
       -
               "text": {

     

       73
       73
       -
                 "type": "string"

     

       74
       74
       -
               },

     

       75
       75
       -
               "textFacets": {

     

       76
       76
       -
                 "type": "array",

     

       77
       77
       -
                 "items": {

     

       78
       78
       -
                   "type": "ref",

     

       79
       79
       -
                   "ref": "social.coves.richtext.facet"

     

       80
       80
       -
                 }

     

       81
       81
       -
               },

     

       82
       82
       -
               "embed": {

     

       83
       83
       -
                 "type": "union",

     

       84
       84
       -
                 "description": "Embedded content (images, video, link preview, or quoted post)",

     

       85
       85
       -
                 "refs": [

     

       86
       86
       -
                   "social.coves.embed.images#view",

     

       87
       87
       -
                   "social.coves.embed.video#view",

     

       88
       88
       -
                   "social.coves.embed.external#view",

     

       89
       89
       -
                   "social.coves.embed.record#view",

     

       90
       90
       -
                   "social.coves.embed.recordWithMedia#view"

     

       91
       91
       -
                 ]

     

       92
       92
       -
               },

     

       93
       93
       -
               "language": {

     

       94
       94
       -
                 "type": "string",

     

       95
       95
       -
                 "format": "language"

     

       96
       96
       -
               },

     

       97
       97
       -
               "createdAt": {

     

       98
       98
       -
                 "type": "string",

     

       99
       99
       -
                 "format": "datetime"

     

       100
       100
       -
               },

     

       101
       101
       -
               "editedAt": {

     

       102
       102
       -
                 "type": "string",

     

       103
       103
       -
                 "format": "datetime"

     

       104
       104
       -
               },

     

       105
       105
       -
               "indexedAt": {

     

       106
       106
       -
                 "type": "string",

     

       107
       107
       -
                 "format": "datetime",

     

       108
       108
       -
                 "description": "When this post was indexed by the AppView"

     

       109
       109
       -
               },

     

       110
       110
       -
               "stats": {

     

       111
       111
       -
                 "type": "ref",

     

       112
       112
       -
                 "ref": "#postStats"

     

       113
       113
       -
               },

     

       114
       114
       -
               "viewer": {

     

       115
       115
       -
                 "type": "ref",

     

       116
       116
       -
                 "ref": "#viewerState"

     

       117
       117
       -
               }

     

       118
       118
       -
             }

     

       119
       119
       -
           },

     

       120
       120
       -
           "authorView": {

     

       121
       121
       -
             "type": "object",

     

       122
       122
       -
             "required": ["did", "handle"],

     

       123
       123
       -
             "properties": {

     

       124
       124
       -
               "did": {

     

       125
       125
       -
                 "type": "string",

     

       126
       126
       -
                 "format": "did"

     

       127
       127
       -
               },

     

       128
       128
       -
               "handle": {

     

       129
       129
       -
                 "type": "string",

     

       130
       130
       -
                 "format": "handle"

     

       131
       131
       -
               },

     

       132
       132
       -
               "displayName": {

     

       133
       133
       -
                 "type": "string"

     

       134
       134
       -
               },

     

       135
       135
       -
               "avatar": {

     

       136
       136
       -
                 "type": "string",

     

       137
       137
       -
                 "format": "uri"

     

       138
       138
       -
               },

     

       139
       139
       -
               "reputation": {

     

       140
       140
       -
                 "type": "integer",

     

       141
       141
       -
                 "description": "Author's reputation in the community"

     

       142
       142
       -
               }

     

       143
       143
       -
             }

     

       144
       144
       -
           },

     

       145
       145
       -
           "communityRef": {

     

       146
       146
       -
             "type": "object",

     

       147
       147
       -
             "required": ["did", "name"],

     

       148
       148
       -
             "properties": {

     

       149
       149
       -
               "did": {

     

       150
       150
       -
                 "type": "string",

     

       151
       151
       -
                 "format": "did"

     

       152
       152
       -
               },

     

       153
       153
       -
               "name": {

     

       154
       154
       -
                 "type": "string"

     

       155
       155
       -
               },

     

       156
       156
       -
               "avatar": {

     

       157
       157
       -
                 "type": "string",

     

       158
       158
       -
                 "format": "uri"

     

       159
       159
       -
               }

     

       160
       160
       -
             }

     

       161
       161
       -
           },

     

       162
       162
       -
           "notFoundPost": {

     

       163
       163
       -
             "type": "object",

     

       164
       164
       -
             "description": "Post was not found (deleted, never indexed, or invalid URI)",

     

       165
       165
       -
             "required": ["uri", "notFound"],

     

       166
       166
       -
             "properties": {

     

       167
       167
       -
               "uri": {

     

       168
       168
       -
                 "type": "string",

     

       169
       169
       -
                 "format": "at-uri"

     

       170
       170
       -
               },

     

       171
       171
       -
               "notFound": {

     

       172
       172
       -
                 "type": "boolean",

     

       173
       173
       -
                 "const": true

     

       174
       174
       -
               }

     

       175
       175
       -
             }

     

       176
       176
       -
           },

     

       177
       177
       -
           "blockedPost": {

     

       178
       178
       -
             "type": "object",

     

       179
       179
       -
             "description": "Post is blocked due to viewer blocking author/community, or community moderation",

     

       180
       180
       -
             "required": ["uri", "blocked"],

     

       181
       181
       -
             "properties": {

     

       182
       182
       -
               "uri": {

     

       183
       183
       -
                 "type": "string",

     

       184
       184
       -
                 "format": "at-uri"

     

       185
       185
       -
               },

     

       186
       186
       -
               "blocked": {

     

       187
       187
       -
                 "type": "boolean",

     

       188
       188
       -
                 "const": true

     

       189
       189
       -
               },

     

       190
       190
       -
               "blockedBy": {

     

       191
       191
       -
                 "type": "string",

     

       192
       192
       -
                 "enum": ["author", "community", "moderator"],

     

       193
       193
       -
                 "description": "What caused the block: viewer blocked author, viewer blocked community, or post was removed by moderators"

     

       194
       194
       -
               },

     

       195
       195
       -
               "author": {

     

       196
       196
       -
                 "type": "ref",

     

       197
       197
       -
                 "ref": "#blockedAuthor"

     

       198
       198
       -
               },

     

       199
       199
       -
               "community": {

     

       200
       200
       -
                 "type": "ref",

     

       201
       201
       -
                 "ref": "#blockedCommunity"

     

       202
       202
       -
               }

     

       203
       203
       -
             }

     

       204
       204
       -
           },

     

       205
       205
       -
           "blockedAuthor": {

     

       206
       206
       -
             "type": "object",

     

       207
       207
       -
             "description": "Minimal author info for blocked posts",

     

       208
       208
       -
             "required": ["did"],

     

       209
       209
       -
             "properties": {

     

       210
       210
       -
               "did": {

     

       211
       211
       -
                 "type": "string",

     

       212
       212
       -
                 "format": "did"

     

       213
       213
       -
               }

     

       214
       214
       -
             }

     

       215
       215
       -
           },

     

       216
       216
       -
           "blockedCommunity": {

     

       217
       217
       -
             "type": "object",

     

       218
       218
       -
             "description": "Minimal community info for blocked posts",

     

       219
       219
       -
             "required": ["did"],

     

       220
       220
       -
             "properties": {

     

       221
       221
       -
               "did": {

     

       222
       222
       -
                 "type": "string",

     

       223
       223
       -
                 "format": "did"

     

       224
       224
       -
               },

     

       225
       225
       -
               "name": {

     

       226
       226
       -
                 "type": "string"

     

       227
       227
       -
               }

     

       228
       228
       -
             }

     

       229
       229
       -
           },

     

       230
       230
       -
           "postStats": {

     

       231
       231
       -
             "type": "object",

     

       232
       232
       -
             "required": ["upvotes", "downvotes", "score", "commentCount"],

     

       233
       233
       -
             "properties": {

     

       234
       234
       -
               "upvotes": {

     

       235
       235
       -
                 "type": "integer",

     

       236
       236
       -
                 "minimum": 0

     

       237
       237
       -
               },

     

       238
       238
       -
               "downvotes": {

     

       239
       239
       -
                 "type": "integer",

     

       240
       240
       -
                 "minimum": 0

     

       241
       241
       -
               },

     

       242
       242
       -
               "score": {

     

       243
       243
       -
                 "type": "integer",

     

       244
       244
       -
                 "description": "Calculated score (upvotes - downvotes)"

     

       245
       245
       -
               },

     

       246
       246
       -
               "commentCount": {

     

       247
       247
       -
                 "type": "integer",

     

       248
       248
       -
                 "minimum": 0

     

       249
       249
       -
               },

     

       250
       250
       -
               "shareCount": {

     

       251
       251
       -
                 "type": "integer",

     

       252
       252
       -
                 "minimum": 0

     

       253
       253
       -
               },

     

       254
       254
       -
               "tagCounts": {

     

       255
       255
       -
                 "type": "object",

     

       256
       256
       -
                 "description": "Aggregate counts of tags applied by community members",

     

       257
       257
       -
                 "additionalProperties": {

     

       258
       258
       -
                   "type": "integer",

     

       259
       259
       -
                   "minimum": 0

     

       260
       260
       -
                 }

     

       261
       261
       -
               }

     

       262
       262
       -
             }

     

       263
       263
       -
           },

     

       264
       264
       -
           "viewerState": {

     

       265
       265
       -
             "type": "object",

     

       266
       266
       -
             "properties": {

     

       267
       267
       -
               "vote": {

     

       268
       268
       -
                 "type": "string",

     

       269
       269
       -
                 "enum": ["up", "down"],

     

       270
       270
       -
                 "description": "Viewer's vote on this post"

     

       271
       271
       -
               },

     

       272
       272
       -
               "voteUri": {

     

       273
       273
       -
                 "type": "string",

     

       274
       274
       -
                 "format": "at-uri"

     

       275
       275
       -
               },

     

       276
       276
       -
               "saved": {

     

       277
       277
       -
                 "type": "boolean"

     

       278
       278
       -
               },

     

       279
       279
       -
               "savedUri": {

     

       280
       280
       -
                 "type": "string",

     

       281
       281
       -
                 "format": "at-uri"

     

       282
       282
       -
               },

     

       283
       283
       -
               "tags": {

     

       284
       284
       -
                 "type": "array",

     

       285
       285
       -
                 "description": "Tags applied by the viewer to this post",

     

       286
       286
       -
                 "items": {

     

       287
       287
       -
                   "type": "string",

     

       288
       288
       -
                   "maxLength": 32

     

       289
       289
       -
                 }

     

       290
       290
       -
               }

     

       291
       291
       -
             }

     

       292
       292
       -
           }

     

       293
       293
       -
         }

     

       294
       294
       -
       }

-99

internal/atproto/lexicon/social/coves/post/getCrosspostChain.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.getCrosspostChain",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Get all crossposts in a crosspost chain for a given post",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of any post in the crosspost chain"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "required": ["crossposts"],

     

       27
       27
       -
                 "properties": {

     

       28
       28
       -
                   "crossposts": {

     

       29
       29
       -
                     "type": "array",

     

       30
       30
       -
                     "description": "All posts in the crosspost chain",

     

       31
       31
       -
                     "items": {

     

       32
       32
       -
                       "type": "ref",

     

       33
       33
       -
                       "ref": "#crosspostView"

     

       34
       34
       -
                     }

     

       35
       35
       -
                   }

     

       36
       36
       -
                 }

     

       37
       37
       -
               }

     

       38
       38
       -
             }

     

       39
       39
       -
           },

     

       40
       40
       -
           "crosspostView": {

     

       41
       41
       -
             "type": "object",

     

       42
       42
       -
             "required": ["uri", "community", "author", "createdAt"],

     

       43
       43
       -
             "properties": {

     

       44
       44
       -
               "uri": {

     

       45
       45
       -
                 "type": "string",

     

       46
       46
       -
                 "format": "at-uri",

     

       47
       47
       -
                 "description": "AT-URI of the post"

     

       48
       48
       -
               },

     

       49
       49
       -
               "community": {

     

       50
       50
       -
                 "type": "object",

     

       51
       51
       -
                 "required": ["uri", "name"],

     

       52
       52
       -
                 "properties": {

     

       53
       53
       -
                   "uri": {

     

       54
       54
       -
                     "type": "string",

     

       55
       55
       -
                     "format": "at-uri",

     

       56
       56
       -
                     "description": "AT-URI of the community"

     

       57
       57
       -
                   },

     

       58
       58
       -
                   "name": {

     

       59
       59
       -
                     "type": "string",

     

       60
       60
       -
                     "description": "Display name of the community"

     

       61
       61
       -
                   },

     

       62
       62
       -
                   "handle": {

     

       63
       63
       -
                     "type": "string",

     

       64
       64
       -
                     "description": "Handle of the community"

     

       65
       65
       -
                   }

     

       66
       66
       -
                 }

     

       67
       67
       -
               },

     

       68
       68
       -
               "author": {

     

       69
       69
       -
                 "type": "object",

     

       70
       70
       -
                 "required": ["did", "handle"],

     

       71
       71
       -
                 "properties": {

     

       72
       72
       -
                   "did": {

     

       73
       73
       -
                     "type": "string",

     

       74
       74
       -
                     "format": "did"

     

       75
       75
       -
                   },

     

       76
       76
       -
                   "handle": {

     

       77
       77
       -
                     "type": "string"

     

       78
       78
       -
                   },

     

       79
       79
       -
                   "displayName": {

     

       80
       80
       -
                     "type": "string"

     

       81
       81
       -
                   },

     

       82
       82
       -
                   "avatar": {

     

       83
       83
       -
                     "type": "string",

     

       84
       84
       -
                     "format": "uri"

     

       85
       85
       -
                   }

     

       86
       86
       -
                 }

     

       87
       87
       -
               },

     

       88
       88
       -
               "isOriginal": {

     

       89
       89
       -
                 "type": "boolean",

     

       90
       90
       -
                 "description": "Whether this is the original post in the chain"

     

       91
       91
       -
               },

     

       92
       92
       -
               "createdAt": {

     

       93
       93
       -
                 "type": "string",

     

       94
       94
       -
                 "format": "datetime"

     

       95
       95
       -
               }

     

       96
       96
       -
             }

     

       97
       97
       -
           }

     

       98
       98
       -
         }

     

       99
       99
       -
       }

-129

internal/atproto/lexicon/social/coves/post/record.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.record",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A unified post record supporting multiple content types",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["$type", "community", "author", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "$type": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "const": "social.coves.post.record",

     

       16
       16
       -
                   "description": "The record type identifier"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "community": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "at-identifier",

     

       21
       21
       -
                   "description": "DID or handle of the community this was posted to"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "author": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "format": "did",

     

       26
       26
       -
                   "description": "DID of the user who created this post. Server-populated from authenticated session; clients MUST NOT provide this field. Required for attribution, moderation, and accountability."

     

       27
       27
       -
                 },

     

       28
       28
       -
                 "title": {

     

       29
       29
       -
                   "type": "string",

     

       30
       30
       -
                   "maxGraphemes": 300,

     

       31
       31
       -
                   "maxLength": 3000,

     

       32
       32
       -
                   "description": "Post title (optional for microblog, image, and video posts)"

     

       33
       33
       -
                 },

     

       34
       34
       -
                 "content": {

     

       35
       35
       -
                   "type": "string",

     

       36
       36
       -
                   "maxLength": 50000,

     

       37
       37
       -
                   "description": "Post content - main text for text posts, description for media, etc."

     

       38
       38
       -
                 },

     

       39
       39
       -
                 "facets": {

     

       40
       40
       -
                   "type": "array",

     

       41
       41
       -
                   "description": "Rich text annotations for content",

     

       42
       42
       -
                   "items": {

     

       43
       43
       -
                     "type": "ref",

     

       44
       44
       -
                     "ref": "social.coves.richtext.facet"

     

       45
       45
       -
                   }

     

       46
       46
       -
                 },

     

       47
       47
       -
                 "embed": {

     

       48
       48
       -
                   "type": "union",

     

       49
       49
       -
                   "description": "Embedded content - images, videos, external links, or quoted posts",

     

       50
       50
       -
                   "refs": [

     

       51
       51
       -
                     "social.coves.embed.images",

     

       52
       52
       -
                     "social.coves.embed.video",

     

       53
       53
       -
                     "social.coves.embed.external",

     

       54
       54
       -
                     "social.coves.embed.post"

     

       55
       55
       -
                   ]

     

       56
       56
       -
                 },

     

       57
       57
       -
                 "originalAuthor": {

     

       58
       58
       -
                   "type": "ref",

     

       59
       59
       -
                   "ref": "#originalAuthor",

     

       60
       60
       -
                   "description": "For microblog posts - information about the original author from federated platform"

     

       61
       61
       -
                 },

     

       62
       62
       -
                 "contentLabels": {

     

       63
       63
       -
                   "type": "array",

     

       64
       64
       -
                   "description": "Self-applied content labels",

     

       65
       65
       -
                   "items": {

     

       66
       66
       -
                     "type": "string",

     

       67
       67
       -
                     "knownValues": ["nsfw", "spoiler", "violence"],

     

       68
       68
       -
                     "maxLength": 32

     

       69
       69
       -
                   }

     

       70
       70
       -
                 },

     

       71
       71
       -
                 "federatedFrom": {

     

       72
       72
       -
                   "type": "ref",

     

       73
       73
       -
                   "ref": "social.coves.federation.post",

     

       74
       74
       -
                   "description": "Reference to original federated post (if applicable)"

     

       75
       75
       -
                 },

     

       76
       76
       -
                 "location": {

     

       77
       77
       -
                   "type": "ref",

     

       78
       78
       -
                   "ref": "social.coves.actor.profile#geoLocation",

     

       79
       79
       -
                   "description": "Geographic location where post was created"

     

       80
       80
       -
                 },

     

       81
       81
       -
                 "crosspostOf": {

     

       82
       82
       -
                   "type": "string",

     

       83
       83
       -
                   "format": "at-uri",

     

       84
       84
       -
                   "description": "If this is a crosspost, AT-URI of the post this is a crosspost of"

     

       85
       85
       -
                 },

     

       86
       86
       -
                 "crosspostChain": {

     

       87
       87
       -
                   "type": "array",

     

       88
       88
       -
                   "description": "Array of AT-URIs of all posts in the crosspost chain (including this one)",

     

       89
       89
       -
                   "items": {

     

       90
       90
       -
                     "type": "string",

     

       91
       91
       -
                     "format": "at-uri"

     

       92
       92
       -
                   }

     

       93
       93
       -
                 },

     

       94
       94
       -
                 "createdAt": {

     

       95
       95
       -
                   "type": "string",

     

       96
       96
       -
                   "format": "datetime"

     

       97
       97
       -
                 }

     

       98
       98
       -
               }

     

       99
       99
       -
             }

     

       100
       100
       -
           },

     

       101
       101
       -
           "originalAuthor": {

     

       102
       102
       -
             "type": "object",

     

       103
       103
       -
             "description": "Information about the original author from a federated platform",

     

       104
       104
       -
             "required": ["handle"],

     

       105
       105
       -
             "properties": {

     

       106
       106
       -
               "did": {

     

       107
       107
       -
                 "type": "string",

     

       108
       108
       -
                 "format": "did",

     

       109
       109
       -
                 "description": "Original author's DID (if available)"

     

       110
       110
       -
               },

     

       111
       111
       -
               "handle": {

     

       112
       112
       -
                 "type": "string",

     

       113
       113
       -
                 "maxLength": 253,

     

       114
       114
       -
                 "description": "Original author's handle"

     

       115
       115
       -
               },

     

       116
       116
       -
               "displayName": {

     

       117
       117
       -
                 "type": "string",

     

       118
       118
       -
                 "maxLength": 640,

     

       119
       119
       -
                 "description": "Original author's display name"

     

       120
       120
       -
               },

     

       121
       121
       -
               "avatar": {

     

       122
       122
       -
                 "type": "string",

     

       123
       123
       -
                 "format": "uri",

     

       124
       124
       -
                 "description": "URL to original author's avatar"

     

       125
       125
       -
               }

     

       126
       126
       -
             }

     

       127
       127
       -
           }

     

       128
       128
       -
         }

     

       129
       129
       -
       }

-80

internal/atproto/lexicon/social/coves/post/search.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.search",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "query",

     

       7
       7
       -
             "description": "Search for posts",

     

       8
       8
       -
             "parameters": {

     

       9
       9
       -
               "type": "params",

     

       10
       10
       -
               "required": ["q"],

     

       11
       11
       -
               "properties": {

     

       12
       12
       -
                 "q": {

     

       13
       13
       -
                   "type": "string",

     

       14
       14
       -
                   "description": "Search query"

     

       15
       15
       -
                 },

     

       16
       16
       -
                 "community": {

     

       17
       17
       -
                   "type": "string",

     

       18
       18
       -
                   "format": "at-identifier",

     

       19
       19
       -
                   "description": "Filter by specific community"

     

       20
       20
       -
                 },

     

       21
       21
       -
                 "author": {

     

       22
       22
       -
                   "type": "string",

     

       23
       23
       -
                   "format": "at-identifier",

     

       24
       24
       -
                   "description": "Filter by author"

     

       25
       25
       -
                 },

     

       26
       26
       -
                 "type": {

     

       27
       27
       -
                   "type": "string",

     

       28
       28
       -
                   "enum": ["text", "image", "video", "article", "microblog"],

     

       29
       29
       -
                   "description": "Filter by post type"

     

       30
       30
       -
                 },

     

       31
       31
       -
                 "tags": {

     

       32
       32
       -
                   "type": "array",

     

       33
       33
       -
                   "items": {

     

       34
       34
       -
                     "type": "string"

     

       35
       35
       -
                   },

     

       36
       36
       -
                   "description": "Filter by tags"

     

       37
       37
       -
                 },

     

       38
       38
       -
                 "sort": {

     

       39
       39
       -
                   "type": "string",

     

       40
       40
       -
                   "enum": ["relevance", "new", "top"],

     

       41
       41
       -
                   "default": "relevance"

     

       42
       42
       -
                 },

     

       43
       43
       -
                 "timeframe": {

     

       44
       44
       -
                   "type": "string",

     

       45
       45
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       46
       46
       -
                   "default": "all"

     

       47
       47
       -
                 },

     

       48
       48
       -
                 "limit": {

     

       49
       49
       -
                   "type": "integer",

     

       50
       50
       -
                   "minimum": 1,

     

       51
       51
       -
                   "maximum": 100,

     

       52
       52
       -
                   "default": 50

     

       53
       53
       -
                 },

     

       54
       54
       -
                 "cursor": {

     

       55
       55
       -
                   "type": "string"

     

       56
       56
       -
                 }

     

       57
       57
       -
               }

     

       58
       58
       -
             },

     

       59
       59
       -
             "output": {

     

       60
       60
       -
               "encoding": "application/json",

     

       61
       61
       -
               "schema": {

     

       62
       62
       -
                 "type": "object",

     

       63
       63
       -
                 "required": ["posts"],

     

       64
       64
       -
                 "properties": {

     

       65
       65
       -
                   "posts": {

     

       66
       66
       -
                     "type": "array",

     

       67
       67
       -
                     "items": {

     

       68
       68
       -
                       "type": "ref",

     

       69
       69
       -
                       "ref": "social.coves.post.getFeed#feedPost"

     

       70
       70
       -
                     }

     

       71
       71
       -
                   },

     

       72
       72
       -
                   "cursor": {

     

       73
       73
       -
                     "type": "string"

     

       74
       74
       -
                   }

     

       75
       75
       -
                 }

     

       76
       76
       -
               }

     

       77
       77
       -
             }

     

       78
       78
       -
           }

     

       79
       79
       -
         }

     

       80
       80
       -
       }

-104

internal/atproto/lexicon/social/coves/post/update.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.post.update",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Update an existing post",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["uri"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "uri": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post to update"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "title": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "maxGraphemes": 300,

     

       22
       22
       -
                     "maxLength": 3000,

     

       23
       23
       -
                     "description": "Updated title"

     

       24
       24
       -
                   },

     

       25
       25
       -
                   "content": {

     

       26
       26
       -
                     "type": "string",

     

       27
       27
       -
                     "maxLength": 50000,

     

       28
       28
       -
                     "description": "Updated content - main text for text posts, description for media, etc."

     

       29
       29
       -
                   },

     

       30
       30
       -
                   "facets": {

     

       31
       31
       -
                     "type": "array",

     

       32
       32
       -
                     "description": "Updated rich text annotations for content",

     

       33
       33
       -
                     "items": {

     

       34
       34
       -
                       "type": "ref",

     

       35
       35
       -
                       "ref": "social.coves.richtext.facet"

     

       36
       36
       -
                     }

     

       37
       37
       -
                   },

     

       38
       38
       -
                   "embed": {

     

       39
       39
       -
                     "type": "union",

     

       40
       40
       -
                     "description": "Updated embedded content (note: changing embed type may be restricted)",

     

       41
       41
       -
                     "refs": [

     

       42
       42
       -
                       "social.coves.embed.images",

     

       43
       43
       -
                       "social.coves.embed.video",

     

       44
       44
       -
                       "social.coves.embed.external",

     

       45
       45
       -
                       "social.coves.embed.post"

     

       46
       46
       -
                     ]

     

       47
       47
       -
                   },

     

       48
       48
       -
                   "contentLabels": {

     

       49
       49
       -
                     "type": "array",

     

       50
       50
       -
                     "description": "Updated content labels",

     

       51
       51
       -
                     "items": {

     

       52
       52
       -
                       "type": "string",

     

       53
       53
       -
                       "knownValues": ["nsfw", "spoiler", "violence"],

     

       54
       54
       -
                       "maxLength": 32

     

       55
       55
       -
                     }

     

       56
       56
       -
                   },

     

       57
       57
       -
                   "editNote": {

     

       58
       58
       -
                     "type": "string",

     

       59
       59
       -
                     "maxLength": 300,

     

       60
       60
       -
                     "description": "Optional note explaining the edit"

     

       61
       61
       -
                   }

     

       62
       62
       -
                 }

     

       63
       63
       -
               }

     

       64
       64
       -
             },

     

       65
       65
       -
             "output": {

     

       66
       66
       -
               "encoding": "application/json",

     

       67
       67
       -
               "schema": {

     

       68
       68
       -
                 "type": "object",

     

       69
       69
       -
                 "required": ["uri", "cid"],

     

       70
       70
       -
                 "properties": {

     

       71
       71
       -
                   "uri": {

     

       72
       72
       -
                     "type": "string",

     

       73
       73
       -
                     "format": "at-uri",

     

       74
       74
       -
                     "description": "AT-URI of the updated post"

     

       75
       75
       -
                   },

     

       76
       76
       -
                   "cid": {

     

       77
       77
       -
                     "type": "string",

     

       78
       78
       -
                     "format": "cid",

     

       79
       79
       -
                     "description": "New CID of the updated post"

     

       80
       80
       -
                   }

     

       81
       81
       -
                 }

     

       82
       82
       -
               }

     

       83
       83
       -
             },

     

       84
       84
       -
             "errors": [

     

       85
       85
       -
               {

     

       86
       86
       -
                 "name": "PostNotFound",

     

       87
       87
       -
                 "description": "Post not found"

     

       88
       88
       -
               },

     

       89
       89
       -
               {

     

       90
       90
       -
                 "name": "NotAuthorized",

     

       91
       91
       -
                 "description": "User is not authorized to edit this post"

     

       92
       92
       -
               },

     

       93
       93
       -
               {

     

       94
       94
       -
                 "name": "EditWindowExpired",

     

       95
       95
       -
                 "description": "Edit window has expired (posts can only be edited within 24 hours)"

     

       96
       96
       -
               },

     

       97
       97
       -
               {

     

       98
       98
       -
                 "name": "InvalidUpdate",

     

       99
       99
       -
                 "description": "Invalid update operation (e.g., changing post type)"

     

       100
       100
       -
               }

     

       101
       101
       -
             ]

     

       102
       102
       -
           }

     

       103
       103
       -
         }

     

       104
       104
       -
       }

+156

internal/atproto/lexicon/com/atproto/label/defs.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "com.atproto.label.defs",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "label": {

     

       6
       6
       +
             "type": "object",

     

       7
       7
       +
             "description": "Metadata tag on an atproto resource (eg, repo or record).",

     

       8
       8
       +
             "required": ["src", "uri", "val", "cts"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "ver": {

     

       11
       11
       +
                 "type": "integer",

     

       12
       12
       +
                 "description": "The AT Protocol version of the label object."

     

       13
       13
       +
               },

     

       14
       14
       +
               "src": {

     

       15
       15
       +
                 "type": "string",

     

       16
       16
       +
                 "format": "did",

     

       17
       17
       +
                 "description": "DID of the actor who created this label."

     

       18
       18
       +
               },

     

       19
       19
       +
               "uri": {

     

       20
       20
       +
                 "type": "string",

     

       21
       21
       +
                 "format": "uri",

     

       22
       22
       +
                 "description": "AT URI of the record, repository (account), or other resource that this label applies to."

     

       23
       23
       +
               },

     

       24
       24
       +
               "cid": {

     

       25
       25
       +
                 "type": "string",

     

       26
       26
       +
                 "format": "cid",

     

       27
       27
       +
                 "description": "Optionally, CID specifying the specific version of 'uri' resource this label applies to."

     

       28
       28
       +
               },

     

       29
       29
       +
               "val": {

     

       30
       30
       +
                 "type": "string",

     

       31
       31
       +
                 "maxLength": 128,

     

       32
       32
       +
                 "description": "The short string name of the value or type of this label."

     

       33
       33
       +
               },

     

       34
       34
       +
               "neg": {

     

       35
       35
       +
                 "type": "boolean",

     

       36
       36
       +
                 "description": "If true, this is a negation label, overwriting a previous label."

     

       37
       37
       +
               },

     

       38
       38
       +
               "cts": {

     

       39
       39
       +
                 "type": "string",

     

       40
       40
       +
                 "format": "datetime",

     

       41
       41
       +
                 "description": "Timestamp when this label was created."

     

       42
       42
       +
               },

     

       43
       43
       +
               "exp": {

     

       44
       44
       +
                 "type": "string",

     

       45
       45
       +
                 "format": "datetime",

     

       46
       46
       +
                 "description": "Timestamp at which this label expires (no longer applies)."

     

       47
       47
       +
               },

     

       48
       48
       +
               "sig": {

     

       49
       49
       +
                 "type": "bytes",

     

       50
       50
       +
                 "description": "Signature of dag-cbor encoded label."

     

       51
       51
       +
               }

     

       52
       52
       +
             }

     

       53
       53
       +
           },

     

       54
       54
       +
           "selfLabels": {

     

       55
       55
       +
             "type": "object",

     

       56
       56
       +
             "description": "Metadata tags on an atproto record, published by the author within the record.",

     

       57
       57
       +
             "required": ["values"],

     

       58
       58
       +
             "properties": {

     

       59
       59
       +
               "values": {

     

       60
       60
       +
                 "type": "array",

     

       61
       61
       +
                 "items": { "type": "ref", "ref": "#selfLabel" },

     

       62
       62
       +
                 "maxLength": 10

     

       63
       63
       +
               }

     

       64
       64
       +
             }

     

       65
       65
       +
           },

     

       66
       66
       +
           "selfLabel": {

     

       67
       67
       +
             "type": "object",

     

       68
       68
       +
             "description": "Metadata tag on an atproto record, published by the author within the record. Note that schemas should use #selfLabels, not #selfLabel.",

     

       69
       69
       +
             "required": ["val"],

     

       70
       70
       +
             "properties": {

     

       71
       71
       +
               "val": {

     

       72
       72
       +
                 "type": "string",

     

       73
       73
       +
                 "maxLength": 128,

     

       74
       74
       +
                 "description": "The short string name of the value or type of this label."

     

       75
       75
       +
               }

     

       76
       76
       +
             }

     

       77
       77
       +
           },

     

       78
       78
       +
           "labelValueDefinition": {

     

       79
       79
       +
             "type": "object",

     

       80
       80
       +
             "description": "Declares a label value and its expected interpretations and behaviors.",

     

       81
       81
       +
             "required": ["identifier", "severity", "blurs", "locales"],

     

       82
       82
       +
             "properties": {

     

       83
       83
       +
               "identifier": {

     

       84
       84
       +
                 "type": "string",

     

       85
       85
       +
                 "description": "The value of the label being defined. Must only include lowercase ascii and the '-' character ([a-z-]+).",

     

       86
       86
       +
                 "maxLength": 100,

     

       87
       87
       +
                 "maxGraphemes": 100

     

       88
       88
       +
               },

     

       89
       89
       +
               "severity": {

     

       90
       90
       +
                 "type": "string",

     

       91
       91
       +
                 "description": "How should a client visually convey this label? 'inform' means neutral and informational; 'alert' means negative and warning; 'none' means show nothing.",

     

       92
       92
       +
                 "knownValues": ["inform", "alert", "none"]

     

       93
       93
       +
               },

     

       94
       94
       +
               "blurs": {

     

       95
       95
       +
                 "type": "string",

     

       96
       96
       +
                 "description": "What should this label hide in the UI, if applied? 'content' hides all of the target; 'media' hides the images/video/audio; 'none' hides nothing.",

     

       97
       97
       +
                 "knownValues": ["content", "media", "none"]

     

       98
       98
       +
               },

     

       99
       99
       +
               "defaultSetting": {

     

       100
       100
       +
                 "type": "string",

     

       101
       101
       +
                 "description": "The default setting for this label.",

     

       102
       102
       +
                 "knownValues": ["ignore", "warn", "hide"],

     

       103
       103
       +
                 "default": "warn"

     

       104
       104
       +
               },

     

       105
       105
       +
               "adultOnly": {

     

       106
       106
       +
                 "type": "boolean",

     

       107
       107
       +
                 "description": "Does the user need to have adult content enabled in order to configure this label?"

     

       108
       108
       +
               },

     

       109
       109
       +
               "locales": {

     

       110
       110
       +
                 "type": "array",

     

       111
       111
       +
                 "items": { "type": "ref", "ref": "#labelValueDefinitionStrings" }

     

       112
       112
       +
               }

     

       113
       113
       +
             }

     

       114
       114
       +
           },

     

       115
       115
       +
           "labelValueDefinitionStrings": {

     

       116
       116
       +
             "type": "object",

     

       117
       117
       +
             "description": "Strings which describe the label in the UI, localized into a specific language.",

     

       118
       118
       +
             "required": ["lang", "name", "description"],

     

       119
       119
       +
             "properties": {

     

       120
       120
       +
               "lang": {

     

       121
       121
       +
                 "type": "string",

     

       122
       122
       +
                 "description": "The code of the language these strings are written in.",

     

       123
       123
       +
                 "format": "language"

     

       124
       124
       +
               },

     

       125
       125
       +
               "name": {

     

       126
       126
       +
                 "type": "string",

     

       127
       127
       +
                 "description": "A short human-readable name for the label.",

     

       128
       128
       +
                 "maxGraphemes": 64,

     

       129
       129
       +
                 "maxLength": 640

     

       130
       130
       +
               },

     

       131
       131
       +
               "description": {

     

       132
       132
       +
                 "type": "string",

     

       133
       133
       +
                 "description": "A longer description of what the label means and why it might be applied.",

     

       134
       134
       +
                 "maxGraphemes": 10000,

     

       135
       135
       +
                 "maxLength": 100000

     

       136
       136
       +
               }

     

       137
       137
       +
             }

     

       138
       138
       +
           },

     

       139
       139
       +
           "labelValue": {

     

       140
       140
       +
             "type": "string",

     

       141
       141
       +
             "knownValues": [

     

       142
       142
       +
               "!hide",

     

       143
       143
       +
               "!no-promote",

     

       144
       144
       +
               "!warn",

     

       145
       145
       +
               "!no-unauthenticated",

     

       146
       146
       +
               "dmca-violation",

     

       147
       147
       +
               "doxxing",

     

       148
       148
       +
               "porn",

     

       149
       149
       +
               "sexual",

     

       150
       150
       +
               "nudity",

     

       151
       151
       +
               "nsfl",

     

       152
       152
       +
               "gore"

     

       153
       153
       +
             ]

     

       154
       154
       +
           }

     

       155
       155
       +
         }

     

       156
       156
       +
       }

+15

internal/atproto/lexicon/com/atproto/repo/strongRef.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "com.atproto.repo.strongRef",

     

       4
       4
       +
         "description": "A URI with a content-hash fingerprint.",

     

       5
       5
       +
         "defs": {

     

       6
       6
       +
           "main": {

     

       7
       7
       +
             "type": "object",

     

       8
       8
       +
             "required": ["uri", "cid"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "uri": { "type": "string", "format": "at-uri" },

     

       11
       11
       +
               "cid": { "type": "string", "format": "cid" }

     

       12
       12
       +
             }

     

       13
       13
       +
           }

     

       14
       14
       +
         }

     

       15
       15
       +
       }

+4 -21

internal/atproto/lexicon/social/coves/interaction/vote.json internal/atproto/lexicon/social/coves/feed/vote.json

···

       1
       1
        
       {

     

       2
       2
        
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.vote",

     

       3
       3
       +
         "id": "social.coves.feed.vote",

     

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "record",

     

       7
       7
       -
             "description": "A vote (upvote or downvote) on a post or comment",

     

       7
       7
       +
             "description": "Record declaring a vote (upvote or downvote) on a post or comment. Requires authentication.",

     

       8
       8
        
             "key": "tid",

     

       9
       9
        
             "record": {

     

       10
       10
        
               "type": "object",

     
···

       12
       12
        
               "properties": {

     

       13
       13
        
                 "subject": {

     

       14
       14
        
                   "type": "ref",

     

       15
       15
       -
                   "ref": "#strongRef",

     

       15
       15
       +
                   "ref": "com.atproto.repo.strongRef",

     

       16
       16
        
                   "description": "Strong reference to the post or comment being voted on"

     

       17
       17
        
                 },

     

       18
       18
        
                 "direction": {

     

       19
       19
        
                   "type": "string",

     

       20
       20
       -
                   "enum": ["up", "down"],

     

       20
       20
       +
                   "knownValues": ["up", "down"],

     

       21
       21
        
                   "description": "Vote direction: up for upvote, down for downvote"

     

       22
       22
        
                 },

     

       23
       23
        
                 "createdAt": {

     
···

       27
       27
        
                 }

     

       28
       28
        
               }

     

       29
       29
        
             }

     

       30
       30
       -
           },

     

       31
       31
       -
           "strongRef": {

     

       32
       32
       -
             "type": "object",

     

       33
       33
       -
             "description": "Strong reference to a record (AT-URI + CID)",

     

       34
       34
       -
             "required": ["uri", "cid"],

     

       35
       35
       -
             "properties": {

     

       36
       36
       -
               "uri": {

     

       37
       37
       -
                 "type": "string",

     

       38
       38
       -
                 "format": "at-uri",

     

       39
       39
       -
                 "description": "AT-URI of the record"

     

       40
       40
       -
               },

     

       41
       41
       -
               "cid": {

     

       42
       42
       -
                 "type": "string",

     

       43
       43
       -
                 "format": "cid",

     

       44
       44
       -
                 "description": "CID of the record content"

     

       45
       45
       -
               }

     

       46
       46
       -
             }

     

       47
       30
        
           }

     

       48
       31
        
         }

     

       49
       32
        
       }

+8 -5

internal/db/migrations/013_create_votes_table.sql

···

       3
       3
        
       -- Votes are indexed from the firehose after being written to user repositories

     

       4
       4
        
       CREATE TABLE votes (

     

       5
       5
        
           id BIGSERIAL PRIMARY KEY,

     

       6
       6
       -
           uri TEXT UNIQUE NOT NULL,               -- AT-URI (at://voter_did/social.coves.interaction.vote/rkey)

     

       6
       6
       +
           uri TEXT UNIQUE NOT NULL,               -- AT-URI (at://voter_did/social.coves.feed.vote/rkey)

     

       7
       7
        
           cid TEXT NOT NULL,                      -- Content ID

     

       8
       8
        
           rkey TEXT NOT NULL,                     -- Record key (TID)

     

       9
       9
        
           voter_did TEXT NOT NULL,                -- User who voted (from AT-URI repo field)

     
···

       18
       18
        
           -- Timestamps

     

       19
       19
        
           created_at TIMESTAMPTZ NOT NULL,        -- Voter's timestamp from record

     

       20
       20
        
           indexed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When indexed by AppView

     

       21
       21
       -
           deleted_at TIMESTAMPTZ,                 -- Soft delete (for firehose delete events)

     

       21
       21
       +
           deleted_at TIMESTAMPTZ                  -- Soft delete (for firehose delete events)

     

       22
       22
        
       

     

       23
       23
       -
           -- Foreign keys

     

       24
       24
       -
           CONSTRAINT fk_voter FOREIGN KEY (voter_did) REFERENCES users(did) ON DELETE CASCADE

     

       23
       23
       +
           -- NO foreign key constraint on voter_did to allow out-of-order indexing from Jetstream

     

       24
       24
       +
           -- Vote events may arrive before user events, which is acceptable since:

     

       25
       25
       +
           -- 1. Votes are authenticated by the user's PDS (security maintained)

     

       26
       26
       +
           -- 2. Orphaned votes from never-indexed users are harmless

     

       27
       27
       +
           -- 3. This prevents race conditions in the firehose consumer

     

       25
       28
        
       );

     

       26
       29
        
       

     

       27
       30
        
       -- Indexes for common query patterns

     
···

       35
       38
        
       

     

       36
       39
        
       -- Comment on table

     

       37
       40
        
       COMMENT ON TABLE votes IS 'Votes indexed from user repositories via Jetstream firehose consumer';

     

       38
       38
       -
       COMMENT ON COLUMN votes.uri IS 'AT-URI in format: at://voter_did/social.coves.interaction.vote/rkey';

     

       41
       41
       +
       COMMENT ON COLUMN votes.uri IS 'AT-URI in format: at://voter_did/social.coves.feed.vote/rkey';

     

       39
       42
        
       COMMENT ON COLUMN votes.subject_uri IS 'Strong reference to post/comment being voted on';

     

       40
       43
        
       COMMENT ON INDEX unique_voter_subject_active IS 'Ensures one active vote per user per subject (soft delete aware)';

     

       41
       44

+9

tests/lexicon-test-data/feed/vote-valid.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "$type": "social.coves.feed.vote",

     

       3
       3
       +
         "subject": {

     

       4
       4
       +
           "uri": "at://did:plc:alice123/social.coves.community.post/3kbx2n5p",

     

       5
       5
       +
           "cid": "bafyreigj3fwnwjuzr35k2kuzmb5dixxczrzjhqkr5srlqplsh6gq3bj3si"

     

       6
       6
       +
         },

     

       7
       7
       +
         "direction": "up",

     

       8
       8
       +
         "createdAt": "2025-01-09T15:00:00Z"

     

       9
       9
       +
       }

-5

tests/lexicon-test-data/interaction/vote-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.vote",

     

       3
       3
       -
         "subject": "at://did:plc:alice123/social.coves.post.text/3kbx2n5p",

     

       4
       4
       -
         "createdAt": "2025-01-09T15:00:00Z"

     

       5
       5
       -
       }

+3 -2

internal/atproto/lexicon/social/coves/community/getMembers.json

···

       25
       25
        
                 },

     

       26
       26
        
                 "sort": {

     

       27
       27
        
                   "type": "string",

     

       28
       28
       -
                   "enum": ["reputation", "recent", "alphabetical"],

     

       29
       29
       -
                   "default": "reputation"

     

       28
       28
       +
                   "knownValues": ["reputation", "recent", "alphabetical"],

     

       29
       29
       +
                   "default": "reputation",

     

       30
       30
       +
                   "maxLength": 64

     

       30
       31
        
                 }

     

       31
       32
        
               }

     

       32
       33
        
             },

-33

internal/atproto/lexicon/social/coves/actor/block.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.block",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A block relationship where one user blocks another",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "did",

     

       16
       16
       -
                   "description": "DID of the user being blocked"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "createdAt": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "datetime",

     

       21
       21
       -
                   "description": "When the block was created"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "reason": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "maxGraphemes": 300,

     

       26
       26
       -
                   "maxLength": 3000,

     

       27
       27
       -
                   "description": "Optional reason for blocking"

     

       28
       28
       -
                 }

     

       29
       29
       -
               }

     

       30
       30
       -
             }

     

       31
       31
       -
           }

     

       32
       32
       -
         }

     

       33
       33
       -
       }

-59

internal/atproto/lexicon/social/coves/actor/blockUser.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.blockUser",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Block another user",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "did",

     

       17
       17
       -
                     "description": "DID of the user to block"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "reason": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "maxGraphemes": 300,

     

       22
       22
       -
                     "maxLength": 3000,

     

       23
       23
       -
                     "description": "Optional reason for blocking"

     

       24
       24
       -
                   }

     

       25
       25
       -
                 }

     

       26
       26
       -
               }

     

       27
       27
       -
             },

     

       28
       28
       -
             "output": {

     

       29
       29
       -
               "encoding": "application/json",

     

       30
       30
       -
               "schema": {

     

       31
       31
       -
                 "type": "object",

     

       32
       32
       -
                 "required": ["uri", "cid"],

     

       33
       33
       -
                 "properties": {

     

       34
       34
       -
                   "uri": {

     

       35
       35
       -
                     "type": "string",

     

       36
       36
       -
                     "format": "at-uri",

     

       37
       37
       -
                     "description": "AT-URI of the created block record"

     

       38
       38
       -
                   },

     

       39
       39
       -
                   "cid": {

     

       40
       40
       -
                     "type": "string",

     

       41
       41
       -
                     "format": "cid",

     

       42
       42
       -
                     "description": "CID of the created block record"

     

       43
       43
       -
                   },

     

       44
       44
       -
                   "existing": {

     

       45
       45
       -
                     "type": "boolean",

     

       46
       46
       -
                     "description": "True if user was already blocked"

     

       47
       47
       -
                   }

     

       48
       48
       -
                 }

     

       49
       49
       -
               }

     

       50
       50
       -
             },

     

       51
       51
       -
             "errors": [

     

       52
       52
       -
               {

     

       53
       53
       -
                 "name": "SubjectNotFound",

     

       54
       54
       -
                 "description": "Subject user not found"

     

       55
       55
       -
               }

     

       56
       56
       -
             ]

     

       57
       57
       -
           }

     

       58
       58
       -
         }

     

       59
       59
       -
       }

+139

internal/atproto/lexicon/social/coves/actor/defs.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.actor.defs",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "profileView": {

     

       6
       6
       +
             "type": "object",

     

       7
       7
       +
             "description": "Basic profile view with essential information",

     

       8
       8
       +
             "required": ["did"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "did": {

     

       11
       11
       +
                 "type": "string",

     

       12
       12
       +
                 "format": "did"

     

       13
       13
       +
               },

     

       14
       14
       +
               "handle": {

     

       15
       15
       +
                 "type": "string",

     

       16
       16
       +
                 "format": "handle",

     

       17
       17
       +
                 "description": "Current handle resolved from DID"

     

       18
       18
       +
               },

     

       19
       19
       +
               "displayName": {

     

       20
       20
       +
                 "type": "string",

     

       21
       21
       +
                 "maxGraphemes": 64,

     

       22
       22
       +
                 "maxLength": 640

     

       23
       23
       +
               },

     

       24
       24
       +
               "avatar": {

     

       25
       25
       +
                 "type": "string",

     

       26
       26
       +
                 "format": "uri",

     

       27
       27
       +
                 "description": "URL to avatar image"

     

       28
       28
       +
               }

     

       29
       29
       +
             }

     

       30
       30
       +
           },

     

       31
       31
       +
           "profileViewDetailed": {

     

       32
       32
       +
             "type": "object",

     

       33
       33
       +
             "description": "Detailed profile view with stats and viewer state",

     

       34
       34
       +
             "required": ["did"],

     

       35
       35
       +
             "properties": {

     

       36
       36
       +
               "did": {

     

       37
       37
       +
                 "type": "string",

     

       38
       38
       +
                 "format": "did"

     

       39
       39
       +
               },

     

       40
       40
       +
               "handle": {

     

       41
       41
       +
                 "type": "string",

     

       42
       42
       +
                 "format": "handle",

     

       43
       43
       +
                 "description": "Current handle resolved from DID"

     

       44
       44
       +
               },

     

       45
       45
       +
               "displayName": {

     

       46
       46
       +
                 "type": "string",

     

       47
       47
       +
                 "maxGraphemes": 64,

     

       48
       48
       +
                 "maxLength": 640

     

       49
       49
       +
               },

     

       50
       50
       +
               "bio": {

     

       51
       51
       +
                 "type": "string",

     

       52
       52
       +
                 "maxGraphemes": 256,

     

       53
       53
       +
                 "maxLength": 2560

     

       54
       54
       +
               },

     

       55
       55
       +
               "bioFacets": {

     

       56
       56
       +
                 "type": "array",

     

       57
       57
       +
                 "description": "Rich text annotations for bio",

     

       58
       58
       +
                 "items": {

     

       59
       59
       +
                   "type": "ref",

     

       60
       60
       +
                   "ref": "social.coves.richtext.facet"

     

       61
       61
       +
                 }

     

       62
       62
       +
               },

     

       63
       63
       +
               "avatar": {

     

       64
       64
       +
                 "type": "string",

     

       65
       65
       +
                 "format": "uri",

     

       66
       66
       +
                 "description": "URL to avatar image"

     

       67
       67
       +
               },

     

       68
       68
       +
               "banner": {

     

       69
       69
       +
                 "type": "string",

     

       70
       70
       +
                 "format": "uri",

     

       71
       71
       +
                 "description": "URL to banner image"

     

       72
       72
       +
               },

     

       73
       73
       +
               "createdAt": {

     

       74
       74
       +
                 "type": "string",

     

       75
       75
       +
                 "format": "datetime"

     

       76
       76
       +
               },

     

       77
       77
       +
               "stats": {

     

       78
       78
       +
                 "type": "ref",

     

       79
       79
       +
                 "ref": "#profileStats",

     

       80
       80
       +
                 "description": "Aggregated statistics"

     

       81
       81
       +
               },

     

       82
       82
       +
               "viewer": {

     

       83
       83
       +
                 "type": "ref",

     

       84
       84
       +
                 "ref": "#viewerState",

     

       85
       85
       +
                 "description": "Viewer's relationship to this profile"

     

       86
       86
       +
               }

     

       87
       87
       +
             }

     

       88
       88
       +
           },

     

       89
       89
       +
           "profileStats": {

     

       90
       90
       +
             "type": "object",

     

       91
       91
       +
             "description": "Aggregated statistics for a user profile",

     

       92
       92
       +
             "properties": {

     

       93
       93
       +
               "postCount": {

     

       94
       94
       +
                 "type": "integer",

     

       95
       95
       +
                 "minimum": 0,

     

       96
       96
       +
                 "description": "Total number of posts created"

     

       97
       97
       +
               },

     

       98
       98
       +
               "commentCount": {

     

       99
       99
       +
                 "type": "integer",

     

       100
       100
       +
                 "minimum": 0,

     

       101
       101
       +
                 "description": "Total number of comments made"

     

       102
       102
       +
               },

     

       103
       103
       +
               "communityCount": {

     

       104
       104
       +
                 "type": "integer",

     

       105
       105
       +
                 "minimum": 0,

     

       106
       106
       +
                 "description": "Number of communities subscribed to"

     

       107
       107
       +
               },

     

       108
       108
       +
               "reputation": {

     

       109
       109
       +
                 "type": "integer",

     

       110
       110
       +
                 "description": "Global reputation score"

     

       111
       111
       +
               },

     

       112
       112
       +
               "membershipCount": {

     

       113
       113
       +
                 "type": "integer",

     

       114
       114
       +
                 "minimum": 0,

     

       115
       115
       +
                 "description": "Number of communities with membership status"

     

       116
       116
       +
               }

     

       117
       117
       +
             }

     

       118
       118
       +
           },

     

       119
       119
       +
           "viewerState": {

     

       120
       120
       +
             "type": "object",

     

       121
       121
       +
             "description": "The viewing user's relationship to this profile",

     

       122
       122
       +
             "properties": {

     

       123
       123
       +
               "blocked": {

     

       124
       124
       +
                 "type": "boolean",

     

       125
       125
       +
                 "description": "Whether the viewer has blocked this user"

     

       126
       126
       +
               },

     

       127
       127
       +
               "blockedBy": {

     

       128
       128
       +
                 "type": "boolean",

     

       129
       129
       +
                 "description": "Whether the viewer is blocked by this user"

     

       130
       130
       +
               },

     

       131
       131
       +
               "blockUri": {

     

       132
       132
       +
                 "type": "string",

     

       133
       133
       +
                 "format": "at-uri",

     

       134
       134
       +
                 "description": "AT-URI of the block record if viewer blocked this user"

     

       135
       135
       +
               }

     

       136
       136
       +
             }

     

       137
       137
       +
           }

     

       138
       138
       +
         }

     

       139
       139
       +
       }

-85

internal/atproto/lexicon/social/coves/actor/getSaved.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.getSaved",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "query",

     

       7
       7
       -
             "description": "Get all saved posts and comments for the authenticated user",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "properties": {

     

       13
       13
       -
                   "limit": {

     

       14
       14
       -
                     "type": "integer",

     

       15
       15
       -
                     "minimum": 1,

     

       16
       16
       -
                     "maximum": 100,

     

       17
       17
       -
                     "default": 50,

     

       18
       18
       -
                     "description": "Number of items to return"

     

       19
       19
       -
                   },

     

       20
       20
       -
                   "cursor": {

     

       21
       21
       -
                     "type": "string",

     

       22
       22
       -
                     "description": "Cursor for pagination"

     

       23
       23
       -
                   },

     

       24
       24
       -
                   "type": {

     

       25
       25
       -
                     "type": "string",

     

       26
       26
       -
                     "enum": ["post", "comment"],

     

       27
       27
       -
                     "description": "Filter by content type (optional)"

     

       28
       28
       -
                   }

     

       29
       29
       -
                 }

     

       30
       30
       -
               }

     

       31
       31
       -
             },

     

       32
       32
       -
             "output": {

     

       33
       33
       -
               "encoding": "application/json",

     

       34
       34
       -
               "schema": {

     

       35
       35
       -
                 "type": "object",

     

       36
       36
       -
                 "required": ["savedItems"],

     

       37
       37
       -
                 "properties": {

     

       38
       38
       -
                   "savedItems": {

     

       39
       39
       -
                     "type": "array",

     

       40
       40
       -
                     "description": "All saved items for the user",

     

       41
       41
       -
                     "items": {

     

       42
       42
       -
                       "type": "ref",

     

       43
       43
       -
                       "ref": "#savedItemView"

     

       44
       44
       -
                     }

     

       45
       45
       -
                   },

     

       46
       46
       -
                   "cursor": {

     

       47
       47
       -
                     "type": "string",

     

       48
       48
       -
                     "description": "Cursor for next page"

     

       49
       49
       -
                   }

     

       50
       50
       -
                 }

     

       51
       51
       -
               }

     

       52
       52
       -
             }

     

       53
       53
       -
           },

     

       54
       54
       -
           "savedItemView": {

     

       55
       55
       -
             "type": "object",

     

       56
       56
       -
             "required": ["uri", "subject", "type", "savedAt"],

     

       57
       57
       -
             "properties": {

     

       58
       58
       -
               "uri": {

     

       59
       59
       -
                 "type": "string",

     

       60
       60
       -
                 "format": "at-uri",

     

       61
       61
       -
                 "description": "AT-URI of the saved record"

     

       62
       62
       -
               },

     

       63
       63
       -
               "subject": {

     

       64
       64
       -
                 "type": "string",

     

       65
       65
       -
                 "format": "at-uri",

     

       66
       66
       -
                 "description": "AT-URI of the saved post or comment"

     

       67
       67
       -
               },

     

       68
       68
       -
               "type": {

     

       69
       69
       -
                 "type": "string",

     

       70
       70
       -
                 "enum": ["post", "comment"],

     

       71
       71
       -
                 "description": "Type of content that was saved"

     

       72
       72
       -
               },

     

       73
       73
       -
               "savedAt": {

     

       74
       74
       -
                 "type": "string",

     

       75
       75
       -
                 "format": "datetime",

     

       76
       76
       -
                 "description": "When the item was saved"

     

       77
       77
       -
               },

     

       78
       78
       -
               "note": {

     

       79
       79
       -
                 "type": "string",

     

       80
       80
       -
                 "description": "Optional note about why this was saved"

     

       81
       81
       -
               }

     

       82
       82
       -
             }

     

       83
       83
       -
           }

     

       84
       84
       -
         }

     

       85
       85
       -
       }

-198

internal/atproto/lexicon/social/coves/actor/preferences.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.preferences",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "User preferences and settings",

     

       8
       8
       -
             "key": "literal:self",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "properties": {

     

       12
       12
       -
                 "feedPreferences": {

     

       13
       13
       -
                   "type": "ref",

     

       14
       14
       -
                   "ref": "#feedPreferences"

     

       15
       15
       -
                 },

     

       16
       16
       -
                 "contentFiltering": {

     

       17
       17
       -
                   "type": "ref",

     

       18
       18
       -
                   "ref": "#contentFiltering"

     

       19
       19
       -
                 },

     

       20
       20
       -
                 "notificationSettings": {

     

       21
       21
       -
                   "type": "ref",

     

       22
       22
       -
                   "ref": "#notificationSettings"

     

       23
       23
       -
                 },

     

       24
       24
       -
                 "privacySettings": {

     

       25
       25
       -
                   "type": "ref",

     

       26
       26
       -
                   "ref": "#privacySettings"

     

       27
       27
       -
                 },

     

       28
       28
       -
                 "displayPreferences": {

     

       29
       29
       -
                   "type": "ref",

     

       30
       30
       -
                   "ref": "#displayPreferences"

     

       31
       31
       -
                 }

     

       32
       32
       -
               }

     

       33
       33
       -
             }

     

       34
       34
       -
           },

     

       35
       35
       -
           "feedPreferences": {

     

       36
       36
       -
             "type": "object",

     

       37
       37
       -
             "description": "Feed and content preferences",

     

       38
       38
       -
             "properties": {

     

       39
       39
       -
               "defaultFeed": {

     

       40
       40
       -
                 "type": "string",

     

       41
       41
       -
                 "enum": ["home", "all"],

     

       42
       42
       -
                 "default": "home"

     

       43
       43
       -
               },

     

       44
       44
       -
               "defaultSort": {

     

       45
       45
       -
                 "type": "string",

     

       46
       46
       -
                 "enum": ["hot", "new", "top"],

     

       47
       47
       -
                 "default": "hot",

     

       48
       48
       -
                 "description": "Default sort order for community feeds"

     

       49
       49
       -
               },

     

       50
       50
       -
               "showNSFW": {

     

       51
       51
       -
                 "type": "boolean",

     

       52
       52
       -
                 "default": false

     

       53
       53
       -
               },

     

       54
       54
       -
               "blurNSFW": {

     

       55
       55
       -
                 "type": "boolean",

     

       56
       56
       -
                 "default": true,

     

       57
       57
       -
                 "description": "Blur NSFW content until clicked"

     

       58
       58
       -
               },

     

       59
       59
       -
               "autoplayVideos": {

     

       60
       60
       -
                 "type": "boolean",

     

       61
       61
       -
                 "default": false

     

       62
       62
       -
               },

     

       63
       63
       -
               "infiniteScroll": {

     

       64
       64
       -
                 "type": "boolean",

     

       65
       65
       -
                 "default": true

     

       66
       66
       -
               }

     

       67
       67
       -
             }

     

       68
       68
       -
           },

     

       69
       69
       -
           "contentFiltering": {

     

       70
       70
       -
             "type": "object",

     

       71
       71
       -
             "description": "Content filtering preferences",

     

       72
       72
       -
             "properties": {

     

       73
       73
       -
               "blockedTags": {

     

       74
       74
       -
                 "type": "array",

     

       75
       75
       -
                 "items": {

     

       76
       76
       -
                   "type": "string"

     

       77
       77
       -
                 },

     

       78
       78
       -
                 "description": "Tags to filter out from feeds"

     

       79
       79
       -
               },

     

       80
       80
       -
               "blockedCommunities": {

     

       81
       81
       -
                 "type": "array",

     

       82
       82
       -
                 "items": {

     

       83
       83
       -
                   "type": "string",

     

       84
       84
       -
                   "format": "did"

     

       85
       85
       -
                 },

     

       86
       86
       -
                 "description": "Communities to filter out from /all feeds"

     

       87
       87
       -
               },

     

       88
       88
       -
               "mutedWords": {

     

       89
       89
       -
                 "type": "array",

     

       90
       90
       -
                 "items": {

     

       91
       91
       -
                   "type": "string"

     

       92
       92
       -
                 },

     

       93
       93
       -
                 "description": "Words to filter out from content"

     

       94
       94
       -
               },

     

       95
       95
       -
               "languageFilter": {

     

       96
       96
       -
                 "type": "array",

     

       97
       97
       -
                 "items": {

     

       98
       98
       -
                   "type": "string",

     

       99
       99
       -
                   "format": "language"

     

       100
       100
       -
                 },

     

       101
       101
       -
                 "description": "Only show content in these languages"

     

       102
       102
       -
               }

     

       103
       103
       -
             }

     

       104
       104
       -
           },

     

       105
       105
       -
           "notificationSettings": {

     

       106
       106
       -
             "type": "object",

     

       107
       107
       -
             "description": "Notification preferences",

     

       108
       108
       -
             "properties": {

     

       109
       109
       -
               "postReplies": {

     

       110
       110
       -
                 "type": "boolean",

     

       111
       111
       -
                 "default": true

     

       112
       112
       -
               },

     

       113
       113
       -
               "commentReplies": {

     

       114
       114
       -
                 "type": "boolean",

     

       115
       115
       -
                 "default": true

     

       116
       116
       -
               },

     

       117
       117
       -
               "mentions": {

     

       118
       118
       -
                 "type": "boolean",

     

       119
       119
       -
                 "default": true

     

       120
       120
       -
               },

     

       121
       121
       -
               "upvotes": {

     

       122
       122
       -
                 "type": "boolean",

     

       123
       123
       -
                 "default": false

     

       124
       124
       -
               },

     

       125
       125
       -
               "newFollowers": {

     

       126
       126
       -
                 "type": "boolean",

     

       127
       127
       -
                 "default": true

     

       128
       128
       -
               },

     

       129
       129
       -
               "communityInvites": {

     

       130
       130
       -
                 "type": "boolean",

     

       131
       131
       -
                 "default": true

     

       132
       132
       -
               },

     

       133
       133
       -
               "moderatorNotifications": {

     

       134
       134
       -
                 "type": "boolean",

     

       135
       135
       -
                 "default": true,

     

       136
       136
       -
                 "description": "Notifications for moderator actions in your communities"

     

       137
       137
       -
               }

     

       138
       138
       -
             }

     

       139
       139
       -
           },

     

       140
       140
       -
           "privacySettings": {

     

       141
       141
       -
             "type": "object",

     

       142
       142
       -
             "description": "Privacy preferences",

     

       143
       143
       -
             "properties": {

     

       144
       144
       -
               "profileVisibility": {

     

       145
       145
       -
                 "type": "string",

     

       146
       146
       -
                 "enum": ["public", "authenticated", "followers"],

     

       147
       147
       -
                 "default": "public"

     

       148
       148
       -
               },

     

       149
       149
       -
               "showSubscriptions": {

     

       150
       150
       -
                 "type": "boolean",

     

       151
       151
       -
                 "default": true

     

       152
       152
       -
               },

     

       153
       153
       -
               "showSavedPosts": {

     

       154
       154
       -
                 "type": "boolean",

     

       155
       155
       -
                 "default": false

     

       156
       156
       -
               },

     

       157
       157
       -
               "showVoteHistory": {

     

       158
       158
       -
                 "type": "boolean",

     

       159
       159
       -
                 "default": false

     

       160
       160
       -
               },

     

       161
       161
       -
               "allowDMs": {

     

       162
       162
       -
                 "type": "string",

     

       163
       163
       -
                 "enum": ["everyone", "followers", "none"],

     

       164
       164
       -
                 "default": "everyone"

     

       165
       165
       -
               }

     

       166
       166
       -
             }

     

       167
       167
       -
           },

     

       168
       168
       -
           "displayPreferences": {

     

       169
       169
       -
             "type": "object",

     

       170
       170
       -
             "description": "Display and UI preferences",

     

       171
       171
       -
             "properties": {

     

       172
       172
       -
               "theme": {

     

       173
       173
       -
                 "type": "string",

     

       174
       174
       -
                 "enum": ["light", "dark", "auto"],

     

       175
       175
       -
                 "default": "auto"

     

       176
       176
       -
               },

     

       177
       177
       -
               "compactView": {

     

       178
       178
       -
                 "type": "boolean",

     

       179
       179
       -
                 "default": false

     

       180
       180
       -
               },

     

       181
       181
       -
               "showAvatars": {

     

       182
       182
       -
                 "type": "boolean",

     

       183
       183
       -
                 "default": true

     

       184
       184
       -
               },

     

       185
       185
       -
               "showThumbnails": {

     

       186
       186
       -
                 "type": "boolean",

     

       187
       187
       -
                 "default": true

     

       188
       188
       -
               },

     

       189
       189
       -
               "postsPerPage": {

     

       190
       190
       -
                 "type": "integer",

     

       191
       191
       -
                 "minimum": 10,

     

       192
       192
       -
                 "maximum": 100,

     

       193
       193
       -
                 "default": 25

     

       194
       194
       -
               }

     

       195
       195
       -
             }

     

       196
       196
       -
           }

     

       197
       197
       -
         }

     

       198
       198
       -
       }

-63

internal/atproto/lexicon/social/coves/actor/saveItem.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.saveItem",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Save a post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject", "type"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to save"

     

       18
       18
       -
                   },

     

       19
       19
       -
                   "type": {

     

       20
       20
       -
                     "type": "string",

     

       21
       21
       -
                     "enum": ["post", "comment"],

     

       22
       22
       -
                     "description": "Type of content being saved"

     

       23
       23
       -
                   },

     

       24
       24
       -
                   "note": {

     

       25
       25
       -
                     "type": "string",

     

       26
       26
       -
                     "maxLength": 300,

     

       27
       27
       -
                     "description": "Optional note about why this was saved"

     

       28
       28
       -
                   }

     

       29
       29
       -
                 }

     

       30
       30
       -
               }

     

       31
       31
       -
             },

     

       32
       32
       -
             "output": {

     

       33
       33
       -
               "encoding": "application/json",

     

       34
       34
       -
               "schema": {

     

       35
       35
       -
                 "type": "object",

     

       36
       36
       -
                 "required": ["uri", "cid"],

     

       37
       37
       -
                 "properties": {

     

       38
       38
       -
                   "uri": {

     

       39
       39
       -
                     "type": "string",

     

       40
       40
       -
                     "format": "at-uri",

     

       41
       41
       -
                     "description": "AT-URI of the created saved record"

     

       42
       42
       -
                   },

     

       43
       43
       -
                   "cid": {

     

       44
       44
       -
                     "type": "string",

     

       45
       45
       -
                     "format": "cid",

     

       46
       46
       -
                     "description": "CID of the created saved record"

     

       47
       47
       -
                   },

     

       48
       48
       -
                   "existing": {

     

       49
       49
       -
                     "type": "boolean",

     

       50
       50
       -
                     "description": "True if item was already saved"

     

       51
       51
       -
                   }

     

       52
       52
       -
                 }

     

       53
       53
       -
               }

     

       54
       54
       -
             },

     

       55
       55
       -
             "errors": [

     

       56
       56
       -
               {

     

       57
       57
       -
                 "name": "SubjectNotFound",

     

       58
       58
       -
                 "description": "The post or comment to save was not found"

     

       59
       59
       -
               }

     

       60
       60
       -
             ]

     

       61
       61
       -
           }

     

       62
       62
       -
         }

     

       63
       63
       -
       }

-37

internal/atproto/lexicon/social/coves/actor/saved.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.saved",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A saved post or comment",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "type", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the post or comment being saved"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "type": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "enum": ["post", "comment"],

     

       21
       21
       -
                   "description": "Type of content being saved"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "createdAt": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "format": "datetime",

     

       26
       26
       -
                   "description": "When the item was saved"

     

       27
       27
       -
                 },

     

       28
       28
       -
                 "note": {

     

       29
       29
       -
                   "type": "string",

     

       30
       30
       -
                   "maxLength": 300,

     

       31
       31
       -
                   "description": "Optional note about why this was saved"

     

       32
       32
       -
                 }

     

       33
       33
       -
               }

     

       34
       34
       -
             }

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

-39

internal/atproto/lexicon/social/coves/actor/subscription.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.subscription",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A subscription to a community",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["community", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "community": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-identifier",

     

       16
       16
       -
                   "description": "DID or handle of the community"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "createdAt": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "datetime",

     

       21
       21
       -
                   "description": "When the subscription started"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "endedAt": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "format": "datetime",

     

       26
       26
       -
                   "description": "When the subscription ended (null if current)"

     

       27
       27
       -
                 },

     

       28
       28
       -
                 "contentVisibility": {

     

       29
       29
       -
                   "type": "integer",

     

       30
       30
       -
                   "minimum": 1,

     

       31
       31
       -
                   "maximum": 5,

     

       32
       32
       -
                   "default": 3,

     

       33
       33
       -
                   "description": "Content visibility level (1=only best content, 5=all content)"

     

       34
       34
       -
                 }

     

       35
       35
       -
               }

     

       36
       36
       -
             }

     

       37
       37
       -
           }

     

       38
       38
       -
         }

     

       39
       39
       -
       }

-37

internal/atproto/lexicon/social/coves/actor/unblockUser.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.unblockUser",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Unblock a previously blocked user",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "did",

     

       17
       17
       -
                     "description": "DID of the user to unblock"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "NotBlocked",

     

       32
       32
       -
                 "description": "User is not currently blocked"

     

       33
       33
       -
               }

     

       34
       34
       -
             ]

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

-37

internal/atproto/lexicon/social/coves/actor/unsaveItem.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.actor.unsaveItem",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "procedure",

     

       7
       7
       -
             "description": "Unsave a previously saved post or comment",

     

       8
       8
       -
             "input": {

     

       9
       9
       -
               "encoding": "application/json",

     

       10
       10
       -
               "schema": {

     

       11
       11
       -
                 "type": "object",

     

       12
       12
       -
                 "required": ["subject"],

     

       13
       13
       -
                 "properties": {

     

       14
       14
       -
                   "subject": {

     

       15
       15
       -
                     "type": "string",

     

       16
       16
       -
                     "format": "at-uri",

     

       17
       17
       -
                     "description": "AT-URI of the post or comment to unsave"

     

       18
       18
       -
                   }

     

       19
       19
       -
                 }

     

       20
       20
       -
               }

     

       21
       21
       -
             },

     

       22
       22
       -
             "output": {

     

       23
       23
       -
               "encoding": "application/json",

     

       24
       24
       -
               "schema": {

     

       25
       25
       -
                 "type": "object",

     

       26
       26
       -
                 "properties": {}

     

       27
       27
       -
               }

     

       28
       28
       -
             },

     

       29
       29
       -
             "errors": [

     

       30
       30
       -
               {

     

       31
       31
       -
                 "name": "NotSaved",

     

       32
       32
       -
                 "description": "Item is not currently saved"

     

       33
       33
       -
               }

     

       34
       34
       -
             ]

     

       35
       35
       -
           }

     

       36
       36
       -
         }

     

       37
       37
       -
       }

+1 -172

internal/atproto/lexicon/social/coves/actor/profile.json

···

       8
       8
        
             "key": "literal:self",

     

       9
       9
        
             "record": {

     

       10
       10
        
               "type": "object",

     

       11
       11
       -
               "required": ["handle", "createdAt"],

     

       11
       11
       +
               "required": ["createdAt"],

     

       12
       12
        
               "properties": {

     

       13
       13
       -
                 "handle": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "handle",

     

       16
       16
       -
                   "maxLength": 253,

     

       17
       17
       -
                   "description": "User's handle"

     

       18
       18
       -
                 },

     

       19
       13
        
                 "displayName": {

     

       20
       14
        
                   "type": "string",

     

       21
       15
        
                   "maxGraphemes": 64,

     
···

       46
       40
        
                   "accept": ["image/png", "image/jpeg", "image/webp"],

     

       47
       41
        
                   "maxSize": 2000000

     

       48
       42
        
                 },

     

       49
       49
       -
                 "verified": {

     

       50
       50
       -
                   "type": "boolean",

     

       51
       51
       -
                   "default": false,

     

       52
       52
       -
                   "description": "Whether the user has completed phone verification"

     

       53
       53
       -
                 },

     

       54
       54
       -
                 "verifiedAt": {

     

       55
       55
       -
                   "type": "string",

     

       56
       56
       -
                   "format": "datetime",

     

       57
       57
       -
                   "description": "When the user was verified"

     

       58
       58
       -
                 },

     

       59
       59
       -
                 "verificationExpiresAt": {

     

       60
       60
       -
                   "type": "string",

     

       61
       61
       -
                   "format": "datetime",

     

       62
       62
       -
                   "description": "When verification expires"

     

       63
       63
       -
                 },

     

       64
       64
       -
                 "federatedFrom": {

     

       65
       65
       -
                   "type": "string",

     

       66
       66
       -
                   "knownValues": ["bluesky", "lemmy", "mastodon", "coves"],

     

       67
       67
       -
                   "description": "Platform user federated from"

     

       68
       68
       -
                 },

     

       69
       69
       -
                 "federatedIdentity": {

     

       70
       70
       -
                   "type": "ref",

     

       71
       71
       -
                   "ref": "#federatedIdentity",

     

       72
       72
       -
                   "description": "Identity information from federated platform"

     

       73
       73
       -
                 },

     

       74
       74
       -
                 "location": {

     

       75
       75
       -
                   "type": "ref",

     

       76
       76
       -
                   "ref": "#geoLocation"

     

       77
       77
       -
                 },

     

       78
       43
        
                 "createdAt": {

     

       79
       44
        
                   "type": "string",

     

       80
       45
        
                   "format": "datetime"

     

       81
       81
       -
                 },

     

       82
       82
       -
                 "moderatedCommunities": {

     

       83
       83
       -
                   "type": "array",

     

       84
       84
       -
                   "description": "Communities the user currently moderates",

     

       85
       85
       -
                   "items": {

     

       86
       86
       -
                     "type": "string",

     

       87
       87
       -
                     "format": "did"

     

       88
       88
       -
                   }

     

       89
       89
       -
                 },

     

       90
       90
       -
                 "moderationHistory": {

     

       91
       91
       -
                   "type": "array",

     

       92
       92
       -
                   "description": "Historical record of all moderation roles",

     

       93
       93
       -
                   "items": {

     

       94
       94
       -
                     "type": "ref",

     

       95
       95
       -
                     "ref": "#moderationRole"

     

       96
       96
       -
                   }

     

       97
       97
       -
                 },

     

       98
       98
       -
                 "violations": {

     

       99
       99
       -
                   "type": "array",

     

       100
       100
       -
                   "description": "Record of rule violations across communities",

     

       101
       101
       -
                   "items": {

     

       102
       102
       -
                     "type": "ref",

     

       103
       103
       -
                     "ref": "#violation"

     

       104
       104
       -
                   }

     

       105
       46
        
                 }

     

       106
       47
        
               }

     

       107
       48
        
             }

     

       108
       108
       -
           },

     

       109
       109
       -
           "moderationRole": {

     

       110
       110
       -
             "type": "object",

     

       111
       111
       -
             "required": ["communityDid", "role", "startedAt"],

     

       112
       112
       -
             "properties": {

     

       113
       113
       -
               "communityDid": {

     

       114
       114
       -
                 "type": "string",

     

       115
       115
       -
                 "format": "did",

     

       116
       116
       -
                 "description": "Community where moderation role was held"

     

       117
       117
       -
               },

     

       118
       118
       -
               "role": {

     

       119
       119
       -
                 "type": "string",

     

       120
       120
       -
                 "knownValues": ["moderator", "admin"],

     

       121
       121
       -
                 "description": "Type of moderation role"

     

       122
       122
       -
               },

     

       123
       123
       -
               "startedAt": {

     

       124
       124
       -
                 "type": "string",

     

       125
       125
       -
                 "format": "datetime",

     

       126
       126
       -
                 "description": "When the role began"

     

       127
       127
       -
               },

     

       128
       128
       -
               "endedAt": {

     

       129
       129
       -
                 "type": "string",

     

       130
       130
       -
                 "format": "datetime",

     

       131
       131
       -
                 "description": "When the role ended (null if current)"

     

       132
       132
       -
               }

     

       133
       133
       -
             }

     

       134
       134
       -
           },

     

       135
       135
       -
           "violation": {

     

       136
       136
       -
             "type": "object",

     

       137
       137
       -
             "required": ["communityDid", "ruleViolated", "timestamp", "severity"],

     

       138
       138
       -
             "properties": {

     

       139
       139
       -
               "communityDid": {

     

       140
       140
       -
                 "type": "string",

     

       141
       141
       -
                 "format": "did",

     

       142
       142
       -
                 "description": "Community where violation occurred"

     

       143
       143
       -
               },

     

       144
       144
       -
               "ruleViolated": {

     

       145
       145
       -
                 "type": "string",

     

       146
       146
       -
                 "description": "Description of the rule that was violated"

     

       147
       147
       -
               },

     

       148
       148
       -
               "timestamp": {

     

       149
       149
       -
                 "type": "string",

     

       150
       150
       -
                 "format": "datetime",

     

       151
       151
       -
                 "description": "When the violation occurred"

     

       152
       152
       -
               },

     

       153
       153
       -
               "severity": {

     

       154
       154
       -
                 "type": "string",

     

       155
       155
       -
                 "knownValues": ["minor", "moderate", "major", "severe"],

     

       156
       156
       -
                 "description": "Severity level of the violation"

     

       157
       157
       -
               },

     

       158
       158
       -
               "resolution": {

     

       159
       159
       -
                 "type": "string",

     

       160
       160
       -
                 "description": "How the violation was resolved"

     

       161
       161
       -
               },

     

       162
       162
       -
               "postUri": {

     

       163
       163
       -
                 "type": "string",

     

       164
       164
       -
                 "format": "at-uri",

     

       165
       165
       -
                 "description": "Optional reference to the violating content"

     

       166
       166
       -
               }

     

       167
       167
       -
             }

     

       168
       168
       -
           },

     

       169
       169
       -
           "federatedIdentity": {

     

       170
       170
       -
             "type": "object",

     

       171
       171
       -
             "description": "Verified identity from a federated platform",

     

       172
       172
       -
             "required": ["did", "handle", "verifiedAt"],

     

       173
       173
       -
             "properties": {

     

       174
       174
       -
               "did": {

     

       175
       175
       -
                 "type": "string",

     

       176
       176
       -
                 "format": "did",

     

       177
       177
       -
                 "description": "Original DID from the federated platform"

     

       178
       178
       -
               },

     

       179
       179
       -
               "handle": {

     

       180
       180
       -
                 "type": "string",

     

       181
       181
       -
                 "maxLength": 253,

     

       182
       182
       -
                 "description": "Original handle from the federated platform"

     

       183
       183
       -
               },

     

       184
       184
       -
               "verifiedAt": {

     

       185
       185
       -
                 "type": "string",

     

       186
       186
       -
                 "format": "datetime",

     

       187
       187
       -
                 "description": "When the federated identity was verified via OAuth"

     

       188
       188
       -
               },

     

       189
       189
       -
               "lastSyncedAt": {

     

       190
       190
       -
                 "type": "string",

     

       191
       191
       -
                 "format": "datetime",

     

       192
       192
       -
                 "description": "Last time profile data was synced from the federated platform"

     

       193
       193
       -
               },

     

       194
       194
       -
               "homePDS": {

     

       195
       195
       -
                 "type": "string",

     

       196
       196
       -
                 "description": "Home PDS server URL for the federated account"

     

       197
       197
       -
               }

     

       198
       198
       -
             }

     

       199
       199
       -
           },

     

       200
       200
       -
           "geoLocation": {

     

       201
       201
       -
             "type": "object",

     

       202
       202
       -
             "description": "Geographic location information",

     

       203
       203
       -
             "properties": {

     

       204
       204
       -
               "country": {

     

       205
       205
       -
                 "type": "string",

     

       206
       206
       -
                 "maxLength": 2,

     

       207
       207
       -
                 "description": "ISO 3166-1 alpha-2 country code"

     

       208
       208
       -
               },

     

       209
       209
       -
               "region": {

     

       210
       210
       -
                 "type": "string",

     

       211
       211
       -
                 "maxLength": 128,

     

       212
       212
       -
                 "description": "State/province/region name"

     

       213
       213
       -
               },

     

       214
       214
       -
               "displayName": {

     

       215
       215
       -
                 "type": "string",

     

       216
       216
       -
                 "maxLength": 256,

     

       217
       217
       -
                 "description": "Human-readable location name"

     

       218
       218
       -
               }

     

       219
       219
       -
             }

     

       220
       49
        
           }

     

       221
       50
        
         }

     

       222
       51
        
       }

+3 -83

internal/atproto/lexicon/social/coves/community/get.json

···

       19
       19
        
             "output": {

     

       20
       20
        
               "encoding": "application/json",

     

       21
       21
        
               "schema": {

     

       22
       22
       -
                 "type": "object",

     

       23
       23
       -
                 "required": ["did", "profile"],

     

       24
       24
       -
                 "properties": {

     

       25
       25
       -
                   "did": {

     

       26
       26
       -
                     "type": "string",

     

       27
       27
       -
                     "format": "did"

     

       28
       28
       -
                   },

     

       29
       29
       -
                   "profile": {

     

       30
       30
       -
                     "type": "ref",

     

       31
       31
       -
                     "ref": "social.coves.community.profile"

     

       32
       32
       -
                   },

     

       33
       33
       -
                   "stats": {

     

       34
       34
       -
                     "type": "ref",

     

       35
       35
       -
                     "ref": "#communityStats"

     

       36
       36
       -
                   },

     

       37
       37
       -
                   "viewer": {

     

       38
       38
       -
                     "type": "ref",

     

       39
       39
       -
                     "ref": "#viewerState",

     

       40
       40
       -
                     "description": "Viewer's relationship to this community"

     

       41
       41
       -
                   }

     

       42
       42
       -
                 }

     

       43
       43
       -
               }

     

       44
       44
       -
             }

     

       45
       45
       -
           },

     

       46
       46
       -
           "communityStats": {

     

       47
       47
       -
             "type": "object",

     

       48
       48
       -
             "required": ["subscriberCount", "memberCount", "postCount", "activePostersCount"],

     

       49
       49
       -
             "properties": {

     

       50
       50
       -
               "subscriberCount": {

     

       51
       51
       -
                 "type": "integer",

     

       52
       52
       -
                 "minimum": 0,

     

       53
       53
       -
                 "description": "Number of users subscribed to this community"

     

       54
       54
       -
               },

     

       55
       55
       -
               "memberCount": {

     

       56
       56
       -
                 "type": "integer",

     

       57
       57
       -
                 "minimum": 0,

     

       58
       58
       -
                 "description": "Number of users with membership status"

     

       59
       59
       -
               },

     

       60
       60
       -
               "postCount": {

     

       61
       61
       -
                 "type": "integer",

     

       62
       62
       -
                 "minimum": 0,

     

       63
       63
       -
                 "description": "Total number of posts in this community"

     

       64
       64
       -
               },

     

       65
       65
       -
               "activePostersCount": {

     

       66
       66
       -
                 "type": "integer",

     

       67
       67
       -
                 "minimum": 0,

     

       68
       68
       -
                 "description": "Number of unique posters in the last 30 days"

     

       69
       69
       -
               },

     

       70
       70
       -
               "moderatorCount": {

     

       71
       71
       -
                 "type": "integer",

     

       72
       72
       -
                 "minimum": 0,

     

       73
       73
       -
                 "description": "Number of active moderators"

     

       74
       74
       -
               }

     

       75
       75
       -
             }

     

       76
       76
       -
           },

     

       77
       77
       -
           "viewerState": {

     

       78
       78
       -
             "type": "object",

     

       79
       79
       -
             "description": "The viewing user's relationship to this community",

     

       80
       80
       -
             "properties": {

     

       81
       81
       -
               "subscribed": {

     

       82
       82
       -
                 "type": "boolean",

     

       83
       83
       -
                 "description": "Whether the viewer is subscribed"

     

       84
       84
       -
               },

     

       85
       85
       -
               "subscriptionUri": {

     

       86
       86
       -
                 "type": "string",

     

       87
       87
       -
                 "format": "at-uri",

     

       88
       88
       -
                 "description": "AT-URI of the subscription record if subscribed"

     

       89
       89
       -
               },

     

       90
       90
       -
               "member": {

     

       91
       91
       -
                 "type": "boolean",

     

       92
       92
       -
                 "description": "Whether the viewer has membership status (AppView-computed)"

     

       93
       93
       -
               },

     

       94
       94
       -
               "reputation": {

     

       95
       95
       -
                 "type": "integer",

     

       96
       96
       -
                 "description": "Viewer's reputation in this community"

     

       97
       97
       -
               },

     

       98
       98
       -
               "moderator": {

     

       99
       99
       -
                 "type": "boolean",

     

       100
       100
       -
                 "description": "Whether the viewer is a moderator"

     

       101
       101
       -
               },

     

       102
       102
       -
               "banned": {

     

       103
       103
       -
                 "type": "boolean",

     

       104
       104
       -
                 "description": "Whether the viewer is banned from this community"

     

       22
       22
       +
                 "type": "ref",

     

       23
       23
       +
                 "ref": "social.coves.community.defs#communityViewDetailed",

     

       24
       24
       +
                 "description": "Detailed community view with stats and viewer state"

     

       105
       25
        
               }

     

       106
       26
        
             }

     

       107
       27
        
           }

-5

tests/lexicon-test-data/actor/block-invalid-did.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.block",

     

       3
       3
       -
         "subject": "not-a-valid-did",

     

       4
       4
       -
         "createdAt": "2025-01-05T09:15:00Z"

     

       5
       5
       -
       }

-6

tests/lexicon-test-data/actor/block-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.block",

     

       3
       3
       -
         "subject": "did:plc:blockeduser123",

     

       4
       4
       -
         "createdAt": "2025-01-05T09:15:00Z",

     

       5
       5
       -
         "reason": "Repeated harassment and spam"

     

       6
       6
       -
       }

-7

tests/lexicon-test-data/actor/preferences-invalid-enum.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.preferences",

     

       3
       3
       -
         "feedPreferences": {

     

       4
       4
       -
           "defaultFeed": "invalid-feed-type",

     

       5
       5
       -
           "defaultSort": "hot"

     

       6
       6
       -
         }

     

       7
       7
       -
       }

-40

tests/lexicon-test-data/actor/preferences-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.preferences",

     

       3
       3
       -
         "feedPreferences": {

     

       4
       4
       -
           "defaultFeed": "home",

     

       5
       5
       -
           "defaultSort": "hot",

     

       6
       6
       -
           "showNSFW": false,

     

       7
       7
       -
           "blurNSFW": true,

     

       8
       8
       -
           "autoplayVideos": true,

     

       9
       9
       -
           "infiniteScroll": true

     

       10
       10
       -
         },

     

       11
       11
       -
         "contentFiltering": {

     

       12
       12
       -
           "blockedTags": ["politics", "spoilers"],

     

       13
       13
       -
           "blockedCommunities": ["did:plc:controversialcommunity"],

     

       14
       14
       -
           "mutedWords": ["spam", "scam"],

     

       15
       15
       -
           "languageFilter": ["en", "es"]

     

       16
       16
       -
         },

     

       17
       17
       -
         "notificationSettings": {

     

       18
       18
       -
           "postReplies": true,

     

       19
       19
       -
           "commentReplies": true,

     

       20
       20
       -
           "mentions": true,

     

       21
       21
       -
           "upvotes": false,

     

       22
       22
       -
           "newFollowers": true,

     

       23
       23
       -
           "communityInvites": true,

     

       24
       24
       -
           "moderatorNotifications": true

     

       25
       25
       -
         },

     

       26
       26
       -
         "privacySettings": {

     

       27
       27
       -
           "profileVisibility": "public",

     

       28
       28
       -
           "showSubscriptions": true,

     

       29
       29
       -
           "showSavedPosts": false,

     

       30
       30
       -
           "showVoteHistory": false,

     

       31
       31
       -
           "allowDMs": "followers"

     

       32
       32
       -
         },

     

       33
       33
       -
         "displayPreferences": {

     

       34
       34
       -
           "theme": "dark",

     

       35
       35
       -
           "compactView": false,

     

       36
       36
       -
           "showAvatars": true,

     

       37
       37
       -
           "showThumbnails": true,

     

       38
       38
       -
           "postsPerPage": 25

     

       39
       39
       -
         }

     

       40
       40
       -
       }

-6

tests/lexicon-test-data/actor/profile-invalid-handle-format.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.profile",

     

       3
       3
       -
         "handle": "invalid handle with spaces",

     

       4
       4
       -
         "displayName": "Test User",

     

       5
       5
       -
         "createdAt": "2024-01-01T00:00:00Z"

     

       6
       6
       -
       }

-4

tests/lexicon-test-data/actor/profile-invalid-missing-handle.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.actor.profile",

     

       3
       3
       -
         "displayName": "Missing Required Fields"

     

       4
       4
       -
       }

-1

tests/lexicon-test-data/actor/profile-valid.json

···

       1
       1
        
       {

     

       2
       2
        
         "$type": "social.coves.actor.profile",

     

       3
       3
       -
         "handle": "alice.example.com",

     

       4
       3
        
         "displayName": "Alice Johnson",

     

       5
       4
        
         "bio": "Software developer passionate about open-source",

     

       6
       5
        
         "createdAt": "2024-01-15T10:30:00Z"

+9 -46

internal/atproto/lexicon/social/coves/richtext/facet.json

···

       47
       47
        
           },

     

       48
       48
        
           "mention": {

     

       49
       49
        
             "type": "object",

     

       50
       50
       -
             "description": "Facet feature for user or community mentions",

     

       51
       51
       -
             "required": ["$type", "did"],

     

       50
       50
       +
             "description": "Facet feature for mention of a user or community. The text is usually a handle with '@' (user) or '!' (community) prefix, but the facet reference is a DID.",

     

       51
       51
       +
             "required": ["did"],

     

       52
       52
        
             "properties": {

     

       53
       53
       -
               "$type": {

     

       54
       54
       -
                 "type": "string",

     

       55
       55
       -
                 "const": "social.coves.richtext.facet#mention"

     

       56
       56
       -
               },

     

       57
       53
        
               "did": {

     

       58
       54
        
                 "type": "string",

     

       59
       55
        
                 "format": "did",

     

       60
       60
       -
                 "description": "DID of the mentioned user (@) or community (!)"

     

       61
       61
       -
               },

     

       62
       62
       -
               "handle": {

     

       63
       63
       -
                 "type": "string",

     

       64
       64
       -
                 "description": "Handle at time of mention (may change)"

     

       56
       56
       +
                 "description": "DID of the mentioned user or community"

     

       65
       57
        
               }

     

       66
       58
        
             }

     

       67
       59
        
           },

     

       68
       60
        
           "link": {

     

       69
       61
        
             "type": "object",

     

       70
       70
       -
             "description": "Facet feature for hyperlinks",

     

       71
       71
       -
             "required": ["$type", "uri"],

     

       62
       62
       +
             "description": "Facet feature for a URL. The text URL may have been simplified or truncated, but the facet reference should be a complete URL.",

     

       63
       63
       +
             "required": ["uri"],

     

       72
       64
        
             "properties": {

     

       73
       73
       -
               "$type": {

     

       74
       74
       -
                 "type": "string",

     

       75
       75
       -
                 "const": "social.coves.richtext.facet#link"

     

       76
       76
       -
               },

     

       77
       65
        
               "uri": {

     

       78
       66
        
                 "type": "string",

     

       79
       67
        
                 "format": "uri",

     
···

       83
       71
        
           },

     

       84
       72
        
           "bold": {

     

       85
       73
        
             "type": "object",

     

       86
       86
       -
             "description": "Bold text formatting",

     

       87
       87
       -
             "required": ["$type"],

     

       88
       88
       -
             "properties": {

     

       89
       89
       -
               "$type": {

     

       90
       90
       -
                 "type": "string",

     

       91
       91
       -
                 "const": "social.coves.richtext.facet#bold"

     

       92
       92
       -
               }

     

       93
       93
       -
             }

     

       74
       74
       +
             "description": "Bold text formatting"

     

       94
       75
        
           },

     

       95
       76
        
           "italic": {

     

       96
       77
        
             "type": "object",

     

       97
       97
       -
             "description": "Italic text formatting",

     

       98
       98
       -
             "required": ["$type"],

     

       99
       99
       -
             "properties": {

     

       100
       100
       -
               "$type": {

     

       101
       101
       -
                 "type": "string",

     

       102
       102
       -
                 "const": "social.coves.richtext.facet#italic"

     

       103
       103
       -
               }

     

       104
       104
       -
             }

     

       78
       78
       +
             "description": "Italic text formatting"

     

       105
       79
        
           },

     

       106
       80
        
           "strikethrough": {

     

       107
       81
        
             "type": "object",

     

       108
       108
       -
             "description": "Strikethrough text formatting",

     

       109
       109
       -
             "required": ["$type"],

     

       110
       110
       -
             "properties": {

     

       111
       111
       -
               "$type": {

     

       112
       112
       -
                 "type": "string",

     

       113
       113
       -
                 "const": "social.coves.richtext.facet#strikethrough"

     

       114
       114
       -
               }

     

       115
       115
       -
             }

     

       82
       82
       +
             "description": "Strikethrough text formatting"

     

       116
       83
        
           },

     

       117
       84
        
           "spoiler": {

     

       118
       85
        
             "type": "object",

     

       119
       86
        
             "description": "Hidden/spoiler text that requires user interaction to reveal",

     

       120
       120
       -
             "required": ["$type"],

     

       121
       87
        
             "properties": {

     

       122
       122
       -
               "$type": {

     

       123
       123
       -
                 "type": "string",

     

       124
       124
       -
                 "const": "social.coves.richtext.facet#spoiler"

     

       125
       125
       -
               },

     

       126
       88
        
               "reason": {

     

       127
       89
        
                 "type": "string",

     

       128
       90
        
                 "maxLength": 128,

     

       91
       91
       +
                 "maxGraphemes": 32,

     

       129
       92
        
                 "description": "Optional explanation of what's hidden"

     

       130
       93
        
               }

     

       131
       94
        
             }

+3 -5

internal/atproto/lexicon/social/coves/richtext/facet_test.go

···

       21
       21
        
       				},

     

       22
       22
        
       				"features": [{

     

       23
       23
        
       					"$type": "social.coves.richtext.facet#mention",

     

       24
       24
       -
       					"did": "did:plc:example123",

     

       25
       25
       -
       					"handle": "alice.bsky.social"

     

       24
       24
       +
       					"did": "did:plc:example123"

     

       26
       25
        
       				}]

     

       27
       26
        
       			}`,

     

       28
       27
        
       			wantErr: false,

     
···

       276
       275
        
       			name:     "mention",

     

       277
       276
        
       			typeName: "social.coves.richtext.facet#mention",

     

       278
       277
        
       			feature: map[string]interface{}{

     

       279
       279
       -
       				"$type":  "social.coves.richtext.facet#mention",

     

       280
       280
       -
       				"did":    "did:plc:example123",

     

       281
       281
       -
       				"handle": "alice.bsky.social",

     

       278
       278
       +
       				"$type": "social.coves.richtext.facet#mention",

     

       279
       279
       +
       				"did":   "did:plc:example123",

     

       282
       280
        
       			},

     

       283
       281
        
       		},

     

       284
       282
        
       		{

+1

internal/atproto/lexicon/social/coves/community/profile.json

···

       13
       13
        
                 "name": {

     

       14
       14
        
                   "type": "string",

     

       15
       15
        
                   "maxLength": 64,

     

       16
       16
       +
                   "maxGraphemes": 64,

     

       16
       17
        
                   "description": "Short community name (local part of handle)"

     

       17
       18
        
                 },

     

       18
       19
        
                 "displayName": {

+1 -1

internal/atproto/lexicon/social/coves/community/search.json

···

       43
       43
        
                     "type": "array",

     

       44
       44
        
                     "items": {

     

       45
       45
        
                       "type": "ref",

     

       46
       46
       -
                       "ref": "social.coves.community.list#communityView"

     

       46
       46
       +
                       "ref": "social.coves.community.defs#communityView"

     

       47
       47
        
                     }

     

       48
       48
        
                   },

     

       49
       49
        
                   "cursor": {

+1

internal/atproto/lexicon/social/coves/embed/images.json

···

       33
       33
        
               "alt": {

     

       34
       34
        
                 "type": "string",

     

       35
       35
        
                 "maxLength": 1000,

     

       36
       36
       +
                 "maxGraphemes": 1000,

     

       36
       37
        
                 "description": "Alt text for accessibility"

     

       37
       38
        
               },

     

       38
       39
        
               "aspectRatio": {

+1 -4

internal/atproto/lexicon/social/coves/embed/video.json

···

       22
       22
        
               "alt": {

     

       23
       23
        
                 "type": "string",

     

       24
       24
        
                 "maxLength": 1000,

     

       25
       25
       +
                 "maxGraphemes": 1000,

     

       25
       26
        
                 "description": "Alt text describing video content"

     

       26
       27
        
               },

     

       27
       28
        
               "duration": {

     

       28
       29
        
                 "type": "integer",

     

       29
       30
        
                 "minimum": 0,

     

       30
       31
        
                 "description": "Duration in seconds"

     

       31
       31
       -
               },

     

       32
       32
       -
               "aspectRatio": {

     

       33
       33
       -
                 "type": "ref",

     

       34
       34
       -
                 "ref": "social.coves.embed.image#aspectRatio"

     

       35
       32
        
               }

     

       36
       33
        
             }

     

       37
       34
        
           }

-32

internal/atproto/lexicon/social/coves/federation/post.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.federation.post",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "object",

     

       7
       7
       -
             "description": "Reference to original federated post",

     

       8
       8
       -
             "required": ["platform", "uri"],

     

       9
       9
       -
             "properties": {

     

       10
       10
       -
               "platform": {

     

       11
       11
       -
                 "type": "string",

     

       12
       12
       -
                 "knownValues": ["bluesky", "lemmy", "atproto"],

     

       13
       13
       -
                 "description": "Platform the post originated from"

     

       14
       14
       -
               },

     

       15
       15
       -
               "uri": {

     

       16
       16
       -
                 "type": "string",

     

       17
       17
       -
                 "format": "uri",

     

       18
       18
       -
                 "description": "Original URI of the post (at:// URI for atproto platforms)"

     

       19
       19
       -
               },

     

       20
       20
       -
               "id": {

     

       21
       21
       -
                 "type": "string",

     

       22
       22
       -
                 "description": "Platform-specific post ID"

     

       23
       23
       -
               },

     

       24
       24
       -
               "originalCreatedAt": {

     

       25
       25
       -
                 "type": "string",

     

       26
       26
       -
                 "format": "datetime",

     

       27
       27
       -
                 "description": "Timestamp when originally posted on source platform"

     

       28
       28
       -
               }

     

       29
       29
       -
             }

     

       30
       30
       -
           }

     

       31
       31
       -
         }

     

       32
       32
       -
       }

+5 -5

internal/atproto/lexicon/social/coves/feed/getAll.json

···

       10
       10
        
               "properties": {

     

       11
       11
        
                 "sort": {

     

       12
       12
        
                   "type": "string",

     

       13
       13
       -
                   "enum": ["hot", "top", "new"],

     

       13
       13
       +
                   "knownValues": ["hot", "top", "new"],

     

       14
       14
        
                   "default": "hot",

     

       15
       15
        
                   "description": "Sort order for global feed"

     

       16
       16
        
                 },

     

       17
       17
        
                 "postType": {

     

       18
       18
        
                   "type": "string",

     

       19
       19
       -
                   "enum": ["text", "article", "image", "video", "microblog"],

     

       19
       19
       +
                   "knownValues": ["text", "article", "image", "video", "microblog"],

     

       20
       20
        
                   "description": "Filter by a single post type (computed from embed structure)"

     

       21
       21
        
                 },

     

       22
       22
        
                 "postTypes": {

     

       23
       23
        
                   "type": "array",

     

       24
       24
        
                   "items": {

     

       25
       25
        
                     "type": "string",

     

       26
       26
       -
                     "enum": ["text", "article", "image", "video", "microblog"]

     

       26
       26
       +
                     "knownValues": ["text", "article", "image", "video", "microblog"]

     

       27
       27
        
                   },

     

       28
       28
        
                   "description": "Filter by multiple post types (computed from embed structure)"

     

       29
       29
        
                 },

     

       30
       30
        
                 "timeframe": {

     

       31
       31
        
                   "type": "string",

     

       32
       32
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       32
       32
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       33
       33
        
                   "default": "day",

     

       34
       34
        
                   "description": "Timeframe for top sorting (only applies when sort=top)"

     

       35
       35
        
                 },

     
···

       54
       54
        
                     "type": "array",

     

       55
       55
        
                     "items": {

     

       56
       56
        
                       "type": "ref",

     

       57
       57
       -
                       "ref": "social.coves.feed.getTimeline#feedViewPost"

     

       57
       57
       +
                       "ref": "social.coves.feed.defs#feedViewPost"

     

       58
       58
        
                     }

     

       59
       59
        
                   },

     

       60
       60
        
                   "cursor": {

+3 -3

internal/atproto/lexicon/social/coves/feed/getCommunity.json

···

       16
       16
        
                 },

     

       17
       17
        
                 "sort": {

     

       18
       18
        
                   "type": "string",

     

       19
       19
       -
                   "enum": ["hot", "top", "new"],

     

       19
       19
       +
                   "knownValues": ["hot", "top", "new"],

     

       20
       20
        
                   "default": "hot",

     

       21
       21
        
                   "description": "Sort order for community feed"

     

       22
       22
        
                 },

     

       23
       23
        
                 "timeframe": {

     

       24
       24
        
                   "type": "string",

     

       25
       25
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       25
       25
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       26
       26
        
                   "default": "day",

     

       27
       27
        
                   "description": "Timeframe for top sorting (only applies when sort=top)"

     

       28
       28
        
                 },

     
···

       47
       47
        
                     "type": "array",

     

       48
       48
        
                     "items": {

     

       49
       49
        
                       "type": "ref",

     

       50
       50
       -
                       "ref": "social.coves.feed.getTimeline#feedViewPost"

     

       50
       50
       +
                       "ref": "social.coves.feed.defs#feedViewPost"

     

       51
       51
        
                     }

     

       52
       52
        
                   },

     

       53
       53
        
                   "cursor": {

+2 -2

internal/atproto/lexicon/social/coves/feed/getDiscover.json

···

       10
       10
        
               "properties": {

     

       11
       11
        
                 "sort": {

     

       12
       12
        
                   "type": "string",

     

       13
       13
       -
                   "enum": ["hot", "top", "new"],

     

       13
       13
       +
                   "knownValues": ["hot", "top", "new"],

     

       14
       14
        
                   "default": "hot",

     

       15
       15
        
                   "description": "Sort order for discover feed"

     

       16
       16
        
                 },

     

       17
       17
        
                 "timeframe": {

     

       18
       18
        
                   "type": "string",

     

       19
       19
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       19
       19
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       20
       20
        
                   "default": "day",

     

       21
       21
        
                   "description": "Timeframe for top sorting (only applies when sort=top)"

     

       22
       22
        
                 },

+2 -2

internal/atproto/lexicon/social/coves/feed/getTimeline.json

···

       10
       10
        
               "properties": {

     

       11
       11
        
                 "sort": {

     

       12
       12
        
                   "type": "string",

     

       13
       13
       -
                   "enum": ["hot", "top", "new"],

     

       13
       13
       +
                   "knownValues": ["hot", "top", "new"],

     

       14
       14
        
                   "default": "hot",

     

       15
       15
        
                   "description": "Sort order for timeline feed"

     

       16
       16
        
                 },

     

       17
       17
        
                 "timeframe": {

     

       18
       18
        
                   "type": "string",

     

       19
       19
       -
                   "enum": ["hour", "day", "week", "month", "year", "all"],

     

       19
       19
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       20
       20
        
                   "default": "day",

     

       21
       21
        
                   "description": "Timeframe for top sorting (only applies when sort=top)"

     

       22
       22
        
                 },

-31

internal/atproto/lexicon/social/coves/interaction/share.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.share",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "Sharing a post to another community or platform",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the post being shared"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "toCommunity": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "format": "at-uri",

     

       21
       21
       -
                   "description": "Community being shared to (if applicable)"

     

       22
       22
       -
                 },

     

       23
       23
       -
                 "createdAt": {

     

       24
       24
       -
                   "type": "string",

     

       25
       25
       -
                   "format": "datetime"

     

       26
       26
       -
                 }

     

       27
       27
       -
               }

     

       28
       28
       -
             }

     

       29
       29
       -
           }

     

       30
       30
       -
         }

     

       31
       31
       -
       }

-33

internal/atproto/lexicon/social/coves/interaction/tag.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.interaction.tag",

     

       4
       4
       -
         "defs": {

     

       5
       5
       -
           "main": {

     

       6
       6
       -
             "type": "record",

     

       7
       7
       -
             "description": "A tag applied to a post or comment",

     

       8
       8
       -
             "key": "tid",

     

       9
       9
       -
             "record": {

     

       10
       10
       -
               "type": "object",

     

       11
       11
       -
               "required": ["subject", "tag", "createdAt"],

     

       12
       12
       -
               "properties": {

     

       13
       13
       -
                 "subject": {

     

       14
       14
       -
                   "type": "string",

     

       15
       15
       -
                   "format": "at-uri",

     

       16
       16
       -
                   "description": "AT-URI of the post or comment being tagged"

     

       17
       17
       -
                 },

     

       18
       18
       -
                 "tag": {

     

       19
       19
       -
                   "type": "string",

     

       20
       20
       -
                   "minLength": 1,

     

       21
       21
       -
                   "maxLength": 50,

     

       22
       22
       -
                   "knownValues": ["helpful", "insightful", "spam", "hostile", "offtopic", "misleading"],

     

       23
       23
       -
                   "description": "Predefined tag or custom community tag"

     

       24
       24
       -
                 },

     

       25
       25
       -
                 "createdAt": {

     

       26
       26
       -
                   "type": "string",

     

       27
       27
       -
                   "format": "datetime"

     

       28
       28
       -
                 }

     

       29
       29
       -
               }

     

       30
       30
       -
             }

     

       31
       31
       -
           }

     

       32
       32
       -
         }

     

       33
       33
       -
       }

-9

tests/lexicon-test-data/community/moderator-invalid-permissions.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.community.moderator",

     

       3
       3
       -
         "user": "did:plc:moderator123",

     

       4
       4
       -
         "community": "did:plc:community123",

     

       5
       5
       -
         "role": "moderator",

     

       6
       6
       -
         "permissions": ["remove_posts", "invalid-permission"],

     

       7
       7
       -
         "createdAt": "2024-06-15T10:00:00Z",

     

       8
       8
       -
         "createdBy": "did:plc:owner123"

     

       9
       9
       -
       }

-5

tests/lexicon-test-data/interaction/share-valid-no-community.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.share",

     

       3
       3
       -
         "subject": "at://did:plc:originalauthor/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "createdAt": "2025-01-09T17:00:00Z"

     

       5
       5
       -
       }

-6

tests/lexicon-test-data/interaction/share-valid.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.share",

     

       3
       3
       -
         "subject": "at://did:plc:originalauthor/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "community": "did:plc:targetcommunity",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:00:00Z"

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/interaction/tag-invalid-empty.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.tag",

     

       3
       3
       -
         "subject": "at://did:plc:author123/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "tag": "",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:15:00Z"

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/interaction/tag-valid-custom.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.tag",

     

       3
       3
       -
         "subject": "at://did:plc:author123/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "tag": "beginner-friendly",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:15:00Z"

     

       6
       6
       -
       }

-6

tests/lexicon-test-data/interaction/tag-valid-known.json

···

       1
       1
       -
       {

     

       2
       2
       -
         "$type": "social.coves.interaction.tag",

     

       3
       3
       -
         "subject": "at://did:plc:author123/social.coves.post.record/3k7a3dmb5bk2c",

     

       4
       4
       -
         "tag": "nsfw",

     

       5
       5
       -
         "createdAt": "2025-01-09T17:15:00Z"

     

       6
       6
       -
       }

+13

scripts/validate-schemas.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Validate all lexicon schemas and test data

     

       3
       3
       +
       

     

       4
       4
       +
       set -e

     

       5
       5
       +
       

     

       6
       6
       +
       echo "🔍 Validating Coves lexicon schemas..."

     

       7
       7
       +
       echo ""

     

       8
       8
       +
       

     

       9
       9
       +
       # Run the Go validation tool

     

       10
       10
       +
       go run ./cmd/validate-lexicon/main.go

     

       11
       11
       +
       

     

       12
       12
       +
       echo ""

     

       13
       13
       +
       echo "✅ Schema validation complete!"

+63

internal/db/migrations/016_create_comments_table.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Create comments table for AppView indexing

     

       3
       3
       +
       -- Comments are indexed from the firehose after being written to user repositories

     

       4
       4
       +
       CREATE TABLE comments (

     

       5
       5
       +
           id BIGSERIAL PRIMARY KEY,

     

       6
       6
       +
           uri TEXT UNIQUE NOT NULL,               -- AT-URI (at://commenter_did/social.coves.feed.comment/rkey)

     

       7
       7
       +
           cid TEXT NOT NULL,                      -- Content ID

     

       8
       8
       +
           rkey TEXT NOT NULL,                     -- Record key (TID)

     

       9
       9
       +
           commenter_did TEXT NOT NULL,            -- User who commented (from AT-URI repo field)

     

       10
       10
       +
       

     

       11
       11
       +
           -- Threading structure (reply references)

     

       12
       12
       +
           root_uri TEXT NOT NULL,                 -- Strong reference to original post (at://...)

     

       13
       13
       +
           root_cid TEXT NOT NULL,                 -- CID of root post (version pinning)

     

       14
       14
       +
           parent_uri TEXT NOT NULL,               -- Strong reference to immediate parent (post or comment)

     

       15
       15
       +
           parent_cid TEXT NOT NULL,               -- CID of parent (version pinning)

     

       16
       16
       +
       

     

       17
       17
       +
           -- Content (content is required per lexicon, others optional)

     

       18
       18
       +
           content TEXT NOT NULL,                  -- Comment text (max 3000 graphemes, 30000 bytes)

     

       19
       19
       +
           content_facets JSONB,                   -- Rich text facets (social.coves.richtext.facet)

     

       20
       20
       +
           embed JSONB,                            -- Embedded content (images, quoted posts)

     

       21
       21
       +
           content_labels JSONB,                   -- Self-applied labels (com.atproto.label.defs#selfLabels)

     

       22
       22
       +
           langs TEXT[],                           -- Languages (ISO 639-1, max 3)

     

       23
       23
       +
       

     

       24
       24
       +
           -- Timestamps

     

       25
       25
       +
           created_at TIMESTAMPTZ NOT NULL,        -- Commenter's timestamp from record

     

       26
       26
       +
           indexed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), -- When indexed by AppView

     

       27
       27
       +
           deleted_at TIMESTAMPTZ,                 -- Soft delete (for firehose delete events)

     

       28
       28
       +
       

     

       29
       29
       +
           -- Stats (denormalized for performance)

     

       30
       30
       +
           upvote_count INT NOT NULL DEFAULT 0,    -- Comments can be voted on (per vote lexicon)

     

       31
       31
       +
           downvote_count INT NOT NULL DEFAULT 0,

     

       32
       32
       +
           score INT NOT NULL DEFAULT 0,           -- upvote_count - downvote_count (for sorting)

     

       33
       33
       +
           reply_count INT NOT NULL DEFAULT 0      -- Number of direct replies to this comment

     

       34
       34
       +
       

     

       35
       35
       +
           -- NO foreign key constraint on commenter_did to allow out-of-order indexing from Jetstream

     

       36
       36
       +
           -- Comment events may arrive before user events, which is acceptable since:

     

       37
       37
       +
           -- 1. Comments are authenticated by the user's PDS (security maintained)

     

       38
       38
       +
           -- 2. Orphaned comments from never-indexed users are harmless

     

       39
       39
       +
           -- 3. This prevents race conditions in the firehose consumer

     

       40
       40
       +
       );

     

       41
       41
       +
       

     

       42
       42
       +
       -- Indexes for threading queries (most important for comment UX)

     

       43
       43
       +
       CREATE INDEX idx_comments_root ON comments(root_uri, created_at DESC) WHERE deleted_at IS NULL;

     

       44
       44
       +
       CREATE INDEX idx_comments_parent ON comments(parent_uri, created_at DESC) WHERE deleted_at IS NULL;

     

       45
       45
       +
       CREATE INDEX idx_comments_parent_score ON comments(parent_uri, score DESC, created_at DESC) WHERE deleted_at IS NULL;

     

       46
       46
       +
       

     

       47
       47
       +
       -- Indexes for user queries

     

       48
       48
       +
       CREATE INDEX idx_comments_commenter ON comments(commenter_did, created_at DESC);

     

       49
       49
       +
       CREATE INDEX idx_comments_uri ON comments(uri);

     

       50
       50
       +
       

     

       51
       51
       +
       -- Index for vote targeting (when votes target comments)

     

       52
       52
       +
       CREATE INDEX idx_comments_uri_active ON comments(uri) WHERE deleted_at IS NULL;

     

       53
       53
       +
       

     

       54
       54
       +
       -- Comment on table

     

       55
       55
       +
       COMMENT ON TABLE comments IS 'Comments indexed from user repositories via Jetstream firehose consumer';

     

       56
       56
       +
       COMMENT ON COLUMN comments.uri IS 'AT-URI in format: at://commenter_did/social.coves.feed.comment/rkey';

     

       57
       57
       +
       COMMENT ON COLUMN comments.root_uri IS 'Strong reference to the original post that started the thread';

     

       58
       58
       +
       COMMENT ON COLUMN comments.parent_uri IS 'Strong reference to immediate parent (post or comment)';

     

       59
       59
       +
       COMMENT ON COLUMN comments.score IS 'Computed as upvote_count - downvote_count for ranking replies';

     

       60
       60
       +
       COMMENT ON COLUMN comments.content_labels IS 'Self-applied labels per com.atproto.label.defs#selfLabels (JSONB: {"values":[{"val":"nsfw","neg":false}]})';

     

       61
       61
       +
       

     

       62
       62
       +
       -- +goose Down

     

       63
       63
       +
       DROP TABLE IF EXISTS comments CASCADE;

+125

internal/atproto/jetstream/comment_jetstream_connector.go

···

       1
       1
       +
       package jetstream

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"encoding/json"

     

       6
       6
       +
       	"fmt"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"sync"

     

       9
       9
       +
       	"time"

     

       10
       10
       +
       

     

       11
       11
       +
       	"github.com/gorilla/websocket"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // CommentJetstreamConnector handles WebSocket connection to Jetstream for comment events

     

       15
       15
       +
       type CommentJetstreamConnector struct {

     

       16
       16
       +
       	consumer *CommentEventConsumer

     

       17
       17
       +
       	wsURL    string

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // NewCommentJetstreamConnector creates a new Jetstream WebSocket connector for comment events

     

       21
       21
       +
       func NewCommentJetstreamConnector(consumer *CommentEventConsumer, wsURL string) *CommentJetstreamConnector {

     

       22
       22
       +
       	return &CommentJetstreamConnector{

     

       23
       23
       +
       		consumer: consumer,

     

       24
       24
       +
       		wsURL:    wsURL,

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // Start begins consuming events from Jetstream

     

       29
       29
       +
       // Runs indefinitely, reconnecting on errors

     

       30
       30
       +
       func (c *CommentJetstreamConnector) Start(ctx context.Context) error {

     

       31
       31
       +
       	log.Printf("Starting Jetstream comment consumer: %s", c.wsURL)

     

       32
       32
       +
       

     

       33
       33
       +
       	for {

     

       34
       34
       +
       		select {

     

       35
       35
       +
       		case <-ctx.Done():

     

       36
       36
       +
       			log.Println("Jetstream comment consumer shutting down")

     

       37
       37
       +
       			return ctx.Err()

     

       38
       38
       +
       		default:

     

       39
       39
       +
       			if err := c.connect(ctx); err != nil {

     

       40
       40
       +
       				log.Printf("Jetstream comment connection error: %v. Retrying in 5s...", err)

     

       41
       41
       +
       				time.Sleep(5 * time.Second)

     

       42
       42
       +
       				continue

     

       43
       43
       +
       			}

     

       44
       44
       +
       		}

     

       45
       45
       +
       	}

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       // connect establishes WebSocket connection and processes events

     

       49
       49
       +
       func (c *CommentJetstreamConnector) connect(ctx context.Context) error {

     

       50
       50
       +
       	conn, _, err := websocket.DefaultDialer.DialContext(ctx, c.wsURL, nil)

     

       51
       51
       +
       	if err != nil {

     

       52
       52
       +
       		return fmt.Errorf("failed to connect to Jetstream: %w", err)

     

       53
       53
       +
       	}

     

       54
       54
       +
       	defer func() {

     

       55
       55
       +
       		if closeErr := conn.Close(); closeErr != nil {

     

       56
       56
       +
       			log.Printf("Failed to close WebSocket connection: %v", closeErr)

     

       57
       57
       +
       		}

     

       58
       58
       +
       	}()

     

       59
       59
       +
       

     

       60
       60
       +
       	log.Println("Connected to Jetstream (comment consumer)")

     

       61
       61
       +
       

     

       62
       62
       +
       	// Set read deadline to detect connection issues

     

       63
       63
       +
       	if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       64
       64
       +
       		log.Printf("Failed to set read deadline: %v", err)

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	// Set pong handler to keep connection alive

     

       68
       68
       +
       	conn.SetPongHandler(func(string) error {

     

       69
       69
       +
       		if err := conn.SetReadDeadline(time.Now().Add(60 * time.Second)); err != nil {

     

       70
       70
       +
       			log.Printf("Failed to set read deadline in pong handler: %v", err)

     

       71
       71
       +
       		}

     

       72
       72
       +
       		return nil

     

       73
       73
       +
       	})

     

       74
       74
       +
       

     

       75
       75
       +
       	// Start ping ticker

     

       76
       76
       +
       	ticker := time.NewTicker(30 * time.Second)

     

       77
       77
       +
       	defer ticker.Stop()

     

       78
       78
       +
       

     

       79
       79
       +
       	done := make(chan struct{})

     

       80
       80
       +
       	var closeOnce sync.Once // Ensure done channel is only closed once

     

       81
       81
       +
       

     

       82
       82
       +
       	// Ping goroutine

     

       83
       83
       +
       	go func() {

     

       84
       84
       +
       		for {

     

       85
       85
       +
       			select {

     

       86
       86
       +
       			case <-ticker.C:

     

       87
       87
       +
       				if err := conn.WriteControl(websocket.PingMessage, []byte{}, time.Now().Add(10*time.Second)); err != nil {

     

       88
       88
       +
       					log.Printf("Failed to send ping: %v", err)

     

       89
       89
       +
       					closeOnce.Do(func() { close(done) })

     

       90
       90
       +
       					return

     

       91
       91
       +
       				}

     

       92
       92
       +
       			case <-done:

     

       93
       93
       +
       				return

     

       94
       94
       +
       			}

     

       95
       95
       +
       		}

     

       96
       96
       +
       	}()

     

       97
       97
       +
       

     

       98
       98
       +
       	// Read loop

     

       99
       99
       +
       	for {

     

       100
       100
       +
       		select {

     

       101
       101
       +
       		case <-done:

     

       102
       102
       +
       			return fmt.Errorf("connection closed by ping failure")

     

       103
       103
       +
       		default:

     

       104
       104
       +
       		}

     

       105
       105
       +
       

     

       106
       106
       +
       		_, message, err := conn.ReadMessage()

     

       107
       107
       +
       		if err != nil {

     

       108
       108
       +
       			closeOnce.Do(func() { close(done) })

     

       109
       109
       +
       			return fmt.Errorf("read error: %w", err)

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       112
       112
       +
       		// Parse Jetstream event

     

       113
       113
       +
       		var event JetstreamEvent

     

       114
       114
       +
       		if err := json.Unmarshal(message, &event); err != nil {

     

       115
       115
       +
       			log.Printf("Failed to parse Jetstream event: %v", err)

     

       116
       116
       +
       			continue

     

       117
       117
       +
       		}

     

       118
       118
       +
       

     

       119
       119
       +
       		// Process event through consumer

     

       120
       120
       +
       		if err := c.consumer.HandleEvent(ctx, &event); err != nil {

     

       121
       121
       +
       			log.Printf("Failed to handle comment event: %v", err)

     

       122
       122
       +
       			// Continue processing other events even if one fails

     

       123
       123
       +
       		}

     

       124
       124
       +
       	}

     

       125
       125
       +
       }

+221

internal/atproto/lexicon/social/coves/community/comment/defs.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.comment.defs",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "commentView": {

     

       6
       6
       +
             "type": "object",

     

       7
       7
       +
             "description": "Base view for a single comment with voting, stats, and viewer state",

     

       8
       8
       +
             "required": ["uri", "cid", "author", "record", "post", "content", "createdAt", "indexedAt", "stats"],

     

       9
       9
       +
             "properties": {

     

       10
       10
       +
               "uri": {

     

       11
       11
       +
                 "type": "string",

     

       12
       12
       +
                 "format": "at-uri",

     

       13
       13
       +
                 "description": "AT-URI of the comment record"

     

       14
       14
       +
               },

     

       15
       15
       +
               "cid": {

     

       16
       16
       +
                 "type": "string",

     

       17
       17
       +
                 "format": "cid",

     

       18
       18
       +
                 "description": "CID of the comment record"

     

       19
       19
       +
               },

     

       20
       20
       +
               "author": {

     

       21
       21
       +
                 "type": "ref",

     

       22
       22
       +
                 "ref": "social.coves.community.post.get#authorView",

     

       23
       23
       +
                 "description": "Comment author information"

     

       24
       24
       +
               },

     

       25
       25
       +
               "record": {

     

       26
       26
       +
                 "type": "unknown",

     

       27
       27
       +
                 "description": "The actual comment record verbatim"

     

       28
       28
       +
               },

     

       29
       29
       +
               "post": {

     

       30
       30
       +
                 "type": "ref",

     

       31
       31
       +
                 "ref": "#postRef",

     

       32
       32
       +
                 "description": "Reference to the parent post"

     

       33
       33
       +
               },

     

       34
       34
       +
               "parent": {

     

       35
       35
       +
                 "type": "ref",

     

       36
       36
       +
                 "ref": "#commentRef",

     

       37
       37
       +
                 "description": "Reference to parent comment if this is a nested reply"

     

       38
       38
       +
               },

     

       39
       39
       +
               "content": {

     

       40
       40
       +
                 "type": "string",

     

       41
       41
       +
                 "description": "Comment text content"

     

       42
       42
       +
               },

     

       43
       43
       +
               "contentFacets": {

     

       44
       44
       +
                 "type": "array",

     

       45
       45
       +
                 "description": "Rich text annotations for mentions, links, formatting",

     

       46
       46
       +
                 "items": {

     

       47
       47
       +
                   "type": "ref",

     

       48
       48
       +
                   "ref": "social.coves.richtext.facet"

     

       49
       49
       +
                 }

     

       50
       50
       +
               },

     

       51
       51
       +
               "embed": {

     

       52
       52
       +
                 "type": "union",

     

       53
       53
       +
                 "description": "Embedded content in the comment (images or quoted post)",

     

       54
       54
       +
                 "refs": [

     

       55
       55
       +
                   "social.coves.embed.images#view",

     

       56
       56
       +
                   "social.coves.embed.post#view"

     

       57
       57
       +
                 ]

     

       58
       58
       +
               },

     

       59
       59
       +
               "createdAt": {

     

       60
       60
       +
                 "type": "string",

     

       61
       61
       +
                 "format": "datetime",

     

       62
       62
       +
                 "description": "When the comment was created"

     

       63
       63
       +
               },

     

       64
       64
       +
               "indexedAt": {

     

       65
       65
       +
                 "type": "string",

     

       66
       66
       +
                 "format": "datetime",

     

       67
       67
       +
                 "description": "When this comment was indexed by the AppView"

     

       68
       68
       +
               },

     

       69
       69
       +
               "stats": {

     

       70
       70
       +
                 "type": "ref",

     

       71
       71
       +
                 "ref": "#commentStats",

     

       72
       72
       +
                 "description": "Comment statistics (votes, replies)"

     

       73
       73
       +
               },

     

       74
       74
       +
               "viewer": {

     

       75
       75
       +
                 "type": "ref",

     

       76
       76
       +
                 "ref": "#commentViewerState",

     

       77
       77
       +
                 "description": "Viewer-specific state (vote, saved, etc.)"

     

       78
       78
       +
               }

     

       79
       79
       +
             }

     

       80
       80
       +
           },

     

       81
       81
       +
           "threadViewComment": {

     

       82
       82
       +
             "type": "object",

     

       83
       83
       +
             "description": "Wrapper for threaded comment structure, similar to Bluesky's threadViewPost pattern",

     

       84
       84
       +
             "required": ["comment"],

     

       85
       85
       +
             "properties": {

     

       86
       86
       +
               "comment": {

     

       87
       87
       +
                 "type": "ref",

     

       88
       88
       +
                 "ref": "#commentView",

     

       89
       89
       +
                 "description": "The comment itself"

     

       90
       90
       +
               },

     

       91
       91
       +
               "replies": {

     

       92
       92
       +
                 "type": "array",

     

       93
       93
       +
                 "description": "Nested replies to this comment",

     

       94
       94
       +
                 "items": {

     

       95
       95
       +
                   "type": "union",

     

       96
       96
       +
                   "refs": ["#threadViewComment", "#notFoundComment", "#blockedComment"]

     

       97
       97
       +
                 }

     

       98
       98
       +
               },

     

       99
       99
       +
               "hasMore": {

     

       100
       100
       +
                 "type": "boolean",

     

       101
       101
       +
                 "description": "True if more replies exist but are not included in this response"

     

       102
       102
       +
               }

     

       103
       103
       +
             }

     

       104
       104
       +
           },

     

       105
       105
       +
           "commentRef": {

     

       106
       106
       +
             "type": "object",

     

       107
       107
       +
             "description": "Reference to a comment record",

     

       108
       108
       +
             "required": ["uri", "cid"],

     

       109
       109
       +
             "properties": {

     

       110
       110
       +
               "uri": {

     

       111
       111
       +
                 "type": "string",

     

       112
       112
       +
                 "format": "at-uri",

     

       113
       113
       +
                 "description": "AT-URI of the comment"

     

       114
       114
       +
               },

     

       115
       115
       +
               "cid": {

     

       116
       116
       +
                 "type": "string",

     

       117
       117
       +
                 "format": "cid",

     

       118
       118
       +
                 "description": "CID of the comment record"

     

       119
       119
       +
               }

     

       120
       120
       +
             }

     

       121
       121
       +
           },

     

       122
       122
       +
           "postRef": {

     

       123
       123
       +
             "type": "object",

     

       124
       124
       +
             "description": "Reference to a post record",

     

       125
       125
       +
             "required": ["uri", "cid"],

     

       126
       126
       +
             "properties": {

     

       127
       127
       +
               "uri": {

     

       128
       128
       +
                 "type": "string",

     

       129
       129
       +
                 "format": "at-uri",

     

       130
       130
       +
                 "description": "AT-URI of the post"

     

       131
       131
       +
               },

     

       132
       132
       +
               "cid": {

     

       133
       133
       +
                 "type": "string",

     

       134
       134
       +
                 "format": "cid",

     

       135
       135
       +
                 "description": "CID of the post record"

     

       136
       136
       +
               }

     

       137
       137
       +
             }

     

       138
       138
       +
           },

     

       139
       139
       +
           "notFoundComment": {

     

       140
       140
       +
             "type": "object",

     

       141
       141
       +
             "description": "Comment was not found (deleted, never indexed, or invalid URI)",

     

       142
       142
       +
             "required": ["uri", "notFound"],

     

       143
       143
       +
             "properties": {

     

       144
       144
       +
               "uri": {

     

       145
       145
       +
                 "type": "string",

     

       146
       146
       +
                 "format": "at-uri",

     

       147
       147
       +
                 "description": "AT-URI of the missing comment"

     

       148
       148
       +
               },

     

       149
       149
       +
               "notFound": {

     

       150
       150
       +
                 "type": "boolean",

     

       151
       151
       +
                 "const": true,

     

       152
       152
       +
                 "description": "Always true for not found comments"

     

       153
       153
       +
               }

     

       154
       154
       +
             }

     

       155
       155
       +
           },

     

       156
       156
       +
           "blockedComment": {

     

       157
       157
       +
             "type": "object",

     

       158
       158
       +
             "description": "Comment is blocked due to viewer blocking author or moderation action",

     

       159
       159
       +
             "required": ["uri", "blocked"],

     

       160
       160
       +
             "properties": {

     

       161
       161
       +
               "uri": {

     

       162
       162
       +
                 "type": "string",

     

       163
       163
       +
                 "format": "at-uri",

     

       164
       164
       +
                 "description": "AT-URI of the blocked comment"

     

       165
       165
       +
               },

     

       166
       166
       +
               "blocked": {

     

       167
       167
       +
                 "type": "boolean",

     

       168
       168
       +
                 "const": true,

     

       169
       169
       +
                 "description": "Always true for blocked comments"

     

       170
       170
       +
               },

     

       171
       171
       +
               "blockedBy": {

     

       172
       172
       +
                 "type": "string",

     

       173
       173
       +
                 "knownValues": ["author", "moderator"],

     

       174
       174
       +
                 "description": "What caused the block: viewer blocked author, or comment was removed by moderators"

     

       175
       175
       +
               }

     

       176
       176
       +
             }

     

       177
       177
       +
           },

     

       178
       178
       +
           "commentStats": {

     

       179
       179
       +
             "type": "object",

     

       180
       180
       +
             "description": "Statistics for a comment",

     

       181
       181
       +
             "required": ["upvotes", "downvotes", "score", "replyCount"],

     

       182
       182
       +
             "properties": {

     

       183
       183
       +
               "upvotes": {

     

       184
       184
       +
                 "type": "integer",

     

       185
       185
       +
                 "minimum": 0,

     

       186
       186
       +
                 "description": "Number of upvotes"

     

       187
       187
       +
               },

     

       188
       188
       +
               "downvotes": {

     

       189
       189
       +
                 "type": "integer",

     

       190
       190
       +
                 "minimum": 0,

     

       191
       191
       +
                 "description": "Number of downvotes"

     

       192
       192
       +
               },

     

       193
       193
       +
               "score": {

     

       194
       194
       +
                 "type": "integer",

     

       195
       195
       +
                 "description": "Calculated score (upvotes - downvotes)"

     

       196
       196
       +
               },

     

       197
       197
       +
               "replyCount": {

     

       198
       198
       +
                 "type": "integer",

     

       199
       199
       +
                 "minimum": 0,

     

       200
       200
       +
                 "description": "Number of direct replies to this comment"

     

       201
       201
       +
               }

     

       202
       202
       +
             }

     

       203
       203
       +
           },

     

       204
       204
       +
           "commentViewerState": {

     

       205
       205
       +
             "type": "object",

     

       206
       206
       +
             "description": "Viewer-specific state for a comment",

     

       207
       207
       +
             "properties": {

     

       208
       208
       +
               "vote": {

     

       209
       209
       +
                 "type": "string",

     

       210
       210
       +
                 "knownValues": ["up", "down"],

     

       211
       211
       +
                 "description": "Viewer's vote on this comment"

     

       212
       212
       +
               },

     

       213
       213
       +
               "voteUri": {

     

       214
       214
       +
                 "type": "string",

     

       215
       215
       +
                 "format": "at-uri",

     

       216
       216
       +
                 "description": "AT-URI of the viewer's vote record"

     

       217
       217
       +
               }

     

       218
       218
       +
             }

     

       219
       219
       +
           }

     

       220
       220
       +
         }

     

       221
       221
       +
       }

+86

internal/atproto/lexicon/social/coves/community/comment/getComments.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.community.comment.getComments",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "query",

     

       7
       7
       +
             "description": "Get comments for a post with threading and sorting support. Supports hot/top/new sorting, configurable nesting depth, and pagination.",

     

       8
       8
       +
             "parameters": {

     

       9
       9
       +
               "type": "params",

     

       10
       10
       +
               "required": ["post"],

     

       11
       11
       +
               "properties": {

     

       12
       12
       +
                 "post": {

     

       13
       13
       +
                   "type": "string",

     

       14
       14
       +
                   "format": "at-uri",

     

       15
       15
       +
                   "description": "AT-URI of the post to get comments for"

     

       16
       16
       +
                 },

     

       17
       17
       +
                 "sort": {

     

       18
       18
       +
                   "type": "string",

     

       19
       19
       +
                   "default": "hot",

     

       20
       20
       +
                   "knownValues": ["hot", "top", "new"],

     

       21
       21
       +
                   "description": "Sort order: hot (trending), top (highest score), new (most recent)"

     

       22
       22
       +
                 },

     

       23
       23
       +
                 "timeframe": {

     

       24
       24
       +
                   "type": "string",

     

       25
       25
       +
                   "knownValues": ["hour", "day", "week", "month", "year", "all"],

     

       26
       26
       +
                   "description": "Timeframe for 'top' sort. Ignored for other sort types."

     

       27
       27
       +
                 },

     

       28
       28
       +
                 "depth": {

     

       29
       29
       +
                   "type": "integer",

     

       30
       30
       +
                   "default": 10,

     

       31
       31
       +
                   "minimum": 0,

     

       32
       32
       +
                   "maximum": 100,

     

       33
       33
       +
                   "description": "Maximum reply nesting depth to return. 0 returns only top-level comments."

     

       34
       34
       +
                 },

     

       35
       35
       +
                 "limit": {

     

       36
       36
       +
                   "type": "integer",

     

       37
       37
       +
                   "default": 50,

     

       38
       38
       +
                   "minimum": 1,

     

       39
       39
       +
                   "maximum": 100,

     

       40
       40
       +
                   "description": "Maximum number of top-level comments to return per page"

     

       41
       41
       +
                 },

     

       42
       42
       +
                 "cursor": {

     

       43
       43
       +
                   "type": "string",

     

       44
       44
       +
                   "description": "Pagination cursor from previous response"

     

       45
       45
       +
                 }

     

       46
       46
       +
               }

     

       47
       47
       +
             },

     

       48
       48
       +
             "output": {

     

       49
       49
       +
               "encoding": "application/json",

     

       50
       50
       +
               "schema": {

     

       51
       51
       +
                 "type": "object",

     

       52
       52
       +
                 "required": ["comments", "post"],

     

       53
       53
       +
                 "properties": {

     

       54
       54
       +
                   "comments": {

     

       55
       55
       +
                     "type": "array",

     

       56
       56
       +
                     "description": "Top-level comments with nested replies up to requested depth",

     

       57
       57
       +
                     "items": {

     

       58
       58
       +
                       "type": "ref",

     

       59
       59
       +
                       "ref": "social.coves.community.comment.defs#threadViewComment"

     

       60
       60
       +
                     }

     

       61
       61
       +
                   },

     

       62
       62
       +
                   "post": {

     

       63
       63
       +
                     "type": "ref",

     

       64
       64
       +
                     "ref": "social.coves.community.post.get#postView",

     

       65
       65
       +
                     "description": "The post these comments belong to"

     

       66
       66
       +
                   },

     

       67
       67
       +
                   "cursor": {

     

       68
       68
       +
                     "type": "string",

     

       69
       69
       +
                     "description": "Pagination cursor for fetching next page of top-level comments"

     

       70
       70
       +
                   }

     

       71
       71
       +
                 }

     

       72
       72
       +
               }

     

       73
       73
       +
             },

     

       74
       74
       +
             "errors": [

     

       75
       75
       +
               {

     

       76
       76
       +
                 "name": "NotFound",

     

       77
       77
       +
                 "description": "Post not found"

     

       78
       78
       +
               },

     

       79
       79
       +
               {

     

       80
       80
       +
                 "name": "InvalidRequest",

     

       81
       81
       +
                 "description": "Invalid parameters (malformed URI, invalid sort/timeframe combination, etc.)"

     

       82
       82
       +
               }

     

       83
       83
       +
             ]

     

       84
       84
       +
           }

     

       85
       85
       +
         }

     

       86
       86
       +
       }

+11

internal/core/comments/interfaces.go

···

       64
       64
        
       	// Returns map[commentURI]*Vote for efficient lookups

     

       65
       65
        
       	// Future: Used when votes table is implemented

     

       66
       66
        
       	GetVoteStateForComments(ctx context.Context, viewerDID string, commentURIs []string) (map[string]interface{}, error)

     

       67
       67
       +
       

     

       68
       68
       +
       	// ListByParentsBatch retrieves direct replies to multiple parents in a single query

     

       69
       69
       +
       	// Returns map[parentURI][]*Comment grouped by parent

     

       70
       70
       +
       	// Used to prevent N+1 queries when loading nested replies

     

       71
       71
       +
       	// Limits results per parent to avoid memory exhaustion

     

       72
       72
       +
       	ListByParentsBatch(

     

       73
       73
       +
       		ctx context.Context,

     

       74
       74
       +
       		parentURIs []string,

     

       75
       75
       +
       		sort string,

     

       76
       76
       +
       		limitPerParent int,

     

       77
       77
       +
       	) (map[string][]*Comment, error)

     

       67
       78
        
       }

+6 -6

tests/lexicon_validation_test.go

···

       72
       72
        
       

     

       73
       73
        
       	// Test specific cross-references that should work

     

       74
       74
        
       	crossRefs := map[string]string{

     

       75
       75
       -
       		"social.coves.richtext.facet#byteSlice":     "byteSlice definition in facet schema",

     

       76
       76
       -
       		"social.coves.community.rules#rule":         "rule definition in community rules",

     

       77
       77
       -
       		"social.coves.actor.defs#profileView":       "profileView definition in actor defs",

     

       78
       78
       -
       		"social.coves.actor.defs#profileStats":      "profileStats definition in actor defs",

     

       79
       79
       -
       		"social.coves.actor.defs#viewerState":       "viewerState definition in actor defs",

     

       80
       80
       -
       		"social.coves.community.defs#communityView": "communityView definition in community defs",

     

       75
       75
       +
       		"social.coves.richtext.facet#byteSlice":      "byteSlice definition in facet schema",

     

       76
       76
       +
       		"social.coves.community.rules#rule":          "rule definition in community rules",

     

       77
       77
       +
       		"social.coves.actor.defs#profileView":        "profileView definition in actor defs",

     

       78
       78
       +
       		"social.coves.actor.defs#profileStats":       "profileStats definition in actor defs",

     

       79
       79
       +
       		"social.coves.actor.defs#viewerState":        "viewerState definition in actor defs",

     

       80
       80
       +
       		"social.coves.community.defs#communityView":  "communityView definition in community defs",

     

       81
       81
        
       		"social.coves.community.defs#communityStats": "communityStats definition in community defs",

     

       82
       82
        
       	}

     

       83
       83

+5

internal/atproto/lexicon/social/coves/community/post/get.json

···

       150
       150
        
                 "type": "string",

     

       151
       151
        
                 "format": "did"

     

       152
       152
        
               },

     

       153
       153
       +
               "handle": {

     

       154
       154
       +
                 "type": "string",

     

       155
       155
       +
                 "format": "handle",

     

       156
       156
       +
                 "description": "Current handle resolved from DID"

     

       157
       157
       +
               },

     

       153
       158
        
               "name": {

     

       154
       159
        
                 "type": "string"

     

       155
       160
        
               },

+200

internal/core/unfurl/circuit_breaker.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"log"

     

       6
       6
       +
       	"sync"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // circuitState represents the state of a circuit breaker

     

       11
       11
       +
       type circuitState int

     

       12
       12
       +
       

     

       13
       13
       +
       const (

     

       14
       14
       +
       	stateClosed   circuitState = iota // Normal operation

     

       15
       15
       +
       	stateOpen                         // Circuit is open (provider failing)

     

       16
       16
       +
       	stateHalfOpen                     // Testing if provider recovered

     

       17
       17
       +
       )

     

       18
       18
       +
       

     

       19
       19
       +
       // circuitBreaker tracks failures per provider and stops trying failing providers

     

       20
       20
       +
       type circuitBreaker struct {

     

       21
       21
       +
       	failures         map[string]int

     

       22
       22
       +
       	lastFailure      map[string]time.Time

     

       23
       23
       +
       	state            map[string]circuitState

     

       24
       24
       +
       	lastStateLog     map[string]time.Time

     

       25
       25
       +
       	failureThreshold int

     

       26
       26
       +
       	openDuration     time.Duration

     

       27
       27
       +
       	mu               sync.RWMutex

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       // newCircuitBreaker creates a circuit breaker with default settings

     

       31
       31
       +
       func newCircuitBreaker() *circuitBreaker {

     

       32
       32
       +
       	return &circuitBreaker{

     

       33
       33
       +
       		failureThreshold: 3,               // Open after 3 consecutive failures

     

       34
       34
       +
       		openDuration:     5 * time.Minute, // Keep open for 5 minutes

     

       35
       35
       +
       		failures:         make(map[string]int),

     

       36
       36
       +
       		lastFailure:      make(map[string]time.Time),

     

       37
       37
       +
       		state:            make(map[string]circuitState),

     

       38
       38
       +
       		lastStateLog:     make(map[string]time.Time),

     

       39
       39
       +
       	}

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       // canAttempt checks if we should attempt to call this provider

     

       43
       43
       +
       // Returns true if circuit is closed or half-open (ready to retry)

     

       44
       44
       +
       func (cb *circuitBreaker) canAttempt(provider string) (bool, error) {

     

       45
       45
       +
       	cb.mu.RLock()

     

       46
       46
       +
       	defer cb.mu.RUnlock()

     

       47
       47
       +
       

     

       48
       48
       +
       	state := cb.getState(provider)

     

       49
       49
       +
       

     

       50
       50
       +
       	switch state {

     

       51
       51
       +
       	case stateClosed:

     

       52
       52
       +
       		return true, nil

     

       53
       53
       +
       	case stateOpen:

     

       54
       54
       +
       		// Check if we should transition to half-open

     

       55
       55
       +
       		lastFail := cb.lastFailure[provider]

     

       56
       56
       +
       		if time.Since(lastFail) > cb.openDuration {

     

       57
       57
       +
       			// Transition to half-open (allow one retry)

     

       58
       58
       +
       			cb.mu.RUnlock()

     

       59
       59
       +
       			cb.mu.Lock()

     

       60
       60
       +
       			cb.state[provider] = stateHalfOpen

     

       61
       61
       +
       			cb.logStateChange(provider, stateHalfOpen)

     

       62
       62
       +
       			cb.mu.Unlock()

     

       63
       63
       +
       			cb.mu.RLock()

     

       64
       64
       +
       			return true, nil

     

       65
       65
       +
       		}

     

       66
       66
       +
       		// Still in open period

     

       67
       67
       +
       		failCount := cb.failures[provider]

     

       68
       68
       +
       		nextRetry := lastFail.Add(cb.openDuration)

     

       69
       69
       +
       		return false, fmt.Errorf(

     

       70
       70
       +
       			"circuit breaker open for provider '%s' (failures: %d, next retry: %s)",

     

       71
       71
       +
       			provider,

     

       72
       72
       +
       			failCount,

     

       73
       73
       +
       			nextRetry.Format("15:04:05"),

     

       74
       74
       +
       		)

     

       75
       75
       +
       	case stateHalfOpen:

     

       76
       76
       +
       		return true, nil

     

       77
       77
       +
       	default:

     

       78
       78
       +
       		return true, nil

     

       79
       79
       +
       	}

     

       80
       80
       +
       }

     

       81
       81
       +
       

     

       82
       82
       +
       // recordSuccess records a successful unfurl, resetting failure count

     

       83
       83
       +
       func (cb *circuitBreaker) recordSuccess(provider string) {

     

       84
       84
       +
       	cb.mu.Lock()

     

       85
       85
       +
       	defer cb.mu.Unlock()

     

       86
       86
       +
       

     

       87
       87
       +
       	oldState := cb.getState(provider)

     

       88
       88
       +
       

     

       89
       89
       +
       	// Reset failure tracking

     

       90
       90
       +
       	delete(cb.failures, provider)

     

       91
       91
       +
       	delete(cb.lastFailure, provider)

     

       92
       92
       +
       	cb.state[provider] = stateClosed

     

       93
       93
       +
       

     

       94
       94
       +
       	// Log recovery if we were in a failure state

     

       95
       95
       +
       	if oldState != stateClosed {

     

       96
       96
       +
       		cb.logStateChange(provider, stateClosed)

     

       97
       97
       +
       	}

     

       98
       98
       +
       }

     

       99
       99
       +
       

     

       100
       100
       +
       // recordFailure records a failed unfurl attempt

     

       101
       101
       +
       func (cb *circuitBreaker) recordFailure(provider string, err error) {

     

       102
       102
       +
       	cb.mu.Lock()

     

       103
       103
       +
       	defer cb.mu.Unlock()

     

       104
       104
       +
       

     

       105
       105
       +
       	// Increment failure count

     

       106
       106
       +
       	cb.failures[provider]++

     

       107
       107
       +
       	cb.lastFailure[provider] = time.Now()

     

       108
       108
       +
       

     

       109
       109
       +
       	failCount := cb.failures[provider]

     

       110
       110
       +
       

     

       111
       111
       +
       	// Check if we should open the circuit

     

       112
       112
       +
       	if failCount >= cb.failureThreshold {

     

       113
       113
       +
       		oldState := cb.getState(provider)

     

       114
       114
       +
       		cb.state[provider] = stateOpen

     

       115
       115
       +
       		if oldState != stateOpen {

     

       116
       116
       +
       			log.Printf(

     

       117
       117
       +
       				"[UNFURL-CIRCUIT] Opening circuit for provider '%s' after %d consecutive failures. Last error: %v",

     

       118
       118
       +
       				provider,

     

       119
       119
       +
       				failCount,

     

       120
       120
       +
       				err,

     

       121
       121
       +
       			)

     

       122
       122
       +
       			cb.lastStateLog[provider] = time.Now()

     

       123
       123
       +
       		}

     

       124
       124
       +
       	} else {

     

       125
       125
       +
       		log.Printf(

     

       126
       126
       +
       			"[UNFURL-CIRCUIT] Failure %d/%d for provider '%s': %v",

     

       127
       127
       +
       			failCount,

     

       128
       128
       +
       			cb.failureThreshold,

     

       129
       129
       +
       			provider,

     

       130
       130
       +
       			err,

     

       131
       131
       +
       		)

     

       132
       132
       +
       	}

     

       133
       133
       +
       }

     

       134
       134
       +
       

     

       135
       135
       +
       // getState returns the current state (must be called with lock held)

     

       136
       136
       +
       func (cb *circuitBreaker) getState(provider string) circuitState {

     

       137
       137
       +
       	if state, exists := cb.state[provider]; exists {

     

       138
       138
       +
       		return state

     

       139
       139
       +
       	}

     

       140
       140
       +
       	return stateClosed

     

       141
       141
       +
       }

     

       142
       142
       +
       

     

       143
       143
       +
       // logStateChange logs state transitions (must be called with lock held)

     

       144
       144
       +
       // Debounced to avoid log spam (max once per minute per provider)

     

       145
       145
       +
       func (cb *circuitBreaker) logStateChange(provider string, newState circuitState) {

     

       146
       146
       +
       	lastLog, exists := cb.lastStateLog[provider]

     

       147
       147
       +
       	if exists && time.Since(lastLog) < time.Minute {

     

       148
       148
       +
       		return // Don't spam logs

     

       149
       149
       +
       	}

     

       150
       150
       +
       

     

       151
       151
       +
       	var stateStr string

     

       152
       152
       +
       	switch newState {

     

       153
       153
       +
       	case stateClosed:

     

       154
       154
       +
       		stateStr = "CLOSED (recovered)"

     

       155
       155
       +
       	case stateOpen:

     

       156
       156
       +
       		stateStr = "OPEN (failing)"

     

       157
       157
       +
       	case stateHalfOpen:

     

       158
       158
       +
       		stateStr = "HALF-OPEN (testing)"

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	log.Printf("[UNFURL-CIRCUIT] Circuit for provider '%s' is now %s", provider, stateStr)

     

       162
       162
       +
       	cb.lastStateLog[provider] = time.Now()

     

       163
       163
       +
       }

     

       164
       164
       +
       

     

       165
       165
       +
       // getStats returns current circuit breaker stats (for debugging/monitoring)

     

       166
       166
       +
       func (cb *circuitBreaker) getStats() map[string]interface{} {

     

       167
       167
       +
       	cb.mu.RLock()

     

       168
       168
       +
       	defer cb.mu.RUnlock()

     

       169
       169
       +
       

     

       170
       170
       +
       	stats := make(map[string]interface{})

     

       171
       171
       +
       

     

       172
       172
       +
       	// Collect all providers with any activity (state, failures, or both)

     

       173
       173
       +
       	providers := make(map[string]bool)

     

       174
       174
       +
       	for provider := range cb.state {

     

       175
       175
       +
       		providers[provider] = true

     

       176
       176
       +
       	}

     

       177
       177
       +
       	for provider := range cb.failures {

     

       178
       178
       +
       		providers[provider] = true

     

       179
       179
       +
       	}

     

       180
       180
       +
       

     

       181
       181
       +
       	for provider := range providers {

     

       182
       182
       +
       		state := cb.getState(provider)

     

       183
       183
       +
       		var stateStr string

     

       184
       184
       +
       		switch state {

     

       185
       185
       +
       		case stateClosed:

     

       186
       186
       +
       			stateStr = "closed"

     

       187
       187
       +
       		case stateOpen:

     

       188
       188
       +
       			stateStr = "open"

     

       189
       189
       +
       		case stateHalfOpen:

     

       190
       190
       +
       			stateStr = "half-open"

     

       191
       191
       +
       		}

     

       192
       192
       +
       

     

       193
       193
       +
       		stats[provider] = map[string]interface{}{

     

       194
       194
       +
       			"state":        stateStr,

     

       195
       195
       +
       			"failures":     cb.failures[provider],

     

       196
       196
       +
       			"last_failure": cb.lastFailure[provider],

     

       197
       197
       +
       		}

     

       198
       198
       +
       	}

     

       199
       199
       +
       	return stats

     

       200
       200
       +
       }

+175

internal/core/unfurl/circuit_breaker_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"testing"

     

       6
       6
       +
       	"time"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       func TestCircuitBreaker_Basic(t *testing.T) {

     

       10
       10
       +
       	cb := newCircuitBreaker()

     

       11
       11
       +
       

     

       12
       12
       +
       	provider := "test-provider"

     

       13
       13
       +
       

     

       14
       14
       +
       	// Should start closed (allow attempts)

     

       15
       15
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       16
       16
       +
       	if !canAttempt {

     

       17
       17
       +
       		t.Errorf("Expected circuit to be closed initially, but got error: %v", err)

     

       18
       18
       +
       	}

     

       19
       19
       +
       

     

       20
       20
       +
       	// Record success

     

       21
       21
       +
       	cb.recordSuccess(provider)

     

       22
       22
       +
       	canAttempt, _ = cb.canAttempt(provider)

     

       23
       23
       +
       	if !canAttempt {

     

       24
       24
       +
       		t.Error("Expected circuit to remain closed after success")

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       func TestCircuitBreaker_OpensAfterFailures(t *testing.T) {

     

       29
       29
       +
       	cb := newCircuitBreaker()

     

       30
       30
       +
       	provider := "failing-provider"

     

       31
       31
       +
       

     

       32
       32
       +
       	// Record failures up to threshold

     

       33
       33
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       34
       34
       +
       		cb.recordFailure(provider, fmt.Errorf("test error %d", i))

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	// Circuit should now be open

     

       38
       38
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       39
       39
       +
       	if canAttempt {

     

       40
       40
       +
       		t.Error("Expected circuit to be open after threshold failures")

     

       41
       41
       +
       	}

     

       42
       42
       +
       	if err == nil {

     

       43
       43
       +
       		t.Error("Expected error when circuit is open")

     

       44
       44
       +
       	}

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       func TestCircuitBreaker_RecoveryAfterSuccess(t *testing.T) {

     

       48
       48
       +
       	cb := newCircuitBreaker()

     

       49
       49
       +
       	provider := "recovery-provider"

     

       50
       50
       +
       

     

       51
       51
       +
       	// Record some failures

     

       52
       52
       +
       	cb.recordFailure(provider, fmt.Errorf("error 1"))

     

       53
       53
       +
       	cb.recordFailure(provider, fmt.Errorf("error 2"))

     

       54
       54
       +
       

     

       55
       55
       +
       	// Record success - should reset failure count

     

       56
       56
       +
       	cb.recordSuccess(provider)

     

       57
       57
       +
       

     

       58
       58
       +
       	// Should be able to attempt again

     

       59
       59
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       60
       60
       +
       	if !canAttempt {

     

       61
       61
       +
       		t.Errorf("Expected circuit to be closed after success, but got error: %v", err)

     

       62
       62
       +
       	}

     

       63
       63
       +
       

     

       64
       64
       +
       	// Failure count should be reset

     

       65
       65
       +
       	if count := cb.failures[provider]; count != 0 {

     

       66
       66
       +
       		t.Errorf("Expected failure count to be reset to 0, got %d", count)

     

       67
       67
       +
       	}

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       func TestCircuitBreaker_HalfOpenTransition(t *testing.T) {

     

       71
       71
       +
       	cb := newCircuitBreaker()

     

       72
       72
       +
       	cb.openDuration = 100 * time.Millisecond // Short duration for testing

     

       73
       73
       +
       	provider := "half-open-provider"

     

       74
       74
       +
       

     

       75
       75
       +
       	// Open the circuit

     

       76
       76
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       77
       77
       +
       		cb.recordFailure(provider, fmt.Errorf("error %d", i))

     

       78
       78
       +
       	}

     

       79
       79
       +
       

     

       80
       80
       +
       	// Should be open

     

       81
       81
       +
       	canAttempt, _ := cb.canAttempt(provider)

     

       82
       82
       +
       	if canAttempt {

     

       83
       83
       +
       		t.Error("Expected circuit to be open")

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	// Wait for open duration

     

       87
       87
       +
       	time.Sleep(150 * time.Millisecond)

     

       88
       88
       +
       

     

       89
       89
       +
       	// Should transition to half-open and allow one attempt

     

       90
       90
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       91
       91
       +
       	if !canAttempt {

     

       92
       92
       +
       		t.Errorf("Expected circuit to transition to half-open after duration, but got error: %v", err)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	// State should be half-open

     

       96
       96
       +
       	cb.mu.RLock()

     

       97
       97
       +
       	state := cb.state[provider]

     

       98
       98
       +
       	cb.mu.RUnlock()

     

       99
       99
       +
       

     

       100
       100
       +
       	if state != stateHalfOpen {

     

       101
       101
       +
       		t.Errorf("Expected state to be half-open, got %v", state)

     

       102
       102
       +
       	}

     

       103
       103
       +
       }

     

       104
       104
       +
       

     

       105
       105
       +
       func TestCircuitBreaker_MultipleProviders(t *testing.T) {

     

       106
       106
       +
       	cb := newCircuitBreaker()

     

       107
       107
       +
       

     

       108
       108
       +
       	// Open circuit for provider A

     

       109
       109
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       110
       110
       +
       		cb.recordFailure("providerA", fmt.Errorf("error"))

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	// Provider A should be blocked

     

       114
       114
       +
       	canAttemptA, _ := cb.canAttempt("providerA")

     

       115
       115
       +
       	if canAttemptA {

     

       116
       116
       +
       		t.Error("Expected providerA circuit to be open")

     

       117
       117
       +
       	}

     

       118
       118
       +
       

     

       119
       119
       +
       	// Provider B should still be open (independent circuits)

     

       120
       120
       +
       	canAttemptB, err := cb.canAttempt("providerB")

     

       121
       121
       +
       	if !canAttemptB {

     

       122
       122
       +
       		t.Errorf("Expected providerB circuit to be closed, but got error: %v", err)

     

       123
       123
       +
       	}

     

       124
       124
       +
       }

     

       125
       125
       +
       

     

       126
       126
       +
       func TestCircuitBreaker_GetStats(t *testing.T) {

     

       127
       127
       +
       	cb := newCircuitBreaker()

     

       128
       128
       +
       

     

       129
       129
       +
       	// Record some activity

     

       130
       130
       +
       	cb.recordFailure("provider1", fmt.Errorf("error 1"))

     

       131
       131
       +
       	cb.recordFailure("provider1", fmt.Errorf("error 2"))

     

       132
       132
       +
       

     

       133
       133
       +
       	stats := cb.getStats()

     

       134
       134
       +
       

     

       135
       135
       +
       	// Should have stats for providers with failures

     

       136
       136
       +
       	if providerStats, ok := stats["provider1"]; !ok {

     

       137
       137
       +
       		t.Error("Expected stats for provider1")

     

       138
       138
       +
       	} else {

     

       139
       139
       +
       		// Check that failure count is tracked

     

       140
       140
       +
       		statsMap := providerStats.(map[string]interface{})

     

       141
       141
       +
       		if failures, ok := statsMap["failures"].(int); !ok || failures != 2 {

     

       142
       142
       +
       			t.Errorf("Expected 2 failures for provider1, got %v", statsMap["failures"])

     

       143
       143
       +
       		}

     

       144
       144
       +
       	}

     

       145
       145
       +
       

     

       146
       146
       +
       	// Provider that succeeds is cleaned up from state

     

       147
       147
       +
       	cb.recordSuccess("provider2")

     

       148
       148
       +
       	_ = cb.getStats()

     

       149
       149
       +
       	// Provider2 should not be in stats (or have state "closed" with 0 failures)

     

       150
       150
       +
       }

     

       151
       151
       +
       

     

       152
       152
       +
       func TestCircuitBreaker_FailureThresholdExact(t *testing.T) {

     

       153
       153
       +
       	cb := newCircuitBreaker()

     

       154
       154
       +
       	provider := "exact-threshold-provider"

     

       155
       155
       +
       

     

       156
       156
       +
       	// Record failures just below threshold

     

       157
       157
       +
       	for i := 0; i < cb.failureThreshold-1; i++ {

     

       158
       158
       +
       		cb.recordFailure(provider, fmt.Errorf("error %d", i))

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	// Should still be closed

     

       162
       162
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       163
       163
       +
       	if !canAttempt {

     

       164
       164
       +
       		t.Errorf("Expected circuit to be closed below threshold, but got error: %v", err)

     

       165
       165
       +
       	}

     

       166
       166
       +
       

     

       167
       167
       +
       	// One more failure should open it

     

       168
       168
       +
       	cb.recordFailure(provider, fmt.Errorf("final error"))

     

       169
       169
       +
       

     

       170
       170
       +
       	// Should now be open

     

       171
       171
       +
       	canAttempt, _ = cb.canAttempt(provider)

     

       172
       172
       +
       	if canAttempt {

     

       173
       173
       +
       		t.Error("Expected circuit to be open at threshold")

     

       174
       174
       +
       	}

     

       175
       175
       +
       }

+202

internal/core/unfurl/kagi_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       func TestFetchKagiKite_Success(t *testing.T) {

     

       15
       15
       +
       	// Mock Kagi HTML response

     

       16
       16
       +
       	mockHTML := `<!DOCTYPE html>

     

       17
       17
       +
       <html>

     

       18
       18
       +
       <head>

     

       19
       19
       +
       	<title>FAA orders 10% flight cuts at 40 airports - Kagi News</title>

     

       20
       20
       +
       	<meta property="og:title" content="FAA orders 10% flight cuts" />

     

       21
       21
       +
       	<meta property="og:description" content="Flight restrictions announced" />

     

       22
       22
       +
       </head>

     

       23
       23
       +
       <body>

     

       24
       24
       +
       	<img src="https://kagiproxy.com/img/DHdCvN_NqVDWU3UyoNZSv86b" alt="Airport runway" />

     

       25
       25
       +
       </body>

     

       26
       26
       +
       </html>`

     

       27
       27
       +
       

     

       28
       28
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       29
       29
       +
       		w.Header().Set("Content-Type", "text/html")

     

       30
       30
       +
       		w.WriteHeader(http.StatusOK)

     

       31
       31
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       32
       32
       +
       	}))

     

       33
       33
       +
       	defer server.Close()

     

       34
       34
       +
       

     

       35
       35
       +
       	ctx := context.Background()

     

       36
       36
       +
       

     

       37
       37
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       38
       38
       +
       

     

       39
       39
       +
       	require.NoError(t, err)

     

       40
       40
       +
       	assert.Equal(t, "article", result.Type)

     

       41
       41
       +
       	assert.Equal(t, "FAA orders 10% flight cuts", result.Title)

     

       42
       42
       +
       	assert.Equal(t, "Flight restrictions announced", result.Description)

     

       43
       43
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       44
       44
       +
       	assert.Equal(t, "kagi", result.Provider)

     

       45
       45
       +
       	assert.Equal(t, "kite.kagi.com", result.Domain)

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       func TestFetchKagiKite_NoImage(t *testing.T) {

     

       49
       49
       +
       	mockHTML := `<!DOCTYPE html>

     

       50
       50
       +
       <html>

     

       51
       51
       +
       <head><title>Test Story</title></head>

     

       52
       52
       +
       <body><p>No images here</p></body>

     

       53
       53
       +
       </html>`

     

       54
       54
       +
       

     

       55
       55
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       56
       56
       +
       		w.Header().Set("Content-Type", "text/html")

     

       57
       57
       +
       		w.WriteHeader(http.StatusOK)

     

       58
       58
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       59
       59
       +
       	}))

     

       60
       60
       +
       	defer server.Close()

     

       61
       61
       +
       

     

       62
       62
       +
       	ctx := context.Background()

     

       63
       63
       +
       

     

       64
       64
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       65
       65
       +
       

     

       66
       66
       +
       	assert.Error(t, err)

     

       67
       67
       +
       	assert.Nil(t, result)

     

       68
       68
       +
       	assert.Contains(t, err.Error(), "no image found")

     

       69
       69
       +
       }

     

       70
       70
       +
       

     

       71
       71
       +
       func TestFetchKagiKite_FallbackToTitle(t *testing.T) {

     

       72
       72
       +
       	mockHTML := `<!DOCTYPE html>

     

       73
       73
       +
       <html>

     

       74
       74
       +
       <head><title>Fallback Title</title></head>

     

       75
       75
       +
       <body>

     

       76
       76
       +
       	<img src="https://kagiproxy.com/img/test123" />

     

       77
       77
       +
       </body>

     

       78
       78
       +
       </html>`

     

       79
       79
       +
       

     

       80
       80
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       81
       81
       +
       		w.Header().Set("Content-Type", "text/html")

     

       82
       82
       +
       		w.WriteHeader(http.StatusOK)

     

       83
       83
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       84
       84
       +
       	}))

     

       85
       85
       +
       	defer server.Close()

     

       86
       86
       +
       

     

       87
       87
       +
       	ctx := context.Background()

     

       88
       88
       +
       

     

       89
       89
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       90
       90
       +
       

     

       91
       91
       +
       	require.NoError(t, err)

     

       92
       92
       +
       	assert.Equal(t, "Fallback Title", result.Title)

     

       93
       93
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       94
       94
       +
       }

     

       95
       95
       +
       

     

       96
       96
       +
       func TestFetchKagiKite_ImageWithAltText(t *testing.T) {

     

       97
       97
       +
       	mockHTML := `<!DOCTYPE html>

     

       98
       98
       +
       <html>

     

       99
       99
       +
       <head><title>News Story</title></head>

     

       100
       100
       +
       <body>

     

       101
       101
       +
       	<img src="https://kagiproxy.com/img/xyz789" alt="This is the alt text description" />

     

       102
       102
       +
       </body>

     

       103
       103
       +
       </html>`

     

       104
       104
       +
       

     

       105
       105
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       106
       106
       +
       		w.Header().Set("Content-Type", "text/html")

     

       107
       107
       +
       		w.WriteHeader(http.StatusOK)

     

       108
       108
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       109
       109
       +
       	}))

     

       110
       110
       +
       	defer server.Close()

     

       111
       111
       +
       

     

       112
       112
       +
       	ctx := context.Background()

     

       113
       113
       +
       

     

       114
       114
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       115
       115
       +
       

     

       116
       116
       +
       	require.NoError(t, err)

     

       117
       117
       +
       	assert.Equal(t, "News Story", result.Title)

     

       118
       118
       +
       	assert.Equal(t, "This is the alt text description", result.Description)

     

       119
       119
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       120
       120
       +
       }

     

       121
       121
       +
       

     

       122
       122
       +
       func TestFetchKagiKite_HTTPError(t *testing.T) {

     

       123
       123
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       124
       124
       +
       		w.WriteHeader(http.StatusNotFound)

     

       125
       125
       +
       	}))

     

       126
       126
       +
       	defer server.Close()

     

       127
       127
       +
       

     

       128
       128
       +
       	ctx := context.Background()

     

       129
       129
       +
       

     

       130
       130
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       131
       131
       +
       

     

       132
       132
       +
       	assert.Error(t, err)

     

       133
       133
       +
       	assert.Nil(t, result)

     

       134
       134
       +
       	assert.Contains(t, err.Error(), "HTTP 404")

     

       135
       135
       +
       }

     

       136
       136
       +
       

     

       137
       137
       +
       func TestFetchKagiKite_Timeout(t *testing.T) {

     

       138
       138
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       139
       139
       +
       		time.Sleep(2 * time.Second)

     

       140
       140
       +
       		w.WriteHeader(http.StatusOK)

     

       141
       141
       +
       	}))

     

       142
       142
       +
       	defer server.Close()

     

       143
       143
       +
       

     

       144
       144
       +
       	ctx := context.Background()

     

       145
       145
       +
       

     

       146
       146
       +
       	result, err := fetchKagiKite(ctx, server.URL, 100*time.Millisecond, "TestBot/1.0")

     

       147
       147
       +
       

     

       148
       148
       +
       	assert.Error(t, err)

     

       149
       149
       +
       	assert.Nil(t, result)

     

       150
       150
       +
       }

     

       151
       151
       +
       

     

       152
       152
       +
       func TestFetchKagiKite_MultipleImages_PicksSecond(t *testing.T) {

     

       153
       153
       +
       	mockHTML := `<!DOCTYPE html>

     

       154
       154
       +
       <html>

     

       155
       155
       +
       <head><title>Story with multiple images</title></head>

     

       156
       156
       +
       <body>

     

       157
       157
       +
       	<img src="https://kagiproxy.com/img/first123" alt="First image (header/logo)" />

     

       158
       158
       +
       	<img src="https://kagiproxy.com/img/second456" alt="Second image" />

     

       159
       159
       +
       </body>

     

       160
       160
       +
       </html>`

     

       161
       161
       +
       

     

       162
       162
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       163
       163
       +
       		w.Header().Set("Content-Type", "text/html")

     

       164
       164
       +
       		w.WriteHeader(http.StatusOK)

     

       165
       165
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       166
       166
       +
       	}))

     

       167
       167
       +
       	defer server.Close()

     

       168
       168
       +
       

     

       169
       169
       +
       	ctx := context.Background()

     

       170
       170
       +
       

     

       171
       171
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       172
       172
       +
       

     

       173
       173
       +
       	require.NoError(t, err)

     

       174
       174
       +
       	// We skip the first image (often a header/logo) and use the second

     

       175
       175
       +
       	assert.Contains(t, result.ThumbnailURL, "second456")

     

       176
       176
       +
       	assert.Equal(t, "Second image", result.Description)

     

       177
       177
       +
       }

     

       178
       178
       +
       

     

       179
       179
       +
       func TestFetchKagiKite_OnlyNonKagiImages_NoMatch(t *testing.T) {

     

       180
       180
       +
       	mockHTML := `<!DOCTYPE html>

     

       181
       181
       +
       <html>

     

       182
       182
       +
       <head><title>Story with non-Kagi images</title></head>

     

       183
       183
       +
       <body>

     

       184
       184
       +
       	<img src="https://example.com/img/test.jpg" alt="External image" />

     

       185
       185
       +
       </body>

     

       186
       186
       +
       </html>`

     

       187
       187
       +
       

     

       188
       188
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       189
       189
       +
       		w.Header().Set("Content-Type", "text/html")

     

       190
       190
       +
       		w.WriteHeader(http.StatusOK)

     

       191
       191
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       192
       192
       +
       	}))

     

       193
       193
       +
       	defer server.Close()

     

       194
       194
       +
       

     

       195
       195
       +
       	ctx := context.Background()

     

       196
       196
       +
       

     

       197
       197
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       198
       198
       +
       

     

       199
       199
       +
       	assert.Error(t, err)

     

       200
       200
       +
       	assert.Nil(t, result)

     

       201
       201
       +
       	assert.Contains(t, err.Error(), "no image found")

     

       202
       202
       +
       }

+269

internal/core/unfurl/opengraph_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       func TestParseOpenGraph_ValidTags(t *testing.T) {

     

       15
       15
       +
       	html := `

     

       16
       16
       +
       <!DOCTYPE html>

     

       17
       17
       +
       <html>

     

       18
       18
       +
       <head>

     

       19
       19
       +
           <meta property="og:title" content="Test Article Title" />

     

       20
       20
       +
           <meta property="og:description" content="This is a test description" />

     

       21
       21
       +
           <meta property="og:image" content="https://example.com/image.jpg" />

     

       22
       22
       +
           <meta property="og:url" content="https://example.com/canonical" />

     

       23
       23
       +
       </head>

     

       24
       24
       +
       <body>

     

       25
       25
       +
           <p>Some content</p>

     

       26
       26
       +
       </body>

     

       27
       27
       +
       </html>

     

       28
       28
       +
       `

     

       29
       29
       +
       

     

       30
       30
       +
       	og, err := parseOpenGraph(html)

     

       31
       31
       +
       	require.NoError(t, err)

     

       32
       32
       +
       

     

       33
       33
       +
       	assert.Equal(t, "Test Article Title", og.Title)

     

       34
       34
       +
       	assert.Equal(t, "This is a test description", og.Description)

     

       35
       35
       +
       	assert.Equal(t, "https://example.com/image.jpg", og.Image)

     

       36
       36
       +
       	assert.Equal(t, "https://example.com/canonical", og.URL)

     

       37
       37
       +
       }

     

       38
       38
       +
       

     

       39
       39
       +
       func TestParseOpenGraph_MissingImage(t *testing.T) {

     

       40
       40
       +
       	html := `

     

       41
       41
       +
       <!DOCTYPE html>

     

       42
       42
       +
       <html>

     

       43
       43
       +
       <head>

     

       44
       44
       +
           <meta property="og:title" content="Article Without Image" />

     

       45
       45
       +
           <meta property="og:description" content="No image tag" />

     

       46
       46
       +
       </head>

     

       47
       47
       +
       <body></body>

     

       48
       48
       +
       </html>

     

       49
       49
       +
       `

     

       50
       50
       +
       

     

       51
       51
       +
       	og, err := parseOpenGraph(html)

     

       52
       52
       +
       	require.NoError(t, err)

     

       53
       53
       +
       

     

       54
       54
       +
       	assert.Equal(t, "Article Without Image", og.Title)

     

       55
       55
       +
       	assert.Equal(t, "No image tag", og.Description)

     

       56
       56
       +
       	assert.Empty(t, og.Image, "Image should be empty when not provided")

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       func TestParseOpenGraph_FallbackToTitle(t *testing.T) {

     

       60
       60
       +
       	html := `

     

       61
       61
       +
       <!DOCTYPE html>

     

       62
       62
       +
       <html>

     

       63
       63
       +
       <head>

     

       64
       64
       +
           <title>Page Title Fallback</title>

     

       65
       65
       +
           <meta name="description" content="Meta description fallback" />

     

       66
       66
       +
       </head>

     

       67
       67
       +
       <body></body>

     

       68
       68
       +
       </html>

     

       69
       69
       +
       `

     

       70
       70
       +
       

     

       71
       71
       +
       	og, err := parseOpenGraph(html)

     

       72
       72
       +
       	require.NoError(t, err)

     

       73
       73
       +
       

     

       74
       74
       +
       	assert.Equal(t, "Page Title Fallback", og.Title, "Should fall back to <title>")

     

       75
       75
       +
       	assert.Equal(t, "Meta description fallback", og.Description, "Should fall back to meta description")

     

       76
       76
       +
       }

     

       77
       77
       +
       

     

       78
       78
       +
       func TestParseOpenGraph_PreferOpenGraphOverFallback(t *testing.T) {

     

       79
       79
       +
       	html := `

     

       80
       80
       +
       <!DOCTYPE html>

     

       81
       81
       +
       <html>

     

       82
       82
       +
       <head>

     

       83
       83
       +
           <title>Page Title</title>

     

       84
       84
       +
           <meta name="description" content="Meta description" />

     

       85
       85
       +
           <meta property="og:title" content="OpenGraph Title" />

     

       86
       86
       +
           <meta property="og:description" content="OpenGraph Description" />

     

       87
       87
       +
       </head>

     

       88
       88
       +
       <body></body>

     

       89
       89
       +
       </html>

     

       90
       90
       +
       `

     

       91
       91
       +
       

     

       92
       92
       +
       	og, err := parseOpenGraph(html)

     

       93
       93
       +
       	require.NoError(t, err)

     

       94
       94
       +
       

     

       95
       95
       +
       	assert.Equal(t, "OpenGraph Title", og.Title, "Should prefer og:title")

     

       96
       96
       +
       	assert.Equal(t, "OpenGraph Description", og.Description, "Should prefer og:description")

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       func TestParseOpenGraph_MalformedHTML(t *testing.T) {

     

       100
       100
       +
       	html := `

     

       101
       101
       +
       <!DOCTYPE html>

     

       102
       102
       +
       <html>

     

       103
       103
       +
       <head>

     

       104
       104
       +
           <meta property="og:title" content="Still Works" />

     

       105
       105
       +
           <meta property="og:description" content="Even with broken tags

     

       106
       106
       +
       </head>

     

       107
       107
       +
       <body>

     

       108
       108
       +
           <p>Unclosed paragraph

     

       109
       109
       +
       </body>

     

       110
       110
       +
       `

     

       111
       111
       +
       

     

       112
       112
       +
       	og, err := parseOpenGraph(html)

     

       113
       113
       +
       	require.NoError(t, err)

     

       114
       114
       +
       

     

       115
       115
       +
       	// Best-effort parsing should still extract what it can

     

       116
       116
       +
       	assert.NotEmpty(t, og.Title, "Should extract title despite malformed HTML")

     

       117
       117
       +
       }

     

       118
       118
       +
       

     

       119
       119
       +
       func TestParseOpenGraph_Empty(t *testing.T) {

     

       120
       120
       +
       	html := `

     

       121
       121
       +
       <!DOCTYPE html>

     

       122
       122
       +
       <html>

     

       123
       123
       +
       <head></head>

     

       124
       124
       +
       <body></body>

     

       125
       125
       +
       </html>

     

       126
       126
       +
       `

     

       127
       127
       +
       

     

       128
       128
       +
       	og, err := parseOpenGraph(html)

     

       129
       129
       +
       	require.NoError(t, err)

     

       130
       130
       +
       

     

       131
       131
       +
       	assert.Empty(t, og.Title)

     

       132
       132
       +
       	assert.Empty(t, og.Description)

     

       133
       133
       +
       	assert.Empty(t, og.Image)

     

       134
       134
       +
       }

     

       135
       135
       +
       

     

       136
       136
       +
       func TestFetchOpenGraph_Success(t *testing.T) {

     

       137
       137
       +
       	// Create test server with OpenGraph metadata

     

       138
       138
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       139
       139
       +
       		assert.Contains(t, r.Header.Get("User-Agent"), "CovesBot")

     

       140
       140
       +
       

     

       141
       141
       +
       		html := `

     

       142
       142
       +
       <!DOCTYPE html>

     

       143
       143
       +
       <html>

     

       144
       144
       +
       <head>

     

       145
       145
       +
           <meta property="og:title" content="Test News Article" />

     

       146
       146
       +
           <meta property="og:description" content="Breaking news story" />

     

       147
       147
       +
           <meta property="og:image" content="https://example.com/news.jpg" />

     

       148
       148
       +
           <meta property="og:url" content="https://example.com/article/123" />

     

       149
       149
       +
       </head>

     

       150
       150
       +
       <body><p>Article content</p></body>

     

       151
       151
       +
       </html>

     

       152
       152
       +
       `

     

       153
       153
       +
       		w.Header().Set("Content-Type", "text/html")

     

       154
       154
       +
       		w.WriteHeader(http.StatusOK)

     

       155
       155
       +
       		_, _ = w.Write([]byte(html))

     

       156
       156
       +
       	}))

     

       157
       157
       +
       	defer server.Close()

     

       158
       158
       +
       

     

       159
       159
       +
       	ctx := context.Background()

     

       160
       160
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       161
       161
       +
       	require.NoError(t, err)

     

       162
       162
       +
       	require.NotNil(t, result)

     

       163
       163
       +
       

     

       164
       164
       +
       	assert.Equal(t, "Test News Article", result.Title)

     

       165
       165
       +
       	assert.Equal(t, "Breaking news story", result.Description)

     

       166
       166
       +
       	assert.Equal(t, "https://example.com/news.jpg", result.ThumbnailURL)

     

       167
       167
       +
       	assert.Equal(t, "article", result.Type)

     

       168
       168
       +
       	assert.Equal(t, "opengraph", result.Provider)

     

       169
       169
       +
       }

     

       170
       170
       +
       

     

       171
       171
       +
       func TestFetchOpenGraph_HTTPError(t *testing.T) {

     

       172
       172
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       173
       173
       +
       		w.WriteHeader(http.StatusNotFound)

     

       174
       174
       +
       	}))

     

       175
       175
       +
       	defer server.Close()

     

       176
       176
       +
       

     

       177
       177
       +
       	ctx := context.Background()

     

       178
       178
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       179
       179
       +
       	require.Error(t, err)

     

       180
       180
       +
       	assert.Nil(t, result)

     

       181
       181
       +
       	assert.Contains(t, err.Error(), "404")

     

       182
       182
       +
       }

     

       183
       183
       +
       

     

       184
       184
       +
       func TestFetchOpenGraph_Timeout(t *testing.T) {

     

       185
       185
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       186
       186
       +
       		time.Sleep(2 * time.Second)

     

       187
       187
       +
       		w.WriteHeader(http.StatusOK)

     

       188
       188
       +
       	}))

     

       189
       189
       +
       	defer server.Close()

     

       190
       190
       +
       

     

       191
       191
       +
       	ctx := context.Background()

     

       192
       192
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 100*time.Millisecond, "CovesBot/1.0")

     

       193
       193
       +
       	require.Error(t, err)

     

       194
       194
       +
       	assert.Nil(t, result)

     

       195
       195
       +
       }

     

       196
       196
       +
       

     

       197
       197
       +
       func TestFetchOpenGraph_NoMetadata(t *testing.T) {

     

       198
       198
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       199
       199
       +
       		html := `<html><head></head><body><p>No metadata</p></body></html>`

     

       200
       200
       +
       		w.Header().Set("Content-Type", "text/html")

     

       201
       201
       +
       		w.WriteHeader(http.StatusOK)

     

       202
       202
       +
       		_, _ = w.Write([]byte(html))

     

       203
       203
       +
       	}))

     

       204
       204
       +
       	defer server.Close()

     

       205
       205
       +
       

     

       206
       206
       +
       	ctx := context.Background()

     

       207
       207
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       208
       208
       +
       	require.NoError(t, err)

     

       209
       209
       +
       	require.NotNil(t, result)

     

       210
       210
       +
       

     

       211
       211
       +
       	// Should still return a result with domain

     

       212
       212
       +
       	assert.Equal(t, "article", result.Type)

     

       213
       213
       +
       	assert.Equal(t, "opengraph", result.Provider)

     

       214
       214
       +
       	assert.NotEmpty(t, result.Domain)

     

       215
       215
       +
       }

     

       216
       216
       +
       

     

       217
       217
       +
       func TestIsOEmbedProvider(t *testing.T) {

     

       218
       218
       +
       	tests := []struct {

     

       219
       219
       +
       		url      string

     

       220
       220
       +
       		expected bool

     

       221
       221
       +
       	}{

     

       222
       222
       +
       		{"https://streamable.com/abc123", true},

     

       223
       223
       +
       		{"https://www.youtube.com/watch?v=test", true},

     

       224
       224
       +
       		{"https://youtu.be/test", true},

     

       225
       225
       +
       		{"https://reddit.com/r/test/comments/123", true},

     

       226
       226
       +
       		{"https://www.reddit.com/r/test/comments/123", true},

     

       227
       227
       +
       		{"https://example.com/article", false},

     

       228
       228
       +
       		{"https://news.ycombinator.com/item?id=123", false},

     

       229
       229
       +
       		{"https://kite.kagi.com/search?q=test", false},

     

       230
       230
       +
       	}

     

       231
       231
       +
       

     

       232
       232
       +
       	for _, tt := range tests {

     

       233
       233
       +
       		t.Run(tt.url, func(t *testing.T) {

     

       234
       234
       +
       			result := isOEmbedProvider(tt.url)

     

       235
       235
       +
       			assert.Equal(t, tt.expected, result, "URL: %s", tt.url)

     

       236
       236
       +
       		})

     

       237
       237
       +
       	}

     

       238
       238
       +
       }

     

       239
       239
       +
       

     

       240
       240
       +
       func TestIsSupported(t *testing.T) {

     

       241
       241
       +
       	tests := []struct {

     

       242
       242
       +
       		url      string

     

       243
       243
       +
       		expected bool

     

       244
       244
       +
       	}{

     

       245
       245
       +
       		{"https://example.com", true},

     

       246
       246
       +
       		{"http://example.com", true},

     

       247
       247
       +
       		{"https://news.site.com/article", true},

     

       248
       248
       +
       		{"ftp://example.com", false},

     

       249
       249
       +
       		{"not-a-url", false},

     

       250
       250
       +
       		{"", false},

     

       251
       251
       +
       	}

     

       252
       252
       +
       

     

       253
       253
       +
       	for _, tt := range tests {

     

       254
       254
       +
       		t.Run(tt.url, func(t *testing.T) {

     

       255
       255
       +
       			result := isSupported(tt.url)

     

       256
       256
       +
       			assert.Equal(t, tt.expected, result, "URL: %s", tt.url)

     

       257
       257
       +
       		})

     

       258
       258
       +
       	}

     

       259
       259
       +
       }

     

       260
       260
       +
       

     

       261
       261
       +
       func TestGetAttr(t *testing.T) {

     

       262
       262
       +
       	html := `<meta property="og:title" content="Test Title" name="test" />`

     

       263
       263
       +
       	doc, err := parseOpenGraph(html)

     

       264
       264
       +
       	require.NoError(t, err)

     

       265
       265
       +
       

     

       266
       266
       +
       	// This is a simple test to verify the helper function works

     

       267
       267
       +
       	// The actual usage is tested in the parseOpenGraph tests

     

       268
       268
       +
       	assert.NotNil(t, doc)

     

       269
       269
       +
       }

+170

internal/core/unfurl/service.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"log"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // Service handles URL unfurling with caching

     

       11
       11
       +
       type Service interface {

     

       12
       12
       +
       	UnfurlURL(ctx context.Context, url string) (*UnfurlResult, error)

     

       13
       13
       +
       	IsSupported(url string) bool

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       type service struct {

     

       17
       17
       +
       	repo           Repository

     

       18
       18
       +
       	circuitBreaker *circuitBreaker

     

       19
       19
       +
       	userAgent      string

     

       20
       20
       +
       	timeout        time.Duration

     

       21
       21
       +
       	cacheTTL       time.Duration

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       // NewService creates a new unfurl service

     

       25
       25
       +
       func NewService(repo Repository, opts ...ServiceOption) Service {

     

       26
       26
       +
       	s := &service{

     

       27
       27
       +
       		repo:           repo,

     

       28
       28
       +
       		timeout:        10 * time.Second,

     

       29
       29
       +
       		userAgent:      "CovesBot/1.0 (+https://coves.social)",

     

       30
       30
       +
       		cacheTTL:       24 * time.Hour,

     

       31
       31
       +
       		circuitBreaker: newCircuitBreaker(),

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	for _, opt := range opts {

     

       35
       35
       +
       		opt(s)

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	return s

     

       39
       39
       +
       }

     

       40
       40
       +
       

     

       41
       41
       +
       // ServiceOption configures the service

     

       42
       42
       +
       type ServiceOption func(*service)

     

       43
       43
       +
       

     

       44
       44
       +
       // WithTimeout sets the HTTP timeout for oEmbed requests

     

       45
       45
       +
       func WithTimeout(timeout time.Duration) ServiceOption {

     

       46
       46
       +
       	return func(s *service) {

     

       47
       47
       +
       		s.timeout = timeout

     

       48
       48
       +
       	}

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       // WithUserAgent sets the User-Agent header for oEmbed requests

     

       52
       52
       +
       func WithUserAgent(userAgent string) ServiceOption {

     

       53
       53
       +
       	return func(s *service) {

     

       54
       54
       +
       		s.userAgent = userAgent

     

       55
       55
       +
       	}

     

       56
       56
       +
       }

     

       57
       57
       +
       

     

       58
       58
       +
       // WithCacheTTL sets the cache TTL

     

       59
       59
       +
       func WithCacheTTL(ttl time.Duration) ServiceOption {

     

       60
       60
       +
       	return func(s *service) {

     

       61
       61
       +
       		s.cacheTTL = ttl

     

       62
       62
       +
       	}

     

       63
       63
       +
       }

     

       64
       64
       +
       

     

       65
       65
       +
       // IsSupported returns true if we can unfurl this URL

     

       66
       66
       +
       func (s *service) IsSupported(url string) bool {

     

       67
       67
       +
       	return isSupported(url)

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       // UnfurlURL fetches metadata for a URL (with caching)

     

       71
       71
       +
       func (s *service) UnfurlURL(ctx context.Context, urlStr string) (*UnfurlResult, error) {

     

       72
       72
       +
       	// 1. Check cache first

     

       73
       73
       +
       	cached, err := s.repo.Get(ctx, urlStr)

     

       74
       74
       +
       	if err == nil && cached != nil {

     

       75
       75
       +
       		log.Printf("[UNFURL] Cache hit for %s (provider: %s)", urlStr, cached.Provider)

     

       76
       76
       +
       		return cached, nil

     

       77
       77
       +
       	}

     

       78
       78
       +
       

     

       79
       79
       +
       	// 2. Check if we support this URL

     

       80
       80
       +
       	if !isSupported(urlStr) {

     

       81
       81
       +
       		return nil, fmt.Errorf("unsupported URL: %s", urlStr)

     

       82
       82
       +
       	}

     

       83
       83
       +
       

     

       84
       84
       +
       	var result *UnfurlResult

     

       85
       85
       +
       	domain := extractDomain(urlStr)

     

       86
       86
       +
       

     

       87
       87
       +
       	// 3. Smart routing: Special handling for Kagi Kite (client-side rendered, no og:image tags)

     

       88
       88
       +
       	if domain == "kite.kagi.com" {

     

       89
       89
       +
       		provider := "kagi"

     

       90
       90
       +
       

     

       91
       91
       +
       		// Check circuit breaker

     

       92
       92
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       93
       93
       +
       		if !canAttempt {

     

       94
       94
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       95
       95
       +
       			return nil, err

     

       96
       96
       +
       		}

     

       97
       97
       +
       

     

       98
       98
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching via Kagi parser...", urlStr)

     

       99
       99
       +
       		result, err = fetchKagiKite(ctx, urlStr, s.timeout, s.userAgent)

     

       100
       100
       +
       		if err != nil {

     

       101
       101
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       102
       102
       +
       			return nil, err

     

       103
       103
       +
       		}

     

       104
       104
       +
       

     

       105
       105
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       106
       106
       +
       

     

       107
       107
       +
       		// Cache result

     

       108
       108
       +
       		if cacheErr := s.repo.Set(ctx, urlStr, result, s.cacheTTL); cacheErr != nil {

     

       109
       109
       +
       			log.Printf("[UNFURL] Warning: failed to cache result: %v", cacheErr)

     

       110
       110
       +
       		}

     

       111
       111
       +
       		return result, nil

     

       112
       112
       +
       	}

     

       113
       113
       +
       

     

       114
       114
       +
       	// 4. Check if this is a known oEmbed provider

     

       115
       115
       +
       	if isOEmbedProvider(urlStr) {

     

       116
       116
       +
       		provider := domain // Use domain as provider name (e.g., "streamable.com", "youtube.com")

     

       117
       117
       +
       

     

       118
       118
       +
       		// Check circuit breaker

     

       119
       119
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       120
       120
       +
       		if !canAttempt {

     

       121
       121
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       122
       122
       +
       			return nil, err

     

       123
       123
       +
       		}

     

       124
       124
       +
       

     

       125
       125
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching from oEmbed...", urlStr)

     

       126
       126
       +
       

     

       127
       127
       +
       		// Fetch from oEmbed provider

     

       128
       128
       +
       		oembed, err := fetchOEmbed(ctx, urlStr, s.timeout, s.userAgent)

     

       129
       129
       +
       		if err != nil {

     

       130
       130
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       131
       131
       +
       			return nil, fmt.Errorf("failed to fetch oEmbed data: %w", err)

     

       132
       132
       +
       		}

     

       133
       133
       +
       

     

       134
       134
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       135
       135
       +
       

     

       136
       136
       +
       		// Convert to UnfurlResult

     

       137
       137
       +
       		result = mapOEmbedToResult(oembed, urlStr)

     

       138
       138
       +
       	} else {

     

       139
       139
       +
       		provider := "opengraph"

     

       140
       140
       +
       

     

       141
       141
       +
       		// Check circuit breaker

     

       142
       142
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       143
       143
       +
       		if !canAttempt {

     

       144
       144
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       145
       145
       +
       			return nil, err

     

       146
       146
       +
       		}

     

       147
       147
       +
       

     

       148
       148
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching via OpenGraph...", urlStr)

     

       149
       149
       +
       

     

       150
       150
       +
       		// Fetch via OpenGraph

     

       151
       151
       +
       		result, err = fetchOpenGraph(ctx, urlStr, s.timeout, s.userAgent)

     

       152
       152
       +
       		if err != nil {

     

       153
       153
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       154
       154
       +
       			return nil, fmt.Errorf("failed to fetch OpenGraph data: %w", err)

     

       155
       155
       +
       		}

     

       156
       156
       +
       

     

       157
       157
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       158
       158
       +
       	}

     

       159
       159
       +
       

     

       160
       160
       +
       	// 5. Store in cache

     

       161
       161
       +
       	if cacheErr := s.repo.Set(ctx, urlStr, result, s.cacheTTL); cacheErr != nil {

     

       162
       162
       +
       		// Log but don't fail - cache is best-effort

     

       163
       163
       +
       		log.Printf("[UNFURL] Warning: Failed to cache result for %s: %v", urlStr, cacheErr)

     

       164
       164
       +
       	}

     

       165
       165
       +
       

     

       166
       166
       +
       	log.Printf("[UNFURL] Successfully unfurled %s (provider: %s, type: %s)",

     

       167
       167
       +
       		urlStr, result.Provider, result.Type)

     

       168
       168
       +
       

     

       169
       169
       +
       	return result, nil

     

       170
       170
       +
       }

+27

internal/core/unfurl/types.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import "time"

     

       4
       4
       +
       

     

       5
       5
       +
       // UnfurlResult represents the result of unfurling a URL

     

       6
       6
       +
       type UnfurlResult struct {

     

       7
       7
       +
       	Type         string `json:"type"`         // "video", "article", "image", "website"

     

       8
       8
       +
       	URI          string `json:"uri"`          // Original URL

     

       9
       9
       +
       	Title        string `json:"title"`        // Page/video title

     

       10
       10
       +
       	Description  string `json:"description"`  // Page/video description

     

       11
       11
       +
       	ThumbnailURL string `json:"thumbnailUrl"` // Preview image URL

     

       12
       12
       +
       	Provider     string `json:"provider"`     // "streamable", "youtube", "reddit"

     

       13
       13
       +
       	Domain       string `json:"domain"`       // Domain of the URL

     

       14
       14
       +
       	Width        int    `json:"width"`        // Media width (if applicable)

     

       15
       15
       +
       	Height       int    `json:"height"`       // Media height (if applicable)

     

       16
       16
       +
       }

     

       17
       17
       +
       

     

       18
       18
       +
       // CacheEntry represents a cached unfurl result with metadata

     

       19
       19
       +
       type CacheEntry struct {

     

       20
       20
       +
       	FetchedAt    time.Time    `db:"fetched_at"`

     

       21
       21
       +
       	ExpiresAt    time.Time    `db:"expires_at"`

     

       22
       22
       +
       	CreatedAt    time.Time    `db:"created_at"`

     

       23
       23
       +
       	ThumbnailURL *string      `db:"thumbnail_url"`

     

       24
       24
       +
       	URL          string       `db:"url"`

     

       25
       25
       +
       	Provider     string       `db:"provider"`

     

       26
       26
       +
       	Metadata     UnfurlResult `db:"metadata"`

     

       27
       27
       +
       }

+14

internal/core/unfurl/errors.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import "errors"

     

       4
       4
       +
       

     

       5
       5
       +
       var (

     

       6
       6
       +
       	// ErrNotFound is returned when an unfurl cache entry is not found or has expired

     

       7
       7
       +
       	ErrNotFound = errors.New("unfurl cache entry not found or expired")

     

       8
       8
       +
       

     

       9
       9
       +
       	// ErrInvalidURL is returned when the provided URL is invalid

     

       10
       10
       +
       	ErrInvalidURL = errors.New("invalid URL")

     

       11
       11
       +
       

     

       12
       12
       +
       	// ErrInvalidTTL is returned when the provided TTL is invalid (e.g., negative or zero)

     

       13
       13
       +
       	ErrInvalidTTL = errors.New("invalid TTL: must be positive")

     

       14
       14
       +
       )

+19

internal/core/unfurl/interfaces.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       // Repository defines the interface for unfurl cache persistence

     

       9
       9
       +
       type Repository interface {

     

       10
       10
       +
       	// Get retrieves a cached unfurl result for the given URL.

     

       11
       11
       +
       	// Returns nil, nil if not found or expired (not an error condition).

     

       12
       12
       +
       	// Returns error only on database failures.

     

       13
       13
       +
       	Get(ctx context.Context, url string) (*UnfurlResult, error)

     

       14
       14
       +
       

     

       15
       15
       +
       	// Set stores an unfurl result in the cache with the specified TTL.

     

       16
       16
       +
       	// If an entry already exists for the URL, it will be updated.

     

       17
       17
       +
       	// The expires_at is calculated as NOW() + ttl.

     

       18
       18
       +
       	Set(ctx context.Context, url string, result *UnfurlResult, ttl time.Duration) error

     

       19
       19
       +
       }

+117

internal/core/unfurl/repository.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"fmt"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       type postgresUnfurlRepo struct {

     

       12
       12
       +
       	db *sql.DB

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       // NewRepository creates a new PostgreSQL unfurl cache repository

     

       16
       16
       +
       func NewRepository(db *sql.DB) Repository {

     

       17
       17
       +
       	return &postgresUnfurlRepo{db: db}

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // Get retrieves a cached unfurl result for the given URL.

     

       21
       21
       +
       // Returns nil, nil if not found or expired (not an error condition).

     

       22
       22
       +
       // Returns error only on database failures.

     

       23
       23
       +
       func (r *postgresUnfurlRepo) Get(ctx context.Context, url string) (*UnfurlResult, error) {

     

       24
       24
       +
       	query := `

     

       25
       25
       +
       		SELECT metadata, thumbnail_url, provider

     

       26
       26
       +
       		FROM unfurl_cache

     

       27
       27
       +
       		WHERE url = $1 AND expires_at > NOW()

     

       28
       28
       +
       	`

     

       29
       29
       +
       

     

       30
       30
       +
       	var metadataJSON []byte

     

       31
       31
       +
       	var thumbnailURL sql.NullString

     

       32
       32
       +
       	var provider string

     

       33
       33
       +
       

     

       34
       34
       +
       	err := r.db.QueryRowContext(ctx, query, url).Scan(&metadataJSON, &thumbnailURL, &provider)

     

       35
       35
       +
       	if err == sql.ErrNoRows {

     

       36
       36
       +
       		// Not found or expired is not an error

     

       37
       37
       +
       		return nil, nil

     

       38
       38
       +
       	}

     

       39
       39
       +
       	if err != nil {

     

       40
       40
       +
       		return nil, fmt.Errorf("failed to get unfurl cache entry: %w", err)

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// Unmarshal metadata JSONB to UnfurlResult

     

       44
       44
       +
       	var result UnfurlResult

     

       45
       45
       +
       	if err := json.Unmarshal(metadataJSON, &result); err != nil {

     

       46
       46
       +
       		return nil, fmt.Errorf("failed to unmarshal metadata: %w", err)

     

       47
       47
       +
       	}

     

       48
       48
       +
       

     

       49
       49
       +
       	// Ensure provider and thumbnailURL are set (may not be in metadata JSON)

     

       50
       50
       +
       	result.Provider = provider

     

       51
       51
       +
       	if thumbnailURL.Valid {

     

       52
       52
       +
       		result.ThumbnailURL = thumbnailURL.String

     

       53
       53
       +
       	}

     

       54
       54
       +
       

     

       55
       55
       +
       	return &result, nil

     

       56
       56
       +
       }

     

       57
       57
       +
       

     

       58
       58
       +
       // Set stores an unfurl result in the cache with the specified TTL.

     

       59
       59
       +
       // If an entry already exists for the URL, it will be updated.

     

       60
       60
       +
       // The expires_at is calculated as NOW() + ttl.

     

       61
       61
       +
       func (r *postgresUnfurlRepo) Set(ctx context.Context, url string, result *UnfurlResult, ttl time.Duration) error {

     

       62
       62
       +
       	// Marshal UnfurlResult to JSON for metadata column

     

       63
       63
       +
       	metadataJSON, err := json.Marshal(result)

     

       64
       64
       +
       	if err != nil {

     

       65
       65
       +
       		return fmt.Errorf("failed to marshal metadata: %w", err)

     

       66
       66
       +
       	}

     

       67
       67
       +
       

     

       68
       68
       +
       	// Store thumbnail_url separately for potential queries

     

       69
       69
       +
       	var thumbnailURL sql.NullString

     

       70
       70
       +
       	if result.ThumbnailURL != "" {

     

       71
       71
       +
       		thumbnailURL.String = result.ThumbnailURL

     

       72
       72
       +
       		thumbnailURL.Valid = true

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Convert Go duration to PostgreSQL interval string

     

       76
       76
       +
       	// e.g., "1 hour", "24 hours", "7 days"

     

       77
       77
       +
       	intervalStr := formatInterval(ttl)

     

       78
       78
       +
       

     

       79
       79
       +
       	query := `

     

       80
       80
       +
       		INSERT INTO unfurl_cache (url, provider, metadata, thumbnail_url, expires_at)

     

       81
       81
       +
       		VALUES ($1, $2, $3, $4, NOW() + $5::interval)

     

       82
       82
       +
       		ON CONFLICT (url) DO UPDATE

     

       83
       83
       +
       		SET provider = EXCLUDED.provider,

     

       84
       84
       +
       		    metadata = EXCLUDED.metadata,

     

       85
       85
       +
       		    thumbnail_url = EXCLUDED.thumbnail_url,

     

       86
       86
       +
       		    expires_at = EXCLUDED.expires_at,

     

       87
       87
       +
       		    fetched_at = NOW()

     

       88
       88
       +
       	`

     

       89
       89
       +
       

     

       90
       90
       +
       	_, err = r.db.ExecContext(ctx, query, url, result.Provider, metadataJSON, thumbnailURL, intervalStr)

     

       91
       91
       +
       	if err != nil {

     

       92
       92
       +
       		return fmt.Errorf("failed to insert/update unfurl cache entry: %w", err)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	return nil

     

       96
       96
       +
       }

     

       97
       97
       +
       

     

       98
       98
       +
       // formatInterval converts a Go duration to a PostgreSQL interval string

     

       99
       99
       +
       // PostgreSQL accepts intervals like "1 hour", "24 hours", "7 days"

     

       100
       100
       +
       func formatInterval(d time.Duration) string {

     

       101
       101
       +
       	seconds := int64(d.Seconds())

     

       102
       102
       +
       

     

       103
       103
       +
       	// Convert to appropriate unit for readability

     

       104
       104
       +
       	switch {

     

       105
       105
       +
       	case seconds >= 86400: // >= 1 day

     

       106
       106
       +
       		days := seconds / 86400

     

       107
       107
       +
       		return fmt.Sprintf("%d days", days)

     

       108
       108
       +
       	case seconds >= 3600: // >= 1 hour

     

       109
       109
       +
       		hours := seconds / 3600

     

       110
       110
       +
       		return fmt.Sprintf("%d hours", hours)

     

       111
       111
       +
       	case seconds >= 60: // >= 1 minute

     

       112
       112
       +
       		minutes := seconds / 60

     

       113
       113
       +
       		return fmt.Sprintf("%d minutes", minutes)

     

       114
       114
       +
       	default:

     

       115
       115
       +
       		return fmt.Sprintf("%d seconds", seconds)

     

       116
       116
       +
       	}

     

       117
       117
       +
       }

+23

internal/db/migrations/017_create_unfurl_cache.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       CREATE TABLE unfurl_cache (

     

       3
       3
       +
           url TEXT PRIMARY KEY,

     

       4
       4
       +
           provider TEXT NOT NULL,

     

       5
       5
       +
           metadata JSONB NOT NULL,

     

       6
       6
       +
           thumbnail_url TEXT,

     

       7
       7
       +
           fetched_at TIMESTAMP NOT NULL DEFAULT NOW(),

     

       8
       8
       +
           expires_at TIMESTAMP NOT NULL,

     

       9
       9
       +
           created_at TIMESTAMP NOT NULL DEFAULT NOW()

     

       10
       10
       +
       );

     

       11
       11
       +
       

     

       12
       12
       +
       CREATE INDEX idx_unfurl_cache_expires ON unfurl_cache(expires_at);

     

       13
       13
       +
       

     

       14
       14
       +
       COMMENT ON TABLE unfurl_cache IS 'Cache for oEmbed/URL unfurl results to reduce external API calls';

     

       15
       15
       +
       COMMENT ON COLUMN unfurl_cache.url IS 'The URL that was unfurled (primary key)';

     

       16
       16
       +
       COMMENT ON COLUMN unfurl_cache.provider IS 'Provider name (streamable, youtube, reddit, etc.)';

     

       17
       17
       +
       COMMENT ON COLUMN unfurl_cache.metadata IS 'Full unfurl result as JSON (title, description, type, etc.)';

     

       18
       18
       +
       COMMENT ON COLUMN unfurl_cache.thumbnail_url IS 'URL of the thumbnail image';

     

       19
       19
       +
       COMMENT ON COLUMN unfurl_cache.expires_at IS 'When this cache entry should be refetched (TTL-based)';

     

       20
       20
       +
       

     

       21
       21
       +
       -- +goose Down

     

       22
       22
       +
       DROP INDEX IF EXISTS idx_unfurl_cache_expires;

     

       23
       23
       +
       DROP TABLE IF EXISTS unfurl_cache;

+9

internal/core/blobs/types.go

···

       1
       1
       +
       package blobs

     

       2
       2
       +
       

     

       3
       3
       +
       // BlobRef represents a blob reference for atproto records

     

       4
       4
       +
       type BlobRef struct {

     

       5
       5
       +
       	Type     string            `json:"$type"`

     

       6
       6
       +
       	Ref      map[string]string `json:"ref"`

     

       7
       7
       +
       	MimeType string            `json:"mimeType"`

     

       8
       8
       +
       	Size     int               `json:"size"`

     

       9
       9
       +
       }

+7 -1

internal/core/posts/interfaces.go

···

       1
       1
        
       package posts

     

       2
       2
        
       

     

       3
       3
       -
       import "context"

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       )

     

       6
       6
       +
       

     

       7
       7
       +
       // Service constructor accepts optional blobs.Service and unfurl.Service for embed enhancement.

     

       8
       8
       +
       // When unfurlService is provided, external embeds will be automatically enriched with metadata.

     

       9
       9
       +
       // When blobService is provided, thumbnails from unfurled URLs will be uploaded as blobs.

     

       4
       10
        
       

     

       5
       11
        
       // Service defines the business logic interface for posts

     

       6
       12
        
       // Coordinates between Repository, community service, and PDS

+81

internal/core/posts/blob_transform.go

···

       1
       1
       +
       package posts

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       )

     

       6
       6
       +
       

     

       7
       7
       +
       // TransformBlobRefsToURLs transforms all blob references in a PostView to PDS URLs

     

       8
       8
       +
       // This modifies the Embed field in-place, converting blob refs to direct URLs

     

       9
       9
       +
       // The transformation only affects external embeds with thumbnail blobs

     

       10
       10
       +
       func TransformBlobRefsToURLs(postView *PostView) {

     

       11
       11
       +
       	if postView == nil || postView.Embed == nil {

     

       12
       12
       +
       		return

     

       13
       13
       +
       	}

     

       14
       14
       +
       

     

       15
       15
       +
       	// Get community PDS URL from post view

     

       16
       16
       +
       	if postView.Community == nil || postView.Community.PDSURL == "" {

     

       17
       17
       +
       		return // Cannot transform without PDS URL

     

       18
       18
       +
       	}

     

       19
       19
       +
       

     

       20
       20
       +
       	communityDID := postView.Community.DID

     

       21
       21
       +
       	pdsURL := postView.Community.PDSURL

     

       22
       22
       +
       

     

       23
       23
       +
       	// Check if embed is a map (should be for external embeds)

     

       24
       24
       +
       	embedMap, ok := postView.Embed.(map[string]interface{})

     

       25
       25
       +
       	if !ok {

     

       26
       26
       +
       		return

     

       27
       27
       +
       	}

     

       28
       28
       +
       

     

       29
       29
       +
       	// Check embed type

     

       30
       30
       +
       	embedType, ok := embedMap["$type"].(string)

     

       31
       31
       +
       	if !ok {

     

       32
       32
       +
       		return

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	// Only transform external embeds

     

       36
       36
       +
       	if embedType == "social.coves.embed.external" {

     

       37
       37
       +
       		if external, ok := embedMap["external"].(map[string]interface{}); ok {

     

       38
       38
       +
       			transformThumbToURL(external, communityDID, pdsURL)

     

       39
       39
       +
       		}

     

       40
       40
       +
       	}

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       // transformThumbToURL converts a thumb blob ref to a PDS URL

     

       44
       44
       +
       // This modifies the external map in-place

     

       45
       45
       +
       func transformThumbToURL(external map[string]interface{}, communityDID, pdsURL string) {

     

       46
       46
       +
       	// Check if thumb exists

     

       47
       47
       +
       	thumb, ok := external["thumb"]

     

       48
       48
       +
       	if !ok {

     

       49
       49
       +
       		return

     

       50
       50
       +
       	}

     

       51
       51
       +
       

     

       52
       52
       +
       	// If thumb is already a string (URL), don't transform

     

       53
       53
       +
       	if _, isString := thumb.(string); isString {

     

       54
       54
       +
       		return

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	// Try to parse as blob ref

     

       58
       58
       +
       	thumbMap, ok := thumb.(map[string]interface{})

     

       59
       59
       +
       	if !ok {

     

       60
       60
       +
       		return

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Extract CID from blob ref

     

       64
       64
       +
       	ref, ok := thumbMap["ref"].(map[string]interface{})

     

       65
       65
       +
       	if !ok {

     

       66
       66
       +
       		return

     

       67
       67
       +
       	}

     

       68
       68
       +
       

     

       69
       69
       +
       	cid, ok := ref["$link"].(string)

     

       70
       70
       +
       	if !ok || cid == "" {

     

       71
       71
       +
       		return

     

       72
       72
       +
       	}

     

       73
       73
       +
       

     

       74
       74
       +
       	// Transform to PDS blob endpoint URL

     

       75
       75
       +
       	// Format: {pds_url}/xrpc/com.atproto.sync.getBlob?did={community_did}&cid={cid}

     

       76
       76
       +
       	blobURL := fmt.Sprintf("%s/xrpc/com.atproto.sync.getBlob?did=%s&cid=%s",

     

       77
       77
       +
       		pdsURL, communityDID, cid)

     

       78
       78
       +
       

     

       79
       79
       +
       	// Replace blob ref with URL string

     

       80
       80
       +
       	external["thumb"] = blobURL

     

       81
       81
       +
       }

+312

internal/core/posts/blob_transform_test.go

···

       1
       1
       +
       package posts

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"testing"

     

       5
       5
       +
       

     

       6
       6
       +
       	"github.com/stretchr/testify/assert"

     

       7
       7
       +
       	"github.com/stretchr/testify/require"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       func TestTransformBlobRefsToURLs(t *testing.T) {

     

       11
       11
       +
       	t.Run("transforms external embed thumb from blob to URL", func(t *testing.T) {

     

       12
       12
       +
       		post := &PostView{

     

       13
       13
       +
       			Community: &CommunityRef{

     

       14
       14
       +
       				DID:    "did:plc:testcommunity",

     

       15
       15
       +
       				PDSURL: "http://localhost:3001",

     

       16
       16
       +
       			},

     

       17
       17
       +
       			Embed: map[string]interface{}{

     

       18
       18
       +
       				"$type": "social.coves.embed.external",

     

       19
       19
       +
       				"external": map[string]interface{}{

     

       20
       20
       +
       					"uri": "https://example.com",

     

       21
       21
       +
       					"thumb": map[string]interface{}{

     

       22
       22
       +
       						"$type": "blob",

     

       23
       23
       +
       						"ref": map[string]interface{}{

     

       24
       24
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       25
       25
       +
       						},

     

       26
       26
       +
       						"mimeType": "image/jpeg",

     

       27
       27
       +
       						"size":     52813,

     

       28
       28
       +
       					},

     

       29
       29
       +
       				},

     

       30
       30
       +
       			},

     

       31
       31
       +
       		}

     

       32
       32
       +
       

     

       33
       33
       +
       		TransformBlobRefsToURLs(post)

     

       34
       34
       +
       

     

       35
       35
       +
       		// Verify embed is still a map

     

       36
       36
       +
       		embedMap, ok := post.Embed.(map[string]interface{})

     

       37
       37
       +
       		require.True(t, ok, "embed should still be a map")

     

       38
       38
       +
       

     

       39
       39
       +
       		// Verify external is still a map

     

       40
       40
       +
       		external, ok := embedMap["external"].(map[string]interface{})

     

       41
       41
       +
       		require.True(t, ok, "external should be a map")

     

       42
       42
       +
       

     

       43
       43
       +
       		// Verify thumb is now a URL string

     

       44
       44
       +
       		thumbURL, ok := external["thumb"].(string)

     

       45
       45
       +
       		require.True(t, ok, "thumb should be a string URL")

     

       46
       46
       +
       		assert.Equal(t,

     

       47
       47
       +
       			"http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:testcommunity&cid=bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       48
       48
       +
       			thumbURL)

     

       49
       49
       +
       	})

     

       50
       50
       +
       

     

       51
       51
       +
       	t.Run("handles missing thumb gracefully", func(t *testing.T) {

     

       52
       52
       +
       		post := &PostView{

     

       53
       53
       +
       			Community: &CommunityRef{

     

       54
       54
       +
       				DID:    "did:plc:testcommunity",

     

       55
       55
       +
       				PDSURL: "http://localhost:3001",

     

       56
       56
       +
       			},

     

       57
       57
       +
       			Embed: map[string]interface{}{

     

       58
       58
       +
       				"$type": "social.coves.embed.external",

     

       59
       59
       +
       				"external": map[string]interface{}{

     

       60
       60
       +
       					"uri": "https://example.com",

     

       61
       61
       +
       					// No thumb field

     

       62
       62
       +
       				},

     

       63
       63
       +
       			},

     

       64
       64
       +
       		}

     

       65
       65
       +
       

     

       66
       66
       +
       		// Should not panic

     

       67
       67
       +
       		TransformBlobRefsToURLs(post)

     

       68
       68
       +
       

     

       69
       69
       +
       		// Verify external is unchanged

     

       70
       70
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       71
       71
       +
       		external := embedMap["external"].(map[string]interface{})

     

       72
       72
       +
       		_, hasThumb := external["thumb"]

     

       73
       73
       +
       		assert.False(t, hasThumb, "thumb should not be added")

     

       74
       74
       +
       	})

     

       75
       75
       +
       

     

       76
       76
       +
       	t.Run("handles already-transformed URL thumb", func(t *testing.T) {

     

       77
       77
       +
       		expectedURL := "http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafytest"

     

       78
       78
       +
       		post := &PostView{

     

       79
       79
       +
       			Community: &CommunityRef{

     

       80
       80
       +
       				DID:    "did:plc:testcommunity",

     

       81
       81
       +
       				PDSURL: "http://localhost:3001",

     

       82
       82
       +
       			},

     

       83
       83
       +
       			Embed: map[string]interface{}{

     

       84
       84
       +
       				"$type": "social.coves.embed.external",

     

       85
       85
       +
       				"external": map[string]interface{}{

     

       86
       86
       +
       					"uri":   "https://example.com",

     

       87
       87
       +
       					"thumb": expectedURL, // Already a URL string

     

       88
       88
       +
       				},

     

       89
       89
       +
       			},

     

       90
       90
       +
       		}

     

       91
       91
       +
       

     

       92
       92
       +
       		// Should not error or change the URL

     

       93
       93
       +
       		TransformBlobRefsToURLs(post)

     

       94
       94
       +
       

     

       95
       95
       +
       		// Verify thumb is unchanged

     

       96
       96
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       97
       97
       +
       		external := embedMap["external"].(map[string]interface{})

     

       98
       98
       +
       		thumbURL, ok := external["thumb"].(string)

     

       99
       99
       +
       		require.True(t, ok, "thumb should still be a string")

     

       100
       100
       +
       		assert.Equal(t, expectedURL, thumbURL, "thumb URL should be unchanged")

     

       101
       101
       +
       	})

     

       102
       102
       +
       

     

       103
       103
       +
       	t.Run("handles missing embed", func(t *testing.T) {

     

       104
       104
       +
       		post := &PostView{

     

       105
       105
       +
       			Community: &CommunityRef{

     

       106
       106
       +
       				DID:    "did:plc:testcommunity",

     

       107
       107
       +
       				PDSURL: "http://localhost:3001",

     

       108
       108
       +
       			},

     

       109
       109
       +
       			Embed: nil,

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       112
       112
       +
       		// Should not panic

     

       113
       113
       +
       		TransformBlobRefsToURLs(post)

     

       114
       114
       +
       

     

       115
       115
       +
       		// Verify embed is still nil

     

       116
       116
       +
       		assert.Nil(t, post.Embed, "embed should remain nil")

     

       117
       117
       +
       	})

     

       118
       118
       +
       

     

       119
       119
       +
       	t.Run("handles nil post", func(t *testing.T) {

     

       120
       120
       +
       		// Should not panic

     

       121
       121
       +
       		TransformBlobRefsToURLs(nil)

     

       122
       122
       +
       	})

     

       123
       123
       +
       

     

       124
       124
       +
       	t.Run("handles missing community", func(t *testing.T) {

     

       125
       125
       +
       		post := &PostView{

     

       126
       126
       +
       			Community: nil,

     

       127
       127
       +
       			Embed: map[string]interface{}{

     

       128
       128
       +
       				"$type": "social.coves.embed.external",

     

       129
       129
       +
       				"external": map[string]interface{}{

     

       130
       130
       +
       					"uri": "https://example.com",

     

       131
       131
       +
       					"thumb": map[string]interface{}{

     

       132
       132
       +
       						"$type": "blob",

     

       133
       133
       +
       						"ref": map[string]interface{}{

     

       134
       134
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       135
       135
       +
       						},

     

       136
       136
       +
       					},

     

       137
       137
       +
       				},

     

       138
       138
       +
       			},

     

       139
       139
       +
       		}

     

       140
       140
       +
       

     

       141
       141
       +
       		// Should not panic or transform

     

       142
       142
       +
       		TransformBlobRefsToURLs(post)

     

       143
       143
       +
       

     

       144
       144
       +
       		// Verify thumb is unchanged (still a blob)

     

       145
       145
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       146
       146
       +
       		external := embedMap["external"].(map[string]interface{})

     

       147
       147
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       148
       148
       +
       		require.True(t, ok, "thumb should still be a map (blob ref)")

     

       149
       149
       +
       		assert.Equal(t, "blob", thumb["$type"], "blob type should be unchanged")

     

       150
       150
       +
       	})

     

       151
       151
       +
       

     

       152
       152
       +
       	t.Run("handles missing PDS URL", func(t *testing.T) {

     

       153
       153
       +
       		post := &PostView{

     

       154
       154
       +
       			Community: &CommunityRef{

     

       155
       155
       +
       				DID:    "did:plc:testcommunity",

     

       156
       156
       +
       				PDSURL: "", // Empty PDS URL

     

       157
       157
       +
       			},

     

       158
       158
       +
       			Embed: map[string]interface{}{

     

       159
       159
       +
       				"$type": "social.coves.embed.external",

     

       160
       160
       +
       				"external": map[string]interface{}{

     

       161
       161
       +
       					"uri": "https://example.com",

     

       162
       162
       +
       					"thumb": map[string]interface{}{

     

       163
       163
       +
       						"$type": "blob",

     

       164
       164
       +
       						"ref": map[string]interface{}{

     

       165
       165
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       166
       166
       +
       						},

     

       167
       167
       +
       					},

     

       168
       168
       +
       				},

     

       169
       169
       +
       			},

     

       170
       170
       +
       		}

     

       171
       171
       +
       

     

       172
       172
       +
       		// Should not panic or transform

     

       173
       173
       +
       		TransformBlobRefsToURLs(post)

     

       174
       174
       +
       

     

       175
       175
       +
       		// Verify thumb is unchanged (still a blob)

     

       176
       176
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       177
       177
       +
       		external := embedMap["external"].(map[string]interface{})

     

       178
       178
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       179
       179
       +
       		require.True(t, ok, "thumb should still be a map (blob ref)")

     

       180
       180
       +
       		assert.Equal(t, "blob", thumb["$type"], "blob type should be unchanged")

     

       181
       181
       +
       	})

     

       182
       182
       +
       

     

       183
       183
       +
       	t.Run("handles malformed blob ref gracefully", func(t *testing.T) {

     

       184
       184
       +
       		post := &PostView{

     

       185
       185
       +
       			Community: &CommunityRef{

     

       186
       186
       +
       				DID:    "did:plc:testcommunity",

     

       187
       187
       +
       				PDSURL: "http://localhost:3001",

     

       188
       188
       +
       			},

     

       189
       189
       +
       			Embed: map[string]interface{}{

     

       190
       190
       +
       				"$type": "social.coves.embed.external",

     

       191
       191
       +
       				"external": map[string]interface{}{

     

       192
       192
       +
       					"uri": "https://example.com",

     

       193
       193
       +
       					"thumb": map[string]interface{}{

     

       194
       194
       +
       						"$type": "blob",

     

       195
       195
       +
       						"ref":   "invalid-ref-format", // Should be a map with $link

     

       196
       196
       +
       					},

     

       197
       197
       +
       				},

     

       198
       198
       +
       			},

     

       199
       199
       +
       		}

     

       200
       200
       +
       

     

       201
       201
       +
       		// Should not panic

     

       202
       202
       +
       		TransformBlobRefsToURLs(post)

     

       203
       203
       +
       

     

       204
       204
       +
       		// Verify thumb is unchanged (malformed blob)

     

       205
       205
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       206
       206
       +
       		external := embedMap["external"].(map[string]interface{})

     

       207
       207
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       208
       208
       +
       		require.True(t, ok, "thumb should still be a map")

     

       209
       209
       +
       		assert.Equal(t, "invalid-ref-format", thumb["ref"], "malformed ref should be unchanged")

     

       210
       210
       +
       	})

     

       211
       211
       +
       

     

       212
       212
       +
       	t.Run("ignores non-external embed types", func(t *testing.T) {

     

       213
       213
       +
       		post := &PostView{

     

       214
       214
       +
       			Community: &CommunityRef{

     

       215
       215
       +
       				DID:    "did:plc:testcommunity",

     

       216
       216
       +
       				PDSURL: "http://localhost:3001",

     

       217
       217
       +
       			},

     

       218
       218
       +
       			Embed: map[string]interface{}{

     

       219
       219
       +
       				"$type": "social.coves.embed.images",

     

       220
       220
       +
       				"images": []interface{}{

     

       221
       221
       +
       					map[string]interface{}{

     

       222
       222
       +
       						"image": map[string]interface{}{

     

       223
       223
       +
       							"$type": "blob",

     

       224
       224
       +
       							"ref": map[string]interface{}{

     

       225
       225
       +
       								"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       226
       226
       +
       							},

     

       227
       227
       +
       						},

     

       228
       228
       +
       					},

     

       229
       229
       +
       				},

     

       230
       230
       +
       			},

     

       231
       231
       +
       		}

     

       232
       232
       +
       

     

       233
       233
       +
       		// Should not transform non-external embeds

     

       234
       234
       +
       		TransformBlobRefsToURLs(post)

     

       235
       235
       +
       

     

       236
       236
       +
       		// Verify images embed is unchanged

     

       237
       237
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       238
       238
       +
       		images := embedMap["images"].([]interface{})

     

       239
       239
       +
       		imageObj := images[0].(map[string]interface{})

     

       240
       240
       +
       		imageBlob := imageObj["image"].(map[string]interface{})

     

       241
       241
       +
       		assert.Equal(t, "blob", imageBlob["$type"], "image blob should be unchanged")

     

       242
       242
       +
       	})

     

       243
       243
       +
       }

     

       244
       244
       +
       

     

       245
       245
       +
       func TestTransformThumbToURL(t *testing.T) {

     

       246
       246
       +
       	t.Run("transforms valid blob ref to URL", func(t *testing.T) {

     

       247
       247
       +
       		external := map[string]interface{}{

     

       248
       248
       +
       			"uri": "https://example.com",

     

       249
       249
       +
       			"thumb": map[string]interface{}{

     

       250
       250
       +
       				"$type": "blob",

     

       251
       251
       +
       				"ref": map[string]interface{}{

     

       252
       252
       +
       					"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       253
       253
       +
       				},

     

       254
       254
       +
       				"mimeType": "image/jpeg",

     

       255
       255
       +
       				"size":     52813,

     

       256
       256
       +
       			},

     

       257
       257
       +
       		}

     

       258
       258
       +
       

     

       259
       259
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       260
       260
       +
       

     

       261
       261
       +
       		thumbURL, ok := external["thumb"].(string)

     

       262
       262
       +
       		require.True(t, ok, "thumb should be a string URL")

     

       263
       263
       +
       		assert.Equal(t,

     

       264
       264
       +
       			"http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       265
       265
       +
       			thumbURL)

     

       266
       266
       +
       	})

     

       267
       267
       +
       

     

       268
       268
       +
       	t.Run("does not transform if thumb is already string", func(t *testing.T) {

     

       269
       269
       +
       		expectedURL := "http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafytest"

     

       270
       270
       +
       		external := map[string]interface{}{

     

       271
       271
       +
       			"uri":   "https://example.com",

     

       272
       272
       +
       			"thumb": expectedURL,

     

       273
       273
       +
       		}

     

       274
       274
       +
       

     

       275
       275
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       276
       276
       +
       

     

       277
       277
       +
       		thumbURL, ok := external["thumb"].(string)

     

       278
       278
       +
       		require.True(t, ok, "thumb should still be a string")

     

       279
       279
       +
       		assert.Equal(t, expectedURL, thumbURL, "thumb should be unchanged")

     

       280
       280
       +
       	})

     

       281
       281
       +
       

     

       282
       282
       +
       	t.Run("does not transform if thumb is missing", func(t *testing.T) {

     

       283
       283
       +
       		external := map[string]interface{}{

     

       284
       284
       +
       			"uri": "https://example.com",

     

       285
       285
       +
       		}

     

       286
       286
       +
       

     

       287
       287
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       288
       288
       +
       

     

       289
       289
       +
       		_, hasThumb := external["thumb"]

     

       290
       290
       +
       		assert.False(t, hasThumb, "thumb should not be added")

     

       291
       291
       +
       	})

     

       292
       292
       +
       

     

       293
       293
       +
       	t.Run("does not transform if CID is empty", func(t *testing.T) {

     

       294
       294
       +
       		external := map[string]interface{}{

     

       295
       295
       +
       			"uri": "https://example.com",

     

       296
       296
       +
       			"thumb": map[string]interface{}{

     

       297
       297
       +
       				"$type": "blob",

     

       298
       298
       +
       				"ref": map[string]interface{}{

     

       299
       299
       +
       					"$link": "", // Empty CID

     

       300
       300
       +
       				},

     

       301
       301
       +
       			},

     

       302
       302
       +
       		}

     

       303
       303
       +
       

     

       304
       304
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       305
       305
       +
       

     

       306
       306
       +
       		// Verify thumb is unchanged

     

       307
       307
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       308
       308
       +
       		require.True(t, ok, "thumb should still be a map")

     

       309
       309
       +
       		ref := thumb["ref"].(map[string]interface{})

     

       310
       310
       +
       		assert.Equal(t, "", ref["$link"], "empty CID should be unchanged")

     

       311
       311
       +
       	})

     

       312
       312
       +
       }

+13 -14

aggregators/kagi-news/src/coves_client.py

···

       72
       72
        
               content: str,

     

       73
       73
        
               facets: List[Dict],

     

       74
       74
        
               title: Optional[str] = None,

     

       75
       75
       -
               embed: Optional[Dict] = None

     

       75
       75
       +
               embed: Optional[Dict] = None,

     

       76
       76
       +
               thumbnail_url: Optional[str] = None

     

       76
       77
        
           ) -> str:

     

       77
       78
        
               """

     

       78
       79
        
               Create a post in a community.

     
···

       83
       84
        
                   facets: Rich text facets (formatting, links)

     

       84
       85
        
                   title: Optional post title

     

       85
       86
        
                   embed: Optional external embed

     

       87
       87
       +
                   thumbnail_url: Optional thumbnail URL (for trusted aggregators only)

     

       86
       88
        
       

     

       87
       89
        
               Returns:

     

       88
       90
        
                   AT Proto URI of created post (e.g., "at://did:plc:.../social.coves.post/...")

     
···

       109
       111
        
                   if embed:

     

       110
       112
        
                       post_data["embed"] = embed

     

       111
       113
        
       

     

       114
       114
       +
                   # Add thumbnail URL at top level if provided (for trusted aggregators)

     

       115
       115
       +
                   if thumbnail_url:

     

       116
       116
       +
                       post_data["thumbnailUrl"] = thumbnail_url

     

       117
       117
       +
       

     

       112
       118
        
                   # Use Coves-specific endpoint (not direct PDS write)

     

       113
       119
        
                   # This provides validation, authorization, and business logic

     

       114
       120
        
                   logger.info(f"Creating post in community: {community_handle}")

     
···

       141
       147
        
               self,

     

       142
       148
        
               uri: str,

     

       143
       149
        
               title: str,

     

       144
       144
       -
               description: str,

     

       145
       145
       -
               thumb: Optional[str] = None

     

       150
       150
       +
               description: str

     

       146
       151
        
           ) -> Dict:

     

       147
       152
        
               """

     

       148
       153
        
               Create external embed object for hot-linked content.

     

       149
       154
        
       

     

       150
       155
        
               Args:

     

       151
       151
       -
                   uri: External URL (story link)

     

       152
       152
       -
                   title: Story title

     

       153
       153
       -
                   description: Story description/summary

     

       154
       154
       -
                   thumb: Optional thumbnail image URL

     

       156
       156
       +
                   uri: URL of the external content

     

       157
       157
       +
                   title: Title of the content

     

       158
       158
       +
                   description: Description/summary

     

       155
       159
        
       

     

       156
       160
        
               Returns:

     

       157
       157
       -
                   External embed dictionary

     

       161
       161
       +
                   Embed dictionary ready for post creation

     

       158
       162
        
               """

     

       159
       159
       -
               embed = {

     

       163
       163
       +
               return {

     

       160
       164
        
                   "$type": "social.coves.embed.external",

     

       161
       165
        
                   "external": {

     

       162
       166
        
                       "uri": uri,

     
···

       165
       169
        
                   }

     

       166
       170
        
               }

     

       167
       171
        
       

     

       168
       168
       -
               if thumb:

     

       169
       169
       -
                   embed["external"]["thumb"] = thumb

     

       170
       170
       -
       

     

       171
       171
       -
               return embed

     

       172
       172
       -
       

     

       173
       172
        
           def _get_timestamp(self) -> str:

     

       174
       173
        
               """

     

       175
       174
        
               Get current timestamp in ISO 8601 format.

+5 -14

aggregators/kagi-news/tests/test_e2e.py

···

       398
       398
        
           Verifies:

     

       399
       399
        
           - Embed structure matches social.coves.embed.external

     

       400
       400
        
           - All required fields are present

     

       401
       401
       -
           - Optional thumbnail is included when provided

     

       401
       401
       +
           - Thumbnails are handled by server's unfurl service (not included in client)

     

       402
       402
        
           """

     

       403
       403
        
           handle, password = aggregator_credentials

     

       404
       404
        
       

     
···

       408
       408
        
               password=password

     

       409
       409
        
           )

     

       410
       410
        
       

     

       411
       411
       -
           # Test with thumbnail

     

       411
       411
       +
           # Create external embed (server will handle thumbnail extraction)

     

       412
       412
        
           embed = client.create_external_embed(

     

       413
       413
        
               uri="https://example.com/story",

     

       414
       414
        
               title="Test Story",

     

       415
       415
       -
               description="Test description",

     

       416
       416
       -
               thumb="https://example.com/image.jpg"

     

       415
       415
       +
               description="Test description"

     

       417
       416
        
           )

     

       418
       417
        
       

     

       419
       418
        
           assert embed["$type"] == "social.coves.embed.external"

     

       420
       419
        
           assert embed["external"]["uri"] == "https://example.com/story"

     

       421
       420
        
           assert embed["external"]["title"] == "Test Story"

     

       422
       421
        
           assert embed["external"]["description"] == "Test description"

     

       423
       423
       -
           assert embed["external"]["thumb"] == "https://example.com/image.jpg"

     

       424
       424
       -
       

     

       425
       425
       -
           # Test without thumbnail

     

       426
       426
       -
           embed_no_thumb = client.create_external_embed(

     

       427
       427
       -
               uri="https://example.com/story2",

     

       428
       428
       -
               title="Test Story 2",

     

       429
       429
       -
               description="Test description 2"

     

       430
       430
       -
           )

     

       431
       431
       -
       

     

       432
       432
       -
           assert "thumb" not in embed_no_thumb["external"]

     

       422
       422
       +
           # Thumbnail is not included - server's unfurl service handles it

     

       423
       423
       +
           assert "thumb" not in embed["external"]

     

       433
       424
        
           print("\n✅ External embed format correct")

+4 -3

aggregators/kagi-news/tests/test_main.py

···

       404
       404
        
               mock_client.create_post.return_value = "at://did:plc:test/social.coves.post/abc123"

     

       405
       405
        
       

     

       406
       406
        
               # Mock create_external_embed to return proper embed structure

     

       407
       407
       +
               # Note: Thumbnails are handled by server's unfurl service, not client

     

       407
       408
        
               mock_client.create_external_embed.return_value = {

     

       408
       409
        
                   "$type": "social.coves.embed.external",

     

       409
       410
        
                   "external": {

     

       410
       411
        
                       "uri": sample_story.link,

     

       411
       412
        
                       "title": sample_story.title,

     

       412
       412
       -
                       "description": sample_story.summary,

     

       413
       413
       -
                       "thumb": sample_story.image_url

     

       413
       413
       +
                       "description": sample_story.summary

     

       414
       414
        
                   }

     

       415
       415
        
               }

     

       416
       416
        
       

     
···

       457
       457
        
                   assert call_kwargs["embed"]["$type"] == "social.coves.embed.external"

     

       458
       458
        
                   assert call_kwargs["embed"]["external"]["uri"] == sample_story.link

     

       459
       459
        
                   assert call_kwargs["embed"]["external"]["title"] == sample_story.title

     

       460
       460
       -
                   assert call_kwargs["embed"]["external"]["thumb"] == sample_story.image_url

     

       460
       460
       +
                   # Thumbnail is not included - server's unfurl service handles it

     

       461
       461
       +
                   assert "thumb" not in call_kwargs["embed"]["external"]

+134

scripts/post_streamable.py

···

       1
       1
       +
       #!/usr/bin/env python3

     

       2
       2
       +
       """

     

       3
       3
       +
       Quick script to post a Streamable video to test-usnews community.

     

       4
       4
       +
       Uses the kagi-news CovesClient infrastructure.

     

       5
       5
       +
       """

     

       6
       6
       +
       

     

       7
       7
       +
       import sys

     

       8
       8
       +
       import os

     

       9
       9
       +
       

     

       10
       10
       +
       # Add kagi-news src to path to use CovesClient

     

       11
       11
       +
       sys.path.insert(0, os.path.join(os.path.dirname(__file__), '../aggregators/kagi-news'))

     

       12
       12
       +
       

     

       13
       13
       +
       from src.coves_client import CovesClient

     

       14
       14
       +
       

     

       15
       15
       +
       def main():

     

       16
       16
       +
           # Configuration

     

       17
       17
       +
           COVES_API_URL = "http://localhost:8081"

     

       18
       18
       +
           PDS_URL = "http://localhost:3001"

     

       19
       19
       +
       

     

       20
       20
       +
           # Use PDS instance credentials (from .env.dev)

     

       21
       21
       +
           HANDLE = "testuser123.local.coves.dev"

     

       22
       22
       +
           PASSWORD = "test-password-123"

     

       23
       23
       +
       

     

       24
       24
       +
           # Post details

     

       25
       25
       +
           COMMUNITY_HANDLE = "test-usnews.community.coves.social"

     

       26
       26
       +
       

     

       27
       27
       +
           # Post 1: Streamable video

     

       28
       28
       +
           STREAMABLE_URL = "https://streamable.com/7kpdft"

     

       29
       29
       +
           STREAMABLE_TITLE = "NBACentral - \"Your son don't wanna be here, we know it's your last weekend. Enjoy ..."

     

       30
       30
       +
       

     

       31
       31
       +
           # Post 2: Reddit highlight

     

       32
       32
       +
           REDDIT_URL = "https://www.reddit.com/r/nba/comments/1orfsgm/highlight_giannis_antetokounmpo_41_pts_15_reb_9/"

     

       33
       33
       +
           REDDIT_TITLE = "[Highlight] Giannis Antetokounmpo (41 PTS, 15 REB, 9 AST) tallies his 56th career regular season game of 40+ points, passing Kareem Abdul-Jabbar for the most such games in franchise history. Milwaukee defeats Chicago 126-110 to win their NBA Cup opener."

     

       34
       34
       +
       

     

       35
       35
       +
           # Initialize client

     

       36
       36
       +
           print(f"Initializing Coves client...")

     

       37
       37
       +
           print(f"  API URL: {COVES_API_URL}")

     

       38
       38
       +
           print(f"  PDS URL: {PDS_URL}")

     

       39
       39
       +
           print(f"  Handle: {HANDLE}")

     

       40
       40
       +
       

     

       41
       41
       +
           client = CovesClient(

     

       42
       42
       +
               api_url=COVES_API_URL,

     

       43
       43
       +
               handle=HANDLE,

     

       44
       44
       +
               password=PASSWORD,

     

       45
       45
       +
               pds_url=PDS_URL

     

       46
       46
       +
           )

     

       47
       47
       +
       

     

       48
       48
       +
           # Authenticate

     

       49
       49
       +
           print("\nAuthenticating...")

     

       50
       50
       +
           try:

     

       51
       51
       +
               client.authenticate()

     

       52
       52
       +
               print(f"✓ Authenticated as {client.did}")

     

       53
       53
       +
           except Exception as e:

     

       54
       54
       +
               print(f"✗ Authentication failed: {e}")

     

       55
       55
       +
               return 1

     

       56
       56
       +
       

     

       57
       57
       +
           # Post 1: Streamable video

     

       58
       58
       +
           print("\n" + "="*60)

     

       59
       59
       +
           print("POST 1: STREAMABLE VIDEO")

     

       60
       60
       +
           print("="*60)

     

       61
       61
       +
       

     

       62
       62
       +
           print("\nCreating minimal external embed (URI only)...")

     

       63
       63
       +
           streamable_embed = {

     

       64
       64
       +
               "$type": "social.coves.embed.external",

     

       65
       65
       +
               "external": {

     

       66
       66
       +
                   "uri": STREAMABLE_URL

     

       67
       67
       +
               }

     

       68
       68
       +
           }

     

       69
       69
       +
           print(f"✓ Embed created with URI only (unfurl service should enrich)")

     

       70
       70
       +
       

     

       71
       71
       +
           print(f"\nPosting to {COMMUNITY_HANDLE}...")

     

       72
       72
       +
           print(f"  Title: {STREAMABLE_TITLE}")

     

       73
       73
       +
           print(f"  Video: {STREAMABLE_URL}")

     

       74
       74
       +
       

     

       75
       75
       +
           try:

     

       76
       76
       +
               post_uri = client.create_post(

     

       77
       77
       +
                   community_handle=COMMUNITY_HANDLE,

     

       78
       78
       +
                   title=STREAMABLE_TITLE,

     

       79
       79
       +
                   content="",

     

       80
       80
       +
                   facets=[],

     

       81
       81
       +
                   embed=streamable_embed

     

       82
       82
       +
               )

     

       83
       83
       +
       

     

       84
       84
       +
               print(f"\n✓ Streamable post created successfully!")

     

       85
       85
       +
               print(f"  URI: {post_uri}")

     

       86
       86
       +
       

     

       87
       87
       +
           except Exception as e:

     

       88
       88
       +
               print(f"\n✗ Streamable post creation failed: {e}")

     

       89
       89
       +
               import traceback

     

       90
       90
       +
               traceback.print_exc()

     

       91
       91
       +
               return 1

     

       92
       92
       +
       

     

       93
       93
       +
           # Post 2: Reddit highlight

     

       94
       94
       +
           print("\n" + "="*60)

     

       95
       95
       +
           print("POST 2: REDDIT HIGHLIGHT")

     

       96
       96
       +
           print("="*60)

     

       97
       97
       +
       

     

       98
       98
       +
           print("\nCreating minimal external embed (URI only)...")

     

       99
       99
       +
           reddit_embed = {

     

       100
       100
       +
               "$type": "social.coves.embed.external",

     

       101
       101
       +
               "external": {

     

       102
       102
       +
                   "uri": REDDIT_URL

     

       103
       103
       +
               }

     

       104
       104
       +
           }

     

       105
       105
       +
           print(f"✓ Embed created with URI only (unfurl service should enrich)")

     

       106
       106
       +
       

     

       107
       107
       +
           print(f"\nPosting to {COMMUNITY_HANDLE}...")

     

       108
       108
       +
           print(f"  Title: {REDDIT_TITLE}")

     

       109
       109
       +
           print(f"  URL: {REDDIT_URL}")

     

       110
       110
       +
       

     

       111
       111
       +
           try:

     

       112
       112
       +
               post_uri = client.create_post(

     

       113
       113
       +
                   community_handle=COMMUNITY_HANDLE,

     

       114
       114
       +
                   title=REDDIT_TITLE,

     

       115
       115
       +
                   content="",

     

       116
       116
       +
                   facets=[],

     

       117
       117
       +
                   embed=reddit_embed

     

       118
       118
       +
               )

     

       119
       119
       +
       

     

       120
       120
       +
               print(f"\n✓ Reddit post created successfully!")

     

       121
       121
       +
               print(f"  URI: {post_uri}")

     

       122
       122
       +
               print(f"\n" + "="*60)

     

       123
       123
       +
               print("Both posts created! Check them out at !test-usnews")

     

       124
       124
       +
               print("="*60)

     

       125
       125
       +
               return 0

     

       126
       126
       +
       

     

       127
       127
       +
           except Exception as e:

     

       128
       128
       +
               print(f"\n✗ Reddit post creation failed: {e}")

     

       129
       129
       +
               import traceback

     

       130
       130
       +
               traceback.print_exc()

     

       131
       131
       +
               return 1

     

       132
       132
       +
       

     

       133
       133
       +
       if __name__ == "__main__":

     

       134
       134
       +
           sys.exit(main())

+6 -3

aggregators/kagi-news/src/html_parser.py

···

       78
       78
        
                   Perspective(

     

       79
       79
        
                       actor=p['actor'],

     

       80
       80
        
                       description=p['description'],

     

       81
       81
       -
                       source_url=p['source_url']

     

       81
       81
       +
                       source_url=p['source_url'],

     

       82
       82
       +
                       source_name=p.get('source_name', '')

     

       82
       83
        
                   )

     

       83
       84
        
                   for p in parsed['perspectives']

     

       84
       85
        
               ]

     
···

       230
       231
        
               actor, rest = full_text.split(':', 1)

     

       231
       232
        
               actor = actor.strip()

     

       232
       233
        
       

     

       233
       233
       -
               # Find the <a> tag for source URL

     

       234
       234
       +
               # Find the <a> tag for source URL and name

     

       234
       235
        
               a_tag = li.find('a')

     

       235
       236
        
               source_url = a_tag['href'] if a_tag and a_tag.get('href') else ""

     

       237
       237
       +
               source_name = a_tag.get_text(strip=True) if a_tag else ""

     

       236
       238
        
       

     

       237
       239
        
               # Extract description (between colon and source link)

     

       238
       240
        
               # Remove the source citation part in parentheses

     
···

       250
       252
        
               return {

     

       251
       253
        
                   'actor': actor,

     

       252
       254
        
                   'description': description,

     

       253
       253
       -
                   'source_url': source_url

     

       255
       255
       +
                   'source_url': source_url,

     

       256
       256
       +
                   'source_name': source_name

     

       254
       257
        
               }

     

       255
       258
        
       

     

       256
       259
        
           def _extract_sources(self, soup: BeautifulSoup) -> List[Dict]:

+1

aggregators/kagi-news/src/models.py

···

       20
       20
        
           actor: str

     

       21
       21
        
           description: str

     

       22
       22
        
           source_url: str

     

       23
       23
       +
           source_name: str = ""  # Name of the source (e.g., "The Straits Times")

     

       23
       24
        
       

     

       24
       25
        
       

     

       25
       26
        
       @dataclass

+11 -7

aggregators/kagi-news/src/richtext_formatter.py

···

       42
       42
        
                   builder.add_bold("Highlights:")

     

       43
       43
        
                   builder.add_text("\n")

     

       44
       44
        
                   for highlight in story.highlights:

     

       45
       45
       -
                       builder.add_text(f"• {highlight}\n")

     

       45
       45
       +
                       builder.add_text(f"• {highlight}\n\n")

     

       46
       46
        
                   builder.add_text("\n")

     

       47
       47
        
       

     

       48
       48
        
               # Perspectives (if present)

     
···

       53
       53
        
                       # Bold the actor name

     

       54
       54
        
                       actor_with_colon = f"{perspective.actor}:"

     

       55
       55
        
                       builder.add_bold(actor_with_colon)

     

       56
       56
       -
                       builder.add_text(f" {perspective.description} (")

     

       56
       56
       +
                       builder.add_text(f" {perspective.description}")

     

       57
       57
        
       

     

       58
       58
       -
                       # Add link to source

     

       59
       59
       -
                       source_link_text = "Source"

     

       60
       60
       -
                       builder.add_link(source_link_text, perspective.source_url)

     

       61
       61
       -
                       builder.add_text(")\n")

     

       58
       58
       +
                       # Add link to source if available

     

       59
       59
       +
                       if perspective.source_url:

     

       60
       60
       +
                           builder.add_text(" (")

     

       61
       61
       +
                           source_link_text = perspective.source_name if perspective.source_name else "Source"

     

       62
       62
       +
                           builder.add_link(source_link_text, perspective.source_url)

     

       63
       63
       +
                           builder.add_text(")")

     

       64
       64
       +
       

     

       65
       65
       +
                       builder.add_text("\n\n")

     

       62
       66
        
                   builder.add_text("\n")

     

       63
       67
        
       

     

       64
       68
        
               # Quote (if present)

     
···

       74
       78
        
                   for source in story.sources:

     

       75
       79
        
                       builder.add_text("• ")

     

       76
       80
        
                       builder.add_link(source.title, source.url)

     

       77
       77
       -
                       builder.add_text(f" - {source.domain}\n")

     

       81
       81
       +
                       builder.add_text(f" - {source.domain}\n\n")

     

       78
       82
        
                   builder.add_text("\n")

     

       79
       83
        
       

     

       80
       84
        
               # Kagi News attribution

+1 -1

internal/atproto/lexicon/social/coves/feed/comment.json internal/atproto/lexicon/social/coves/community/comment.json

···

       1
       1
        
       {

     

       2
       2
        
         "lexicon": 1,

     

       3
       3
       -
         "id": "social.coves.feed.comment",

     

       3
       3
       +
         "id": "social.coves.community.comment",

     

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "record",

+34

internal/db/migrations/018_migrate_comment_namespace.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Migration: Update comment URIs from social.coves.feed.comment to social.coves.community.comment

     

       3
       3
       +
       -- This updates the namespace for all comment records in the database.

     

       4
       4
       +
       -- Since we're pre-production, we're only updating the comments table (not votes).

     

       5
       5
       +
       

     

       6
       6
       +
       -- Update main comment URIs

     

       7
       7
       +
       UPDATE comments

     

       8
       8
       +
       SET uri = REPLACE(uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       9
       9
       +
       WHERE uri LIKE '%/social.coves.feed.comment/%';

     

       10
       10
       +
       

     

       11
       11
       +
       -- Update root references (when root is a comment, not a post)

     

       12
       12
       +
       UPDATE comments

     

       13
       13
       +
       SET root_uri = REPLACE(root_uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       14
       14
       +
       WHERE root_uri LIKE '%/social.coves.feed.comment/%';

     

       15
       15
       +
       

     

       16
       16
       +
       -- Update parent references (when parent is a comment)

     

       17
       17
       +
       UPDATE comments

     

       18
       18
       +
       SET parent_uri = REPLACE(parent_uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       19
       19
       +
       WHERE parent_uri LIKE '%/social.coves.feed.comment/%';

     

       20
       20
       +
       

     

       21
       21
       +
       -- +goose Down

     

       22
       22
       +
       -- Rollback: Revert comment URIs from social.coves.community.comment to social.coves.feed.comment

     

       23
       23
       +
       

     

       24
       24
       +
       UPDATE comments

     

       25
       25
       +
       SET uri = REPLACE(uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       26
       26
       +
       WHERE uri LIKE '%/social.coves.community.comment/%';

     

       27
       27
       +
       

     

       28
       28
       +
       UPDATE comments

     

       29
       29
       +
       SET root_uri = REPLACE(root_uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       30
       30
       +
       WHERE root_uri LIKE '%/social.coves.community.comment/%';

     

       31
       31
       +
       

     

       32
       32
       +
       UPDATE comments

     

       33
       33
       +
       SET parent_uri = REPLACE(parent_uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       34
       34
       +
       WHERE parent_uri LIKE '%/social.coves.community.comment/%';

+2 -2

internal/core/comments/view_models.go

···

       5
       5
        
       )

     

       6
       6
        
       

     

       7
       7
        
       // CommentView represents the full view of a comment with all metadata

     

       8
       8
       -
       // Matches social.coves.feed.getComments#commentView lexicon

     

       8
       8
       +
       // Matches social.coves.community.comment.getComments#commentView lexicon

     

       9
       9
        
       // Used in thread views and get endpoints

     

       10
       10
        
       type CommentView struct {

     

       11
       11
        
       	Embed         interface{}         `json:"embed,omitempty"`

     
···

       24
       24
        
       }

     

       25
       25
        
       

     

       26
       26
        
       // ThreadViewComment represents a comment with its nested replies

     

       27
       27
       -
       // Matches social.coves.feed.getComments#threadViewComment lexicon

     

       27
       27
       +
       // Matches social.coves.community.comment.getComments#threadViewComment lexicon

     

       28
       28
        
       // Supports recursive threading for comment trees

     

       29
       29
        
       type ThreadViewComment struct {

     

       30
       30
        
       	Comment *CommentView         `json:"comment"`

+1 -1

internal/validation/lexicon.go

···

       86
       86
        
       

     

       87
       87
        
       // ValidateComment validates a comment record

     

       88
       88
        
       func (v *LexiconValidator) ValidateComment(comment map[string]interface{}) error {

     

       89
       89
       -
       	return v.ValidateRecord(comment, "social.coves.feed.comment")

     

       89
       89
       +
       	return v.ValidateRecord(comment, "social.coves.community.comment")

     

       90
       90
        
       }

     

       91
       91
        
       

     

       92
       92
        
       // ValidateVote validates a vote record

+18 -15

docs/COMMENT_SYSTEM_IMPLEMENTATION.md

···

       308
       308
        
       ```json

     

       309
       309
        
       {

     

       310
       310
        
         "lexicon": 1,

     

       311
       311
       -
         "id": "social.coves.feed.comment",

     

       311
       311
       +
         "id": "social.coves.community.comment",

     

       312
       312
        
         "defs": {

     

       313
       313
        
           "main": {

     

       314
       314
        
             "type": "record",

     
···

       365
       365
        
       ```sql

     

       366
       366
        
       CREATE TABLE comments (

     

       367
       367
        
           id BIGSERIAL PRIMARY KEY,

     

       368
       368
       -
           uri TEXT UNIQUE NOT NULL,               -- AT-URI (at://commenter_did/social.coves.feed.comment/rkey)

     

       368
       368
       +
           uri TEXT UNIQUE NOT NULL,               -- AT-URI (at://commenter_did/social.coves.community.comment/rkey)

     

       369
       369
        
           cid TEXT NOT NULL,                      -- Content ID

     

       370
       370
        
           rkey TEXT NOT NULL,                     -- Record key (TID)

     

       371
       371
        
           commenter_did TEXT NOT NULL,            -- User who commented (from AT-URI repo field)

     
···

       559
       559
        
               return nil

     

       560
       560
        
           }

     

       561
       561
        
       

     

       562
       562
       -
           if event.Commit.Collection == "social.coves.feed.comment" {

     

       562
       562
       +
           if event.Commit.Collection == "social.coves.community.comment" {

     

       563
       563
        
               switch event.Commit.Operation {

     

       564
       564
        
               case "create":

     

       565
       565
        
                   return c.createComment(ctx, event.Did, commit)

     
···

       653
       653
        
       - Auto-reconnect on errors (5-second retry)

     

       654
       654
        
       - Ping/pong keepalive (30-second ping, 60-second read deadline)

     

       655
       655
        
       - Graceful shutdown via context cancellation

     

       656
       656
       -
       - Subscribes to: `wantedCollections=social.coves.feed.comment`

     

       656
       656
       +
       - Subscribes to: `wantedCollections=social.coves.community.comment`

     

       657
       657
        
       

     

       658
       658
        
       ---

     

       659
       659
        
       

     
···

       669
       669
        
       // Start Jetstream consumer for comments

     

       670
       670
        
       commentJetstreamURL := os.Getenv("COMMENT_JETSTREAM_URL")

     

       671
       671
        
       if commentJetstreamURL == "" {

     

       672
       672
       -
           commentJetstreamURL = "ws://localhost:6008/subscribe?wantedCollections=social.coves.feed.comment"

     

       672
       672
       +
           commentJetstreamURL = "ws://localhost:6008/subscribe?wantedCollections=social.coves.community.comment"

     

       673
       673
        
       }

     

       674
       674
        
       

     

       675
       675
        
       commentEventConsumer := jetstream.NewCommentEventConsumer(commentRepo, db)

     
···

       682
       682
        
       }()

     

       683
       683
        
       

     

       684
       684
        
       log.Printf("Started Jetstream comment consumer: %s", commentJetstreamURL)

     

       685
       685
       -
       log.Println("  - Indexing: social.coves.feed.comment CREATE/UPDATE/DELETE operations")

     

       685
       685
       +
       log.Println("  - Indexing: social.coves.community.comment CREATE/UPDATE/DELETE operations")

     

       686
       686
        
       log.Println("  - Updating: Post comment counts and comment reply counts atomically")

     

       687
       687
        
       ```

     

       688
       688
        
       

     
···

       835
       835
        
       | Aspect | Votes | Comments |

     

       836
       836
        
       |--------|-------|----------|

     

       837
       837
        
       | **Location** | User repositories | User repositories |

     

       838
       838
       -
       | **Lexicon** | `social.coves.feed.vote` | `social.coves.feed.comment` |

     

       838
       838
       +
       | **Lexicon** | `social.coves.feed.vote` | `social.coves.community.comment` |

     

       839
       839
        
       | **Operations** | CREATE, DELETE | CREATE, UPDATE, DELETE |

     

       840
       840
        
       | **Mutability** | Immutable | Editable |

     

       841
       841
        
       | **Foreign Keys** | None (out-of-order indexing) | None (out-of-order indexing) |

     
···

       1197
       1197
        
       

     

       1198
       1198
        
       ---

     

       1199
       1199
        
       

     

       1200
       1200
       -
       ### 📋 Phase 4: Namespace Migration (Separate Task)

     

       1200
       1200
       +
       ### ✅ Phase 4: Namespace Migration (COMPLETED)

     

       1201
       1201
       +
       

     

       1202
       1202
       +
       **Completed:** 2025-11-16

     

       1201
       1203
        
       

     

       1202
       1204
        
       **Scope:**

     

       1203
       1203
       -
       - Migrate existing `social.coves.feed.comment` records to `social.coves.community.comment`

     

       1204
       1204
       -
       - Update all AT-URIs in database

     

       1205
       1205
       -
       - Update Jetstream consumer collection filter

     

       1206
       1206
       -
       - Migration script with rollback capability

     

       1207
       1207
       -
       - Zero-downtime deployment strategy

     

       1205
       1205
       +
       - ✅ Migrated `social.coves.community.comment` namespace to `social.coves.community.comment`

     

       1206
       1206
       +
       - ✅ Updated lexicon definitions (record and query schemas)

     

       1207
       1207
       +
       - ✅ Updated Jetstream consumer collection filter

     

       1208
       1208
       +
       - ✅ Updated all code references (consumer, service, validation layers)

     

       1209
       1209
       +
       - ✅ Updated integration tests and test data generation scripts

     

       1210
       1210
       +
       - ✅ Created database migration (018_migrate_comment_namespace.sql)

     

       1208
       1211
        
       

     

       1209
       1209
       -
       **Note:** Currently out of scope - will be tackled separately when needed.

     

       1212
       1212
       +
       **Note:** Since we're pre-production, no historical data migration was needed. Migration script updates URIs in comments table (uri, root_uri, parent_uri columns).

     

       1210
       1213
        
       

     

       1211
       1214
        
       ---

     

       1212
       1215
        
       

     
···

       1456
       1459
        
       ### Environment Variables

     

       1457
       1460
        
       ```bash

     

       1458
       1461
        
       # Jetstream URL (optional, defaults to localhost:6008)

     

       1459
       1459
       -
       export COMMENT_JETSTREAM_URL="ws://localhost:6008/subscribe?wantedCollections=social.coves.feed.comment"

     

       1462
       1462
       +
       export COMMENT_JETSTREAM_URL="ws://localhost:6008/subscribe?wantedCollections=social.coves.community.comment"

     

       1460
       1463
        
       

     

       1461
       1464
        
       # Database URL

     

       1462
       1465
        
       export TEST_DATABASE_URL="postgres://test_user:test_password@localhost:5434/coves_test?sslmode=disable"

+3 -2

internal/core/unfurl/providers.go

···

       108
       108
        
       

     

       109
       109
        
       // normalizeURL converts protocol-relative URLs to HTTPS

     

       110
       110
        
       // Examples:

     

       111
       111
       -
       //   "//example.com/image.jpg" -> "https://example.com/image.jpg"

     

       112
       112
       -
       //   "https://example.com/image.jpg" -> "https://example.com/image.jpg" (unchanged)

     

       111
       111
       +
       //

     

       112
       112
       +
       //	"//example.com/image.jpg" -> "https://example.com/image.jpg"

     

       113
       113
       +
       //	"https://example.com/image.jpg" -> "https://example.com/image.jpg" (unchanged)

     

       113
       114
        
       func normalizeURL(urlStr string) string {

     

       114
       115
        
       	if strings.HasPrefix(urlStr, "//") {

     

       115
       116
        
       		return "https:" + urlStr

+785

docs/federation-prd.md

···

       1
       1
       +
       # Federation PRD: Cross-Instance Posting (Beta)

     

       2
       2
       +
       

     

       3
       3
       +
       **Status:** Planning - Beta

     

       4
       4
       +
       **Target:** Beta Release

     

       5
       5
       +
       **Owner:** TBD

     

       6
       6
       +
       **Last Updated:** 2025-11-16

     

       7
       7
       +
       

     

       8
       8
       +
       ---

     

       9
       9
       +
       

     

       10
       10
       +
       ## Overview

     

       11
       11
       +
       

     

       12
       12
       +
       Enable Lemmy-style federation where users on any Coves instance can post to communities hosted on other instances, while maintaining community ownership and moderation control.

     

       13
       13
       +
       

     

       14
       14
       +
       ### Problem Statement

     

       15
       15
       +
       

     

       16
       16
       +
       **Current (Alpha):**

     

       17
       17
       +
       - Posts to communities require community credentials

     

       18
       18
       +
       - Users can only post to communities on their home instance

     

       19
       19
       +
       - No true federation across instances

     

       20
       20
       +
       

     

       21
       21
       +
       **Desired (Beta):**

     

       22
       22
       +
       - User A@coves.social can post to !gaming@covesinstance.com

     

       23
       23
       +
       - Communities maintain full moderation control

     

       24
       24
       +
       - Content lives in community repositories (not user repos)

     

       25
       25
       +
       - Seamless UX - users don't think about federation

     

       26
       26
       +
       

     

       27
       27
       +
       ---

     

       28
       28
       +
       

     

       29
       29
       +
       ## Goals

     

       30
       30
       +
       

     

       31
       31
       +
       ### Primary Goals

     

       32
       32
       +
       1. **Enable cross-instance posting** - Users can post to any community on any federated instance

     

       33
       33
       +
       2. **Preserve community ownership** - Posts live in community repos, not user repos

     

       34
       34
       +
       3. **atProto-native implementation** - Use `com.atproto.server.getServiceAuth` pattern

     

       35
       35
       +
       4. **Maintain security** - No compromise on auth, validation, or moderation

     

       36
       36
       +
       

     

       37
       37
       +
       ### Non-Goals (Future Versions)

     

       38
       38
       +
       - Automatic instance discovery (Beta: manual allowlist)

     

       39
       39
       +
       - Cross-instance moderation delegation

     

       40
       40
       +
       - Content mirroring/replication

     

       41
       41
       +
       - User migration between instances

     

       42
       42
       +
       

     

       43
       43
       +
       ---

     

       44
       44
       +
       

     

       45
       45
       +
       ## Technical Approach

     

       46
       46
       +
       

     

       47
       47
       +
       ### Architecture: atProto Service Auth

     

       48
       48
       +
       

     

       49
       49
       +
       Use atProto's native service authentication delegation pattern:

     

       50
       50
       +
       

     

       51
       51
       +
       ```

     

       52
       52
       +
       ┌─────────────┐         ┌──────────────────┐         ┌─────────────┐

     

       53
       53
       +
       │  User A     │         │  coves.social    │         │ covesinstance│

     

       54
       54
       +
       │ @coves.soc  │────────▶│   AppView        │────────▶│  .com PDS   │

     

       55
       55
       +
       └─────────────┘  (1)    └──────────────────┘  (2)    └─────────────┘

     

       56
       56
       +
                       JWT auth    Request Service Auth         Validate

     

       57
       57
       +
                                            │                       │

     

       58
       58
       +
                                            │◀──────────────────────┘

     

       59
       59
       +
                                            │        (3) Scoped Token

     

       60
       60
       +
                                            │

     

       61
       61
       +
                                            ▼

     

       62
       62
       +
                                   ┌──────────────────┐

     

       63
       63
       +
                                   │ covesinstance    │

     

       64
       64
       +
                                   │  .com PDS        │

     

       65
       65
       +
                                   │ Write Post       │

     

       66
       66
       +
                                   └──────────────────┘

     

       67
       67
       +
                                            │

     

       68
       68
       +
                                            ▼

     

       69
       69
       +
                                   ┌──────────────────┐

     

       70
       70
       +
                                   │   Firehose       │

     

       71
       71
       +
                                   │  (broadcasts)    │

     

       72
       72
       +
                                   └──────────────────┘

     

       73
       73
       +
                                            │

     

       74
       74
       +
                               ┌────────────┴────────────┐

     

       75
       75
       +
                               ▼                         ▼

     

       76
       76
       +
                       ┌──────────────┐        ┌──────────────┐

     

       77
       77
       +
                       │ coves.social │        │covesinstance │

     

       78
       78
       +
                       │   AppView    │        │  .com AppView│

     

       79
       79
       +
                       │  (indexes)   │        │   (indexes)  │

     

       80
       80
       +
                       └──────────────┘        └──────────────┘

     

       81
       81
       +
       ```

     

       82
       82
       +
       

     

       83
       83
       +
       ### Flow Breakdown

     

       84
       84
       +
       

     

       85
       85
       +
       **Step 1: User Authentication (Unchanged)**

     

       86
       86
       +
       - User authenticates with their home instance (coves.social)

     

       87
       87
       +
       - Receives JWT token for API requests

     

       88
       88
       +
       

     

       89
       89
       +
       **Step 2: Service Auth Request (New)**

     

       90
       90
       +
       - When posting to remote community, AppView requests service auth token

     

       91
       91
       +
       - Endpoint: `POST {remote-pds}/xrpc/com.atproto.server.getServiceAuth`

     

       92
       92
       +
       - Payload:

     

       93
       93
       +
         ```json

     

       94
       94
       +
         {

     

       95
       95
       +
           "aud": "did:plc:community123",  // Community DID

     

       96
       96
       +
           "exp": 1234567890,               // Token expiration

     

       97
       97
       +
           "lxm": "social.coves.community.post.create"  // Authorized method

     

       98
       98
       +
         }

     

       99
       99
       +
         ```

     

       100
       100
       +
       

     

       101
       101
       +
       **Step 3: Service Auth Validation (New - PDS Side)**

     

       102
       102
       +
       - Remote PDS validates request:

     

       103
       103
       +
         - Is requesting service trusted? (instance allowlist)

     

       104
       104
       +
         - Is user banned from community?

     

       105
       105
       +
         - Does community allow remote posts?

     

       106
       106
       +
         - Rate limiting checks

     

       107
       107
       +
       - Returns scoped token valid for specific community + operation

     

       108
       108
       +
       

     

       109
       109
       +
       **Step 4: Post Creation (Modified)**

     

       110
       110
       +
       - AppView uses service auth token to write to remote PDS

     

       111
       111
       +
       - Same `com.atproto.repo.createRecord` endpoint as current implementation

     

       112
       112
       +
       - Post record written to community's repository

     

       113
       113
       +
       

     

       114
       114
       +
       **Step 5: Indexing (Unchanged)**

     

       115
       115
       +
       - PDS broadcasts to firehose

     

       116
       116
       +
       - All AppViews index via Jetstream consumers

     

       117
       117
       +
       

     

       118
       118
       +
       ---

     

       119
       119
       +
       

     

       120
       120
       +
       ## Implementation Details

     

       121
       121
       +
       

     

       122
       122
       +
       ### Phase 1: Service Detection (Local vs Remote)

     

       123
       123
       +
       

     

       124
       124
       +
       **File:** `internal/core/posts/service.go`

     

       125
       125
       +
       

     

       126
       126
       +
       ```go

     

       127
       127
       +
       func (s *postService) CreatePost(ctx context.Context, req CreatePostRequest) (*CreatePostResponse, error) {

     

       128
       128
       +
           // ... existing validation ...

     

       129
       129
       +
       

     

       130
       130
       +
           community, err := s.communityService.GetByDID(ctx, communityDID)

     

       131
       131
       +
           if err != nil {

     

       132
       132
       +
               return nil, err

     

       133
       133
       +
           }

     

       134
       134
       +
       

     

       135
       135
       +
           // NEW: Route based on community location

     

       136
       136
       +
           if s.isLocalCommunity(community) {

     

       137
       137
       +
               return s.createLocalPost(ctx, community, req)

     

       138
       138
       +
           }

     

       139
       139
       +
           return s.createFederatedPost(ctx, community, req)

     

       140
       140
       +
       }

     

       141
       141
       +
       

     

       142
       142
       +
       func (s *postService) isLocalCommunity(community *communities.Community) bool {

     

       143
       143
       +
           localPDSHost := extractHost(s.pdsURL)

     

       144
       144
       +
           communityPDSHost := extractHost(community.PDSURL)

     

       145
       145
       +
           return localPDSHost == communityPDSHost

     

       146
       146
       +
       }

     

       147
       147
       +
       ```

     

       148
       148
       +
       

     

       149
       149
       +
       ### Phase 2: Service Auth Client

     

       150
       150
       +
       

     

       151
       151
       +
       **New File:** `internal/atproto/service_auth/client.go`

     

       152
       152
       +
       

     

       153
       153
       +
       ```go

     

       154
       154
       +
       type ServiceAuthClient interface {

     

       155
       155
       +
           // RequestServiceAuth obtains a scoped token for writing to remote community

     

       156
       156
       +
           RequestServiceAuth(ctx context.Context, opts ServiceAuthOptions) (*ServiceAuthToken, error)

     

       157
       157
       +
       }

     

       158
       158
       +
       

     

       159
       159
       +
       type ServiceAuthOptions struct {

     

       160
       160
       +
           RemotePDSURL  string    // Remote PDS endpoint

     

       161
       161
       +
           CommunityDID  string    // Target community DID

     

       162
       162
       +
           UserDID       string    // Author DID (for validation)

     

       163
       163
       +
           Method        string    // "social.coves.community.post.create"

     

       164
       164
       +
           ExpiresIn     int       // Token lifetime (seconds)

     

       165
       165
       +
       }

     

       166
       166
       +
       

     

       167
       167
       +
       type ServiceAuthToken struct {

     

       168
       168
       +
           Token     string    // JWT token for auth

     

       169
       169
       +
           ExpiresAt time.Time // When token expires

     

       170
       170
       +
       }

     

       171
       171
       +
       

     

       172
       172
       +
       func (c *serviceAuthClient) RequestServiceAuth(ctx context.Context, opts ServiceAuthOptions) (*ServiceAuthToken, error) {

     

       173
       173
       +
           endpoint := fmt.Sprintf("%s/xrpc/com.atproto.server.getServiceAuth", opts.RemotePDSURL)

     

       174
       174
       +
       

     

       175
       175
       +
           payload := map[string]interface{}{

     

       176
       176
       +
               "aud": opts.CommunityDID,

     

       177
       177
       +
               "exp": time.Now().Add(time.Duration(opts.ExpiresIn) * time.Second).Unix(),

     

       178
       178
       +
               "lxm": opts.Method,

     

       179
       179
       +
           }

     

       180
       180
       +
       

     

       181
       181
       +
           // Sign request with our instance DID credentials

     

       182
       182
       +
           signedReq, err := c.signRequest(payload)

     

       183
       183
       +
           if err != nil {

     

       184
       184
       +
               return nil, fmt.Errorf("failed to sign service auth request: %w", err)

     

       185
       185
       +
           }

     

       186
       186
       +
       

     

       187
       187
       +
           resp, err := c.httpClient.Post(endpoint, signedReq)

     

       188
       188
       +
           if err != nil {

     

       189
       189
       +
               return nil, fmt.Errorf("service auth request failed: %w", err)

     

       190
       190
       +
           }

     

       191
       191
       +
       

     

       192
       192
       +
           return parseServiceAuthResponse(resp)

     

       193
       193
       +
       }

     

       194
       194
       +
       ```

     

       195
       195
       +
       

     

       196
       196
       +
       ### Phase 3: Federated Post Creation

     

       197
       197
       +
       

     

       198
       198
       +
       **File:** `internal/core/posts/service.go`

     

       199
       199
       +
       

     

       200
       200
       +
       ```go

     

       201
       201
       +
       func (s *postService) createFederatedPost(ctx context.Context, community *communities.Community, req CreatePostRequest) (*CreatePostResponse, error) {

     

       202
       202
       +
           // 1. Request service auth token from remote PDS

     

       203
       203
       +
           token, err := s.serviceAuthClient.RequestServiceAuth(ctx, service_auth.ServiceAuthOptions{

     

       204
       204
       +
               RemotePDSURL: community.PDSURL,

     

       205
       205
       +
               CommunityDID: community.DID,

     

       206
       206
       +
               UserDID:      req.AuthorDID,

     

       207
       207
       +
               Method:       "social.coves.community.post.create",

     

       208
       208
       +
               ExpiresIn:    300, // 5 minutes

     

       209
       209
       +
           })

     

       210
       210
       +
           if err != nil {

     

       211
       211
       +
               // Handle specific errors

     

       212
       212
       +
               if isUnauthorized(err) {

     

       213
       213
       +
                   return nil, ErrNotAuthorizedRemote

     

       214
       214
       +
               }

     

       215
       215
       +
               if isBanned(err) {

     

       216
       216
       +
                   return nil, ErrBannedRemote

     

       217
       217
       +
               }

     

       218
       218
       +
               return nil, fmt.Errorf("failed to obtain service auth: %w", err)

     

       219
       219
       +
           }

     

       220
       220
       +
       

     

       221
       221
       +
           // 2. Build post record (same as local)

     

       222
       222
       +
           postRecord := PostRecord{

     

       223
       223
       +
               Type:      "social.coves.community.post",

     

       224
       224
       +
               Community: community.DID,

     

       225
       225
       +
               Author:    req.AuthorDID,

     

       226
       226
       +
               Title:     req.Title,

     

       227
       227
       +
               Content:   req.Content,

     

       228
       228
       +
               // ... other fields ...

     

       229
       229
       +
               CreatedAt: time.Now().UTC().Format(time.RFC3339),

     

       230
       230
       +
           }

     

       231
       231
       +
       

     

       232
       232
       +
           // 3. Write to remote PDS using service auth token

     

       233
       233
       +
           uri, cid, err := s.createPostOnRemotePDS(ctx, community.PDSURL, community.DID, postRecord, token.Token)

     

       234
       234
       +
           if err != nil {

     

       235
       235
       +
               return nil, fmt.Errorf("failed to write to remote PDS: %w", err)

     

       236
       236
       +
           }

     

       237
       237
       +
       

     

       238
       238
       +
           log.Printf("[FEDERATION] User %s posted to remote community %s: %s",

     

       239
       239
       +
               req.AuthorDID, community.DID, uri)

     

       240
       240
       +
       

     

       241
       241
       +
           return &CreatePostResponse{

     

       242
       242
       +
               URI: uri,

     

       243
       243
       +
               CID: cid,

     

       244
       244
       +
           }, nil

     

       245
       245
       +
       }

     

       246
       246
       +
       

     

       247
       247
       +
       func (s *postService) createPostOnRemotePDS(

     

       248
       248
       +
           ctx context.Context,

     

       249
       249
       +
           pdsURL string,

     

       250
       250
       +
           communityDID string,

     

       251
       251
       +
           record PostRecord,

     

       252
       252
       +
           serviceAuthToken string,

     

       253
       253
       +
       ) (uri, cid string, err error) {

     

       254
       254
       +
           endpoint := fmt.Sprintf("%s/xrpc/com.atproto.repo.createRecord", pdsURL)

     

       255
       255
       +
       

     

       256
       256
       +
           payload := map[string]interface{}{

     

       257
       257
       +
               "repo":       communityDID,

     

       258
       258
       +
               "collection": "social.coves.community.post",

     

       259
       259
       +
               "record":     record,

     

       260
       260
       +
           }

     

       261
       261
       +
       

     

       262
       262
       +
           jsonData, _ := json.Marshal(payload)

     

       263
       263
       +
           req, _ := http.NewRequestWithContext(ctx, "POST", endpoint, bytes.NewBuffer(jsonData))

     

       264
       264
       +
       

     

       265
       265
       +
           // Use service auth token instead of community credentials

     

       266
       266
       +
           req.Header.Set("Authorization", "Bearer "+serviceAuthToken)

     

       267
       267
       +
           req.Header.Set("Content-Type", "application/json")

     

       268
       268
       +
       

     

       269
       269
       +
           // ... execute request, parse response ...

     

       270
       270
       +
           return uri, cid, nil

     

       271
       271
       +
       }

     

       272
       272
       +
       ```

     

       273
       273
       +
       

     

       274
       274
       +
       ### Phase 4: PDS Service Auth Validation (PDS Extension)

     

       275
       275
       +
       

     

       276
       276
       +
       **Note:** This requires extending the PDS. Options:

     

       277
       277
       +
       1. Contribute to official atproto PDS

     

       278
       278
       +
       2. Run modified PDS fork

     

       279
       279
       +
       3. Use PDS middleware/proxy

     

       280
       280
       +
       

     

       281
       281
       +
       **Conceptual Implementation:**

     

       282
       282
       +
       

     

       283
       283
       +
       ```go

     

       284
       284
       +
       // PDS validates service auth requests before issuing tokens

     

       285
       285
       +
       func (h *ServiceAuthHandler) HandleGetServiceAuth(w http.ResponseWriter, r *http.Request) {

     

       286
       286
       +
           var req ServiceAuthRequest

     

       287
       287
       +
           json.NewDecoder(r.Body).Decode(&req)

     

       288
       288
       +
       

     

       289
       289
       +
           // 1. Verify requesting service is trusted

     

       290
       290
       +
           requestingDID := extractDIDFromJWT(r.Header.Get("Authorization"))

     

       291
       291
       +
           if !h.isTrustedInstance(requestingDID) {

     

       292
       292
       +
               writeError(w, http.StatusForbidden, "UntrustedInstance", "Instance not in allowlist")

     

       293
       293
       +
               return

     

       294
       294
       +
           }

     

       295
       295
       +
       

     

       296
       296
       +
           // 2. Validate community exists on this PDS

     

       297
       297
       +
           community, err := h.getCommunityByDID(req.Aud)

     

       298
       298
       +
           if err != nil {

     

       299
       299
       +
               writeError(w, http.StatusNotFound, "CommunityNotFound", "Community not hosted here")

     

       300
       300
       +
               return

     

       301
       301
       +
           }

     

       302
       302
       +
       

     

       303
       303
       +
           // 3. Check user not banned (query from AppView or local moderation records)

     

       304
       304
       +
           if h.isUserBanned(req.UserDID, req.Aud) {

     

       305
       305
       +
               writeError(w, http.StatusForbidden, "Banned", "User banned from community")

     

       306
       306
       +
               return

     

       307
       307
       +
           }

     

       308
       308
       +
       

     

       309
       309
       +
           // 4. Check community settings (allows remote posts?)

     

       310
       310
       +
           if !community.AllowFederatedPosts {

     

       311
       311
       +
               writeError(w, http.StatusForbidden, "FederationDisabled", "Community doesn't accept federated posts")

     

       312
       312
       +
               return

     

       313
       313
       +
           }

     

       314
       314
       +
       

     

       315
       315
       +
           // 5. Rate limiting (per user, per community, per instance)

     

       316
       316
       +
           if h.exceedsRateLimit(req.UserDID, req.Aud, requestingDID) {

     

       317
       317
       +
               writeError(w, http.StatusTooManyRequests, "RateLimited", "Too many requests")

     

       318
       318
       +
               return

     

       319
       319
       +
           }

     

       320
       320
       +
       

     

       321
       321
       +
           // 6. Generate scoped token

     

       322
       322
       +
           token := h.issueServiceAuthToken(ServiceAuthTokenOptions{

     

       323
       323
       +
               Audience:    req.Aud,           // Community DID

     

       324
       324
       +
               Subject:     requestingDID,     // Requesting instance DID

     

       325
       325
       +
               Method:      req.Lxm,           // Authorized method

     

       326
       326
       +
               ExpiresAt:   time.Unix(req.Exp, 0),

     

       327
       327
       +
               Scopes:      []string{"write:posts"},

     

       328
       328
       +
           })

     

       329
       329
       +
       

     

       330
       330
       +
           json.NewEncoder(w).Encode(map[string]string{

     

       331
       331
       +
               "token": token,

     

       332
       332
       +
           })

     

       333
       333
       +
       }

     

       334
       334
       +
       ```

     

       335
       335
       +
       

     

       336
       336
       +
       ---

     

       337
       337
       +
       

     

       338
       338
       +
       ## Database Schema Changes

     

       339
       339
       +
       

     

       340
       340
       +
       ### New Table: `instance_federation`

     

       341
       341
       +
       

     

       342
       342
       +
       Tracks trusted instances and federation settings:

     

       343
       343
       +
       

     

       344
       344
       +
       ```sql

     

       345
       345
       +
       CREATE TABLE instance_federation (

     

       346
       346
       +
           id SERIAL PRIMARY KEY,

     

       347
       347
       +
           instance_did TEXT NOT NULL UNIQUE,

     

       348
       348
       +
           instance_domain TEXT NOT NULL,

     

       349
       349
       +
           trust_level TEXT NOT NULL,  -- 'trusted', 'limited', 'blocked'

     

       350
       350
       +
           allowed_methods TEXT[] NOT NULL DEFAULT '{}',

     

       351
       351
       +
           rate_limit_posts_per_hour INTEGER NOT NULL DEFAULT 100,

     

       352
       352
       +
           created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),

     

       353
       353
       +
           updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),

     

       354
       354
       +
           notes TEXT

     

       355
       355
       +
       );

     

       356
       356
       +
       

     

       357
       357
       +
       CREATE INDEX idx_instance_federation_did ON instance_federation(instance_did);

     

       358
       358
       +
       CREATE INDEX idx_instance_federation_trust ON instance_federation(trust_level);

     

       359
       359
       +
       ```

     

       360
       360
       +
       

     

       361
       361
       +
       ### New Table: `federation_rate_limits`

     

       362
       362
       +
       

     

       363
       363
       +
       Track federated post rate limits:

     

       364
       364
       +
       

     

       365
       365
       +
       ```sql

     

       366
       366
       +
       CREATE TABLE federation_rate_limits (

     

       367
       367
       +
           id SERIAL PRIMARY KEY,

     

       368
       368
       +
           user_did TEXT NOT NULL,

     

       369
       369
       +
           community_did TEXT NOT NULL,

     

       370
       370
       +
           instance_did TEXT NOT NULL,

     

       371
       371
       +
           window_start TIMESTAMPTZ NOT NULL,

     

       372
       372
       +
           post_count INTEGER NOT NULL DEFAULT 1,

     

       373
       373
       +
           created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),

     

       374
       374
       +
           updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),

     

       375
       375
       +
       

     

       376
       376
       +
           UNIQUE(user_did, community_did, instance_did, window_start)

     

       377
       377
       +
       );

     

       378
       378
       +
       

     

       379
       379
       +
       CREATE INDEX idx_federation_rate_limits_lookup

     

       380
       380
       +
           ON federation_rate_limits(user_did, community_did, instance_did, window_start);

     

       381
       381
       +
       ```

     

       382
       382
       +
       

     

       383
       383
       +
       ### Update Table: `communities`

     

       384
       384
       +
       

     

       385
       385
       +
       Add federation settings:

     

       386
       386
       +
       

     

       387
       387
       +
       ```sql

     

       388
       388
       +
       ALTER TABLE communities

     

       389
       389
       +
       ADD COLUMN allow_federated_posts BOOLEAN NOT NULL DEFAULT true,

     

       390
       390
       +
       ADD COLUMN federation_mode TEXT NOT NULL DEFAULT 'open';

     

       391
       391
       +
       -- federation_mode: 'open' (any instance), 'allowlist' (trusted only), 'local' (no federation)

     

       392
       392
       +
       ```

     

       393
       393
       +
       

     

       394
       394
       +
       ---

     

       395
       395
       +
       

     

       396
       396
       +
       ## Security Considerations

     

       397
       397
       +
       

     

       398
       398
       +
       ### 1. Instance Trust Model

     

       399
       399
       +
       

     

       400
       400
       +
       **Allowlist Approach (Beta):**

     

       401
       401
       +
       - Manual approval of federated instances

     

       402
       402
       +
       - Admin UI to manage instance trust levels

     

       403
       403
       +
       - Default: block all, explicit allow

     

       404
       404
       +
       

     

       405
       405
       +
       **Trust Levels:**

     

       406
       406
       +
       - `trusted` - Full federation, normal rate limits

     

       407
       407
       +
       - `limited` - Federation allowed, strict rate limits

     

       408
       408
       +
       - `blocked` - No federation

     

       409
       409
       +
       

     

       410
       410
       +
       ### 2. User Ban Synchronization

     

       411
       411
       +
       

     

       412
       412
       +
       **Challenge:** Remote instance needs to check local bans

     

       413
       413
       +
       

     

       414
       414
       +
       **Options:**

     

       415
       415
       +
       1. **Service auth validation** - PDS queries AppView for ban status

     

       416
       416
       +
       2. **Ban records in PDS** - Moderation records stored in community repo

     

       417
       417
       +
       3. **Cached ban list** - Remote instances cache ban lists (with TTL)

     

       418
       418
       +
       

     

       419
       419
       +
       **Beta Approach:** Option 1 (service auth validation queries AppView)

     

       420
       420
       +
       

     

       421
       421
       +
       ### 3. Rate Limiting

     

       422
       422
       +
       

     

       423
       423
       +
       **Multi-level rate limits:**

     

       424
       424
       +
       - Per user per community: 10 posts/hour

     

       425
       425
       +
       - Per instance per community: 100 posts/hour

     

       426
       426
       +
       - Per user across all communities: 50 posts/hour

     

       427
       427
       +
       

     

       428
       428
       +
       **Implementation:** In-memory + PostgreSQL for persistence

     

       429
       429
       +
       

     

       430
       430
       +
       ### 4. Content Validation

     

       431
       431
       +
       

     

       432
       432
       +
       **Same validation as local posts:**

     

       433
       433
       +
       - Lexicon validation

     

       434
       434
       +
       - Content length limits

     

       435
       435
       +
       - Embed validation

     

       436
       436
       +
       - Label validation

     

       437
       437
       +
       

     

       438
       438
       +
       **Additional federation checks:**

     

       439
       439
       +
       - Verify author DID is valid

     

       440
       440
       +
       - Verify requesting instance signature

     

       441
       441
       +
       - Verify token scopes match operation

     

       442
       442
       +
       

     

       443
       443
       +
       ---

     

       444
       444
       +
       

     

       445
       445
       +
       ## API Changes

     

       446
       446
       +
       

     

       447
       447
       +
       ### New Endpoint: `social.coves.federation.getTrustedInstances`

     

       448
       448
       +
       

     

       449
       449
       +
       **Purpose:** List instances this instance federates with

     

       450
       450
       +
       

     

       451
       451
       +
       **Lexicon:**

     

       452
       452
       +
       ```json

     

       453
       453
       +
       {

     

       454
       454
       +
         "lexicon": 1,

     

       455
       455
       +
         "id": "social.coves.federation.getTrustedInstances",

     

       456
       456
       +
         "defs": {

     

       457
       457
       +
           "main": {

     

       458
       458
       +
             "type": "query",

     

       459
       459
       +
             "output": {

     

       460
       460
       +
               "encoding": "application/json",

     

       461
       461
       +
               "schema": {

     

       462
       462
       +
                 "type": "object",

     

       463
       463
       +
                 "required": ["instances"],

     

       464
       464
       +
                 "properties": {

     

       465
       465
       +
                   "instances": {

     

       466
       466
       +
                     "type": "array",

     

       467
       467
       +
                     "items": { "$ref": "#instanceView" }

     

       468
       468
       +
                   }

     

       469
       469
       +
                 }

     

       470
       470
       +
               }

     

       471
       471
       +
             }

     

       472
       472
       +
           },

     

       473
       473
       +
           "instanceView": {

     

       474
       474
       +
             "type": "object",

     

       475
       475
       +
             "required": ["did", "domain", "trustLevel"],

     

       476
       476
       +
             "properties": {

     

       477
       477
       +
               "did": { "type": "string" },

     

       478
       478
       +
               "domain": { "type": "string" },

     

       479
       479
       +
               "trustLevel": { "type": "string" },

     

       480
       480
       +
               "allowedMethods": { "type": "array", "items": { "type": "string" } }

     

       481
       481
       +
             }

     

       482
       482
       +
           }

     

       483
       483
       +
         }

     

       484
       484
       +
       }

     

       485
       485
       +
       ```

     

       486
       486
       +
       

     

       487
       487
       +
       ### Modified Endpoint: `social.coves.community.post.create`

     

       488
       488
       +
       

     

       489
       489
       +
       **Changes:**

     

       490
       490
       +
       - No API contract changes

     

       491
       491
       +
       - Internal routing: local vs federated

     

       492
       492
       +
       - New error codes:

     

       493
       493
       +
         - `FederationFailed` - Remote instance unreachable

     

       494
       494
       +
         - `RemoteNotAuthorized` - Remote instance rejected auth

     

       495
       495
       +
         - `RemoteBanned` - User banned on remote community

     

       496
       496
       +
       

     

       497
       497
       +
       ---

     

       498
       498
       +
       

     

       499
       499
       +
       ## User Experience

     

       500
       500
       +
       

     

       501
       501
       +
       ### Happy Path: Cross-Instance Post

     

       502
       502
       +
       

     

       503
       503
       +
       1. User on coves.social navigates to !gaming@covesinstance.com

     

       504
       504
       +
       2. Clicks "Create Post"

     

       505
       505
       +
       3. Fills out post form (title, content, etc.)

     

       506
       506
       +
       4. Clicks "Submit"

     

       507
       507
       +
       5. **Behind the scenes:**

     

       508
       508
       +
          - coves.social requests service auth from covesinstance.com

     

       509
       509
       +
          - covesinstance.com validates and issues token

     

       510
       510
       +
          - coves.social writes post using token

     

       511
       511
       +
          - Post appears in feed within seconds (via firehose)

     

       512
       512
       +
       6. **User sees:** Post published successfully

     

       513
       513
       +
       7. Post appears in:

     

       514
       514
       +
          - covesinstance.com feeds (native community)

     

       515
       515
       +
          - coves.social discover/all feeds (indexed via firehose)

     

       516
       516
       +
          - User's profile on coves.social

     

       517
       517
       +
       

     

       518
       518
       +
       ### Error Cases

     

       519
       519
       +
       

     

       520
       520
       +
       **User Banned:**

     

       521
       521
       +
       - Error: "You are banned from !gaming@covesinstance.com"

     

       522
       522
       +
       - Suggestion: "Contact community moderators for more information"

     

       523
       523
       +
       

     

       524
       524
       +
       **Instance Blocked:**

     

       525
       525
       +
       - Error: "This community does not accept posts from your instance"

     

       526
       526
       +
       - Suggestion: "Contact community administrators or create a local account"

     

       527
       527
       +
       

     

       528
       528
       +
       **Federation Unavailable:**

     

       529
       529
       +
       - Error: "Unable to connect to covesinstance.com. Try again later."

     

       530
       530
       +
       - Fallback: Allow saving as draft (future feature)

     

       531
       531
       +
       

     

       532
       532
       +
       **Rate Limited:**

     

       533
       533
       +
       - Error: "You're posting too quickly. Please wait before posting again."

     

       534
       534
       +
       - Show: Countdown until next post allowed

     

       535
       535
       +
       

     

       536
       536
       +
       ---

     

       537
       537
       +
       

     

       538
       538
       +
       ## Testing Requirements

     

       539
       539
       +
       

     

       540
       540
       +
       ### Unit Tests

     

       541
       541
       +
       

     

       542
       542
       +
       1. **Service Detection:**

     

       543
       543
       +
          - `isLocalCommunity()` correctly identifies local vs remote

     

       544
       544
       +
          - Handles edge cases (different ports, subdomains)

     

       545
       545
       +
       

     

       546
       546
       +
       2. **Service Auth Client:**

     

       547
       547
       +
          - Correctly formats service auth requests

     

       548
       548
       +
          - Handles token expiration

     

       549
       549
       +
          - Retries on transient failures

     

       550
       550
       +
       

     

       551
       551
       +
       3. **Federated Post Creation:**

     

       552
       552
       +
          - Uses service auth token instead of community credentials

     

       553
       553
       +
          - Falls back gracefully on errors

     

       554
       554
       +
          - Logs federation events

     

       555
       555
       +
       

     

       556
       556
       +
       ### Integration Tests

     

       557
       557
       +
       

     

       558
       558
       +
       1. **Local Post (Regression):**

     

       559
       559
       +
          - Posting to local community still works

     

       560
       560
       +
          - No performance degradation

     

       561
       561
       +
       

     

       562
       562
       +
       2. **Federated Post:**

     

       563
       563
       +
          - User can post to remote community

     

       564
       564
       +
          - Service auth token requested correctly

     

       565
       565
       +
          - Post written to remote PDS

     

       566
       566
       +
          - Post indexed by both AppViews

     

       567
       567
       +
       

     

       568
       568
       +
       3. **Authorization Failures:**

     

       569
       569
       +
          - Banned users rejected at service auth stage

     

       570
       570
       +
          - Untrusted instances rejected

     

       571
       571
       +
          - Expired tokens rejected

     

       572
       572
       +
       

     

       573
       573
       +
       4. **Rate Limiting:**

     

       574
       574
       +
          - Per-user rate limits enforced

     

       575
       575
       +
          - Per-instance rate limits enforced

     

       576
       576
       +
          - Rate limit resets correctly

     

       577
       577
       +
       

     

       578
       578
       +
       ### End-to-End Tests

     

       579
       579
       +
       

     

       580
       580
       +
       1. **Cross-Instance User Journey:**

     

       581
       581
       +
          - Set up two instances (instance-a, instance-b)

     

       582
       582
       +
          - Create community on instance-b

     

       583
       583
       +
          - User on instance-a posts to instance-b community

     

       584
       584
       +
          - Verify post appears on both instances

     

       585
       585
       +
       

     

       586
       586
       +
       2. **Moderation Enforcement:**

     

       587
       587
       +
          - Ban user on remote instance

     

       588
       588
       +
          - Verify user can't post from any instance

     

       589
       589
       +
          - Unban user

     

       590
       590
       +
          - Verify user can post again

     

       591
       591
       +
       

     

       592
       592
       +
       3. **Instance Blocklist:**

     

       593
       593
       +
          - Block instance-a on instance-b

     

       594
       594
       +
          - Verify users from instance-a can't post to instance-b communities

     

       595
       595
       +
          - Unblock instance-a

     

       596
       596
       +
          - Verify posting works again

     

       597
       597
       +
       

     

       598
       598
       +
       ---

     

       599
       599
       +
       

     

       600
       600
       +
       ## Migration Path (Alpha → Beta)

     

       601
       601
       +
       

     

       602
       602
       +
       ### Phase 1: Backend Implementation (No User Impact)

     

       603
       603
       +
       1. Add service auth client

     

       604
       604
       +
       2. Add local vs remote detection

     

       605
       605
       +
       3. Deploy with feature flag `ENABLE_FEDERATION=false`

     

       606
       606
       +
       

     

       607
       607
       +
       ### Phase 2: Database Migration

     

       608
       608
       +
       1. Add federation tables

     

       609
       609
       +
       2. Seed with initial trusted instances (manual)

     

       610
       610
       +
       3. Add community federation flags (default: allow)

     

       611
       611
       +
       

     

       612
       612
       +
       ### Phase 3: Soft Launch

     

       613
       613
       +
       1. Enable federation for single test instance

     

       614
       614
       +
       2. Monitor service auth requests/errors

     

       615
       615
       +
       3. Validate rate limiting works

     

       616
       616
       +
       

     

       617
       617
       +
       ### Phase 4: Beta Rollout

     

       618
       618
       +
       1. Enable `ENABLE_FEDERATION=true` for all instances

     

       619
       619
       +
       2. Admin UI for managing trusted instances

     

       620
       620
       +
       3. Community settings for federation preferences

     

       621
       621
       +
       

     

       622
       622
       +
       ### Phase 5: Documentation & Onboarding

     

       623
       623
       +
       1. Instance operator guide: "How to federate with other instances"

     

       624
       624
       +
       2. Community moderator guide: "Federation settings"

     

       625
       625
       +
       3. User guide: "Posting across instances"

     

       626
       626
       +
       

     

       627
       627
       +
       ---

     

       628
       628
       +
       

     

       629
       629
       +
       ## Metrics & Success Criteria

     

       630
       630
       +
       

     

       631
       631
       +
       ### Performance Metrics

     

       632
       632
       +
       - Service auth request latency: p95 < 200ms

     

       633
       633
       +
       - Federated post creation time: p95 < 2 seconds (vs 500ms local)

     

       634
       634
       +
       - Service auth token cache hit rate: > 80%

     

       635
       635
       +
       

     

       636
       636
       +
       ### Adoption Metrics

     

       637
       637
       +
       - % of posts that are federated: Target 20% by end of Beta

     

       638
       638
       +
       - Number of federated instances: Target 5+ by end of Beta

     

       639
       639
       +
       - Cross-instance engagement (comments, votes): Monitor trend

     

       640
       640
       +
       

     

       641
       641
       +
       ### Reliability Metrics

     

       642
       642
       +
       - Service auth success rate: > 99%

     

       643
       643
       +
       - Federated post success rate: > 95%

     

       644
       644
       +
       - Service auth token validation errors: < 1%

     

       645
       645
       +
       

     

       646
       646
       +
       ### Security Metrics

     

       647
       647
       +
       - Unauthorized access attempts: Monitor & alert

     

       648
       648
       +
       - Rate limit triggers: Track per instance

     

       649
       649
       +
       - Ban evasion attempts: Zero tolerance

     

       650
       650
       +
       

     

       651
       651
       +
       ---

     

       652
       652
       +
       

     

       653
       653
       +
       ## Rollback Plan

     

       654
       654
       +
       

     

       655
       655
       +
       If federation causes critical issues:

     

       656
       656
       +
       

     

       657
       657
       +
       1. **Immediate:** Set `ENABLE_FEDERATION=false` via env var

     

       658
       658
       +
       2. **Fallback:** All posts route through local-only flow

     

       659
       659
       +
       3. **Investigation:** Review logs for service auth failures

     

       660
       660
       +
       4. **Fix Forward:** Deploy patch, re-enable gradually

     

       661
       661
       +
       

     

       662
       662
       +
       **No data loss:** Posts are written to PDS, indexed via firehose regardless of federation method.

     

       663
       663
       +
       

     

       664
       664
       +
       ---

     

       665
       665
       +
       

     

       666
       666
       +
       ## Open Questions

     

       667
       667
       +
       

     

       668
       668
       +
       1. **Instance Discovery:** How do users find communities on other instances?

     

       669
       669
       +
          - Beta: Manual (users share links)

     

       670
       670
       +
          - Future: Instance directory, community search across instances

     

       671
       671
       +
       

     

       672
       672
       +
       2. **Service Auth Token Caching:** Should AppViews cache service auth tokens?

     

       673
       673
       +
          - Pros: Reduce latency, fewer PDS requests

     

       674
       674
       +
          - Cons: Stale permissions, ban enforcement delay

     

       675
       675
       +
          - **Decision needed:** Cache with short TTL (5 minutes)?

     

       676
       676
       +
       

     

       677
       677
       +
       3. **PDS Implementation:** Who implements service auth validation?

     

       678
       678
       +
          - Option A: Contribute to official PDS (long timeline)

     

       679
       679
       +
          - Option B: Run forked PDS (maintenance burden)

     

       680
       680
       +
          - Option C: Proxy/middleware (added complexity)

     

       681
       681
       +
          - **Decision needed:** Start with Option B, migrate to Option A?

     

       682
       682
       +
       

     

       683
       683
       +
       4. **Federation Symmetry:** If instance-a trusts instance-b, does instance-b auto-trust instance-a?

     

       684
       684
       +
          - Beta: No (asymmetric trust)

     

       685
       685
       +
          - Future: Mutual federation agreements?

     

       686
       686
       +
       

     

       687
       687
       +
       5. **Cross-Instance Moderation:** Should bans propagate across instances?

     

       688
       688
       +
          - Beta: No (each instance decides)

     

       689
       689
       +
          - Future: Shared moderation lists?

     

       690
       690
       +
       

     

       691
       691
       +
       ---

     

       692
       692
       +
       

     

       693
       693
       +
       ## Future Enhancements (Post-Beta)

     

       694
       694
       +
       

     

       695
       695
       +
       1. **Service Auth Token Caching:** Reduce latency for frequent posters

     

       696
       696
       +
       2. **Batch Service Auth:** Request tokens for multiple communities at once

     

       697
       697
       +
       3. **Instance Discovery API:** Automatic instance detection/registration

     

       698
       698
       +
       4. **Federation Analytics:** Dashboard showing cross-instance activity

     

       699
       699
       +
       5. **Moderation Sync:** Optional shared ban lists across trusted instances

     

       700
       700
       +
       6. **Content Mirroring:** Cache federated posts locally for performance

     

       701
       701
       +
       7. **User Migration:** Transfer account between instances

     

       702
       702
       +
       

     

       703
       703
       +
       ---

     

       704
       704
       +
       

     

       705
       705
       +
       ## Resources

     

       706
       706
       +
       

     

       707
       707
       +
       ### Documentation

     

       708
       708
       +
       - [atProto Service Auth Spec](https://atproto.com/specs/service-auth) (hypothetical - check actual docs)

     

       709
       709
       +
       - Lemmy Federation Architecture

     

       710
       710
       +
       - Mastodon Federation Implementation

     

       711
       711
       +
       

     

       712
       712
       +
       ### Code References

     

       713
       713
       +
       - `internal/core/posts/service.go` - Post creation service

     

       714
       714
       +
       - `internal/api/handlers/post/create.go` - Post creation handler

     

       715
       715
       +
       - `internal/atproto/jetstream/` - Firehose consumers

     

       716
       716
       +
       

     

       717
       717
       +
       ### Dependencies

     

       718
       718
       +
       - atproto SDK (for service auth)

     

       719
       719
       +
       - PDS v0.4+ (service auth support)

     

       720
       720
       +
       - PostgreSQL 14+ (for federation tables)

     

       721
       721
       +
       

     

       722
       722
       +
       ---

     

       723
       723
       +
       

     

       724
       724
       +
       ## Appendix A: Service Auth Request Example

     

       725
       725
       +
       

     

       726
       726
       +
       **Request to Remote PDS:**

     

       727
       727
       +
       ```http

     

       728
       728
       +
       POST https://covesinstance.com/xrpc/com.atproto.server.getServiceAuth

     

       729
       729
       +
       Authorization: Bearer {coves-social-instance-jwt}

     

       730
       730
       +
       Content-Type: application/json

     

       731
       731
       +
       

     

       732
       732
       +
       {

     

       733
       733
       +
         "aud": "did:plc:community123",

     

       734
       734
       +
         "exp": 1700000000,

     

       735
       735
       +
         "lxm": "social.coves.community.post.create"

     

       736
       736
       +
       }

     

       737
       737
       +
       ```

     

       738
       738
       +
       

     

       739
       739
       +
       **Response:**

     

       740
       740
       +
       ```http

     

       741
       741
       +
       HTTP/1.1 200 OK

     

       742
       742
       +
       Content-Type: application/json

     

       743
       743
       +
       

     

       744
       744
       +
       {

     

       745
       745
       +
         "token": "eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9..."

     

       746
       746
       +
       }

     

       747
       747
       +
       ```

     

       748
       748
       +
       

     

       749
       749
       +
       **Using Token to Create Post:**

     

       750
       750
       +
       ```http

     

       751
       751
       +
       POST https://covesinstance.com/xrpc/com.atproto.repo.createRecord

     

       752
       752
       +
       Authorization: Bearer {service-auth-token}

     

       753
       753
       +
       Content-Type: application/json

     

       754
       754
       +
       

     

       755
       755
       +
       {

     

       756
       756
       +
         "repo": "did:plc:community123",

     

       757
       757
       +
         "collection": "social.coves.community.post",

     

       758
       758
       +
         "record": {

     

       759
       759
       +
           "$type": "social.coves.community.post",

     

       760
       760
       +
           "community": "did:plc:community123",

     

       761
       761
       +
           "author": "did:plc:user456",

     

       762
       762
       +
           "title": "Hello from coves.social!",

     

       763
       763
       +
           "content": "This is a federated post",

     

       764
       764
       +
           "createdAt": "2024-11-16T12:00:00Z"

     

       765
       765
       +
         }

     

       766
       766
       +
       }

     

       767
       767
       +
       ```

     

       768
       768
       +
       

     

       769
       769
       +
       ---

     

       770
       770
       +
       

     

       771
       771
       +
       ## Appendix B: Error Handling Matrix

     

       772
       772
       +
       

     

       773
       773
       +
       | Error Condition | HTTP Status | Error Code | User Message | Retry Strategy |

     

       774
       774
       +
       |----------------|-------------|------------|--------------|----------------|

     

       775
       775
       +
       | Instance not trusted | 403 | `UntrustedInstance` | "This community doesn't accept posts from your instance" | No retry |

     

       776
       776
       +
       | User banned | 403 | `Banned` | "You are banned from this community" | No retry |

     

       777
       777
       +
       | Rate limit exceeded | 429 | `RateLimited` | "Too many posts. Try again in X minutes" | Exponential backoff |

     

       778
       778
       +
       | PDS unreachable | 503 | `ServiceUnavailable` | "Community temporarily unavailable" | Retry 3x with backoff |

     

       779
       779
       +
       | Invalid token | 401 | `InvalidToken` | "Session expired. Please try again" | Refresh token & retry |

     

       780
       780
       +
       | Community not found | 404 | `CommunityNotFound` | "Community not found" | No retry |

     

       781
       781
       +
       | Service auth failed | 500 | `FederationFailed` | "Unable to connect. Try again later" | Retry 2x |

     

       782
       782
       +
       

     

       783
       783
       +
       ---

     

       784
       784
       +
       

     

       785
       785
       +
       **End of PRD**

+130 -28

docs/PRD_ALPHA_GO_LIVE.md

···

       7
       7
        
       ## 🎯 Major Progress Update

     

       8
       8
        
       

     

       9
       9
        
       **✅ ALL E2E TESTS COMPLETE!** (Completed 2025-11-16)

     

       10
       10
       +
       **✅ BIDIRECTIONAL DID VERIFICATION COMPLETE!** (Completed 2025-11-16)

     

       10
       11
        
       

     

       11
       12
        
       All 6 critical E2E test suites have been implemented and are passing:

     

       12
       13
        
       - ✅ Full User Journey (signup → community → post → comment → vote)

     
···

       19
       20
        
       **Time Saved**: ~7-12 hours through parallel agent implementation

     

       20
       21
        
       **Test Quality**: Enhanced with comprehensive database record verification to catch race conditions

     

       21
       22
        
       

     

       23
       23
       +
       ### Production Deployment Requirements

     

       24
       24
       +
       

     

       25
       25
       +
       **Architecture**:

     

       26
       26
       +
       - **AppView Domain**: coves.social (instance identity, API, frontend)

     

       27
       27
       +
       - **PDS Domain**: coves.me (separate domain required - cannot be same as AppView)

     

       28
       28
       +
       - **Community Handles**: Use @coves.social (AppView domain)

     

       29
       29
       +
       - **Jetstream**: Connects to Bluesky's production firehose (wss://jetstream2.us-east.bsky.network)

     

       30
       30
       +
       

     

       31
       31
       +
       **Required: .well-known/did.json at coves.social**:

     

       32
       32
       +
       ```json

     

       33
       33
       +
       {

     

       34
       34
       +
         "id": "did:web:coves.social",

     

       35
       35
       +
         "alsoKnownAs": ["at://coves.social"],

     

       36
       36
       +
         "verificationMethod": [

     

       37
       37
       +
           {

     

       38
       38
       +
             "id": "did:web:coves.social#atproto",

     

       39
       39
       +
             "type": "Multikey",

     

       40
       40
       +
             "controller": "did:web:coves.social",

     

       41
       41
       +
             "publicKeyMultibase": "z..."

     

       42
       42
       +
           }

     

       43
       43
       +
         ],

     

       44
       44
       +
         "service": [

     

       45
       45
       +
           {

     

       46
       46
       +
             "id": "#atproto_pds",

     

       47
       47
       +
             "type": "AtprotoPersonalDataServer",

     

       48
       48
       +
             "serviceEndpoint": "https://coves.me"

     

       49
       49
       +
           }

     

       50
       50
       +
         ]

     

       51
       51
       +
       }

     

       52
       52
       +
       ```

     

       53
       53
       +
       

     

       54
       54
       +
       **Environment Variables**:

     

       55
       55
       +
       - AppView:

     

       56
       56
       +
         - `INSTANCE_DID=did:web:coves.social`

     

       57
       57
       +
         - `INSTANCE_DOMAIN=coves.social`

     

       58
       58
       +
         - `PDS_URL=https://coves.me` (separate domain)

     

       59
       59
       +
         - `SKIP_DID_WEB_VERIFICATION=false` (production)

     

       60
       60
       +
         - `JETSTREAM_URL=wss://jetstream2.us-east.bsky.network/subscribe`

     

       61
       61
       +
       

     

       62
       62
       +
       **Verification**:

     

       63
       63
       +
       - `curl https://coves.social/.well-known/did.json` (should return DID document)

     

       64
       64
       +
       - `curl https://coves.me/xrpc/_health` (PDS health check)

     

       65
       65
       +
       

     

       22
       66
        
       ## Overview

     

       23
       67
        
       

     

       24
       68
        
       This document tracks the remaining work required to launch Coves alpha with real users. Focus is on critical functionality, security, and operational readiness.

     
···

       29
       73
        
       

     

       30
       74
        
       ### 1. Authentication & Security

     

       31
       75
        
       

     

       76
       76
       +
       #### Production PDS Deployment

     

       77
       77
       +
       **CRITICAL**: PDS must be on separate domain from AppView (coves.me, not coves.social)

     

       78
       78
       +
       

     

       79
       79
       +
       - [ ] Deploy PDS to coves.me domain

     

       80
       80
       +
         - [ ] Set up DNS: A record for coves.me → server IP

     

       81
       81
       +
         - [ ] Configure SSL certificate for coves.me

     

       82
       82
       +
         - [ ] Deploy PDS container/service on port 2583

     

       83
       83
       +
         - [ ] Configure nginx/Caddy reverse proxy for coves.me → localhost:2583

     

       84
       84
       +
         - [ ] Set PDS_HOSTNAME=coves.me in PDS environment

     

       85
       85
       +
         - [ ] Mount persistent volume for PDS data (/pds/data)

     

       86
       86
       +
       - [ ] Verify PDS connectivity

     

       87
       87
       +
         - [ ] Test: `curl https://coves.me/xrpc/_health`

     

       88
       88
       +
         - [ ] Create test community account on PDS

     

       89
       89
       +
         - [ ] Verify JWKS endpoint: `curl https://coves.me/.well-known/jwks.json`

     

       90
       90
       +
         - [ ] Test community account token provisioning

     

       91
       91
       +
       - [ ] Configure AppView to use production PDS

     

       92
       92
       +
         - [ ] Set `PDS_URL=https://coves.me` in AppView .env

     

       93
       93
       +
         - [ ] Test community creation flow (provisions account on coves.me)

     

       94
       94
       +
         - [ ] Verify account provisioning works end-to-end

     

       95
       95
       +
       

     

       96
       96
       +
       **Important**: Jetstream connects to Bluesky's production firehose, which automatically includes events from all production PDS instances (including coves.me once it's live)

     

       97
       97
       +
       

     

       98
       98
       +
       **Estimated Effort**: 4-6 hours

     

       99
       99
       +
       **Risk**: Medium (infrastructure setup, DNS propagation)

     

       100
       100
       +
       

     

       32
       101
        
       #### JWT Signature Verification (Production Mode)

     

       33
       33
       -
       - [ ] Test with production PDS at `pds.bretton.dev`

     

       34
       34
       -
         - [ ] Create test account on production PDS

     

       35
       35
       -
         - [ ] Verify JWKS endpoint is accessible

     

       102
       102
       +
       - [ ] Test with production PDS at coves.me

     

       103
       103
       +
         - [ ] Verify JWKS endpoint is accessible: `https://coves.me/.well-known/jwks.json`

     

       36
       104
        
         - [ ] Run `TestJWTSignatureVerification` against production PDS

     

       37
       105
        
         - [ ] Confirm signature verification succeeds

     

       38
       38
       -
         - [ ] Test token refresh flow

     

       106
       106
       +
         - [ ] Test token refresh flow for community accounts

     

       39
       107
        
       - [ ] Set `AUTH_SKIP_VERIFY=false` in production environment

     

       40
       108
        
       - [ ] Verify all auth middleware tests pass with verification enabled

     

       41
       41
       -
       - [ ] Document production PDS requirements for communities

     

       42
       42
       -
       

     

       43
       43
       -
       **Estimated Effort**: 2-3 hours

     

       44
       44
       -
       **Risk**: Medium (code implemented, needs validation)

     

       45
       45
       -
       

     

       46
       46
       -
       #### did:web Verification

     

       47
       47
       -
       - [ ] Complete did:web domain verification implementation

     

       48
       48
       -
       - [ ] Test with real did:web identities

     

       49
       49
       -
       - [ ] Add security logging for verification failures

     

       50
       50
       -
       - [ ] Set `SKIP_DID_WEB_VERIFICATION=false` for production

     

       51
       109
        
       

     

       52
       110
        
       **Estimated Effort**: 2-3 hours

     

       53
       53
       -
       **Risk**: Medium

     

       111
       111
       +
       **Risk**: Low (depends on PDS deployment)

     

       112
       112
       +
       

     

       113
       113
       +
       #### did:web Verification ✅ COMPLETE

     

       114
       114
       +
       - [x] Complete did:web domain verification implementation (2025-11-16)

     

       115
       115
       +
       - [x] Implement Bluesky-compatible bidirectional verification

     

       116
       116
       +
       - [x] Add alsoKnownAs field verification in DID documents

     

       117
       117
       +
       - [x] Add security logging for verification failures

     

       118
       118
       +
       - [x] Update cache TTL to 24h (matches Bluesky recommendations)

     

       119
       119
       +
       - [x] Comprehensive test coverage with mock HTTP servers

     

       120
       120
       +
       - [ ] Set `SKIP_DID_WEB_VERIFICATION=false` for production (dev default: true)

     

       121
       121
       +
       - [ ] Deploy `.well-known/did.json` to production domain

     

       122
       122
       +
       

     

       123
       123
       +
       **Implementation Details**:

     

       124
       124
       +
       - **Location**: [internal/atproto/jetstream/community_consumer.go](../internal/atproto/jetstream/community_consumer.go)

     

       125
       125
       +
       - **Verification Flow**: Domain matching + DID document fetch + alsoKnownAs validation

     

       126
       126
       +
       - **Security Model**: Matches Bluesky (DNS/HTTPS authority + bidirectional binding)

     

       127
       127
       +
       - **Performance**: Bounded LRU cache (1000 entries), rate limiting (10 req/s), 24h TTL

     

       128
       128
       +
       - **Impact**: AppView indexing and federation trust (not community creation API)

     

       129
       129
       +
       - **Tests**: `tests/integration/community_hostedby_security_test.go`

     

       130
       130
       +
       

     

       131
       131
       +
       **Actual Effort**: 3 hours (implementation + testing)

     

       132
       132
       +
       **Risk**: ✅ Low (complete and tested)

     

       54
       133
        
       

     

       55
       134
        
       ### 2. DPoP Token Architecture Fix

     

       56
       135
        
       

     
···

       172
       251
        
         - [ ] Common issues and fixes

     

       173
       252
        
         - [ ] Emergency procedures (PDS down, database down, etc.)

     

       174
       253
        
       - [ ] Create production environment checklist

     

       175
       175
       -
         - [ ] All environment variables set

     

       176
       176
       -
         - [ ] `AUTH_SKIP_VERIFY=false`

     

       177
       177
       -
         - [ ] `SKIP_DID_WEB_VERIFICATION=false`

     

       178
       178
       -
         - [ ] Database migrations applied

     

       179
       179
       -
         - [ ] PDS connectivity verified

     

       180
       180
       -
         - [ ] JWKS caching working

     

       181
       181
       -
         - [ ] Jetstream consumers running

     

       254
       254
       +
         - [ ] **Domain Setup**

     

       255
       255
       +
           - [ ] AppView domain (coves.social) DNS configured

     

       256
       256
       +
           - [ ] PDS domain (coves.me) DNS configured - MUST be separate domain

     

       257
       257
       +
           - [ ] SSL certificates for both domains

     

       258
       258
       +
           - [ ] Nginx/Caddy reverse proxy configured for both domains

     

       259
       259
       +
         - [ ] **AppView Environment Variables**

     

       260
       260
       +
           - [ ] `INSTANCE_DID=did:web:coves.social`

     

       261
       261
       +
           - [ ] `INSTANCE_DOMAIN=coves.social`

     

       262
       262
       +
           - [ ] `PDS_URL=https://coves.me` (separate domain)

     

       263
       263
       +
           - [ ] `AUTH_SKIP_VERIFY=false`

     

       264
       264
       +
           - [ ] `SKIP_DID_WEB_VERIFICATION=false`

     

       265
       265
       +
           - [ ] `JETSTREAM_URL=wss://jetstream2.us-east.bsky.network/subscribe`

     

       266
       266
       +
         - [ ] **PDS Environment Variables**

     

       267
       267
       +
           - [ ] `PDS_HOSTNAME=coves.me`

     

       268
       268
       +
           - [ ] `PDS_PORT=2583`

     

       269
       269
       +
           - [ ] Persistent storage mounted

     

       270
       270
       +
         - [ ] **Deployment Verification**

     

       271
       271
       +
           - [ ] Deploy `.well-known/did.json` to coves.social with `serviceEndpoint: https://coves.me`

     

       272
       272
       +
           - [ ] Verify: `curl https://coves.social/.well-known/did.json`

     

       273
       273
       +
           - [ ] Verify: `curl https://coves.me/xrpc/_health`

     

       274
       274
       +
           - [ ] Database migrations applied

     

       275
       275
       +
           - [ ] PDS connectivity verified from AppView

     

       276
       276
       +
           - [ ] JWKS caching working

     

       277
       277
       +
           - [ ] Jetstream consumer connected to Bluesky production firehose

     

       278
       278
       +
           - [ ] Test community creation end-to-end

     

       182
       279
        
         - [ ] Monitoring and alerting active

     

       183
       280
        
       

     

       184
       281
        
       **Estimated Effort**: 6-8 hours

     
···

       342
       439
        
       ## Timeline Estimate

     

       343
       440
        
       

     

       344
       441
        
       ### Week 1: Critical Blockers (P0)

     

       345
       345
       -
       - **Days 1-2**: Authentication (JWT + did:web verification)

     

       442
       442
       +
       - ~~**Days 1-2**: Authentication (JWT + did:web verification)~~ ✅ **did:web COMPLETED**

     

       443
       443
       +
       - **Day 1**: Production PDS deployment (coves.me domain setup)

     

       444
       444
       +
       - **Day 2**: JWT signature verification with production PDS

     

       346
       445
        
       - **Day 3**: DPoP token architecture fix

     

       347
       446
        
       - ~~**Day 4**: Handle resolution + comment count reconciliation~~ ✅ **COMPLETED**

     

       348
       447
        
       - **Day 4-5**: Testing and bug fixes

     

       349
       448
        
       

     

       350
       350
       -
       **Total**: 15-20 hours (reduced from 20-25 due to completed items)

     

       449
       449
       +
       **Total**: 16-23 hours (added 4-6 hours for PDS deployment, reduced from original due to did:web completion)

     

       351
       450
        
       

     

       352
       451
        
       ### Week 2: Production Infrastructure (P1)

     

       353
       452
        
       - **Days 6-7**: Monitoring + structured logging

     
···

       363
       462
        
       

     

       364
       463
        
       **Total**: ~~20-25 hours~~ → **13 hours actual** (E2E tests) + 7-12 hours remaining (load testing, polish)

     

       365
       464
        
       

     

       366
       366
       -
       **Grand Total: ~~65-80 hours~~ → 50-65 hours remaining (approximately 1.5-2 weeks full-time)**

     

       367
       367
       -
       *(Originally 70-85 hours. Reduced by completed items: handle resolution, comment count reconciliation, and ALL E2E tests)*

     

       465
       465
       +
       **Grand Total: ~~65-80 hours~~ → 51-68 hours remaining (approximately 1.5-2 weeks full-time)**

     

       466
       466
       +
       *(Originally 70-85 hours. Adjusted for: +4-6 hours PDS deployment, -3 hours did:web completion, -13 hours E2E tests completion, -4 hours handle resolution and comment reconciliation)*

     

       368
       467
        
       

     

       369
       468
        
       **✅ Progress Update**: E2E testing section COMPLETE ahead of schedule - saved ~7-12 hours through parallel agent implementation

     

       370
       469
        
       

     
···

       377
       476
        
       - [ ] All P0 blockers resolved

     

       378
       477
        
         - ✅ Handle resolution (COMPLETE)

     

       379
       478
        
         - ✅ Comment count reconciliation (COMPLETE)

     

       479
       479
       +
         - ✅ did:web verification (COMPLETE - needs production deployment)

     

       480
       480
       +
         - [ ] Production PDS deployed to coves.me (separate domain)

     

       380
       481
        
         - [ ] JWT signature verification working with production PDS

     

       381
       482
        
         - [ ] DPoP architecture fix implemented

     

       382
       382
       -
         - [ ] did:web verification complete

     

       383
       483
        
       - [ ] Subscriptions/blocking work via client-write pattern

     

       384
       484
        
       - [x] **All integration tests passing** ✅

     

       385
       485
        
       - [x] **E2E user journey test passing** ✅

     
···

       461
       561
        
       11. [ ] Go/no-go decision

     

       462
       562
        
       12. [ ] Launch! 🚀

     

       463
       563
        
       

     

       464
       464
       -
       **🎉 Major Milestone**: All E2E tests complete! Test coverage now includes full user journey, blob uploads, concurrent operations, rate limiting, and error recovery.

     

       564
       564
       +
       **🎉 Major Milestones**:

     

       565
       565
       +
       - All E2E tests complete! Test coverage now includes full user journey, blob uploads, concurrent operations, rate limiting, and error recovery.

     

       566
       566
       +
       - Bidirectional DID verification complete! Bluesky-compatible security model with alsoKnownAs validation, 24h cache TTL, and comprehensive test coverage.

+18

internal/api/routes/aggregator.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/api/handlers/aggregator"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/atproto/identity"

     

       5
       7
        
       	"Coves/internal/core/aggregators"

     

       8
       8
       +
       	"Coves/internal/core/users"

     

       9
       9
       +
       	"net/http"

     

       10
       10
       +
       	"time"

     

       6
       11
        
       

     

       7
       12
        
       	"github.com/go-chi/chi/v5"

     

       8
       13
        
       )

     
···

       12
       17
        
       func RegisterAggregatorRoutes(

     

       13
       18
        
       	r chi.Router,

     

       14
       19
        
       	aggregatorService aggregators.Service,

     

       20
       20
       +
       	userService users.UserService,

     

       21
       21
       +
       	identityResolver identity.Resolver,

     

       15
       22
        
       ) {

     

       16
       23
        
       	// Create query handlers

     

       17
       24
        
       	getServicesHandler := aggregator.NewGetServicesHandler(aggregatorService)

     

       18
       25
        
       	getAuthorizationsHandler := aggregator.NewGetAuthorizationsHandler(aggregatorService)

     

       19
       26
        
       	listForCommunityHandler := aggregator.NewListForCommunityHandler(aggregatorService)

     

       20
       27
        
       

     

       28
       28
       +
       	// Create registration handler

     

       29
       29
       +
       	registerHandler := aggregator.NewRegisterHandler(userService, identityResolver)

     

       30
       30
       +
       

     

       21
       31
        
       	// Query endpoints (public - no auth required)

     

       22
       32
        
       	// GET /xrpc/social.coves.aggregator.getServices?dids=did:plc:abc,did:plc:def

     

       23
       33
        
       	// Following app.bsky.feed.getFeedGenerators pattern

     
···

       31
       41
        
       	// Lists aggregators authorized by a community

     

       32
       42
        
       	r.Get("/xrpc/social.coves.aggregator.listForCommunity", listForCommunityHandler.HandleListForCommunity)

     

       33
       43
        
       

     

       44
       44
       +
       	// Registration endpoint (public - no auth required)

     

       45
       45
       +
       	// Aggregators register themselves after creating their own PDS accounts

     

       46
       46
       +
       	// POST /xrpc/social.coves.aggregator.register

     

       47
       47
       +
       	// Rate limited to 10 requests per 10 minutes per IP to prevent abuse

     

       48
       48
       +
       	registrationRateLimiter := middleware.NewRateLimiter(10, 10*time.Minute)

     

       49
       49
       +
       	r.Post("/xrpc/social.coves.aggregator.register",

     

       50
       50
       +
       		registrationRateLimiter.Middleware(http.HandlerFunc(registerHandler.HandleRegister)).ServeHTTP)

     

       51
       51
       +
       

     

       34
       52
        
       	// Write endpoints (Phase 2 - require authentication and moderator permissions)

     

       35
       53
        
       	// TODO: Implement after Jetstream consumer is ready

     

       36
       54
        
       	// POST /xrpc/social.coves.aggregator.enable (requires auth + moderator)

+73

internal/atproto/lexicon/social/coves/aggregator/register.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "lexicon": 1,

     

       3
       3
       +
         "id": "social.coves.aggregator.register",

     

       4
       4
       +
         "defs": {

     

       5
       5
       +
           "main": {

     

       6
       6
       +
             "type": "procedure",

     

       7
       7
       +
             "description": "Register an existing aggregator DID with this Coves instance. Aggregators must first create their own DID via PLC directory, then call this endpoint to register. Domain ownership is verified via .well-known/atproto-did file.",

     

       8
       8
       +
             "input": {

     

       9
       9
       +
               "encoding": "application/json",

     

       10
       10
       +
               "schema": {

     

       11
       11
       +
                 "type": "object",

     

       12
       12
       +
                 "required": ["did", "domain"],

     

       13
       13
       +
                 "properties": {

     

       14
       14
       +
                   "did": {

     

       15
       15
       +
                     "type": "string",

     

       16
       16
       +
                     "format": "did",

     

       17
       17
       +
                     "description": "DID of the aggregator (did:plc or did:web format)"

     

       18
       18
       +
                   },

     

       19
       19
       +
                   "domain": {

     

       20
       20
       +
                     "type": "string",

     

       21
       21
       +
                     "format": "uri",

     

       22
       22
       +
                     "description": "Domain where the aggregator is hosted (e.g., 'rss-bot.example.com'). Must serve .well-known/atproto-did file containing the DID."

     

       23
       23
       +
                   }

     

       24
       24
       +
                 }

     

       25
       25
       +
               }

     

       26
       26
       +
             },

     

       27
       27
       +
             "output": {

     

       28
       28
       +
               "encoding": "application/json",

     

       29
       29
       +
               "schema": {

     

       30
       30
       +
                 "type": "object",

     

       31
       31
       +
                 "required": ["did", "handle"],

     

       32
       32
       +
                 "properties": {

     

       33
       33
       +
                   "did": {

     

       34
       34
       +
                     "type": "string",

     

       35
       35
       +
                     "format": "did",

     

       36
       36
       +
                     "description": "DID of the registered aggregator"

     

       37
       37
       +
                   },

     

       38
       38
       +
                   "handle": {

     

       39
       39
       +
                     "type": "string",

     

       40
       40
       +
                     "description": "Handle extracted from DID document"

     

       41
       41
       +
                   },

     

       42
       42
       +
                   "message": {

     

       43
       43
       +
                     "type": "string",

     

       44
       44
       +
                     "description": "Success message with next steps"

     

       45
       45
       +
                   }

     

       46
       46
       +
                 }

     

       47
       47
       +
               }

     

       48
       48
       +
             },

     

       49
       49
       +
             "errors": [

     

       50
       50
       +
               {

     

       51
       51
       +
                 "name": "InvalidDID",

     

       52
       52
       +
                 "description": "DID format is invalid or not did:plc or did:web format"

     

       53
       53
       +
               },

     

       54
       54
       +
               {

     

       55
       55
       +
                 "name": "DomainVerificationFailed",

     

       56
       56
       +
                 "description": "Could not verify domain ownership via .well-known/atproto-did or DID mismatch"

     

       57
       57
       +
               },

     

       58
       58
       +
               {

     

       59
       59
       +
                 "name": "AlreadyRegistered",

     

       60
       60
       +
                 "description": "This aggregator DID is already registered with this instance"

     

       61
       61
       +
               },

     

       62
       62
       +
               {

     

       63
       63
       +
                 "name": "DIDResolutionFailed",

     

       64
       64
       +
                 "description": "Could not resolve DID document to extract handle and PDS URL"

     

       65
       65
       +
               },

     

       66
       66
       +
               {

     

       67
       67
       +
                 "name": "RegistrationFailed",

     

       68
       68
       +
                 "description": "Internal server error occurred during registration"

     

       69
       69
       +
               }

     

       70
       70
       +
             ]

     

       71
       71
       +
           }

     

       72
       72
       +
         }

     

       73
       73
       +
       }

+591

docs/aggregators/SETUP_GUIDE.md

···

       1
       1
       +
       # Aggregator Setup Guide

     

       2
       2
       +
       

     

       3
       3
       +
       This guide explains how to set up and register an aggregator with Coves instances.

     

       4
       4
       +
       

     

       5
       5
       +
       ## Table of Contents

     

       6
       6
       +
       

     

       7
       7
       +
       - [Overview](#overview)

     

       8
       8
       +
       - [Architecture](#architecture)

     

       9
       9
       +
       - [Prerequisites](#prerequisites)

     

       10
       10
       +
       - [Quick Start](#quick-start)

     

       11
       11
       +
       - [Detailed Setup Steps](#detailed-setup-steps)

     

       12
       12
       +
       - [Authorization Process](#authorization-process)

     

       13
       13
       +
       - [Posting to Communities](#posting-to-communities)

     

       14
       14
       +
       - [Rate Limits](#rate-limits)

     

       15
       15
       +
       - [Security Best Practices](#security-best-practices)

     

       16
       16
       +
       - [Troubleshooting](#troubleshooting)

     

       17
       17
       +
       - [API Reference](#api-reference)

     

       18
       18
       +
       

     

       19
       19
       +
       ## Overview

     

       20
       20
       +
       

     

       21
       21
       +
       **Aggregators** are automated services that post content to Coves communities. They are similar to Bluesky's feed generators and labelers - self-managed external services that integrate with the platform.

     

       22
       22
       +
       

     

       23
       23
       +
       **Key characteristics**:

     

       24
       24
       +
       - Self-owned: You create and manage your own PDS account

     

       25
       25
       +
       - Domain-verified: Prove ownership via `.well-known/atproto-did`

     

       26
       26
       +
       - Community-authorized: Moderators grant posting permission per-community

     

       27
       27
       +
       - Rate-limited: 10 posts per hour per community

     

       28
       28
       +
       

     

       29
       29
       +
       **Example use cases**:

     

       30
       30
       +
       - RSS feed aggregators (tech news, blog posts)

     

       31
       31
       +
       - Social media cross-posters (Twitter → Coves)

     

       32
       32
       +
       - Event notifications (GitHub releases, weather alerts)

     

       33
       33
       +
       - Content curation bots (daily links, summaries)

     

       34
       34
       +
       

     

       35
       35
       +
       ## Architecture

     

       36
       36
       +
       

     

       37
       37
       +
       ### Data Flow

     

       38
       38
       +
       

     

       39
       39
       +
       ```

     

       40
       40
       +
       ┌──────────────────────────────────────────────────────────┐

     

       41
       41
       +
       │ 1. One-Time Setup                                        │

     

       42
       42
       +
       ├──────────────────────────────────────────────────────────┤

     

       43
       43
       +
       │ Aggregator creates PDS account                           │

     

       44
       44
       +
       │   ↓                                                       │

     

       45
       45
       +
       │ Proves domain ownership (.well-known)                    │

     

       46
       46
       +
       │   ↓                                                       │

     

       47
       47
       +
       │ Registers with Coves (enters users table)                │

     

       48
       48
       +
       │   ↓                                                       │

     

       49
       49
       +
       │ Writes service declaration                               │

     

       50
       50
       +
       │   ↓                                                       │

     

       51
       51
       +
       │ Jetstream indexes into aggregators table                 │

     

       52
       52
       +
       └──────────────────────────────────────────────────────────┘

     

       53
       53
       +
       

     

       54
       54
       +
       ┌──────────────────────────────────────────────────────────┐

     

       55
       55
       +
       │ 2. Per-Community Authorization                           │

     

       56
       56
       +
       ├──────────────────────────────────────────────────────────┤

     

       57
       57
       +
       │ Moderator writes authorization record                    │

     

       58
       58
       +
       │   ↓                                                       │

     

       59
       59
       +
       │ Jetstream indexes into aggregator_authorizations         │

     

       60
       60
       +
       └──────────────────────────────────────────────────────────┘

     

       61
       61
       +
       

     

       62
       62
       +
       ┌──────────────────────────────────────────────────────────┐

     

       63
       63
       +
       │ 3. Posting (Ongoing)                                     │

     

       64
       64
       +
       ├──────────────────────────────────────────────────────────┤

     

       65
       65
       +
       │ Aggregator calls post creation endpoint                  │

     

       66
       66
       +
       │   ↓                                                       │

     

       67
       67
       +
       │ Handler validates:                                        │

     

       68
       68
       +
       │   - Author in users table ✓                              │

     

       69
       69
       +
       │   - Author in aggregators table ✓                        │

     

       70
       70
       +
       │   - Authorization exists ✓                               │

     

       71
       71
       +
       │   - Rate limit not exceeded ✓                            │

     

       72
       72
       +
       │   ↓                                                       │

     

       73
       73
       +
       │ Post written to community's PDS                          │

     

       74
       74
       +
       │   ↓                                                       │

     

       75
       75
       +
       │ Jetstream indexes post                                   │

     

       76
       76
       +
       └──────────────────────────────────────────────────────────┘

     

       77
       77
       +
       ```

     

       78
       78
       +
       

     

       79
       79
       +
       ### Database Tables

     

       80
       80
       +
       

     

       81
       81
       +
       **users** - All actors (users, communities, aggregators)

     

       82
       82
       +
       ```sql

     

       83
       83
       +
       CREATE TABLE users (

     

       84
       84
       +
           did TEXT PRIMARY KEY,

     

       85
       85
       +
           handle TEXT NOT NULL,

     

       86
       86
       +
           pds_url TEXT,

     

       87
       87
       +
           indexed_at TIMESTAMPTZ

     

       88
       88
       +
       );

     

       89
       89
       +
       ```

     

       90
       90
       +
       

     

       91
       91
       +
       **aggregators** - Aggregator-specific metadata

     

       92
       92
       +
       ```sql

     

       93
       93
       +
       CREATE TABLE aggregators (

     

       94
       94
       +
           did TEXT PRIMARY KEY,

     

       95
       95
       +
           display_name TEXT NOT NULL,

     

       96
       96
       +
           description TEXT,

     

       97
       97
       +
           avatar_url TEXT,

     

       98
       98
       +
           config_schema JSONB,

     

       99
       99
       +
           source_url TEXT,

     

       100
       100
       +
           maintainer_did TEXT,

     

       101
       101
       +
           record_uri TEXT NOT NULL UNIQUE,

     

       102
       102
       +
           record_cid TEXT NOT NULL,

     

       103
       103
       +
           created_at TIMESTAMPTZ,

     

       104
       104
       +
           indexed_at TIMESTAMPTZ

     

       105
       105
       +
       );

     

       106
       106
       +
       ```

     

       107
       107
       +
       

     

       108
       108
       +
       **aggregator_authorizations** - Community authorizations

     

       109
       109
       +
       ```sql

     

       110
       110
       +
       CREATE TABLE aggregator_authorizations (

     

       111
       111
       +
           id BIGSERIAL PRIMARY KEY,

     

       112
       112
       +
           aggregator_did TEXT NOT NULL,

     

       113
       113
       +
           community_did TEXT NOT NULL,

     

       114
       114
       +
           enabled BOOLEAN NOT NULL DEFAULT true,

     

       115
       115
       +
           config JSONB,

     

       116
       116
       +
           created_by TEXT,

     

       117
       117
       +
           record_uri TEXT NOT NULL UNIQUE,

     

       118
       118
       +
           record_cid TEXT NOT NULL,

     

       119
       119
       +
           UNIQUE(aggregator_did, community_did)

     

       120
       120
       +
       );

     

       121
       121
       +
       ```

     

       122
       122
       +
       

     

       123
       123
       +
       ## Prerequisites

     

       124
       124
       +
       

     

       125
       125
       +
       1. **Domain ownership**: You must own a domain where you can host static files over HTTPS

     

       126
       126
       +
       2. **Web server**: Ability to serve the `.well-known/atproto-did` file

     

       127
       127
       +
       3. **Development tools**: `curl`, `jq`, basic shell scripting knowledge

     

       128
       128
       +
       4. **Email address**: For creating the PDS account

     

       129
       129
       +
       

     

       130
       130
       +
       **Optional**:

     

       131
       131
       +
       - Custom avatar image (PNG/JPEG/WebP, max 1MB)

     

       132
       132
       +
       - GitHub repository for source code transparency

     

       133
       133
       +
       

     

       134
       134
       +
       ## Quick Start

     

       135
       135
       +
       

     

       136
       136
       +
       We provide automated setup scripts:

     

       137
       137
       +
       

     

       138
       138
       +
       ```bash

     

       139
       139
       +
       cd scripts/aggregator-setup

     

       140
       140
       +
       

     

       141
       141
       +
       # Make scripts executable

     

       142
       142
       +
       chmod +x *.sh

     

       143
       143
       +
       

     

       144
       144
       +
       # Run setup scripts in order

     

       145
       145
       +
       ./1-create-pds-account.sh

     

       146
       146
       +
       ./2-setup-wellknown.sh

     

       147
       147
       +
       # (Upload .well-known to your web server)

     

       148
       148
       +
       ./3-register-with-coves.sh

     

       149
       149
       +
       ./4-create-service-declaration.sh

     

       150
       150
       +
       ```

     

       151
       151
       +
       

     

       152
       152
       +
       See [scripts/aggregator-setup/README.md](../../scripts/aggregator-setup/README.md) for detailed script documentation.

     

       153
       153
       +
       

     

       154
       154
       +
       ## Detailed Setup Steps

     

       155
       155
       +
       

     

       156
       156
       +
       ### Step 1: Create PDS Account

     

       157
       157
       +
       

     

       158
       158
       +
       Your aggregator needs its own atProto identity (DID). The easiest way is to create an account on an existing PDS.

     

       159
       159
       +
       

     

       160
       160
       +
       **Using an existing PDS (recommended)**:

     

       161
       161
       +
       

     

       162
       162
       +
       ```bash

     

       163
       163
       +
       curl -X POST https://bsky.social/xrpc/com.atproto.server.createAccount \

     

       164
       164
       +
         -H "Content-Type: application/json" \

     

       165
       165
       +
         -d '{

     

       166
       166
       +
           "handle": "mynewsbot.bsky.social",

     

       167
       167
       +
           "email": "bot@example.com",

     

       168
       168
       +
           "password": "secure-password-here"

     

       169
       169
       +
         }'

     

       170
       170
       +
       ```

     

       171
       171
       +
       

     

       172
       172
       +
       **Response**:

     

       173
       173
       +
       ```json

     

       174
       174
       +
       {

     

       175
       175
       +
         "accessJwt": "eyJ...",

     

       176
       176
       +
         "refreshJwt": "eyJ...",

     

       177
       177
       +
         "handle": "mynewsbot.bsky.social",

     

       178
       178
       +
         "did": "did:plc:abc123...",

     

       179
       179
       +
         "didDoc": {...}

     

       180
       180
       +
       }

     

       181
       181
       +
       ```

     

       182
       182
       +
       

     

       183
       183
       +
       **Save these credentials securely!** You'll need the DID and access token for all subsequent operations.

     

       184
       184
       +
       

     

       185
       185
       +
       **Alternative**: Run your own PDS or use `did:web` (advanced).

     

       186
       186
       +
       

     

       187
       187
       +
       ### Step 2: Prove Domain Ownership

     

       188
       188
       +
       

     

       189
       189
       +
       To register with Coves, you must prove you own a domain by serving your DID at `https://yourdomain.com/.well-known/atproto-did`.

     

       190
       190
       +
       

     

       191
       191
       +
       **Create the file**:

     

       192
       192
       +
       

     

       193
       193
       +
       ```bash

     

       194
       194
       +
       mkdir -p .well-known

     

       195
       195
       +
       echo "did:plc:abc123..." > .well-known/atproto-did

     

       196
       196
       +
       ```

     

       197
       197
       +
       

     

       198
       198
       +
       **Upload to your web server** so it's accessible at:

     

       199
       199
       +
       ```

     

       200
       200
       +
       https://rss-bot.example.com/.well-known/atproto-did

     

       201
       201
       +
       ```

     

       202
       202
       +
       

     

       203
       203
       +
       **Verify it works**:

     

       204
       204
       +
       ```bash

     

       205
       205
       +
       curl https://rss-bot.example.com/.well-known/atproto-did

     

       206
       206
       +
       # Should return: did:plc:abc123...

     

       207
       207
       +
       ```

     

       208
       208
       +
       

     

       209
       209
       +
       **Nginx configuration example**:

     

       210
       210
       +
       ```nginx

     

       211
       211
       +
       location /.well-known/atproto-did {

     

       212
       212
       +
           alias /var/www/.well-known/atproto-did;

     

       213
       213
       +
           default_type text/plain;

     

       214
       214
       +
           add_header Access-Control-Allow-Origin *;

     

       215
       215
       +
       }

     

       216
       216
       +
       ```

     

       217
       217
       +
       

     

       218
       218
       +
       ### Step 3: Register with Coves

     

       219
       219
       +
       

     

       220
       220
       +
       Call the registration endpoint to register your aggregator DID with the Coves instance.

     

       221
       221
       +
       

     

       222
       222
       +
       **Endpoint**: `POST /xrpc/social.coves.aggregator.register`

     

       223
       223
       +
       

     

       224
       224
       +
       **Request**:

     

       225
       225
       +
       ```bash

     

       226
       226
       +
       curl -X POST https://api.coves.social/xrpc/social.coves.aggregator.register \

     

       227
       227
       +
         -H "Content-Type: application/json" \

     

       228
       228
       +
         -d '{

     

       229
       229
       +
           "did": "did:plc:abc123...",

     

       230
       230
       +
           "domain": "rss-bot.example.com"

     

       231
       231
       +
         }'

     

       232
       232
       +
       ```

     

       233
       233
       +
       

     

       234
       234
       +
       **Response** (Success):

     

       235
       235
       +
       ```json

     

       236
       236
       +
       {

     

       237
       237
       +
         "did": "did:plc:abc123...",

     

       238
       238
       +
         "handle": "mynewsbot.bsky.social",

     

       239
       239
       +
         "message": "Aggregator registered successfully. Next step: create a service declaration record at at://did:plc:abc123.../social.coves.aggregator.service/self"

     

       240
       240
       +
       }

     

       241
       241
       +
       ```

     

       242
       242
       +
       

     

       243
       243
       +
       **What happens**:

     

       244
       244
       +
       1. Coves fetches `https://rss-bot.example.com/.well-known/atproto-did`

     

       245
       245
       +
       2. Verifies it contains your DID

     

       246
       246
       +
       3. Resolves your DID to get handle and PDS URL

     

       247
       247
       +
       4. Inserts you into the `users` table

     

       248
       248
       +
       

     

       249
       249
       +
       **You're now registered!** But you need to create a service declaration next.

     

       250
       250
       +
       

     

       251
       251
       +
       ### Step 4: Create Service Declaration

     

       252
       252
       +
       

     

       253
       253
       +
       Write a `social.coves.aggregator.service` record to your repository. This contains metadata about your aggregator and gets indexed by Coves' Jetstream consumer.

     

       254
       254
       +
       

     

       255
       255
       +
       **Endpoint**: `POST https://your-pds.com/xrpc/com.atproto.repo.createRecord`

     

       256
       256
       +
       

     

       257
       257
       +
       **Request**:

     

       258
       258
       +
       ```bash

     

       259
       259
       +
       curl -X POST https://bsky.social/xrpc/com.atproto.repo.createRecord \

     

       260
       260
       +
         -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \

     

       261
       261
       +
         -H "Content-Type: application/json" \

     

       262
       262
       +
         -d '{

     

       263
       263
       +
           "repo": "did:plc:abc123...",

     

       264
       264
       +
           "collection": "social.coves.aggregator.service",

     

       265
       265
       +
           "rkey": "self",

     

       266
       266
       +
           "record": {

     

       267
       267
       +
             "$type": "social.coves.aggregator.service",

     

       268
       268
       +
             "did": "did:plc:abc123...",

     

       269
       269
       +
             "displayName": "RSS News Aggregator",

     

       270
       270
       +
             "description": "Aggregates tech news from various RSS feeds",

     

       271
       271
       +
             "sourceUrl": "https://github.com/yourname/rss-aggregator",

     

       272
       272
       +
             "maintainer": "did:plc:your-personal-did",

     

       273
       273
       +
             "createdAt": "2024-01-15T12:00:00Z"

     

       274
       274
       +
           }

     

       275
       275
       +
         }'

     

       276
       276
       +
       ```

     

       277
       277
       +
       

     

       278
       278
       +
       **Response**:

     

       279
       279
       +
       ```json

     

       280
       280
       +
       {

     

       281
       281
       +
         "uri": "at://did:plc:abc123.../social.coves.aggregator.service/self",

     

       282
       282
       +
         "cid": "bafyrei..."

     

       283
       283
       +
       }

     

       284
       284
       +
       ```

     

       285
       285
       +
       

     

       286
       286
       +
       **Optional fields**:

     

       287
       287
       +
       - `avatar`: Blob reference to avatar image

     

       288
       288
       +
       - `configSchema`: JSON Schema for community-specific configuration

     

       289
       289
       +
       

     

       290
       290
       +
       **Wait 5-10 seconds** for Jetstream to index your service declaration into the `aggregators` table.

     

       291
       291
       +
       

     

       292
       292
       +
       ## Authorization Process

     

       293
       293
       +
       

     

       294
       294
       +
       Before you can post to a community, a moderator must authorize your aggregator.

     

       295
       295
       +
       

     

       296
       296
       +
       ### How Authorization Works

     

       297
       297
       +
       

     

       298
       298
       +
       1. **Moderator decision**: Community moderator evaluates your aggregator

     

       299
       299
       +
       2. **Authorization record**: Moderator writes `social.coves.aggregator.authorization` to community's repo

     

       300
       300
       +
       3. **Jetstream indexing**: Record gets indexed into `aggregator_authorizations` table

     

       301
       301
       +
       4. **Posting enabled**: You can now post to that community

     

       302
       302
       +
       

     

       303
       303
       +
       ### Authorization Record Structure

     

       304
       304
       +
       

     

       305
       305
       +
       **Location**: `at://{community_did}/social.coves.aggregator.authorization/{rkey}`

     

       306
       306
       +
       

     

       307
       307
       +
       **Example**:

     

       308
       308
       +
       ```json

     

       309
       309
       +
       {

     

       310
       310
       +
         "$type": "social.coves.aggregator.authorization",

     

       311
       311
       +
         "aggregatorDid": "did:plc:abc123...",

     

       312
       312
       +
         "communityDid": "did:plc:community123...",

     

       313
       313
       +
         "enabled": true,

     

       314
       314
       +
         "createdBy": "did:plc:moderator...",

     

       315
       315
       +
         "createdAt": "2024-01-15T12:00:00Z",

     

       316
       316
       +
         "config": {

     

       317
       317
       +
           "maxPostsPerHour": 5,

     

       318
       318
       +
           "allowedCategories": ["tech", "news"]

     

       319
       319
       +
         }

     

       320
       320
       +
       }

     

       321
       321
       +
       ```

     

       322
       322
       +
       

     

       323
       323
       +
       ### Checking Your Authorizations

     

       324
       324
       +
       

     

       325
       325
       +
       **Endpoint**: `GET /xrpc/social.coves.aggregator.getAuthorizations`

     

       326
       326
       +
       

     

       327
       327
       +
       ```bash

     

       328
       328
       +
       curl "https://api.coves.social/xrpc/social.coves.aggregator.getAuthorizations?aggregatorDid=did:plc:abc123...&enabledOnly=true"

     

       329
       329
       +
       ```

     

       330
       330
       +
       

     

       331
       331
       +
       **Response**:

     

       332
       332
       +
       ```json

     

       333
       333
       +
       {

     

       334
       334
       +
         "authorizations": [

     

       335
       335
       +
           {

     

       336
       336
       +
             "aggregatorDid": "did:plc:abc123...",

     

       337
       337
       +
             "communityDid": "did:plc:community123...",

     

       338
       338
       +
             "communityHandle": "~tech@coves.social",

     

       339
       339
       +
             "enabled": true,

     

       340
       340
       +
             "createdAt": "2024-01-15T12:00:00Z",

     

       341
       341
       +
             "config": {...}

     

       342
       342
       +
           }

     

       343
       343
       +
         ]

     

       344
       344
       +
       }

     

       345
       345
       +
       ```

     

       346
       346
       +
       

     

       347
       347
       +
       ## Posting to Communities

     

       348
       348
       +
       

     

       349
       349
       +
       Once authorized, you can post to communities using the standard post creation endpoint.

     

       350
       350
       +
       

     

       351
       351
       +
       ### Create Post

     

       352
       352
       +
       

     

       353
       353
       +
       **Endpoint**: `POST /xrpc/social.coves.community.post.create`

     

       354
       354
       +
       

     

       355
       355
       +
       **Request**:

     

       356
       356
       +
       ```bash

     

       357
       357
       +
       curl -X POST https://api.coves.social/xrpc/social.coves.community.post.create \

     

       358
       358
       +
         -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \

     

       359
       359
       +
         -H "Content-Type: application/json" \

     

       360
       360
       +
         -d '{

     

       361
       361
       +
           "communityDid": "did:plc:community123...",

     

       362
       362
       +
           "post": {

     

       363
       363
       +
             "text": "New blog post: Understanding atProto Identity\nhttps://example.com/post",

     

       364
       364
       +
             "createdAt": "2024-01-15T12:00:00Z",

     

       365
       365
       +
             "facets": [

     

       366
       366
       +
               {

     

       367
       367
       +
                 "index": { "byteStart": 50, "byteEnd": 75 },

     

       368
       368
       +
                 "features": [

     

       369
       369
       +
                   {

     

       370
       370
       +
                     "$type": "social.coves.richtext.facet#link",

     

       371
       371
       +
                     "uri": "https://example.com/post"

     

       372
       372
       +
                   }

     

       373
       373
       +
                 ]

     

       374
       374
       +
               }

     

       375
       375
       +
             ]

     

       376
       376
       +
           }

     

       377
       377
       +
         }'

     

       378
       378
       +
       ```

     

       379
       379
       +
       

     

       380
       380
       +
       **Response**:

     

       381
       381
       +
       ```json

     

       382
       382
       +
       {

     

       383
       383
       +
         "uri": "at://did:plc:abc123.../social.coves.community.post/3k...",

     

       384
       384
       +
         "cid": "bafyrei..."

     

       385
       385
       +
       }

     

       386
       386
       +
       ```

     

       387
       387
       +
       

     

       388
       388
       +
       ### Post Validation

     

       389
       389
       +
       

     

       390
       390
       +
       The handler validates:

     

       391
       391
       +
       1. **Authentication**: Valid JWT token

     

       392
       392
       +
       2. **Author exists**: DID in `users` table

     

       393
       393
       +
       3. **Is aggregator**: DID in `aggregators` table

     

       394
       394
       +
       4. **Authorization**: Active authorization for (aggregator, community)

     

       395
       395
       +
       5. **Rate limit**: Less than 10 posts/hour to this community

     

       396
       396
       +
       6. **Content**: Valid post structure per lexicon

     

       397
       397
       +
       

     

       398
       398
       +
       ### Rate Limits

     

       399
       399
       +
       

     

       400
       400
       +
       **Per-community rate limit**: 10 posts per hour

     

       401
       401
       +
       

     

       402
       402
       +
       This is tracked in the `aggregator_posts` table and enforced at the handler level.

     

       403
       403
       +
       

     

       404
       404
       +
       **Why?**: Prevents spam while allowing useful bot activity.

     

       405
       405
       +
       

     

       406
       406
       +
       **Best practices**:

     

       407
       407
       +
       - Batch similar content

     

       408
       408
       +
       - Post only high-quality content

     

       409
       409
       +
       - Respect community guidelines

     

       410
       410
       +
       - Monitor your posting rate

     

       411
       411
       +
       

     

       412
       412
       +
       ## Security Best Practices

     

       413
       413
       +
       

     

       414
       414
       +
       ### Credential Management

     

       415
       415
       +
       

     

       416
       416
       +
       ✅ **DO**:

     

       417
       417
       +
       - Store credentials in environment variables or secret management

     

       418
       418
       +
       - Use HTTPS for all API calls

     

       419
       419
       +
       - Rotate access tokens regularly (use refresh tokens)

     

       420
       420
       +
       - Keep `aggregator-config.env` out of version control

     

       421
       421
       +
       

     

       422
       422
       +
       ❌ **DON'T**:

     

       423
       423
       +
       - Hardcode credentials in source code

     

       424
       424
       +
       - Commit credentials to Git

     

       425
       425
       +
       - Share access tokens publicly

     

       426
       426
       +
       - Reuse personal credentials for bots

     

       427
       427
       +
       

     

       428
       428
       +
       ### Domain Security

     

       429
       429
       +
       

     

       430
       430
       +
       ✅ **DO**:

     

       431
       431
       +
       - Use HTTPS for `.well-known` endpoint

     

       432
       432
       +
       - Keep domain under your control

     

       433
       433
       +
       - Monitor for unauthorized changes

     

       434
       434
       +
       - Use DNSSEC if possible

     

       435
       435
       +
       

     

       436
       436
       +
       ❌ **DON'T**:

     

       437
       437
       +
       - Use HTTP (will fail verification)

     

       438
       438
       +
       - Use shared/untrusted hosting

     

       439
       439
       +
       - Allow others to modify `.well-known` files

     

       440
       440
       +
       - Use expired SSL certificates

     

       441
       441
       +
       

     

       442
       442
       +
       ### Content Security

     

       443
       443
       +
       

     

       444
       444
       +
       ✅ **DO**:

     

       445
       445
       +
       - Validate all external content before posting

     

       446
       446
       +
       - Sanitize URLs and text

     

       447
       447
       +
       - Rate-limit your own posting

     

       448
       448
       +
       - Implement circuit breakers for failures

     

       449
       449
       +
       

     

       450
       450
       +
       ❌ **DON'T**:

     

       451
       451
       +
       - Post unvalidated user input

     

       452
       452
       +
       - Include malicious links

     

       453
       453
       +
       - Spam communities

     

       454
       454
       +
       - Bypass rate limits

     

       455
       455
       +
       

     

       456
       456
       +
       ## Troubleshooting

     

       457
       457
       +
       

     

       458
       458
       +
       ### Registration Errors

     

       459
       459
       +
       

     

       460
       460
       +
       #### Error: "DomainVerificationFailed"

     

       461
       461
       +
       

     

       462
       462
       +
       **Cause**: `.well-known/atproto-did` not accessible or contains wrong DID

     

       463
       463
       +
       

     

       464
       464
       +
       **Solutions**:

     

       465
       465
       +
       1. Verify file is accessible: `curl https://yourdomain.com/.well-known/atproto-did`

     

       466
       466
       +
       2. Check content matches your DID exactly (no extra whitespace)

     

       467
       467
       +
       3. Ensure HTTPS is working (not HTTP)

     

       468
       468
       +
       4. Check web server logs for access errors

     

       469
       469
       +
       5. Verify firewall rules allow HTTPS traffic

     

       470
       470
       +
       

     

       471
       471
       +
       #### Error: "AlreadyRegistered"

     

       472
       472
       +
       

     

       473
       473
       +
       **Cause**: This DID is already registered with this Coves instance

     

       474
       474
       +
       

     

       475
       475
       +
       **Solutions**:

     

       476
       476
       +
       - This is safe to ignore if you're re-running setup

     

       477
       477
       +
       - If you need to update info, just create a new service declaration

     

       478
       478
       +
       - Contact instance admin if you need to remove registration

     

       479
       479
       +
       

     

       480
       480
       +
       #### Error: "DIDResolutionFailed"

     

       481
       481
       +
       

     

       482
       482
       +
       **Cause**: Could not resolve DID document from PLC directory

     

       483
       483
       +
       

     

       484
       484
       +
       **Solutions**:

     

       485
       485
       +
       1. Verify DID exists: `curl https://plc.directory/{your-did}`

     

       486
       486
       +
       2. Wait 30 seconds and retry (PLC propagation delay)

     

       487
       487
       +
       3. Check PDS is accessible

     

       488
       488
       +
       4. Verify DID format is correct (must start with `did:plc:` or `did:web:`)

     

       489
       489
       +
       

     

       490
       490
       +
       ### Posting Errors

     

       491
       491
       +
       

     

       492
       492
       +
       #### Error: "NotAuthorized"

     

       493
       493
       +
       

     

       494
       494
       +
       **Cause**: No active authorization for this (aggregator, community) pair

     

       495
       495
       +
       

     

       496
       496
       +
       **Solutions**:

     

       497
       497
       +
       1. Check authorizations: `GET /xrpc/social.coves.aggregator.getAuthorizations`

     

       498
       498
       +
       2. Contact community moderator to request authorization

     

       499
       499
       +
       3. Verify authorization wasn't disabled

     

       500
       500
       +
       4. Wait for Jetstream to index authorization (5-10 seconds)

     

       501
       501
       +
       

     

       502
       502
       +
       #### Error: "RateLimitExceeded"

     

       503
       503
       +
       

     

       504
       504
       +
       **Cause**: Exceeded 10 posts/hour to this community

     

       505
       505
       +
       

     

       506
       506
       +
       **Solutions**:

     

       507
       507
       +
       1. Wait for the rate limit window to reset

     

       508
       508
       +
       2. Batch posts to stay under limit

     

       509
       509
       +
       3. Distribute posts across multiple communities

     

       510
       510
       +
       4. Implement posting queue in your aggregator

     

       511
       511
       +
       

     

       512
       512
       +
       ### Service Declaration Not Appearing

     

       513
       513
       +
       

     

       514
       514
       +
       **Symptoms**: Service declaration created but not in `aggregators` table

     

       515
       515
       +
       

     

       516
       516
       +
       **Solutions**:

     

       517
       517
       +
       1. Wait 5-10 seconds for Jetstream to index

     

       518
       518
       +
       2. Check Jetstream consumer logs for errors

     

       519
       519
       +
       3. Verify record was created: Check PDS at `at://your-did/social.coves.aggregator.service/self`

     

       520
       520
       +
       4. Verify `$type` field is exactly `"social.coves.aggregator.service"`

     

       521
       521
       +
       5. Check `displayName` is not empty (required field)

     

       522
       522
       +
       

     

       523
       523
       +
       ## API Reference

     

       524
       524
       +
       

     

       525
       525
       +
       ### Registration Endpoint

     

       526
       526
       +
       

     

       527
       527
       +
       **`POST /xrpc/social.coves.aggregator.register`**

     

       528
       528
       +
       

     

       529
       529
       +
       **Input**:

     

       530
       530
       +
       ```typescript

     

       531
       531
       +
       {

     

       532
       532
       +
         did: string      // DID of aggregator (did:plc or did:web)

     

       533
       533
       +
         domain: string   // Domain serving .well-known/atproto-did

     

       534
       534
       +
       }

     

       535
       535
       +
       ```

     

       536
       536
       +
       

     

       537
       537
       +
       **Output**:

     

       538
       538
       +
       ```typescript

     

       539
       539
       +
       {

     

       540
       540
       +
         did: string      // Registered DID

     

       541
       541
       +
         handle: string   // Handle from DID document

     

       542
       542
       +
         message: string  // Next steps message

     

       543
       543
       +
       }

     

       544
       544
       +
       ```

     

       545
       545
       +
       

     

       546
       546
       +
       **Errors**:

     

       547
       547
       +
       - `InvalidDID`: DID format invalid

     

       548
       548
       +
       - `DomainVerificationFailed`: .well-known verification failed

     

       549
       549
       +
       - `AlreadyRegistered`: DID already registered

     

       550
       550
       +
       - `DIDResolutionFailed`: Could not resolve DID

     

       551
       551
       +
       

     

       552
       552
       +
       ### Query Endpoints

     

       553
       553
       +
       

     

       554
       554
       +
       **`GET /xrpc/social.coves.aggregator.getServices`**

     

       555
       555
       +
       

     

       556
       556
       +
       Get aggregator service details.

     

       557
       557
       +
       

     

       558
       558
       +
       **Parameters**:

     

       559
       559
       +
       - `dids`: Array of DIDs (comma-separated)

     

       560
       560
       +
       

     

       561
       561
       +
       **`GET /xrpc/social.coves.aggregator.getAuthorizations`**

     

       562
       562
       +
       

     

       563
       563
       +
       List communities that authorized an aggregator.

     

       564
       564
       +
       

     

       565
       565
       +
       **Parameters**:

     

       566
       566
       +
       - `aggregatorDid`: Aggregator DID

     

       567
       567
       +
       - `enabledOnly`: Filter to enabled only (default: false)

     

       568
       568
       +
       

     

       569
       569
       +
       **`GET /xrpc/social.coves.aggregator.listForCommunity`**

     

       570
       570
       +
       

     

       571
       571
       +
       List aggregators authorized by a community.

     

       572
       572
       +
       

     

       573
       573
       +
       **Parameters**:

     

       574
       574
       +
       - `communityDid`: Community DID

     

       575
       575
       +
       - `enabledOnly`: Filter to enabled only (default: false)

     

       576
       576
       +
       

     

       577
       577
       +
       ## Further Reading

     

       578
       578
       +
       

     

       579
       579
       +
       - [Aggregator PRD](PRD_AGGREGATORS.md) - Architecture and design decisions

     

       580
       580
       +
       - [atProto Guide](../../ATPROTO_GUIDE.md) - atProto fundamentals

     

       581
       581
       +
       - [Communities PRD](../PRD_COMMUNITIES.md) - Community system overview

     

       582
       582
       +
       - [Setup Scripts README](../../scripts/aggregator-setup/README.md) - Script documentation

     

       583
       583
       +
       

     

       584
       584
       +
       ## Support

     

       585
       585
       +
       

     

       586
       586
       +
       For issues or questions:

     

       587
       587
       +
       

     

       588
       588
       +
       1. Check this guide's troubleshooting section

     

       589
       589
       +
       2. Review the PRD and architecture docs

     

       590
       590
       +
       3. Check Coves GitHub issues

     

       591
       591
       +
       4. Ask in Coves developer community

+95

scripts/aggregator-setup/1-create-pds-account.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 1-create-pds-account.sh

     

       4
       4
       +
       # Purpose: Create a PDS account for your aggregator

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script helps you create an account on a PDS (Personal Data Server).

     

       7
       7
       +
       # The PDS will automatically create a DID:PLC for you.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 1: Create PDS Account for Your Aggregator"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Get PDS URL

     

       17
       17
       +
       read -p "Enter PDS URL (default: https://bsky.social): " PDS_URL

     

       18
       18
       +
       PDS_URL=${PDS_URL:-https://bsky.social}

     

       19
       19
       +
       

     

       20
       20
       +
       # Get credentials

     

       21
       21
       +
       read -p "Enter desired handle (e.g., mynewsbot.bsky.social): " HANDLE

     

       22
       22
       +
       read -p "Enter email: " EMAIL

     

       23
       23
       +
       read -sp "Enter password: " PASSWORD

     

       24
       24
       +
       echo ""

     

       25
       25
       +
       

     

       26
       26
       +
       # Validate inputs

     

       27
       27
       +
       if [ -z "$HANDLE" ] || [ -z "$EMAIL" ] || [ -z "$PASSWORD" ]; then

     

       28
       28
       +
           echo "Error: All fields are required"

     

       29
       29
       +
           exit 1

     

       30
       30
       +
       fi

     

       31
       31
       +
       

     

       32
       32
       +
       echo ""

     

       33
       33
       +
       echo "Creating account on $PDS_URL..."

     

       34
       34
       +
       

     

       35
       35
       +
       # Create account via com.atproto.server.createAccount

     

       36
       36
       +
       RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.server.createAccount" \

     

       37
       37
       +
           -H "Content-Type: application/json" \

     

       38
       38
       +
           -d "{

     

       39
       39
       +
               \"handle\": \"$HANDLE\",

     

       40
       40
       +
               \"email\": \"$EMAIL\",

     

       41
       41
       +
               \"password\": \"$PASSWORD\"

     

       42
       42
       +
           }")

     

       43
       43
       +
       

     

       44
       44
       +
       # Check if successful

     

       45
       45
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       46
       46
       +
           echo "Error creating account:"

     

       47
       47
       +
           echo "$RESPONSE" | jq '.'

     

       48
       48
       +
           exit 1

     

       49
       49
       +
       fi

     

       50
       50
       +
       

     

       51
       51
       +
       # Extract DID and access token

     

       52
       52
       +
       DID=$(echo "$RESPONSE" | jq -r '.did')

     

       53
       53
       +
       ACCESS_JWT=$(echo "$RESPONSE" | jq -r '.accessJwt')

     

       54
       54
       +
       REFRESH_JWT=$(echo "$RESPONSE" | jq -r '.refreshJwt')

     

       55
       55
       +
       

     

       56
       56
       +
       if [ -z "$DID" ] || [ "$DID" = "null" ]; then

     

       57
       57
       +
           echo "Error: Failed to extract DID from response"

     

       58
       58
       +
           echo "$RESPONSE" | jq '.'

     

       59
       59
       +
           exit 1

     

       60
       60
       +
       fi

     

       61
       61
       +
       

     

       62
       62
       +
       echo ""

     

       63
       63
       +
       echo "✓ Account created successfully!"

     

       64
       64
       +
       echo ""

     

       65
       65
       +
       echo "=== Save these credentials ===="

     

       66
       66
       +
       echo "DID:          $DID"

     

       67
       67
       +
       echo "Handle:       $HANDLE"

     

       68
       68
       +
       echo "PDS URL:      $PDS_URL"

     

       69
       69
       +
       echo "Email:        $EMAIL"

     

       70
       70
       +
       echo "Password:     [hidden]"

     

       71
       71
       +
       echo "Access JWT:   $ACCESS_JWT"

     

       72
       72
       +
       echo "Refresh JWT:  $REFRESH_JWT"

     

       73
       73
       +
       echo "==============================="

     

       74
       74
       +
       echo ""

     

       75
       75
       +
       

     

       76
       76
       +
       # Save to config file

     

       77
       77
       +
       CONFIG_FILE="aggregator-config.env"

     

       78
       78
       +
       cat > "$CONFIG_FILE" <<EOF

     

       79
       79
       +
       # Aggregator Account Configuration

     

       80
       80
       +
       # Generated: $(date)

     

       81
       81
       +
       

     

       82
       82
       +
       AGGREGATOR_DID="$DID"

     

       83
       83
       +
       AGGREGATOR_HANDLE="$HANDLE"

     

       84
       84
       +
       AGGREGATOR_PDS_URL="$PDS_URL"

     

       85
       85
       +
       AGGREGATOR_EMAIL="$EMAIL"

     

       86
       86
       +
       AGGREGATOR_PASSWORD="$PASSWORD"

     

       87
       87
       +
       AGGREGATOR_ACCESS_JWT="$ACCESS_JWT"

     

       88
       88
       +
       AGGREGATOR_REFRESH_JWT="$REFRESH_JWT"

     

       89
       89
       +
       EOF

     

       90
       90
       +
       

     

       91
       91
       +
       echo "✓ Configuration saved to $CONFIG_FILE"

     

       92
       92
       +
       echo ""

     

       93
       93
       +
       echo "IMPORTANT: Keep this file secure! It contains your credentials."

     

       94
       94
       +
       echo ""

     

       95
       95
       +
       echo "Next step: Run ./2-setup-wellknown.sh"

+93

scripts/aggregator-setup/2-setup-wellknown.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 2-setup-wellknown.sh

     

       4
       4
       +
       # Purpose: Generate .well-known/atproto-did file for domain verification

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script creates the .well-known/atproto-did file that proves you own your domain.

     

       7
       7
       +
       # You'll need to host this file at https://yourdomain.com/.well-known/atproto-did

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 2: Setup .well-known/atproto-did"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Load config if available

     

       17
       17
       +
       if [ -f "aggregator-config.env" ]; then

     

       18
       18
       +
           source aggregator-config.env

     

       19
       19
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       20
       20
       +
           echo "  DID: $AGGREGATOR_DID"

     

       21
       21
       +
           echo ""

     

       22
       22
       +
       else

     

       23
       23
       +
           echo "Configuration file not found. Please run 1-create-pds-account.sh first."

     

       24
       24
       +
           exit 1

     

       25
       25
       +
       fi

     

       26
       26
       +
       

     

       27
       27
       +
       # Get domain

     

       28
       28
       +
       read -p "Enter your aggregator's domain (e.g., rss-bot.example.com): " DOMAIN

     

       29
       29
       +
       

     

       30
       30
       +
       if [ -z "$DOMAIN" ]; then

     

       31
       31
       +
           echo "Error: Domain is required"

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       # Save domain to config

     

       36
       36
       +
       echo "" >> aggregator-config.env

     

       37
       37
       +
       echo "AGGREGATOR_DOMAIN=\"$DOMAIN\"" >> aggregator-config.env

     

       38
       38
       +
       

     

       39
       39
       +
       echo ""

     

       40
       40
       +
       echo "Creating .well-known directory..."

     

       41
       41
       +
       mkdir -p .well-known

     

       42
       42
       +
       

     

       43
       43
       +
       # Create the atproto-did file

     

       44
       44
       +
       echo "$AGGREGATOR_DID" > .well-known/atproto-did

     

       45
       45
       +
       

     

       46
       46
       +
       echo "✓ Created .well-known/atproto-did with content: $AGGREGATOR_DID"

     

       47
       47
       +
       echo ""

     

       48
       48
       +
       

     

       49
       49
       +
       echo "================================================"

     

       50
       50
       +
       echo "Next Steps:"

     

       51
       51
       +
       echo "================================================"

     

       52
       52
       +
       echo ""

     

       53
       53
       +
       echo "1. Upload the .well-known directory to your web server"

     

       54
       54
       +
       echo "   The file must be accessible at:"

     

       55
       55
       +
       echo "   https://$DOMAIN/.well-known/atproto-did"

     

       56
       56
       +
       echo ""

     

       57
       57
       +
       echo "2. Verify it's working by running:"

     

       58
       58
       +
       echo "   curl https://$DOMAIN/.well-known/atproto-did"

     

       59
       59
       +
       echo "   (Should return: $AGGREGATOR_DID)"

     

       60
       60
       +
       echo ""

     

       61
       61
       +
       echo "3. Once verified, run: ./3-register-with-coves.sh"

     

       62
       62
       +
       echo ""

     

       63
       63
       +
       

     

       64
       64
       +
       # Create nginx example

     

       65
       65
       +
       cat > nginx-example.conf <<EOF

     

       66
       66
       +
       # Example nginx configuration for serving .well-known

     

       67
       67
       +
       # Add this to your nginx server block:

     

       68
       68
       +
       

     

       69
       69
       +
       location /.well-known/atproto-did {

     

       70
       70
       +
           alias /path/to/your/.well-known/atproto-did;

     

       71
       71
       +
           default_type text/plain;

     

       72
       72
       +
           add_header Access-Control-Allow-Origin *;

     

       73
       73
       +
       }

     

       74
       74
       +
       EOF

     

       75
       75
       +
       

     

       76
       76
       +
       echo "✓ Created nginx-example.conf for reference"

     

       77
       77
       +
       echo ""

     

       78
       78
       +
       

     

       79
       79
       +
       # Create Apache example

     

       80
       80
       +
       cat > apache-example.conf <<EOF

     

       81
       81
       +
       # Example Apache configuration for serving .well-known

     

       82
       82
       +
       # Add this to your Apache virtual host:

     

       83
       83
       +
       

     

       84
       84
       +
       Alias /.well-known /path/to/your/.well-known

     

       85
       85
       +
       <Directory /path/to/your/.well-known>

     

       86
       86
       +
           Options None

     

       87
       87
       +
           AllowOverride None

     

       88
       88
       +
           Require all granted

     

       89
       89
       +
           Header set Access-Control-Allow-Origin "*"

     

       90
       90
       +
       </Directory>

     

       91
       91
       +
       EOF

     

       92
       92
       +
       

     

       93
       93
       +
       echo "✓ Created apache-example.conf for reference"

+103

scripts/aggregator-setup/3-register-with-coves.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 3-register-with-coves.sh

     

       4
       4
       +
       # Purpose: Register your aggregator with a Coves instance

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script calls the social.coves.aggregator.register XRPC endpoint

     

       7
       7
       +
       # to register your aggregator DID with the Coves instance.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 3: Register with Coves Instance"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Load config if available

     

       17
       17
       +
       if [ -f "aggregator-config.env" ]; then

     

       18
       18
       +
           source aggregator-config.env

     

       19
       19
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       20
       20
       +
           echo "  DID:    $AGGREGATOR_DID"

     

       21
       21
       +
           echo "  Domain: $AGGREGATOR_DOMAIN"

     

       22
       22
       +
           echo ""

     

       23
       23
       +
       else

     

       24
       24
       +
           echo "Configuration file not found. Please run previous scripts first."

     

       25
       25
       +
           exit 1

     

       26
       26
       +
       fi

     

       27
       27
       +
       

     

       28
       28
       +
       # Validate domain is set

     

       29
       29
       +
       if [ -z "$AGGREGATOR_DOMAIN" ]; then

     

       30
       30
       +
           echo "Error: AGGREGATOR_DOMAIN not set. Please run 2-setup-wellknown.sh first."

     

       31
       31
       +
           exit 1

     

       32
       32
       +
       fi

     

       33
       33
       +
       

     

       34
       34
       +
       # Get Coves instance URL

     

       35
       35
       +
       read -p "Enter Coves instance URL (default: https://api.coves.social): " COVES_URL

     

       36
       36
       +
       COVES_URL=${COVES_URL:-https://api.coves.social}

     

       37
       37
       +
       

     

       38
       38
       +
       echo ""

     

       39
       39
       +
       echo "Verifying .well-known/atproto-did is accessible..."

     

       40
       40
       +
       

     

       41
       41
       +
       # Verify .well-known is accessible

     

       42
       42
       +
       WELLKNOWN_URL="https://$AGGREGATOR_DOMAIN/.well-known/atproto-did"

     

       43
       43
       +
       WELLKNOWN_CONTENT=$(curl -s "$WELLKNOWN_URL" || echo "ERROR")

     

       44
       44
       +
       

     

       45
       45
       +
       if [ "$WELLKNOWN_CONTENT" = "ERROR" ]; then

     

       46
       46
       +
           echo "✗ Error: Could not access $WELLKNOWN_URL"

     

       47
       47
       +
           echo "  Please ensure the file is uploaded and accessible."

     

       48
       48
       +
           exit 1

     

       49
       49
       +
       elif [ "$WELLKNOWN_CONTENT" != "$AGGREGATOR_DID" ]; then

     

       50
       50
       +
           echo "✗ Error: .well-known/atproto-did contains wrong DID"

     

       51
       51
       +
           echo "  Expected: $AGGREGATOR_DID"

     

       52
       52
       +
           echo "  Got:      $WELLKNOWN_CONTENT"

     

       53
       53
       +
           exit 1

     

       54
       54
       +
       fi

     

       55
       55
       +
       

     

       56
       56
       +
       echo "✓ .well-known/atproto-did is correctly configured"

     

       57
       57
       +
       echo ""

     

       58
       58
       +
       

     

       59
       59
       +
       echo "Registering with $COVES_URL..."

     

       60
       60
       +
       

     

       61
       61
       +
       # Call registration endpoint

     

       62
       62
       +
       RESPONSE=$(curl -s -X POST "$COVES_URL/xrpc/social.coves.aggregator.register" \

     

       63
       63
       +
           -H "Content-Type: application/json" \

     

       64
       64
       +
           -d "{

     

       65
       65
       +
               \"did\": \"$AGGREGATOR_DID\",

     

       66
       66
       +
               \"domain\": \"$AGGREGATOR_DOMAIN\"

     

       67
       67
       +
           }")

     

       68
       68
       +
       

     

       69
       69
       +
       # Check if successful

     

       70
       70
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       71
       71
       +
           echo "✗ Registration failed:"

     

       72
       72
       +
           echo "$RESPONSE" | jq '.'

     

       73
       73
       +
           exit 1

     

       74
       74
       +
       fi

     

       75
       75
       +
       

     

       76
       76
       +
       # Extract response

     

       77
       77
       +
       REGISTERED_DID=$(echo "$RESPONSE" | jq -r '.did')

     

       78
       78
       +
       REGISTERED_HANDLE=$(echo "$RESPONSE" | jq -r '.handle')

     

       79
       79
       +
       MESSAGE=$(echo "$RESPONSE" | jq -r '.message')

     

       80
       80
       +
       

     

       81
       81
       +
       if [ -z "$REGISTERED_DID" ] || [ "$REGISTERED_DID" = "null" ]; then

     

       82
       82
       +
           echo "✗ Error: Unexpected response format"

     

       83
       83
       +
           echo "$RESPONSE" | jq '.'

     

       84
       84
       +
           exit 1

     

       85
       85
       +
       fi

     

       86
       86
       +
       

     

       87
       87
       +
       echo ""

     

       88
       88
       +
       echo "✓ Registration successful!"

     

       89
       89
       +
       echo ""

     

       90
       90
       +
       echo "=== Registration Details ===="

     

       91
       91
       +
       echo "DID:     $REGISTERED_DID"

     

       92
       92
       +
       echo "Handle:  $REGISTERED_HANDLE"

     

       93
       93
       +
       echo "Message: $MESSAGE"

     

       94
       94
       +
       echo "============================="

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       

     

       97
       97
       +
       # Save Coves URL to config

     

       98
       98
       +
       echo "" >> aggregator-config.env

     

       99
       99
       +
       echo "COVES_INSTANCE_URL=\"$COVES_URL\"" >> aggregator-config.env

     

       100
       100
       +
       

     

       101
       101
       +
       echo "✓ Updated aggregator-config.env with Coves instance URL"

     

       102
       102
       +
       echo ""

     

       103
       103
       +
       echo "Next step: Run ./4-create-service-declaration.sh"

+125

scripts/aggregator-setup/4-create-service-declaration.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 4-create-service-declaration.sh

     

       4
       4
       +
       # Purpose: Create aggregator service declaration record

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script writes a social.coves.aggregator.service record to your aggregator's repository.

     

       7
       7
       +
       # This record contains metadata about your aggregator (name, description, etc.) and will be

     

       8
       8
       +
       # indexed by Coves' Jetstream consumer into the aggregators table.

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       echo "================================================"

     

       13
       13
       +
       echo "Step 4: Create Service Declaration"

     

       14
       14
       +
       echo "================================================"

     

       15
       15
       +
       echo ""

     

       16
       16
       +
       

     

       17
       17
       +
       # Load config if available

     

       18
       18
       +
       if [ -f "aggregator-config.env" ]; then

     

       19
       19
       +
           source aggregator-config.env

     

       20
       20
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       21
       21
       +
           echo "  DID:       $AGGREGATOR_DID"

     

       22
       22
       +
           echo "  PDS URL:   $AGGREGATOR_PDS_URL"

     

       23
       23
       +
           echo ""

     

       24
       24
       +
       else

     

       25
       25
       +
           echo "Configuration file not found. Please run previous scripts first."

     

       26
       26
       +
           exit 1

     

       27
       27
       +
       fi

     

       28
       28
       +
       

     

       29
       29
       +
       # Validate required fields

     

       30
       30
       +
       if [ -z "$AGGREGATOR_ACCESS_JWT" ]; then

     

       31
       31
       +
           echo "Error: AGGREGATOR_ACCESS_JWT not set. Please run 1-create-pds-account.sh first."

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       echo "Enter aggregator metadata:"

     

       36
       36
       +
       echo ""

     

       37
       37
       +
       

     

       38
       38
       +
       # Get metadata from user

     

       39
       39
       +
       read -p "Display Name (e.g., 'RSS News Aggregator'): " DISPLAY_NAME

     

       40
       40
       +
       read -p "Description: " DESCRIPTION

     

       41
       41
       +
       read -p "Source URL (e.g., 'https://github.com/yourname/aggregator'): " SOURCE_URL

     

       42
       42
       +
       read -p "Maintainer DID (your personal DID, optional): " MAINTAINER_DID

     

       43
       43
       +
       

     

       44
       44
       +
       if [ -z "$DISPLAY_NAME" ]; then

     

       45
       45
       +
           echo "Error: Display name is required"

     

       46
       46
       +
           exit 1

     

       47
       47
       +
       fi

     

       48
       48
       +
       

     

       49
       49
       +
       echo ""

     

       50
       50
       +
       echo "Creating service declaration record..."

     

       51
       51
       +
       

     

       52
       52
       +
       # Build the service record

     

       53
       53
       +
       SERVICE_RECORD=$(cat <<EOF

     

       54
       54
       +
       {

     

       55
       55
       +
           "\$type": "social.coves.aggregator.service",

     

       56
       56
       +
           "did": "$AGGREGATOR_DID",

     

       57
       57
       +
           "displayName": "$DISPLAY_NAME",

     

       58
       58
       +
           "description": "$DESCRIPTION",

     

       59
       59
       +
           "sourceUrl": "$SOURCE_URL",

     

       60
       60
       +
           "maintainer": "$MAINTAINER_DID",

     

       61
       61
       +
           "createdAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"

     

       62
       62
       +
       }

     

       63
       63
       +
       EOF

     

       64
       64
       +
       )

     

       65
       65
       +
       

     

       66
       66
       +
       # Call com.atproto.repo.createRecord

     

       67
       67
       +
       RESPONSE=$(curl -s -X POST "$AGGREGATOR_PDS_URL/xrpc/com.atproto.repo.createRecord" \

     

       68
       68
       +
           -H "Authorization: Bearer $AGGREGATOR_ACCESS_JWT" \

     

       69
       69
       +
           -H "Content-Type: application/json" \

     

       70
       70
       +
           -d "{

     

       71
       71
       +
               \"repo\": \"$AGGREGATOR_DID\",

     

       72
       72
       +
               \"collection\": \"social.coves.aggregator.service\",

     

       73
       73
       +
               \"rkey\": \"self\",

     

       74
       74
       +
               \"record\": $SERVICE_RECORD

     

       75
       75
       +
           }")

     

       76
       76
       +
       

     

       77
       77
       +
       # Check if successful

     

       78
       78
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       79
       79
       +
           echo "✗ Failed to create service declaration:"

     

       80
       80
       +
           echo "$RESPONSE" | jq '.'

     

       81
       81
       +
           exit 1

     

       82
       82
       +
       fi

     

       83
       83
       +
       

     

       84
       84
       +
       # Extract response

     

       85
       85
       +
       RECORD_URI=$(echo "$RESPONSE" | jq -r '.uri')

     

       86
       86
       +
       RECORD_CID=$(echo "$RESPONSE" | jq -r '.cid')

     

       87
       87
       +
       

     

       88
       88
       +
       if [ -z "$RECORD_URI" ] || [ "$RECORD_URI" = "null" ]; then

     

       89
       89
       +
           echo "✗ Error: Unexpected response format"

     

       90
       90
       +
           echo "$RESPONSE" | jq '.'

     

       91
       91
       +
           exit 1

     

       92
       92
       +
       fi

     

       93
       93
       +
       

     

       94
       94
       +
       echo ""

     

       95
       95
       +
       echo "✓ Service declaration created successfully!"

     

       96
       96
       +
       echo ""

     

       97
       97
       +
       echo "=== Record Details ===="

     

       98
       98
       +
       echo "URI: $RECORD_URI"

     

       99
       99
       +
       echo "CID: $RECORD_CID"

     

       100
       100
       +
       echo "======================="

     

       101
       101
       +
       echo ""

     

       102
       102
       +
       

     

       103
       103
       +
       # Save to config

     

       104
       104
       +
       echo "" >> aggregator-config.env

     

       105
       105
       +
       echo "SERVICE_DECLARATION_URI=\"$RECORD_URI\"" >> aggregator-config.env

     

       106
       106
       +
       echo "SERVICE_DECLARATION_CID=\"$RECORD_CID\"" >> aggregator-config.env

     

       107
       107
       +
       

     

       108
       108
       +
       echo "✓ Updated aggregator-config.env"

     

       109
       109
       +
       echo ""

     

       110
       110
       +
       echo "================================================"

     

       111
       111
       +
       echo "Setup Complete!"

     

       112
       112
       +
       echo "================================================"

     

       113
       113
       +
       echo ""

     

       114
       114
       +
       echo "Your aggregator is now registered with Coves!"

     

       115
       115
       +
       echo ""

     

       116
       116
       +
       echo "Next steps:"

     

       117
       117
       +
       echo "1. Wait a few seconds for Jetstream to index your service declaration"

     

       118
       118
       +
       echo "2. Verify your aggregator appears in the aggregators list"

     

       119
       119
       +
       echo "3. Community moderators can now authorize your aggregator"

     

       120
       120
       +
       echo "4. Once authorized, you can start posting to communities"

     

       121
       121
       +
       echo ""

     

       122
       122
       +
       echo "To test posting, use the Coves XRPC endpoint:"

     

       123
       123
       +
       echo "  POST $COVES_INSTANCE_URL/xrpc/social.coves.community.post.create"

     

       124
       124
       +
       echo ""

     

       125
       125
       +
       echo "See docs/aggregators/SETUP_GUIDE.md for more information"

+252

scripts/aggregator-setup/README.md

···

       1
       1
       +
       # Aggregator Setup Scripts

     

       2
       2
       +
       

     

       3
       3
       +
       This directory contains scripts to help you set up and register your aggregator with Coves instances.

     

       4
       4
       +
       

     

       5
       5
       +
       ## Overview

     

       6
       6
       +
       

     

       7
       7
       +
       Aggregators are automated services that post content to Coves communities. They are similar to Bluesky's feed generators and labelers. To use aggregators with Coves, you need to:

     

       8
       8
       +
       

     

       9
       9
       +
       1. Create a PDS account for your aggregator (gets you a DID)

     

       10
       10
       +
       2. Prove you own a domain via `.well-known/atproto-did`

     

       11
       11
       +
       3. Register with a Coves instance

     

       12
       12
       +
       4. Create a service declaration record

     

       13
       13
       +
       

     

       14
       14
       +
       These scripts automate this process for you.

     

       15
       15
       +
       

     

       16
       16
       +
       ## Prerequisites

     

       17
       17
       +
       

     

       18
       18
       +
       - **Domain ownership**: You must own a domain where you can host the `.well-known/atproto-did` file

     

       19
       19
       +
       - **Web server**: Ability to serve static files over HTTPS

     

       20
       20
       +
       - **Tools**: `curl`, `jq` (for JSON processing)

     

       21
       21
       +
       - **Account**: Email address for creating the PDS account

     

       22
       22
       +
       

     

       23
       23
       +
       ## Quick Start

     

       24
       24
       +
       

     

       25
       25
       +
       ### Interactive Setup (Recommended)

     

       26
       26
       +
       

     

       27
       27
       +
       Run the scripts in order:

     

       28
       28
       +
       

     

       29
       29
       +
       ```bash

     

       30
       30
       +
       # Make scripts executable

     

       31
       31
       +
       chmod +x *.sh

     

       32
       32
       +
       

     

       33
       33
       +
       # Step 1: Create PDS account

     

       34
       34
       +
       ./1-create-pds-account.sh

     

       35
       35
       +
       

     

       36
       36
       +
       # Step 2: Generate .well-known file

     

       37
       37
       +
       ./2-setup-wellknown.sh

     

       38
       38
       +
       

     

       39
       39
       +
       # Step 3: Register with Coves (after uploading .well-known)

     

       40
       40
       +
       ./3-register-with-coves.sh

     

       41
       41
       +
       

     

       42
       42
       +
       # Step 4: Create service declaration

     

       43
       43
       +
       ./4-create-service-declaration.sh

     

       44
       44
       +
       ```

     

       45
       45
       +
       

     

       46
       46
       +
       ### Automated Setup Example

     

       47
       47
       +
       

     

       48
       48
       +
       For a reference implementation of automated setup, see the Kagi News aggregator at [aggregators/kagi-news/scripts/setup.sh](../../aggregators/kagi-news/scripts/setup.sh).

     

       49
       49
       +
       

     

       50
       50
       +
       The Kagi script shows how to automate all 4 steps (with the manual .well-known upload step in between).

     

       51
       51
       +
       

     

       52
       52
       +
       ## Script Reference

     

       53
       53
       +
       

     

       54
       54
       +
       ### 1-create-pds-account.sh

     

       55
       55
       +
       

     

       56
       56
       +
       **Purpose**: Creates a PDS account for your aggregator

     

       57
       57
       +
       

     

       58
       58
       +
       **Prompts for**:

     

       59
       59
       +
       - PDS URL (default: https://bsky.social)

     

       60
       60
       +
       - Handle (e.g., mynewsbot.bsky.social)

     

       61
       61
       +
       - Email

     

       62
       62
       +
       - Password

     

       63
       63
       +
       

     

       64
       64
       +
       **Outputs**:

     

       65
       65
       +
       - `aggregator-config.env` - Configuration file with DID and credentials

     

       66
       66
       +
       - Prints your DID and access tokens

     

       67
       67
       +
       

     

       68
       68
       +
       **Notes**:

     

       69
       69
       +
       - Keep the config file secure! It contains your credentials

     

       70
       70
       +
       - The PDS automatically generates a DID:PLC for you

     

       71
       71
       +
       - You can use any PDS service, not just bsky.social

     

       72
       72
       +
       

     

       73
       73
       +
       ### 2-setup-wellknown.sh

     

       74
       74
       +
       

     

       75
       75
       +
       **Purpose**: Generates the `.well-known/atproto-did` file for domain verification

     

       76
       76
       +
       

     

       77
       77
       +
       **Prompts for**:

     

       78
       78
       +
       - Your domain (e.g., rss-bot.example.com)

     

       79
       79
       +
       

     

       80
       80
       +
       **Outputs**:

     

       81
       81
       +
       - `.well-known/atproto-did` - File containing your DID

     

       82
       82
       +
       - `nginx-example.conf` - Example nginx configuration

     

       83
       83
       +
       - `apache-example.conf` - Example Apache configuration

     

       84
       84
       +
       

     

       85
       85
       +
       **Manual step required**:

     

       86
       86
       +
       Upload the `.well-known` directory to your web server. The file must be accessible at:

     

       87
       87
       +
       ```

     

       88
       88
       +
       https://yourdomain.com/.well-known/atproto-did

     

       89
       89
       +
       ```

     

       90
       90
       +
       

     

       91
       91
       +
       **Verify it works**:

     

       92
       92
       +
       ```bash

     

       93
       93
       +
       curl https://yourdomain.com/.well-known/atproto-did

     

       94
       94
       +
       # Should return your DID (e.g., did:plc:abc123...)

     

       95
       95
       +
       ```

     

       96
       96
       +
       

     

       97
       97
       +
       ### 3-register-with-coves.sh

     

       98
       98
       +
       

     

       99
       99
       +
       **Purpose**: Registers your aggregator with a Coves instance

     

       100
       100
       +
       

     

       101
       101
       +
       **Prompts for**:

     

       102
       102
       +
       - Coves instance URL (default: https://api.coves.social)

     

       103
       103
       +
       

     

       104
       104
       +
       **Prerequisites**:

     

       105
       105
       +
       - `.well-known/atproto-did` must be accessible from your domain

     

       106
       106
       +
       - Scripts 1 and 2 must be completed

     

       107
       107
       +
       

     

       108
       108
       +
       **What it does**:

     

       109
       109
       +
       1. Verifies your `.well-known/atproto-did` is accessible

     

       110
       110
       +
       2. Calls `social.coves.aggregator.register` XRPC endpoint

     

       111
       111
       +
       3. Coves verifies domain ownership

     

       112
       112
       +
       4. Inserts your aggregator into the `users` table

     

       113
       113
       +
       

     

       114
       114
       +
       **Outputs**:

     

       115
       115
       +
       - Updates `aggregator-config.env` with Coves instance URL

     

       116
       116
       +
       - Prints registration confirmation

     

       117
       117
       +
       

     

       118
       118
       +
       ### 4-create-service-declaration.sh

     

       119
       119
       +
       

     

       120
       120
       +
       **Purpose**: Creates the service declaration record in your repository

     

       121
       121
       +
       

     

       122
       122
       +
       **Prompts for**:

     

       123
       123
       +
       - Display name (e.g., "RSS News Aggregator")

     

       124
       124
       +
       - Description

     

       125
       125
       +
       - Source URL (GitHub repo, etc.)

     

       126
       126
       +
       - Maintainer DID (optional)

     

       127
       127
       +
       

     

       128
       128
       +
       **What it does**:

     

       129
       129
       +
       1. Creates a `social.coves.aggregator.service` record at `at://your-did/social.coves.aggregator.service/self`

     

       130
       130
       +
       2. Jetstream consumer will index this into the `aggregators` table

     

       131
       131
       +
       3. Communities can now discover and authorize your aggregator

     

       132
       132
       +
       

     

       133
       133
       +
       **Outputs**:

     

       134
       134
       +
       - Updates `aggregator-config.env` with record URI and CID

     

       135
       135
       +
       - Prints record details

     

       136
       136
       +
       

     

       137
       137
       +
       ## Configuration File

     

       138
       138
       +
       

     

       139
       139
       +
       After running the scripts, you'll have an `aggregator-config.env` file with:

     

       140
       140
       +
       

     

       141
       141
       +
       ```bash

     

       142
       142
       +
       AGGREGATOR_DID="did:plc:..."

     

       143
       143
       +
       AGGREGATOR_HANDLE="mynewsbot.bsky.social"

     

       144
       144
       +
       AGGREGATOR_PDS_URL="https://bsky.social"

     

       145
       145
       +
       AGGREGATOR_EMAIL="bot@example.com"

     

       146
       146
       +
       AGGREGATOR_PASSWORD="..."

     

       147
       147
       +
       AGGREGATOR_ACCESS_JWT="..."

     

       148
       148
       +
       AGGREGATOR_REFRESH_JWT="..."

     

       149
       149
       +
       AGGREGATOR_DOMAIN="rss-bot.example.com"

     

       150
       150
       +
       COVES_INSTANCE_URL="https://api.coves.social"

     

       151
       151
       +
       SERVICE_DECLARATION_URI="at://did:plc:.../social.coves.aggregator.service/self"

     

       152
       152
       +
       SERVICE_DECLARATION_CID="..."

     

       153
       153
       +
       ```

     

       154
       154
       +
       

     

       155
       155
       +
       **Use this in your aggregator code** to authenticate and post.

     

       156
       156
       +
       

     

       157
       157
       +
       ## What Happens Next?

     

       158
       158
       +
       

     

       159
       159
       +
       After completing all 4 steps:

     

       160
       160
       +
       

     

       161
       161
       +
       1. **Your aggregator is registered** in the Coves instance's `users` table

     

       162
       162
       +
       2. **Your service declaration is indexed** in the `aggregators` table (takes a few seconds)

     

       163
       163
       +
       3. **Community moderators can now authorize** your aggregator for their communities

     

       164
       164
       +
       4. **Once authorized**, your aggregator can post to those communities

     

       165
       165
       +
       

     

       166
       166
       +
       ## Creating an Authorization

     

       167
       167
       +
       

     

       168
       168
       +
       Authorizations are created by community moderators, not by aggregators. The moderator writes a `social.coves.aggregator.authorization` record to their community's repository.

     

       169
       169
       +
       

     

       170
       170
       +
       See `docs/aggregators/SETUP_GUIDE.md` for more information on the authorization process.

     

       171
       171
       +
       

     

       172
       172
       +
       ## Posting to Communities

     

       173
       173
       +
       

     

       174
       174
       +
       Once authorized, your aggregator can post using:

     

       175
       175
       +
       

     

       176
       176
       +
       ```bash

     

       177
       177
       +
       curl -X POST https://api.coves.social/xrpc/social.coves.community.post.create \

     

       178
       178
       +
         -H "Authorization: Bearer $AGGREGATOR_ACCESS_JWT" \

     

       179
       179
       +
         -H "Content-Type: application/json" \

     

       180
       180
       +
         -d '{

     

       181
       181
       +
           "communityDid": "did:plc:...",

     

       182
       182
       +
           "post": {

     

       183
       183
       +
             "text": "Your post content",

     

       184
       184
       +
             "createdAt": "2024-01-15T12:00:00Z"

     

       185
       185
       +
           }

     

       186
       186
       +
         }'

     

       187
       187
       +
       ```

     

       188
       188
       +
       

     

       189
       189
       +
       ## Troubleshooting

     

       190
       190
       +
       

     

       191
       191
       +
       ### Error: "DomainVerificationFailed"

     

       192
       192
       +
       

     

       193
       193
       +
       - Verify `.well-known/atproto-did` is accessible: `curl https://yourdomain.com/.well-known/atproto-did`

     

       194
       194
       +
       - Check the content matches your DID exactly (no extra whitespace)

     

       195
       195
       +
       - Ensure HTTPS is working (not HTTP)

     

       196
       196
       +
       - Check CORS headers if accessing from browser

     

       197
       197
       +
       

     

       198
       198
       +
       ### Error: "AlreadyRegistered"

     

       199
       199
       +
       

     

       200
       200
       +
       - You've already registered this DID with this Coves instance

     

       201
       201
       +
       - This is safe to ignore if you're re-running the setup

     

       202
       202
       +
       

     

       203
       203
       +
       ### Error: "DIDResolutionFailed"

     

       204
       204
       +
       

     

       205
       205
       +
       - Your DID might be invalid or not found in the PLC directory

     

       206
       206
       +
       - Verify your DID exists: `curl https://plc.directory/<your-did>`

     

       207
       207
       +
       - Wait a few seconds and try again (PLC directory might be propagating)

     

       208
       208
       +
       

     

       209
       209
       +
       ### Service declaration not appearing

     

       210
       210
       +
       

     

       211
       211
       +
       - Wait 5-10 seconds for Jetstream consumer to index it

     

       212
       212
       +
       - Check the Jetstream logs for errors

     

       213
       213
       +
       - Verify the record was created: Check your PDS at `at://your-did/social.coves.aggregator.service/self`

     

       214
       214
       +
       

     

       215
       215
       +
       ## Example: Kagi News Aggregator

     

       216
       216
       +
       

     

       217
       217
       +
       For a complete reference implementation, see the Kagi News aggregator at `aggregators/kagi-news/`.

     

       218
       218
       +
       

     

       219
       219
       +
       The Kagi aggregator includes an automated setup script at [aggregators/kagi-news/scripts/setup.sh](../../aggregators/kagi-news/scripts/setup.sh) that demonstrates how to:

     

       220
       220
       +
       

     

       221
       221
       +
       - Automate the entire registration process

     

       222
       222
       +
       - Use environment variables for configuration

     

       223
       223
       +
       - Handle errors gracefully

     

       224
       224
       +
       - Integrate the setup into your aggregator project

     

       225
       225
       +
       

     

       226
       226
       +
       This shows how you can package scripts 1-4 into a single automated flow for your specific aggregator.

     

       227
       227
       +
       

     

       228
       228
       +
       ## Security Notes

     

       229
       229
       +
       

     

       230
       230
       +
       - **Never commit `aggregator-config.env`** to version control

     

       231
       231
       +
       - Store credentials securely (use environment variables or secret management)

     

       232
       232
       +
       - Rotate access tokens regularly

     

       233
       233
       +
       - Use HTTPS for all API calls

     

       234
       234
       +
       - Validate community authorization before posting

     

       235
       235
       +
       

     

       236
       236
       +
       ## More Information

     

       237
       237
       +
       

     

       238
       238
       +
       - [Aggregator Setup Guide](../../docs/aggregators/SETUP_GUIDE.md)

     

       239
       239
       +
       - [Aggregator PRD](../../docs/aggregators/PRD_AGGREGATORS.md)

     

       240
       240
       +
       - [atProto Identity Guide](../../ATPROTO_GUIDE.md)

     

       241
       241
       +
       - [Coves Communities PRD](../../docs/PRD_COMMUNITIES.md)

     

       242
       242
       +
       

     

       243
       243
       +
       ## Support

     

       244
       244
       +
       

     

       245
       245
       +
       If you encounter issues:

     

       246
       246
       +
       

     

       247
       247
       +
       1. Check the troubleshooting section above

     

       248
       248
       +
       2. Review the full documentation in `docs/aggregators/`

     

       249
       249
       +
       3. Open an issue on GitHub with:

     

       250
       250
       +
          - Which script failed

     

       251
       251
       +
          - Error message

     

       252
       252
       +
          - Your domain (without credentials)

+195

aggregators/kagi-news/scripts/setup.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: setup-kagi-aggregator.sh

     

       4
       4
       +
       # Purpose: Complete setup script for Kagi News RSS aggregator

     

       5
       5
       +
       #

     

       6
       6
       +
       # This is a reference implementation showing automated setup for a specific aggregator.

     

       7
       7
       +
       # Other aggregator developers can use this as a template.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Kagi News RSS Aggregator - Automated Setup"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Configuration for Kagi aggregator

     

       17
       17
       +
       AGGREGATOR_NAME="kagi-news-bot"

     

       18
       18
       +
       DISPLAY_NAME="Kagi News RSS"

     

       19
       19
       +
       DESCRIPTION="Aggregates tech news from Kagi RSS feeds and posts to relevant communities"

     

       20
       20
       +
       SOURCE_URL="https://github.com/coves-social/kagi-aggregator"

     

       21
       21
       +
       

     

       22
       22
       +
       # Check if config already exists

     

       23
       23
       +
       if [ -f "kagi-aggregator-config.env" ]; then

     

       24
       24
       +
           echo "Configuration file already exists. Loading existing configuration..."

     

       25
       25
       +
           source kagi-aggregator-config.env

     

       26
       26
       +
           SKIP_ACCOUNT_CREATION=true

     

       27
       27
       +
       else

     

       28
       28
       +
           SKIP_ACCOUNT_CREATION=false

     

       29
       29
       +
       fi

     

       30
       30
       +
       

     

       31
       31
       +
       # Get runtime configuration

     

       32
       32
       +
       if [ "$SKIP_ACCOUNT_CREATION" = false ]; then

     

       33
       33
       +
           read -p "Enter PDS URL (default: https://bsky.social): " PDS_URL

     

       34
       34
       +
           PDS_URL=${PDS_URL:-https://bsky.social}

     

       35
       35
       +
       

     

       36
       36
       +
           read -p "Enter email for bot account: " EMAIL

     

       37
       37
       +
           read -sp "Enter password for bot account: " PASSWORD

     

       38
       38
       +
           echo ""

     

       39
       39
       +
       

     

       40
       40
       +
           # Generate handle

     

       41
       41
       +
           TIMESTAMP=$(date +%s)

     

       42
       42
       +
           HANDLE="$AGGREGATOR_NAME-$TIMESTAMP.bsky.social"

     

       43
       43
       +
       

     

       44
       44
       +
           echo ""

     

       45
       45
       +
           echo "Creating PDS account..."

     

       46
       46
       +
           echo "Handle: $HANDLE"

     

       47
       47
       +
       

     

       48
       48
       +
           # Create account

     

       49
       49
       +
           RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.server.createAccount" \

     

       50
       50
       +
               -H "Content-Type: application/json" \

     

       51
       51
       +
               -d "{

     

       52
       52
       +
                   \"handle\": \"$HANDLE\",

     

       53
       53
       +
                   \"email\": \"$EMAIL\",

     

       54
       54
       +
                   \"password\": \"$PASSWORD\"

     

       55
       55
       +
               }")

     

       56
       56
       +
       

     

       57
       57
       +
           if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       58
       58
       +
               echo "✗ Error creating account:"

     

       59
       59
       +
               echo "$RESPONSE" | jq '.'

     

       60
       60
       +
               exit 1

     

       61
       61
       +
           fi

     

       62
       62
       +
       

     

       63
       63
       +
           DID=$(echo "$RESPONSE" | jq -r '.did')

     

       64
       64
       +
           ACCESS_JWT=$(echo "$RESPONSE" | jq -r '.accessJwt')

     

       65
       65
       +
           REFRESH_JWT=$(echo "$RESPONSE" | jq -r '.refreshJwt')

     

       66
       66
       +
       

     

       67
       67
       +
           echo "✓ Account created: $DID"

     

       68
       68
       +
       

     

       69
       69
       +
           # Save configuration

     

       70
       70
       +
           cat > kagi-aggregator-config.env <<EOF

     

       71
       71
       +
       # Kagi Aggregator Configuration

     

       72
       72
       +
       AGGREGATOR_DID="$DID"

     

       73
       73
       +
       AGGREGATOR_HANDLE="$HANDLE"

     

       74
       74
       +
       AGGREGATOR_PDS_URL="$PDS_URL"

     

       75
       75
       +
       AGGREGATOR_EMAIL="$EMAIL"

     

       76
       76
       +
       AGGREGATOR_PASSWORD="$PASSWORD"

     

       77
       77
       +
       AGGREGATOR_ACCESS_JWT="$ACCESS_JWT"

     

       78
       78
       +
       AGGREGATOR_REFRESH_JWT="$REFRESH_JWT"

     

       79
       79
       +
       EOF

     

       80
       80
       +
       

     

       81
       81
       +
           echo "✓ Configuration saved to kagi-aggregator-config.env"

     

       82
       82
       +
       fi

     

       83
       83
       +
       

     

       84
       84
       +
       # Get domain and Coves instance

     

       85
       85
       +
       read -p "Enter aggregator domain (e.g., kagi-news.example.com): " DOMAIN

     

       86
       86
       +
       read -p "Enter Coves instance URL (default: https://api.coves.social): " COVES_URL

     

       87
       87
       +
       COVES_URL=${COVES_URL:-https://api.coves.social}

     

       88
       88
       +
       

     

       89
       89
       +
       # Setup .well-known

     

       90
       90
       +
       echo ""

     

       91
       91
       +
       echo "Setting up .well-known/atproto-did..."

     

       92
       92
       +
       mkdir -p .well-known

     

       93
       93
       +
       echo "$DID" > .well-known/atproto-did

     

       94
       94
       +
       echo "✓ Created .well-known/atproto-did"

     

       95
       95
       +
       

     

       96
       96
       +
       echo ""

     

       97
       97
       +
       echo "================================================"

     

       98
       98
       +
       echo "IMPORTANT: Manual Step Required"

     

       99
       99
       +
       echo "================================================"

     

       100
       100
       +
       echo ""

     

       101
       101
       +
       echo "Upload the .well-known directory to your web server at:"

     

       102
       102
       +
       echo "  https://$DOMAIN/.well-known/atproto-did"

     

       103
       103
       +
       echo ""

     

       104
       104
       +
       read -p "Press Enter when the file is uploaded and accessible..."

     

       105
       105
       +
       

     

       106
       106
       +
       # Verify .well-known

     

       107
       107
       +
       echo ""

     

       108
       108
       +
       echo "Verifying .well-known/atproto-did..."

     

       109
       109
       +
       WELLKNOWN_CONTENT=$(curl -s "https://$DOMAIN/.well-known/atproto-did" || echo "ERROR")

     

       110
       110
       +
       

     

       111
       111
       +
       if [ "$WELLKNOWN_CONTENT" != "$DID" ]; then

     

       112
       112
       +
           echo "✗ Error: .well-known/atproto-did not accessible or contains wrong DID"

     

       113
       113
       +
           echo "  Expected: $DID"

     

       114
       114
       +
           echo "  Got:      $WELLKNOWN_CONTENT"

     

       115
       115
       +
           exit 1

     

       116
       116
       +
       fi

     

       117
       117
       +
       

     

       118
       118
       +
       echo "✓ .well-known/atproto-did verified"

     

       119
       119
       +
       

     

       120
       120
       +
       # Register with Coves

     

       121
       121
       +
       echo ""

     

       122
       122
       +
       echo "Registering with Coves instance..."

     

       123
       123
       +
       RESPONSE=$(curl -s -X POST "$COVES_URL/xrpc/social.coves.aggregator.register" \

     

       124
       124
       +
           -H "Content-Type: application/json" \

     

       125
       125
       +
           -d "{

     

       126
       126
       +
               \"did\": \"$DID\",

     

       127
       127
       +
               \"domain\": \"$DOMAIN\"

     

       128
       128
       +
           }")

     

       129
       129
       +
       

     

       130
       130
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       131
       131
       +
           echo "✗ Registration failed:"

     

       132
       132
       +
           echo "$RESPONSE" | jq '.'

     

       133
       133
       +
           exit 1

     

       134
       134
       +
       fi

     

       135
       135
       +
       

     

       136
       136
       +
       echo "✓ Registered with Coves"

     

       137
       137
       +
       

     

       138
       138
       +
       # Create service declaration

     

       139
       139
       +
       echo ""

     

       140
       140
       +
       echo "Creating service declaration..."

     

       141
       141
       +
       SERVICE_RECORD=$(cat <<EOF

     

       142
       142
       +
       {

     

       143
       143
       +
           "\$type": "social.coves.aggregator.service",

     

       144
       144
       +
           "did": "$DID",

     

       145
       145
       +
           "displayName": "$DISPLAY_NAME",

     

       146
       146
       +
           "description": "$DESCRIPTION",

     

       147
       147
       +
           "sourceUrl": "$SOURCE_URL",

     

       148
       148
       +
           "createdAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"

     

       149
       149
       +
       }

     

       150
       150
       +
       EOF

     

       151
       151
       +
       )

     

       152
       152
       +
       

     

       153
       153
       +
       RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.repo.createRecord" \

     

       154
       154
       +
           -H "Authorization: Bearer $ACCESS_JWT" \

     

       155
       155
       +
           -H "Content-Type: application/json" \

     

       156
       156
       +
           -d "{

     

       157
       157
       +
               \"repo\": \"$DID\",

     

       158
       158
       +
               \"collection\": \"social.coves.aggregator.service\",

     

       159
       159
       +
               \"rkey\": \"self\",

     

       160
       160
       +
               \"record\": $SERVICE_RECORD

     

       161
       161
       +
           }")

     

       162
       162
       +
       

     

       163
       163
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       164
       164
       +
           echo "✗ Failed to create service declaration:"

     

       165
       165
       +
           echo "$RESPONSE" | jq '.'

     

       166
       166
       +
           exit 1

     

       167
       167
       +
       fi

     

       168
       168
       +
       

     

       169
       169
       +
       RECORD_URI=$(echo "$RESPONSE" | jq -r '.uri')

     

       170
       170
       +
       echo "✓ Service declaration created: $RECORD_URI"

     

       171
       171
       +
       

     

       172
       172
       +
       # Save final configuration

     

       173
       173
       +
       cat >> kagi-aggregator-config.env <<EOF

     

       174
       174
       +
       

     

       175
       175
       +
       # Setup completed on $(date)

     

       176
       176
       +
       AGGREGATOR_DOMAIN="$DOMAIN"

     

       177
       177
       +
       COVES_INSTANCE_URL="$COVES_URL"

     

       178
       178
       +
       SERVICE_DECLARATION_URI="$RECORD_URI"

     

       179
       179
       +
       EOF

     

       180
       180
       +
       

     

       181
       181
       +
       echo ""

     

       182
       182
       +
       echo "================================================"

     

       183
       183
       +
       echo "✓ Kagi Aggregator Setup Complete!"

     

       184
       184
       +
       echo "================================================"

     

       185
       185
       +
       echo ""

     

       186
       186
       +
       echo "Configuration saved to: kagi-aggregator-config.env"

     

       187
       187
       +
       echo ""

     

       188
       188
       +
       echo "Your aggregator is now registered and ready to use."

     

       189
       189
       +
       echo ""

     

       190
       190
       +
       echo "Next steps:"

     

       191
       191
       +
       echo "1. Start your aggregator bot: npm start (or appropriate command)"

     

       192
       192
       +
       echo "2. Community moderators can authorize your aggregator"

     

       193
       193
       +
       echo "3. Once authorized, your bot can start posting"

     

       194
       194
       +
       echo ""

     

       195
       195
       +
       echo "See docs/aggregators/SETUP_GUIDE.md for more information"

+55

aggregators/kagi-news/.dockerignore

···

       1
       1
       +
       # Git

     

       2
       2
       +
       .git

     

       3
       3
       +
       .gitignore

     

       4
       4
       +
       

     

       5
       5
       +
       # Python

     

       6
       6
       +
       __pycache__

     

       7
       7
       +
       *.py[cod]

     

       8
       8
       +
       *$py.class

     

       9
       9
       +
       *.so

     

       10
       10
       +
       .Python

     

       11
       11
       +
       venv/

     

       12
       12
       +
       *.egg-info

     

       13
       13
       +
       dist/

     

       14
       14
       +
       build/

     

       15
       15
       +
       

     

       16
       16
       +
       # Testing

     

       17
       17
       +
       .pytest_cache/

     

       18
       18
       +
       .coverage

     

       19
       19
       +
       htmlcov/

     

       20
       20
       +
       .tox/

     

       21
       21
       +
       .hypothesis/

     

       22
       22
       +
       

     

       23
       23
       +
       # IDE

     

       24
       24
       +
       .vscode/

     

       25
       25
       +
       .idea/

     

       26
       26
       +
       *.swp

     

       27
       27
       +
       *.swo

     

       28
       28
       +
       *~

     

       29
       29
       +
       

     

       30
       30
       +
       # Environment

     

       31
       31
       +
       .env.local

     

       32
       32
       +
       .env.*.local

     

       33
       33
       +
       

     

       34
       34
       +
       # Data and logs

     

       35
       35
       +
       data/

     

       36
       36
       +
       *.log

     

       37
       37
       +
       

     

       38
       38
       +
       # Documentation

     

       39
       39
       +
       README.md

     

       40
       40
       +
       docs/

     

       41
       41
       +
       

     

       42
       42
       +
       # Docker

     

       43
       43
       +
       Dockerfile

     

       44
       44
       +
       docker-compose.yml

     

       45
       45
       +
       .dockerignore

     

       46
       46
       +
       

     

       47
       47
       +
       # Development

     

       48
       48
       +
       tests/

     

       49
       49
       +
       pytest.ini

     

       50
       50
       +
       mypy.ini

     

       51
       51
       +
       .mypy_cache/

     

       52
       52
       +
       

     

       53
       53
       +
       # OS

     

       54
       54
       +
       .DS_Store

     

       55
       55
       +
       Thumbs.db

+53

aggregators/kagi-news/Dockerfile

···

       1
       1
       +
       # Kagi News RSS Aggregator

     

       2
       2
       +
       # Production-ready Docker image with cron scheduler

     

       3
       3
       +
       

     

       4
       4
       +
       FROM python:3.11-slim

     

       5
       5
       +
       

     

       6
       6
       +
       # Install cron and other utilities

     

       7
       7
       +
       RUN apt-get update && apt-get install -y \

     

       8
       8
       +
           cron \

     

       9
       9
       +
           curl \

     

       10
       10
       +
           procps \

     

       11
       11
       +
           && rm -rf /var/lib/apt/lists/*

     

       12
       12
       +
       

     

       13
       13
       +
       # Set working directory

     

       14
       14
       +
       WORKDIR /app

     

       15
       15
       +
       

     

       16
       16
       +
       # Copy requirements first for better caching

     

       17
       17
       +
       COPY requirements.txt .

     

       18
       18
       +
       

     

       19
       19
       +
       # Install Python dependencies (exclude dev/test deps in production)

     

       20
       20
       +
       RUN pip install --no-cache-dir \

     

       21
       21
       +
           feedparser==6.0.11 \

     

       22
       22
       +
           beautifulsoup4==4.12.3 \

     

       23
       23
       +
           requests==2.31.0 \

     

       24
       24
       +
           atproto==0.0.55 \

     

       25
       25
       +
           pyyaml==6.0.1

     

       26
       26
       +
       

     

       27
       27
       +
       # Copy application code

     

       28
       28
       +
       COPY src/ ./src/

     

       29
       29
       +
       COPY config.yaml ./

     

       30
       30
       +
       

     

       31
       31
       +
       # Copy crontab file

     

       32
       32
       +
       COPY crontab /etc/cron.d/kagi-aggregator

     

       33
       33
       +
       

     

       34
       34
       +
       # Give execution rights on the cron job and apply it

     

       35
       35
       +
       RUN chmod 0644 /etc/cron.d/kagi-aggregator && \

     

       36
       36
       +
           crontab /etc/cron.d/kagi-aggregator

     

       37
       37
       +
       

     

       38
       38
       +
       # Create log file to be able to run tail

     

       39
       39
       +
       RUN touch /var/log/cron.log

     

       40
       40
       +
       

     

       41
       41
       +
       # Copy entrypoint script

     

       42
       42
       +
       COPY docker-entrypoint.sh /usr/local/bin/

     

       43
       43
       +
       RUN chmod +x /usr/local/bin/docker-entrypoint.sh

     

       44
       44
       +
       

     

       45
       45
       +
       # Health check - verify cron is running

     

       46
       46
       +
       HEALTHCHECK --interval=60s --timeout=10s --start-period=10s --retries=3 \

     

       47
       47
       +
           CMD pgrep cron || exit 1

     

       48
       48
       +
       

     

       49
       49
       +
       # Run the entrypoint script

     

       50
       50
       +
       ENTRYPOINT ["docker-entrypoint.sh"]

     

       51
       51
       +
       

     

       52
       52
       +
       # Default command: tail the cron log

     

       53
       53
       +
       CMD ["tail", "-f", "/var/log/cron.log"]

+48

aggregators/kagi-news/docker-compose.yml

···

       1
       1
       +
       services:

     

       2
       2
       +
         kagi-aggregator:

     

       3
       3
       +
           build:

     

       4
       4
       +
             context: .

     

       5
       5
       +
             dockerfile: Dockerfile

     

       6
       6
       +
           container_name: kagi-news-aggregator

     

       7
       7
       +
           restart: unless-stopped

     

       8
       8
       +
       

     

       9
       9
       +
           # Environment variables - override in .env file or here

     

       10
       10
       +
           environment:

     

       11
       11
       +
             # Required: Aggregator credentials

     

       12
       12
       +
             - AGGREGATOR_HANDLE=${AGGREGATOR_HANDLE}

     

       13
       13
       +
             - AGGREGATOR_PASSWORD=${AGGREGATOR_PASSWORD}

     

       14
       14
       +
       

     

       15
       15
       +
             # Optional: Override Coves API URL

     

       16
       16
       +
             - COVES_API_URL=${COVES_API_URL:-https://api.coves.social}

     

       17
       17
       +
       

     

       18
       18
       +
             # Optional: Run immediately on startup (useful for testing)

     

       19
       19
       +
             - RUN_ON_STARTUP=${RUN_ON_STARTUP:-false}

     

       20
       20
       +
       

     

       21
       21
       +
           # Mount config file if you want to modify it without rebuilding

     

       22
       22
       +
           volumes:

     

       23
       23
       +
             - ./config.yaml:/app/config.yaml:ro

     

       24
       24
       +
             - ./data:/app/data  # For state persistence (if implemented)

     

       25
       25
       +
       

     

       26
       26
       +
           # Use env_file to load credentials from .env

     

       27
       27
       +
           env_file:

     

       28
       28
       +
             - .env

     

       29
       29
       +
       

     

       30
       30
       +
           # Logging configuration

     

       31
       31
       +
           logging:

     

       32
       32
       +
             driver: "json-file"

     

       33
       33
       +
             options:

     

       34
       34
       +
               max-size: "10m"

     

       35
       35
       +
               max-file: "3"

     

       36
       36
       +
       

     

       37
       37
       +
           # Health check

     

       38
       38
       +
           healthcheck:

     

       39
       39
       +
             test: ["CMD", "pgrep", "cron"]

     

       40
       40
       +
             interval: 60s

     

       41
       41
       +
             timeout: 10s

     

       42
       42
       +
             retries: 3

     

       43
       43
       +
             start_period: 10s

     

       44
       44
       +
       

     

       45
       45
       +
       # Optional: Networks for multi-container setups

     

       46
       46
       +
       # networks:

     

       47
       47
       +
       #   coves:

     

       48
       48
       +
       #     external: true

+41

aggregators/kagi-news/docker-entrypoint.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       set -e

     

       3
       3
       +
       

     

       4
       4
       +
       echo "Starting Kagi News RSS Aggregator..."

     

       5
       5
       +
       echo "========================================="

     

       6
       6
       +
       

     

       7
       7
       +
       # Load environment variables if .env file exists

     

       8
       8
       +
       if [ -f /app/.env ]; then

     

       9
       9
       +
           echo "Loading environment variables from .env"

     

       10
       10
       +
           export $(grep -v '^#' /app/.env | xargs)

     

       11
       11
       +
       fi

     

       12
       12
       +
       

     

       13
       13
       +
       # Validate required environment variables

     

       14
       14
       +
       if [ -z "$AGGREGATOR_HANDLE" ] || [ -z "$AGGREGATOR_PASSWORD" ]; then

     

       15
       15
       +
           echo "ERROR: Missing required environment variables!"

     

       16
       16
       +
           echo "Please set AGGREGATOR_HANDLE and AGGREGATOR_PASSWORD"

     

       17
       17
       +
           exit 1

     

       18
       18
       +
       fi

     

       19
       19
       +
       

     

       20
       20
       +
       echo "Aggregator Handle: $AGGREGATOR_HANDLE"

     

       21
       21
       +
       echo "Cron schedule loaded from /etc/cron.d/kagi-aggregator"

     

       22
       22
       +
       

     

       23
       23
       +
       # Start cron in the background

     

       24
       24
       +
       echo "Starting cron daemon..."

     

       25
       25
       +
       cron

     

       26
       26
       +
       

     

       27
       27
       +
       # Optional: Run aggregator immediately on startup (for testing)

     

       28
       28
       +
       if [ "$RUN_ON_STARTUP" = "true" ]; then

     

       29
       29
       +
           echo "Running aggregator immediately (RUN_ON_STARTUP=true)..."

     

       30
       30
       +
           cd /app && python -m src.main

     

       31
       31
       +
       fi

     

       32
       32
       +
       

     

       33
       33
       +
       echo "========================================="

     

       34
       34
       +
       echo "Kagi News Aggregator is running!"

     

       35
       35
       +
       echo "Cron schedule: Daily at 1 PM UTC"

     

       36
       36
       +
       echo "Logs will appear below:"

     

       37
       37
       +
       echo "========================================="

     

       38
       38
       +
       echo ""

     

       39
       39
       +
       

     

       40
       40
       +
       # Execute the command passed to docker run (defaults to tail -f /var/log/cron.log)

     

       41
       41
       +
       exec "$@"

+20

.beads/.gitignore

···

       1
       1
       +
       # SQLite databases

     

       2
       2
       +
       *.db

     

       3
       3
       +
       *.db-journal

     

       4
       4
       +
       *.db-wal

     

       5
       5
       +
       *.db-shm

     

       6
       6
       +
       

     

       7
       7
       +
       # Daemon runtime files

     

       8
       8
       +
       daemon.lock

     

       9
       9
       +
       daemon.log

     

       10
       10
       +
       daemon.pid

     

       11
       11
       +
       bd.sock

     

       12
       12
       +
       

     

       13
       13
       +
       # Legacy database files

     

       14
       14
       +
       db.sqlite

     

       15
       15
       +
       bd.db

     

       16
       16
       +
       

     

       17
       17
       +
       # Keep JSONL exports and config (source of truth for git)

     

       18
       18
       +
       !*.jsonl

     

       19
       19
       +
       !metadata.json

     

       20
       20
       +
       !config.json

+56

.beads/config.yaml

···

       1
       1
       +
       # Beads Configuration File

     

       2
       2
       +
       # This file configures default behavior for all bd commands in this repository

     

       3
       3
       +
       # All settings can also be set via environment variables (BD_* prefix)

     

       4
       4
       +
       # or overridden with command-line flags

     

       5
       5
       +
       

     

       6
       6
       +
       # Issue prefix for this repository (used by bd init)

     

       7
       7
       +
       # If not set, bd init will auto-detect from directory name

     

       8
       8
       +
       # Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.

     

       9
       9
       +
       # issue-prefix: ""

     

       10
       10
       +
       

     

       11
       11
       +
       # Use no-db mode: load from JSONL, no SQLite, write back after each command

     

       12
       12
       +
       # When true, bd will use .beads/issues.jsonl as the source of truth

     

       13
       13
       +
       # instead of SQLite database

     

       14
       14
       +
       # no-db: false

     

       15
       15
       +
       

     

       16
       16
       +
       # Disable daemon for RPC communication (forces direct database access)

     

       17
       17
       +
       # no-daemon: false

     

       18
       18
       +
       

     

       19
       19
       +
       # Disable auto-flush of database to JSONL after mutations

     

       20
       20
       +
       # no-auto-flush: false

     

       21
       21
       +
       

     

       22
       22
       +
       # Disable auto-import from JSONL when it's newer than database

     

       23
       23
       +
       # no-auto-import: false

     

       24
       24
       +
       

     

       25
       25
       +
       # Enable JSON output by default

     

       26
       26
       +
       # json: false

     

       27
       27
       +
       

     

       28
       28
       +
       # Default actor for audit trails (overridden by BD_ACTOR or --actor)

     

       29
       29
       +
       # actor: ""

     

       30
       30
       +
       

     

       31
       31
       +
       # Path to database (overridden by BEADS_DB or --db)

     

       32
       32
       +
       # db: ""

     

       33
       33
       +
       

     

       34
       34
       +
       # Auto-start daemon if not running (can also use BEADS_AUTO_START_DAEMON)

     

       35
       35
       +
       # auto-start-daemon: true

     

       36
       36
       +
       

     

       37
       37
       +
       # Debounce interval for auto-flush (can also use BEADS_FLUSH_DEBOUNCE)

     

       38
       38
       +
       # flush-debounce: "5s"

     

       39
       39
       +
       

     

       40
       40
       +
       # Multi-repo configuration (experimental - bd-307)

     

       41
       41
       +
       # Allows hydrating from multiple repositories and routing writes to the correct JSONL

     

       42
       42
       +
       # repos:

     

       43
       43
       +
       #   primary: "."  # Primary repo (where this database lives)

     

       44
       44
       +
       #   additional:   # Additional repos to hydrate from (read-only)

     

       45
       45
       +
       #     - ~/beads-planning  # Personal planning repo

     

       46
       46
       +
       #     - ~/work-planning   # Work planning repo

     

       47
       47
       +
       

     

       48
       48
       +
       # Integration settings (access with 'bd config get/set')

     

       49
       49
       +
       # These are stored in the database, not in this file:

     

       50
       50
       +
       # - jira.url

     

       51
       51
       +
       # - jira.project

     

       52
       52
       +
       # - linear.url

     

       53
       53
       +
       # - linear.api-key

     

       54
       54
       +
       # - github.org

     

       55
       55
       +
       # - github.repo

     

       56
       56
       +
       # - sync.branch - Git branch for beads commits (use BEADS_SYNC_BRANCH env var or bd config set)

+4

.beads/metadata.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "database": "beads.db",

     

       3
       3
       +
         "jsonl_export": "beads.jsonl"

     

       4
       4
       +
       }

+3

.gitattributes

···

       1
       1
       +
       

     

       2
       2
       +
       # Use bd merge for beads JSONL files

     

       3
       3
       +
       .beads/beads.jsonl merge=beads

+131

AGENTS.md

···

       1
       1
       +
       # AI Agent Guidelines for Coves

     

       2
       2
       +
       

     

       3
       3
       +
       ## Issue Tracking with bd (beads)

     

       4
       4
       +
       

     

       5
       5
       +
       **IMPORTANT**: This project uses **bd (beads)** for ALL issue tracking. Do NOT use markdown TODOs, task lists, or other tracking methods.

     

       6
       6
       +
       

     

       7
       7
       +
       ### Why bd?

     

       8
       8
       +
       

     

       9
       9
       +
       - Dependency-aware: Track blockers and relationships between issues

     

       10
       10
       +
       - Git-friendly: Auto-syncs to JSONL for version control

     

       11
       11
       +
       - Agent-optimized: JSON output, ready work detection, discovered-from links

     

       12
       12
       +
       - Prevents duplicate tracking systems and confusion

     

       13
       13
       +
       

     

       14
       14
       +
       ### Quick Start

     

       15
       15
       +
       

     

       16
       16
       +
       **Check for ready work:**

     

       17
       17
       +
       ```bash

     

       18
       18
       +
       bd ready --json

     

       19
       19
       +
       ```

     

       20
       20
       +
       

     

       21
       21
       +
       **Create new issues:**

     

       22
       22
       +
       ```bash

     

       23
       23
       +
       bd create "Issue title" -t bug|feature|task -p 0-4 --json

     

       24
       24
       +
       bd create "Issue title" -p 1 --deps discovered-from:bd-123 --json

     

       25
       25
       +
       ```

     

       26
       26
       +
       

     

       27
       27
       +
       **Claim and update:**

     

       28
       28
       +
       ```bash

     

       29
       29
       +
       bd update bd-42 --status in_progress --json

     

       30
       30
       +
       bd update bd-42 --priority 1 --json

     

       31
       31
       +
       ```

     

       32
       32
       +
       

     

       33
       33
       +
       **Complete work:**

     

       34
       34
       +
       ```bash

     

       35
       35
       +
       bd close bd-42 --reason "Completed" --json

     

       36
       36
       +
       ```

     

       37
       37
       +
       

     

       38
       38
       +
       ### Issue Types

     

       39
       39
       +
       

     

       40
       40
       +
       - `bug` - Something broken

     

       41
       41
       +
       - `feature` - New functionality

     

       42
       42
       +
       - `task` - Work item (tests, docs, refactoring)

     

       43
       43
       +
       - `epic` - Large feature with subtasks

     

       44
       44
       +
       - `chore` - Maintenance (dependencies, tooling)

     

       45
       45
       +
       

     

       46
       46
       +
       ### Priorities

     

       47
       47
       +
       

     

       48
       48
       +
       - `0` - Critical (security, data loss, broken builds)

     

       49
       49
       +
       - `1` - High (major features, important bugs)

     

       50
       50
       +
       - `2` - Medium (default, nice-to-have)

     

       51
       51
       +
       - `3` - Low (polish, optimization)

     

       52
       52
       +
       - `4` - Backlog (future ideas)

     

       53
       53
       +
       

     

       54
       54
       +
       ### Workflow for AI Agents

     

       55
       55
       +
       

     

       56
       56
       +
       1. **Check ready work**: `bd ready` shows unblocked issues

     

       57
       57
       +
       2. **Claim your task**: `bd update <id> --status in_progress`

     

       58
       58
       +
       3. **Work on it**: Implement, test, document

     

       59
       59
       +
       4. **Discover new work?** Create linked issue:

     

       60
       60
       +
          - `bd create "Found bug" -p 1 --deps discovered-from:<parent-id>`

     

       61
       61
       +
       5. **Complete**: `bd close <id> --reason "Done"`

     

       62
       62
       +
       6. **Commit together**: Always commit the `.beads/issues.jsonl` file together with the code changes so issue state stays in sync with code state

     

       63
       63
       +
       

     

       64
       64
       +
       ### Auto-Sync

     

       65
       65
       +
       

     

       66
       66
       +
       bd automatically syncs with git:

     

       67
       67
       +
       - Exports to `.beads/issues.jsonl` after changes (5s debounce)

     

       68
       68
       +
       - Imports from JSONL when newer (e.g., after `git pull`)

     

       69
       69
       +
       - No manual export/import needed!

     

       70
       70
       +
       

     

       71
       71
       +
       ### MCP Server (Recommended)

     

       72
       72
       +
       

     

       73
       73
       +
       If using Claude or MCP-compatible clients, install the beads MCP server:

     

       74
       74
       +
       

     

       75
       75
       +
       ```bash

     

       76
       76
       +
       pip install beads-mcp

     

       77
       77
       +
       ```

     

       78
       78
       +
       

     

       79
       79
       +
       Add to MCP config (e.g., `~/.config/claude/config.json`):

     

       80
       80
       +
       ```json

     

       81
       81
       +
       {

     

       82
       82
       +
         "beads": {

     

       83
       83
       +
           "command": "beads-mcp",

     

       84
       84
       +
           "args": []

     

       85
       85
       +
         }

     

       86
       86
       +
       }

     

       87
       87
       +
       ```

     

       88
       88
       +
       

     

       89
       89
       +
       Then use `mcp__beads__*` functions instead of CLI commands.

     

       90
       90
       +
       

     

       91
       91
       +
       ### Managing AI-Generated Planning Documents

     

       92
       92
       +
       

     

       93
       93
       +
       AI assistants often create planning and design documents during development:

     

       94
       94
       +
       - PLAN.md, IMPLEMENTATION.md, ARCHITECTURE.md

     

       95
       95
       +
       - DESIGN.md, CODEBASE_SUMMARY.md, INTEGRATION_PLAN.md

     

       96
       96
       +
       - TESTING_GUIDE.md, TECHNICAL_DESIGN.md, and similar files

     

       97
       97
       +
       

     

       98
       98
       +
       **Best Practice: Use a dedicated directory for these ephemeral files**

     

       99
       99
       +
       

     

       100
       100
       +
       **Recommended approach:**

     

       101
       101
       +
       - Create a `history/` directory in the project root

     

       102
       102
       +
       - Store ALL AI-generated planning/design docs in `history/`

     

       103
       103
       +
       - Keep the repository root clean and focused on permanent project files

     

       104
       104
       +
       - Only access `history/` when explicitly asked to review past planning

     

       105
       105
       +
       

     

       106
       106
       +
       **Example .gitignore entry (optional):**

     

       107
       107
       +
       ```

     

       108
       108
       +
       # AI planning documents (ephemeral)

     

       109
       109
       +
       history/

     

       110
       110
       +
       ```

     

       111
       111
       +
       

     

       112
       112
       +
       **Benefits:**

     

       113
       113
       +
       - ✅ Clean repository root

     

       114
       114
       +
       - ✅ Clear separation between ephemeral and permanent documentation

     

       115
       115
       +
       - ✅ Easy to exclude from version control if desired

     

       116
       116
       +
       - ✅ Preserves planning history for archeological research

     

       117
       117
       +
       - ✅ Reduces noise when browsing the project

     

       118
       118
       +
       

     

       119
       119
       +
       ### Important Rules

     

       120
       120
       +
       

     

       121
       121
       +
       - ✅ Use bd for ALL task tracking

     

       122
       122
       +
       - ✅ Always use `--json` flag for programmatic use

     

       123
       123
       +
       - ✅ Link discovered work with `discovered-from` dependencies

     

       124
       124
       +
       - ✅ Check `bd ready` before asking "what should I work on?"

     

       125
       125
       +
       - ✅ Store AI planning docs in `history/` directory

     

       126
       126
       +
       - ❌ Do NOT create markdown TODO lists

     

       127
       127
       +
       - ❌ Do NOT use external issue trackers

     

       128
       128
       +
       - ❌ Do NOT duplicate tracking systems

     

       129
       129
       +
       - ❌ Do NOT clutter repo root with planning documents

     

       130
       130
       +
       

     

       131
       131
       +
       For more details, see the [beads repository](https://github.com/steveyegge/beads).

+15

CLAUDE.md

···

       7
       7
        
       - Security is built-in, not bolted-on

     

       8
       8
        
       - Test-driven: write the test, then make it pass

     

       9
       9
        
       - ASK QUESTIONS if you need context surrounding the product DONT ASSUME

     

       10
       10
       +
       

     

       10
       11
        
       ## No Stubs, No Shortcuts

     

       11
       12
        
       - **NEVER** use `unimplemented!()`, `todo!()`, or stub implementations

     

       12
       13
        
       - **NEVER** leave placeholder code or incomplete implementations

     
···

       15
       16
        
       - Every feature must be complete before moving on

     

       16
       17
        
       - E2E tests must test REAL infrastructure - not mocks

     

       17
       18
        
       

     

       19
       19
       +
       ## Issue Tracking

     

       20
       20
       +
       

     

       21
       21
       +
       **This project uses [bd (beads)](https://github.com/steveyegge/beads) for ALL issue tracking.**

     

       22
       22
       +
       

     

       23
       23
       +
       - Use `bd` commands, NOT markdown TODOs or task lists

     

       24
       24
       +
       - Check `bd ready` for unblocked work

     

       25
       25
       +
       - Always commit `.beads/issues.jsonl` with code changes

     

       26
       26
       +
       - See [AGENTS.md](AGENTS.md) for full workflow details

     

       27
       27
       +
       

     

       28
       28
       +
       Quick commands:

     

       29
       29
       +
       - `bd ready --json` - Show ready work

     

       30
       30
       +
       - `bd create "Title" -t bug|feature|task -p 0-4 --json` - Create issue

     

       31
       31
       +
       - `bd update <id> --status in_progress --json` - Claim work

     

       32
       32
       +
       - `bd close <id> --reason "Done" --json` - Complete work

     

       18
       33
        
       ## Break Down Complex Tasks

     

       19
       34
        
       - Large files or complex features should be broken into manageable chunks

     

       20
       35
        
       - If a file is too large, discuss breaking it into smaller modules

+8 -8

internal/core/communities/community.go

···

       123
       123
        
       

     

       124
       124
        
       // ListCommunitiesRequest represents query parameters for listing communities

     

       125
       125
        
       type ListCommunitiesRequest struct {

     

       126
       126
       -
       	Visibility string `json:"visibility,omitempty"`

     

       127
       127
       -
       	HostedBy   string `json:"hostedBy,omitempty"`

     

       128
       128
       -
       	SortBy     string `json:"sortBy,omitempty"`

     

       129
       129
       -
       	SortOrder  string `json:"sortOrder,omitempty"`

     

       130
       130
       -
       	Limit      int    `json:"limit"`

     

       131
       131
       -
       	Offset     int    `json:"offset"`

     

       126
       126
       +
       	Sort       string `json:"sort,omitempty"`       // Enum: popular, active, new, alphabetical

     

       127
       127
       +
       	Visibility string `json:"visibility,omitempty"` // Filter: public, unlisted, private

     

       128
       128
       +
       	Category   string `json:"category,omitempty"`   // Optional: filter by category (future)

     

       129
       129
       +
       	Language   string `json:"language,omitempty"`   // Optional: filter by language (future)

     

       130
       130
       +
       	Limit      int    `json:"limit"`                // 1-100, default 50

     

       131
       131
       +
       	Offset     int    `json:"offset"`               // Pagination offset

     

       132
       132
        
       }

     

       133
       133
        
       

     

       134
       134
        
       // SearchCommunitiesRequest represents query parameters for searching communities

     
···

       159
       159
        
       	name := c.Handle[:communityIndex]

     

       160
       160
        
       

     

       161
       161
        
       	// Extract instance domain (everything after ".community.")

     

       162
       162
       -
       	// len(".community.") = 11

     

       163
       163
       -
       	instanceDomain := c.Handle[communityIndex+11:]

     

       162
       162
       +
       	communitySegment := ".community."

     

       163
       163
       +
       	instanceDomain := c.Handle[communityIndex+len(communitySegment):]

     

       164
       164
        
       

     

       165
       165
        
       	return fmt.Sprintf("!%s@%s", name, instanceDomain)

     

       166
       166
        
       }

+2 -2

internal/core/communities/interfaces.go

···

       16
       16
        
       	UpdateCredentials(ctx context.Context, did, accessToken, refreshToken string) error

     

       17
       17
        
       

     

       18
       18
        
       	// Listing & Search

     

       19
       19
       -
       	List(ctx context.Context, req ListCommunitiesRequest) ([]*Community, int, error) // Returns communities + total count

     

       19
       19
       +
       	List(ctx context.Context, req ListCommunitiesRequest) ([]*Community, error)

     

       20
       20
        
       	Search(ctx context.Context, req SearchCommunitiesRequest) ([]*Community, int, error)

     

       21
       21
        
       

     

       22
       22
        
       	// Subscriptions (lightweight feed follows)

     
···

       62
       62
        
       	CreateCommunity(ctx context.Context, req CreateCommunityRequest) (*Community, error)

     

       63
       63
        
       	GetCommunity(ctx context.Context, identifier string) (*Community, error) // identifier can be DID or handle

     

       64
       64
        
       	UpdateCommunity(ctx context.Context, req UpdateCommunityRequest) (*Community, error)

     

       65
       65
       -
       	ListCommunities(ctx context.Context, req ListCommunitiesRequest) ([]*Community, int, error)

     

       65
       65
       +
       	ListCommunities(ctx context.Context, req ListCommunitiesRequest) ([]*Community, error)

     

       66
       66
        
       	SearchCommunities(ctx context.Context, req SearchCommunitiesRequest) ([]*Community, int, error)

     

       67
       67
        
       

     

       68
       68
        
       	// Subscription operations (write-forward: creates record in user's PDS)

+57

scripts/backup.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Database Backup Script

     

       3
       3
       +
       # Usage: ./scripts/backup.sh

     

       4
       4
       +
       #

     

       5
       5
       +
       # Creates timestamped PostgreSQL backups in ./backups/

     

       6
       6
       +
       # Retention: Keeps last 30 days of backups

     

       7
       7
       +
       

     

       8
       8
       +
       set -e

     

       9
       9
       +
       

     

       10
       10
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       11
       11
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       12
       12
       +
       BACKUP_DIR="$PROJECT_DIR/backups"

     

       13
       13
       +
       COMPOSE_FILE="$PROJECT_DIR/docker-compose.prod.yml"

     

       14
       14
       +
       

     

       15
       15
       +
       # Load environment

     

       16
       16
       +
       set -a

     

       17
       17
       +
       source "$PROJECT_DIR/.env.prod"

     

       18
       18
       +
       set +a

     

       19
       19
       +
       

     

       20
       20
       +
       # Colors

     

       21
       21
       +
       GREEN='\033[0;32m'

     

       22
       22
       +
       YELLOW='\033[1;33m'

     

       23
       23
       +
       NC='\033[0m'

     

       24
       24
       +
       

     

       25
       25
       +
       log() { echo -e "${GREEN}[BACKUP]${NC} $1"; }

     

       26
       26
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       27
       27
       +
       

     

       28
       28
       +
       # Create backup directory

     

       29
       29
       +
       mkdir -p "$BACKUP_DIR"

     

       30
       30
       +
       

     

       31
       31
       +
       # Generate timestamp

     

       32
       32
       +
       TIMESTAMP=$(date +%Y%m%d_%H%M%S)

     

       33
       33
       +
       BACKUP_FILE="$BACKUP_DIR/coves_${TIMESTAMP}.sql.gz"

     

       34
       34
       +
       

     

       35
       35
       +
       log "Starting backup..."

     

       36
       36
       +
       

     

       37
       37
       +
       # Run pg_dump inside container

     

       38
       38
       +
       docker compose -f "$COMPOSE_FILE" exec -T postgres \

     

       39
       39
       +
           pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" --clean --if-exists \

     

       40
       40
       +
           | gzip > "$BACKUP_FILE"

     

       41
       41
       +
       

     

       42
       42
       +
       # Get file size

     

       43
       43
       +
       SIZE=$(du -h "$BACKUP_FILE" | cut -f1)

     

       44
       44
       +
       

     

       45
       45
       +
       log "✅ Backup complete: $BACKUP_FILE ($SIZE)"

     

       46
       46
       +
       

     

       47
       47
       +
       # Cleanup old backups (keep last 30 days)

     

       48
       48
       +
       log "Cleaning up backups older than 30 days..."

     

       49
       49
       +
       find "$BACKUP_DIR" -name "coves_*.sql.gz" -mtime +30 -delete

     

       50
       50
       +
       

     

       51
       51
       +
       # List recent backups

     

       52
       52
       +
       log ""

     

       53
       53
       +
       log "Recent backups:"

     

       54
       54
       +
       ls -lh "$BACKUP_DIR"/*.sql.gz 2>/dev/null | tail -5

     

       55
       55
       +
       

     

       56
       56
       +
       log ""

     

       57
       57
       +
       log "To restore: gunzip -c $BACKUP_FILE | docker compose -f docker-compose.prod.yml exec -T postgres psql -U $POSTGRES_USER -d $POSTGRES_DB"

+133

scripts/deploy.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Deployment Script

     

       3
       3
       +
       # Usage: ./scripts/deploy.sh [service]

     

       4
       4
       +
       #

     

       5
       5
       +
       # Examples:

     

       6
       6
       +
       #   ./scripts/deploy.sh           # Deploy all services

     

       7
       7
       +
       #   ./scripts/deploy.sh appview   # Deploy only AppView

     

       8
       8
       +
       #   ./scripts/deploy.sh --pull    # Pull from git first, then deploy

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       COMPOSE_FILE="$PROJECT_DIR/docker-compose.prod.yml"

     

       15
       15
       +
       

     

       16
       16
       +
       # Colors for output

     

       17
       17
       +
       RED='\033[0;31m'

     

       18
       18
       +
       GREEN='\033[0;32m'

     

       19
       19
       +
       YELLOW='\033[1;33m'

     

       20
       20
       +
       NC='\033[0m' # No Color

     

       21
       21
       +
       

     

       22
       22
       +
       log() {

     

       23
       23
       +
           echo -e "${GREEN}[DEPLOY]${NC} $1"

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       warn() {

     

       27
       27
       +
           echo -e "${YELLOW}[WARN]${NC} $1"

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       error() {

     

       31
       31
       +
           echo -e "${RED}[ERROR]${NC} $1"

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       # Parse arguments

     

       36
       36
       +
       PULL_GIT=false

     

       37
       37
       +
       SERVICE=""

     

       38
       38
       +
       

     

       39
       39
       +
       for arg in "$@"; do

     

       40
       40
       +
           case $arg in

     

       41
       41
       +
               --pull)

     

       42
       42
       +
                   PULL_GIT=true

     

       43
       43
       +
                   ;;

     

       44
       44
       +
               *)

     

       45
       45
       +
                   SERVICE="$arg"

     

       46
       46
       +
                   ;;

     

       47
       47
       +
           esac

     

       48
       48
       +
       done

     

       49
       49
       +
       

     

       50
       50
       +
       cd "$PROJECT_DIR"

     

       51
       51
       +
       

     

       52
       52
       +
       # Load environment variables

     

       53
       53
       +
       if [ ! -f ".env.prod" ]; then

     

       54
       54
       +
           error ".env.prod not found! Copy from .env.prod.example and configure secrets."

     

       55
       55
       +
       fi

     

       56
       56
       +
       

     

       57
       57
       +
       log "Loading environment from .env.prod..."

     

       58
       58
       +
       set -a

     

       59
       59
       +
       source .env.prod

     

       60
       60
       +
       set +a

     

       61
       61
       +
       

     

       62
       62
       +
       # Optional: Pull from git

     

       63
       63
       +
       if [ "$PULL_GIT" = true ]; then

     

       64
       64
       +
           log "Pulling latest code from git..."

     

       65
       65
       +
           git fetch origin

     

       66
       66
       +
           git pull origin main

     

       67
       67
       +
       fi

     

       68
       68
       +
       

     

       69
       69
       +
       # Check database connectivity before deployment

     

       70
       70
       +
       log "Checking database connectivity..."

     

       71
       71
       +
       if docker compose -f "$COMPOSE_FILE" exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; then

     

       72
       72
       +
           log "Database is ready"

     

       73
       73
       +
       else

     

       74
       74
       +
           warn "Database not ready yet - it will start with the deployment"

     

       75
       75
       +
       fi

     

       76
       76
       +
       

     

       77
       77
       +
       # Build and deploy

     

       78
       78
       +
       if [ -n "$SERVICE" ]; then

     

       79
       79
       +
           log "Building $SERVICE..."

     

       80
       80
       +
           docker compose -f "$COMPOSE_FILE" build --no-cache "$SERVICE"

     

       81
       81
       +
       

     

       82
       82
       +
           log "Deploying $SERVICE..."

     

       83
       83
       +
           docker compose -f "$COMPOSE_FILE" up -d "$SERVICE"

     

       84
       84
       +
       else

     

       85
       85
       +
           log "Building all services..."

     

       86
       86
       +
           docker compose -f "$COMPOSE_FILE" build --no-cache

     

       87
       87
       +
       

     

       88
       88
       +
           log "Deploying all services..."

     

       89
       89
       +
           docker compose -f "$COMPOSE_FILE" up -d

     

       90
       90
       +
       fi

     

       91
       91
       +
       

     

       92
       92
       +
       # Health check

     

       93
       93
       +
       log "Waiting for services to be healthy..."

     

       94
       94
       +
       sleep 10

     

       95
       95
       +
       

     

       96
       96
       +
       # Wait for database to be ready before running migrations

     

       97
       97
       +
       log "Waiting for database..."

     

       98
       98
       +
       for i in {1..30}; do

     

       99
       99
       +
           if docker compose -f "$COMPOSE_FILE" exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; then

     

       100
       100
       +
               break

     

       101
       101
       +
           fi

     

       102
       102
       +
           sleep 1

     

       103
       103
       +
       done

     

       104
       104
       +
       

     

       105
       105
       +
       # Run database migrations

     

       106
       106
       +
       # The AppView runs migrations on startup, but we can also trigger them explicitly

     

       107
       107
       +
       log "Running database migrations..."

     

       108
       108
       +
       if docker compose -f "$COMPOSE_FILE" exec -T appview /app/coves-server migrate 2>/dev/null; then

     

       109
       109
       +
           log "✅ Migrations completed"

     

       110
       110
       +
       else

     

       111
       111
       +
           warn "⚠️  Migration command not available or failed - AppView will run migrations on startup"

     

       112
       112
       +
       fi

     

       113
       113
       +
       

     

       114
       114
       +
       # Check AppView health

     

       115
       115
       +
       if docker compose -f "$COMPOSE_FILE" exec -T appview wget --spider -q http://localhost:8080/xrpc/_health 2>/dev/null; then

     

       116
       116
       +
           log "✅ AppView is healthy"

     

       117
       117
       +
       else

     

       118
       118
       +
           warn "⚠️  AppView health check failed - check logs with: docker compose -f docker-compose.prod.yml logs appview"

     

       119
       119
       +
       fi

     

       120
       120
       +
       

     

       121
       121
       +
       # Check PDS health

     

       122
       122
       +
       if docker compose -f "$COMPOSE_FILE" exec -T pds wget --spider -q http://localhost:3000/xrpc/_health 2>/dev/null; then

     

       123
       123
       +
           log "✅ PDS is healthy"

     

       124
       124
       +
       else

     

       125
       125
       +
           warn "⚠️  PDS health check failed - check logs with: docker compose -f docker-compose.prod.yml logs pds"

     

       126
       126
       +
       fi

     

       127
       127
       +
       

     

       128
       128
       +
       log "Deployment complete!"

     

       129
       129
       +
       log ""

     

       130
       130
       +
       log "Useful commands:"

     

       131
       131
       +
       log "  View logs:     docker compose -f docker-compose.prod.yml logs -f"

     

       132
       132
       +
       log "  Check status:  docker compose -f docker-compose.prod.yml ps"

     

       133
       133
       +
       log "  Rollback:      docker compose -f docker-compose.prod.yml down && git checkout HEAD~1 && ./scripts/deploy.sh"

+149

scripts/generate-did-keys.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Generate cryptographic keys for Coves did:web DID document

     

       3
       3
       +
       #

     

       4
       4
       +
       # This script generates a secp256k1 (K-256) key pair as required by atproto.

     

       5
       5
       +
       # Reference: https://atproto.com/specs/cryptography

     

       6
       6
       +
       #

     

       7
       7
       +
       # Key format:

     

       8
       8
       +
       #   - Curve: secp256k1 (K-256) - same as Bitcoin/Ethereum

     

       9
       9
       +
       #   - Type: Multikey

     

       10
       10
       +
       #   - Encoding: publicKeyMultibase with base58btc ('z' prefix)

     

       11
       11
       +
       #   - Multicodec: 0xe7 for secp256k1 compressed public key

     

       12
       12
       +
       #

     

       13
       13
       +
       # Output:

     

       14
       14
       +
       #   - Private key (hex) for PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX

     

       15
       15
       +
       #   - Public key (multibase) for did.json publicKeyMultibase field

     

       16
       16
       +
       #   - Complete did.json file

     

       17
       17
       +
       

     

       18
       18
       +
       set -e

     

       19
       19
       +
       

     

       20
       20
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       21
       21
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       22
       22
       +
       OUTPUT_DIR="$PROJECT_DIR/static/.well-known"

     

       23
       23
       +
       

     

       24
       24
       +
       # Colors

     

       25
       25
       +
       GREEN='\033[0;32m'

     

       26
       26
       +
       YELLOW='\033[1;33m'

     

       27
       27
       +
       RED='\033[0;31m'

     

       28
       28
       +
       NC='\033[0m'

     

       29
       29
       +
       

     

       30
       30
       +
       log() { echo -e "${GREEN}[KEYGEN]${NC} $1"; }

     

       31
       31
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       32
       32
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       33
       33
       +
       

     

       34
       34
       +
       # Check for required tools

     

       35
       35
       +
       if ! command -v openssl &> /dev/null; then

     

       36
       36
       +
           error "openssl is required but not installed"

     

       37
       37
       +
       fi

     

       38
       38
       +
       

     

       39
       39
       +
       if ! command -v python3 &> /dev/null; then

     

       40
       40
       +
           error "python3 is required for base58 encoding"

     

       41
       41
       +
       fi

     

       42
       42
       +
       

     

       43
       43
       +
       # Check for base58 library

     

       44
       44
       +
       if ! python3 -c "import base58" 2>/dev/null; then

     

       45
       45
       +
           warn "Installing base58 Python library..."

     

       46
       46
       +
           pip3 install base58 || error "Failed to install base58. Run: pip3 install base58"

     

       47
       47
       +
       fi

     

       48
       48
       +
       

     

       49
       49
       +
       log "Generating secp256k1 key pair for did:web..."

     

       50
       50
       +
       

     

       51
       51
       +
       # Generate private key

     

       52
       52
       +
       PRIVATE_KEY_PEM=$(mktemp)

     

       53
       53
       +
       openssl ecparam -name secp256k1 -genkey -noout -out "$PRIVATE_KEY_PEM" 2>/dev/null

     

       54
       54
       +
       

     

       55
       55
       +
       # Extract private key as hex (for PDS config)

     

       56
       56
       +
       PRIVATE_KEY_HEX=$(openssl ec -in "$PRIVATE_KEY_PEM" -text -noout 2>/dev/null | \

     

       57
       57
       +
           grep -A 3 "priv:" | tail -n 3 | tr -d ' :\n' | tr -d '\r')

     

       58
       58
       +
       

     

       59
       59
       +
       # Extract public key as compressed format

     

       60
       60
       +
       # OpenSSL outputs the public key, we need to get the compressed form

     

       61
       61
       +
       PUBLIC_KEY_HEX=$(openssl ec -in "$PRIVATE_KEY_PEM" -pubout -conv_form compressed -outform DER 2>/dev/null | \

     

       62
       62
       +
           tail -c 33 | xxd -p | tr -d '\n')

     

       63
       63
       +
       

     

       64
       64
       +
       # Clean up temp file

     

       65
       65
       +
       rm -f "$PRIVATE_KEY_PEM"

     

       66
       66
       +
       

     

       67
       67
       +
       # Encode public key as multibase with multicodec

     

       68
       68
       +
       # Multicodec 0xe7 = secp256k1 compressed public key

     

       69
       69
       +
       # Then base58btc encode with 'z' prefix

     

       70
       70
       +
       PUBLIC_KEY_MULTIBASE=$(python3 << EOF

     

       71
       71
       +
       import base58

     

       72
       72
       +
       

     

       73
       73
       +
       # Compressed public key bytes

     

       74
       74
       +
       pub_hex = "$PUBLIC_KEY_HEX"

     

       75
       75
       +
       pub_bytes = bytes.fromhex(pub_hex)

     

       76
       76
       +
       

     

       77
       77
       +
       # Prepend multicodec 0xe7 for secp256k1-pub

     

       78
       78
       +
       # 0xe7 as varint is just 0xe7 (single byte, < 128)

     

       79
       79
       +
       multicodec = bytes([0xe7, 0x01])  # 0xe701 for secp256k1-pub compressed

     

       80
       80
       +
       key_with_codec = multicodec + pub_bytes

     

       81
       81
       +
       

     

       82
       82
       +
       # Base58btc encode

     

       83
       83
       +
       encoded = base58.b58encode(key_with_codec).decode('ascii')

     

       84
       84
       +
       

     

       85
       85
       +
       # Add 'z' prefix for multibase

     

       86
       86
       +
       print('z' + encoded)

     

       87
       87
       +
       EOF

     

       88
       88
       +
       )

     

       89
       89
       +
       

     

       90
       90
       +
       log "Keys generated successfully!"

     

       91
       91
       +
       echo ""

     

       92
       92
       +
       echo "============================================"

     

       93
       93
       +
       echo "  PRIVATE KEY (keep secret!)"

     

       94
       94
       +
       echo "============================================"

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       echo "Add this to your .env.prod file:"

     

       97
       97
       +
       echo ""

     

       98
       98
       +
       echo "PDS_ROTATION_KEY=$PRIVATE_KEY_HEX"

     

       99
       99
       +
       echo ""

     

       100
       100
       +
       echo "============================================"

     

       101
       101
       +
       echo "  PUBLIC KEY (for did.json)"

     

       102
       102
       +
       echo "============================================"

     

       103
       103
       +
       echo ""

     

       104
       104
       +
       echo "publicKeyMultibase: $PUBLIC_KEY_MULTIBASE"

     

       105
       105
       +
       echo ""

     

       106
       106
       +
       

     

       107
       107
       +
       # Generate the did.json file

     

       108
       108
       +
       log "Generating did.json..."

     

       109
       109
       +
       

     

       110
       110
       +
       mkdir -p "$OUTPUT_DIR"

     

       111
       111
       +
       

     

       112
       112
       +
       cat > "$OUTPUT_DIR/did.json" << EOF

     

       113
       113
       +
       {

     

       114
       114
       +
         "id": "did:web:coves.social",

     

       115
       115
       +
         "alsoKnownAs": ["at://coves.social"],

     

       116
       116
       +
         "verificationMethod": [

     

       117
       117
       +
           {

     

       118
       118
       +
             "id": "did:web:coves.social#atproto",

     

       119
       119
       +
             "type": "Multikey",

     

       120
       120
       +
             "controller": "did:web:coves.social",

     

       121
       121
       +
             "publicKeyMultibase": "$PUBLIC_KEY_MULTIBASE"

     

       122
       122
       +
           }

     

       123
       123
       +
         ],

     

       124
       124
       +
         "service": [

     

       125
       125
       +
           {

     

       126
       126
       +
             "id": "#atproto_pds",

     

       127
       127
       +
             "type": "AtprotoPersonalDataServer",

     

       128
       128
       +
             "serviceEndpoint": "https://coves.me"

     

       129
       129
       +
           }

     

       130
       130
       +
         ]

     

       131
       131
       +
       }

     

       132
       132
       +
       EOF

     

       133
       133
       +
       

     

       134
       134
       +
       log "Created: $OUTPUT_DIR/did.json"

     

       135
       135
       +
       echo ""

     

       136
       136
       +
       echo "============================================"

     

       137
       137
       +
       echo "  NEXT STEPS"

     

       138
       138
       +
       echo "============================================"

     

       139
       139
       +
       echo ""

     

       140
       140
       +
       echo "1. Copy the PDS_ROTATION_KEY value to your .env.prod file"

     

       141
       141
       +
       echo ""

     

       142
       142
       +
       echo "2. Verify the did.json looks correct:"

     

       143
       143
       +
       echo "   cat $OUTPUT_DIR/did.json"

     

       144
       144
       +
       echo ""

     

       145
       145
       +
       echo "3. After deployment, verify it's accessible:"

     

       146
       146
       +
       echo "   curl https://coves.social/.well-known/did.json"

     

       147
       147
       +
       echo ""

     

       148
       148
       +
       warn "IMPORTANT: Keep the private key secret! Only share the public key."

     

       149
       149
       +
       warn "The did.json file with the public key IS safe to commit to git."

+106

scripts/setup-production.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Production Setup Script

     

       3
       3
       +
       # Run this once on a fresh server to set up everything

     

       4
       4
       +
       #

     

       5
       5
       +
       # Prerequisites:

     

       6
       6
       +
       #   - Docker and docker-compose installed

     

       7
       7
       +
       #   - Git installed

     

       8
       8
       +
       #   - .env.prod file configured

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       

     

       15
       15
       +
       # Colors

     

       16
       16
       +
       GREEN='\033[0;32m'

     

       17
       17
       +
       YELLOW='\033[1;33m'

     

       18
       18
       +
       RED='\033[0;31m'

     

       19
       19
       +
       NC='\033[0m'

     

       20
       20
       +
       

     

       21
       21
       +
       log() { echo -e "${GREEN}[SETUP]${NC} $1"; }

     

       22
       22
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       23
       23
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       24
       24
       +
       

     

       25
       25
       +
       cd "$PROJECT_DIR"

     

       26
       26
       +
       

     

       27
       27
       +
       # Check prerequisites

     

       28
       28
       +
       log "Checking prerequisites..."

     

       29
       29
       +
       

     

       30
       30
       +
       if ! command -v docker &> /dev/null; then

     

       31
       31
       +
           error "Docker is not installed. Install with: curl -fsSL https://get.docker.com | sh"

     

       32
       32
       +
       fi

     

       33
       33
       +
       

     

       34
       34
       +
       if ! docker compose version &> /dev/null; then

     

       35
       35
       +
           error "docker compose is not available. Install with: apt install docker-compose-plugin"

     

       36
       36
       +
       fi

     

       37
       37
       +
       

     

       38
       38
       +
       # Check for .env.prod

     

       39
       39
       +
       if [ ! -f ".env.prod" ]; then

     

       40
       40
       +
           error ".env.prod not found! Copy from .env.prod.example and configure secrets."

     

       41
       41
       +
       fi

     

       42
       42
       +
       

     

       43
       43
       +
       # Load environment

     

       44
       44
       +
       set -a

     

       45
       45
       +
       source .env.prod

     

       46
       46
       +
       set +a

     

       47
       47
       +
       

     

       48
       48
       +
       # Create required directories

     

       49
       49
       +
       log "Creating directories..."

     

       50
       50
       +
       mkdir -p backups

     

       51
       51
       +
       mkdir -p static/.well-known

     

       52
       52
       +
       

     

       53
       53
       +
       # Check for did.json

     

       54
       54
       +
       if [ ! -f "static/.well-known/did.json" ]; then

     

       55
       55
       +
           warn "static/.well-known/did.json not found!"

     

       56
       56
       +
           warn "Run ./scripts/generate-did-keys.sh to create it."

     

       57
       57
       +
       fi

     

       58
       58
       +
       

     

       59
       59
       +
       # Note: Caddy logs are written to Docker volume (caddy-data)

     

       60
       60
       +
       # If you need host-accessible logs, uncomment and run as root:

     

       61
       61
       +
       # mkdir -p /var/log/caddy && chown 1000:1000 /var/log/caddy

     

       62
       62
       +
       

     

       63
       63
       +
       # Pull Docker images

     

       64
       64
       +
       log "Pulling Docker images..."

     

       65
       65
       +
       docker compose -f docker-compose.prod.yml pull postgres pds caddy

     

       66
       66
       +
       

     

       67
       67
       +
       # Build AppView

     

       68
       68
       +
       log "Building AppView..."

     

       69
       69
       +
       docker compose -f docker-compose.prod.yml build appview

     

       70
       70
       +
       

     

       71
       71
       +
       # Start services

     

       72
       72
       +
       log "Starting services..."

     

       73
       73
       +
       docker compose -f docker-compose.prod.yml up -d

     

       74
       74
       +
       

     

       75
       75
       +
       # Wait for PostgreSQL

     

       76
       76
       +
       log "Waiting for PostgreSQL to be ready..."

     

       77
       77
       +
       until docker compose -f docker-compose.prod.yml exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; do

     

       78
       78
       +
           sleep 2

     

       79
       79
       +
       done

     

       80
       80
       +
       log "PostgreSQL is ready!"

     

       81
       81
       +
       

     

       82
       82
       +
       # Run migrations

     

       83
       83
       +
       log "Running database migrations..."

     

       84
       84
       +
       # The AppView runs migrations on startup, but you can also run them manually:

     

       85
       85
       +
       # docker compose -f docker-compose.prod.yml exec appview /app/coves-server migrate

     

       86
       86
       +
       

     

       87
       87
       +
       # Final status

     

       88
       88
       +
       log ""

     

       89
       89
       +
       log "============================================"

     

       90
       90
       +
       log "  Coves Production Setup Complete!"

     

       91
       91
       +
       log "============================================"

     

       92
       92
       +
       log ""

     

       93
       93
       +
       log "Services running:"

     

       94
       94
       +
       docker compose -f docker-compose.prod.yml ps

     

       95
       95
       +
       log ""

     

       96
       96
       +
       log "Next steps:"

     

       97
       97
       +
       log "  1. Configure DNS for coves.social and coves.me"

     

       98
       98
       +
       log "  2. Run ./scripts/generate-did-keys.sh to create DID keys"

     

       99
       99
       +
       log "  3. Test health endpoints:"

     

       100
       100
       +
       log "     curl https://coves.social/xrpc/_health"

     

       101
       101
       +
       log "     curl https://coves.me/xrpc/_health"

     

       102
       102
       +
       log ""

     

       103
       103
       +
       log "Useful commands:"

     

       104
       104
       +
       log "  View logs:     docker compose -f docker-compose.prod.yml logs -f"

     

       105
       105
       +
       log "  Deploy update: ./scripts/deploy.sh appview"

     

       106
       106
       +
       log "  Backup DB:     ./scripts/backup.sh"

+19

static/.well-known/did.json.template

···

       1
       1
       +
       {

     

       2
       2
       +
         "id": "did:web:coves.social",

     

       3
       3
       +
         "alsoKnownAs": ["at://coves.social"],

     

       4
       4
       +
         "verificationMethod": [

     

       5
       5
       +
           {

     

       6
       6
       +
             "id": "did:web:coves.social#atproto",

     

       7
       7
       +
             "type": "Multikey",

     

       8
       8
       +
             "controller": "did:web:coves.social",

     

       9
       9
       +
             "publicKeyMultibase": "REPLACE_WITH_YOUR_PUBLIC_KEY"

     

       10
       10
       +
           }

     

       11
       11
       +
         ],

     

       12
       12
       +
         "service": [

     

       13
       13
       +
           {

     

       14
       14
       +
             "id": "#atproto_pds",

     

       15
       15
       +
             "type": "AtprotoPersonalDataServer",

     

       16
       16
       +
             "serviceEndpoint": "https://coves.me"

     

       17
       17
       +
           }

     

       18
       18
       +
         ]

     

       19
       19
       +
       }

+18

static/client-metadata.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "client_id": "https://coves.social/client-metadata.json",

     

       3
       3
       +
         "client_name": "Coves",

     

       4
       4
       +
         "client_uri": "https://coves.social",

     

       5
       5
       +
         "logo_uri": "https://coves.social/logo.png",

     

       6
       6
       +
         "tos_uri": "https://coves.social/terms",

     

       7
       7
       +
         "policy_uri": "https://coves.social/privacy",

     

       8
       8
       +
         "redirect_uris": [

     

       9
       9
       +
           "https://coves.social/oauth/callback",

     

       10
       10
       +
           "social.coves:/oauth/callback"

     

       11
       11
       +
         ],

     

       12
       12
       +
         "scope": "atproto transition:generic",

     

       13
       13
       +
         "grant_types": ["authorization_code", "refresh_token"],

     

       14
       14
       +
         "response_types": ["code"],

     

       15
       15
       +
         "application_type": "native",

     

       16
       16
       +
         "token_endpoint_auth_method": "none",

     

       17
       17
       +
         "dpop_bound_access_tokens": true

     

       18
       18
       +
       }

+97

static/oauth/callback.html

···

       1
       1
       +
       <!DOCTYPE html>

     

       2
       2
       +
       <html>

     

       3
       3
       +
       <head>

     

       4
       4
       +
         <meta charset="utf-8">

     

       5
       5
       +
         <meta name="viewport" content="width=device-width, initial-scale=1">

     

       6
       6
       +
         <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'unsafe-inline'; style-src 'unsafe-inline'">

     

       7
       7
       +
         <title>Authorization Successful - Coves</title>

     

       8
       8
       +
         <style>

     

       9
       9
       +
           body {

     

       10
       10
       +
             font-family: system-ui, -apple-system, sans-serif;

     

       11
       11
       +
             display: flex;

     

       12
       12
       +
             align-items: center;

     

       13
       13
       +
             justify-content: center;

     

       14
       14
       +
             min-height: 100vh;

     

       15
       15
       +
             margin: 0;

     

       16
       16
       +
             background: #f5f5f5;

     

       17
       17
       +
           }

     

       18
       18
       +
           .container {

     

       19
       19
       +
             text-align: center;

     

       20
       20
       +
             padding: 2rem;

     

       21
       21
       +
             background: white;

     

       22
       22
       +
             border-radius: 8px;

     

       23
       23
       +
             box-shadow: 0 2px 8px rgba(0,0,0,0.1);

     

       24
       24
       +
             max-width: 400px;

     

       25
       25
       +
           }

     

       26
       26
       +
           .success { color: #22c55e; font-size: 3rem; margin-bottom: 1rem; }

     

       27
       27
       +
           h1 { margin: 0 0 0.5rem; color: #1f2937; font-size: 1.5rem; }

     

       28
       28
       +
           p { color: #6b7280; margin: 0.5rem 0; }

     

       29
       29
       +
           a {

     

       30
       30
       +
             display: inline-block;

     

       31
       31
       +
             margin-top: 1rem;

     

       32
       32
       +
             padding: 0.75rem 1.5rem;

     

       33
       33
       +
             background: #3b82f6;

     

       34
       34
       +
             color: white;

     

       35
       35
       +
             text-decoration: none;

     

       36
       36
       +
             border-radius: 6px;

     

       37
       37
       +
             font-weight: 500;

     

       38
       38
       +
           }

     

       39
       39
       +
           a:hover { background: #2563eb; }

     

       40
       40
       +
         </style>

     

       41
       41
       +
       </head>

     

       42
       42
       +
       <body>

     

       43
       43
       +
         <div class="container">

     

       44
       44
       +
           <div class="success">✓</div>

     

       45
       45
       +
           <h1>Authorization Successful!</h1>

     

       46
       46
       +
           <p id="status">Returning to Coves...</p>

     

       47
       47
       +
           <a href="#" id="manualLink">Open Coves</a>

     

       48
       48
       +
         </div>

     

       49
       49
       +
         <script>

     

       50
       50
       +
           (function() {

     

       51
       51
       +
             // Parse and sanitize query params - only allow expected OAuth parameters

     

       52
       52
       +
             const urlParams = new URLSearchParams(window.location.search);

     

       53
       53
       +
             const safeParams = new URLSearchParams();

     

       54
       54
       +
       

     

       55
       55
       +
             // Whitelist only expected OAuth callback parameters

     

       56
       56
       +
             const code = urlParams.get('code');

     

       57
       57
       +
             const state = urlParams.get('state');

     

       58
       58
       +
             const error = urlParams.get('error');

     

       59
       59
       +
             const errorDescription = urlParams.get('error_description');

     

       60
       60
       +
             const iss = urlParams.get('iss');

     

       61
       61
       +
       

     

       62
       62
       +
             if (code) safeParams.set('code', code);

     

       63
       63
       +
             if (state) safeParams.set('state', state);

     

       64
       64
       +
             if (error) safeParams.set('error', error);

     

       65
       65
       +
             if (errorDescription) safeParams.set('error_description', errorDescription);

     

       66
       66
       +
             if (iss) safeParams.set('iss', iss);

     

       67
       67
       +
       

     

       68
       68
       +
             const sanitizedQuery = safeParams.toString() ? '?' + safeParams.toString() : '';

     

       69
       69
       +
       

     

       70
       70
       +
             const userAgent = navigator.userAgent || '';

     

       71
       71
       +
             const isAndroid = /Android/i.test(userAgent);

     

       72
       72
       +
       

     

       73
       73
       +
             // Build deep link based on platform

     

       74
       74
       +
             let deepLink;

     

       75
       75
       +
             if (isAndroid) {

     

       76
       76
       +
               // Android: Intent URL format

     

       77
       77
       +
               const pathAndQuery = '/oauth/callback' + sanitizedQuery;

     

       78
       78
       +
               deepLink = 'intent:/' + pathAndQuery + '#Intent;scheme=social.coves;package=social.coves;end';

     

       79
       79
       +
             } else {

     

       80
       80
       +
               // iOS: Custom scheme

     

       81
       81
       +
               deepLink = 'social.coves:/oauth/callback' + sanitizedQuery;

     

       82
       82
       +
             }

     

       83
       83
       +
       

     

       84
       84
       +
             // Update manual link

     

       85
       85
       +
             document.getElementById('manualLink').href = deepLink;

     

       86
       86
       +
       

     

       87
       87
       +
             // Attempt automatic redirect

     

       88
       88
       +
             window.location.href = deepLink;

     

       89
       89
       +
       

     

       90
       90
       +
             // Update status after 2 seconds if redirect didn't work

     

       91
       91
       +
             setTimeout(function() {

     

       92
       92
       +
               document.getElementById('status').textContent = 'Click the button above to continue';

     

       93
       93
       +
             }, 2000);

     

       94
       94
       +
           })();

     

       95
       95
       +
         </script>

     

       96
       96
       +
       </body>

     

       97
       97
       +
       </html>

+2 -1

Dockerfile

···

       42
       42
        
       COPY --from=builder /build/coves-server /app/coves-server

     

       43
       43
        
       

     

       44
       44
        
       # Copy migrations (needed for goose)

     

       45
       45
       -
       COPY --from=builder /build/internal/db/migrations /app/migrations

     

       45
       45
       +
       # Must maintain path structure as app looks for internal/db/migrations

     

       46
       46
       +
       COPY --from=builder /build/internal/db/migrations /app/internal/db/migrations

     

       46
       47
        
       

     

       47
       48
        
       # Set ownership

     

       48
       49
        
       RUN chown -R coves:coves /app

+187

scripts/derive-did-from-key.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Derive public key from existing PDS_ROTATION_KEY and create did.json

     

       3
       3
       +
       #

     

       4
       4
       +
       # This script takes your existing private key and derives the public key from it.

     

       5
       5
       +
       # Use this if you already have a PDS running with a rotation key but need to

     

       6
       6
       +
       # create/fix the did.json file.

     

       7
       7
       +
       #

     

       8
       8
       +
       # Usage: ./scripts/derive-did-from-key.sh

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       OUTPUT_DIR="$PROJECT_DIR/static/.well-known"

     

       15
       15
       +
       

     

       16
       16
       +
       # Colors

     

       17
       17
       +
       GREEN='\033[0;32m'

     

       18
       18
       +
       YELLOW='\033[1;33m'

     

       19
       19
       +
       RED='\033[0;31m'

     

       20
       20
       +
       NC='\033[0m'

     

       21
       21
       +
       

     

       22
       22
       +
       log() { echo -e "${GREEN}[DERIVE]${NC} $1"; }

     

       23
       23
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       24
       24
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       25
       25
       +
       

     

       26
       26
       +
       # Check for required tools

     

       27
       27
       +
       if ! command -v openssl &> /dev/null; then

     

       28
       28
       +
           error "openssl is required but not installed"

     

       29
       29
       +
       fi

     

       30
       30
       +
       

     

       31
       31
       +
       if ! command -v python3 &> /dev/null; then

     

       32
       32
       +
           error "python3 is required for base58 encoding"

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       # Check for base58 library

     

       36
       36
       +
       if ! python3 -c "import base58" 2>/dev/null; then

     

       37
       37
       +
           warn "Installing base58 Python library..."

     

       38
       38
       +
           pip3 install base58 || error "Failed to install base58. Run: pip3 install base58"

     

       39
       39
       +
       fi

     

       40
       40
       +
       

     

       41
       41
       +
       # Load environment to get the existing key

     

       42
       42
       +
       if [ -f "$PROJECT_DIR/.env.prod" ]; then

     

       43
       43
       +
           source "$PROJECT_DIR/.env.prod"

     

       44
       44
       +
       elif [ -f "$PROJECT_DIR/.env" ]; then

     

       45
       45
       +
           source "$PROJECT_DIR/.env"

     

       46
       46
       +
       else

     

       47
       47
       +
           error "No .env.prod or .env file found"

     

       48
       48
       +
       fi

     

       49
       49
       +
       

     

       50
       50
       +
       if [ -z "$PDS_ROTATION_KEY" ]; then

     

       51
       51
       +
           error "PDS_ROTATION_KEY not found in environment"

     

       52
       52
       +
       fi

     

       53
       53
       +
       

     

       54
       54
       +
       # Validate key format (should be 64 hex chars)

     

       55
       55
       +
       if [[ ! "$PDS_ROTATION_KEY" =~ ^[0-9a-fA-F]{64}$ ]]; then

     

       56
       56
       +
           error "PDS_ROTATION_KEY is not a valid 64-character hex string"

     

       57
       57
       +
       fi

     

       58
       58
       +
       

     

       59
       59
       +
       log "Deriving public key from existing PDS_ROTATION_KEY..."

     

       60
       60
       +
       

     

       61
       61
       +
       # Create a temporary PEM file from the hex private key

     

       62
       62
       +
       TEMP_DIR=$(mktemp -d)

     

       63
       63
       +
       PRIVATE_KEY_HEX="$PDS_ROTATION_KEY"

     

       64
       64
       +
       

     

       65
       65
       +
       # Convert hex private key to PEM format

     

       66
       66
       +
       # secp256k1 curve OID: 1.3.132.0.10

     

       67
       67
       +
       python3 > "$TEMP_DIR/private.pem" << EOF

     

       68
       68
       +
       import binascii

     

       69
       69
       +
       

     

       70
       70
       +
       # Private key in hex

     

       71
       71
       +
       priv_hex = "$PRIVATE_KEY_HEX"

     

       72
       72
       +
       priv_bytes = binascii.unhexlify(priv_hex)

     

       73
       73
       +
       

     

       74
       74
       +
       # secp256k1 OID

     

       75
       75
       +
       oid = bytes([0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a])

     

       76
       76
       +
       

     

       77
       77
       +
       # Build the EC private key structure

     

       78
       78
       +
       # SEQUENCE { version INTEGER, privateKey OCTET STRING, [0] OID, [1] publicKey }

     

       79
       79
       +
       # We'll use a simpler approach: just the private key with curve params

     

       80
       80
       +
       

     

       81
       81
       +
       # EC PARAMETERS for secp256k1

     

       82
       82
       +
       ec_params = bytes([

     

       83
       83
       +
           0x30, 0x07,  # SEQUENCE, 7 bytes

     

       84
       84
       +
           0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a  # OID for secp256k1

     

       85
       85
       +
       ])

     

       86
       86
       +
       

     

       87
       87
       +
       # EC PRIVATE KEY structure

     

       88
       88
       +
       # SEQUENCE { version, privateKey, [0] parameters }

     

       89
       89
       +
       inner = bytes([0x02, 0x01, 0x01])  # version = 1

     

       90
       90
       +
       inner += bytes([0x04, 0x20]) + priv_bytes  # OCTET STRING with 32-byte key

     

       91
       91
       +
       inner += bytes([0xa0, 0x07]) + bytes([0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a])  # [0] OID

     

       92
       92
       +
       

     

       93
       93
       +
       # Wrap in SEQUENCE

     

       94
       94
       +
       key_der = bytes([0x30, len(inner)]) + inner

     

       95
       95
       +
       

     

       96
       96
       +
       # Base64 encode

     

       97
       97
       +
       import base64

     

       98
       98
       +
       key_b64 = base64.b64encode(key_der).decode('ascii')

     

       99
       99
       +
       

     

       100
       100
       +
       # Format as PEM

     

       101
       101
       +
       print("-----BEGIN EC PRIVATE KEY-----")

     

       102
       102
       +
       for i in range(0, len(key_b64), 64):

     

       103
       103
       +
           print(key_b64[i:i+64])

     

       104
       104
       +
       print("-----END EC PRIVATE KEY-----")

     

       105
       105
       +
       EOF

     

       106
       106
       +
       

     

       107
       107
       +
       # Extract the compressed public key

     

       108
       108
       +
       PUBLIC_KEY_HEX=$(openssl ec -in "$TEMP_DIR/private.pem" -pubout -conv_form compressed -outform DER 2>/dev/null | \

     

       109
       109
       +
           tail -c 33 | xxd -p | tr -d '\n')

     

       110
       110
       +
       

     

       111
       111
       +
       # Clean up

     

       112
       112
       +
       rm -rf "$TEMP_DIR"

     

       113
       113
       +
       

     

       114
       114
       +
       if [ -z "$PUBLIC_KEY_HEX" ] || [ ${#PUBLIC_KEY_HEX} -ne 66 ]; then

     

       115
       115
       +
           error "Failed to derive public key. Got: $PUBLIC_KEY_HEX"

     

       116
       116
       +
       fi

     

       117
       117
       +
       

     

       118
       118
       +
       log "Derived public key: ${PUBLIC_KEY_HEX:0:8}...${PUBLIC_KEY_HEX: -8}"

     

       119
       119
       +
       

     

       120
       120
       +
       # Encode public key as multibase with multicodec

     

       121
       121
       +
       PUBLIC_KEY_MULTIBASE=$(python3 << EOF

     

       122
       122
       +
       import base58

     

       123
       123
       +
       

     

       124
       124
       +
       # Compressed public key bytes

     

       125
       125
       +
       pub_hex = "$PUBLIC_KEY_HEX"

     

       126
       126
       +
       pub_bytes = bytes.fromhex(pub_hex)

     

       127
       127
       +
       

     

       128
       128
       +
       # Prepend multicodec 0xe7 for secp256k1-pub

     

       129
       129
       +
       # 0xe7 as varint is just 0xe7 (single byte, < 128)

     

       130
       130
       +
       multicodec = bytes([0xe7, 0x01])  # 0xe701 for secp256k1-pub compressed

     

       131
       131
       +
       key_with_codec = multicodec + pub_bytes

     

       132
       132
       +
       

     

       133
       133
       +
       # Base58btc encode

     

       134
       134
       +
       encoded = base58.b58encode(key_with_codec).decode('ascii')

     

       135
       135
       +
       

     

       136
       136
       +
       # Add 'z' prefix for multibase

     

       137
       137
       +
       print('z' + encoded)

     

       138
       138
       +
       EOF

     

       139
       139
       +
       )

     

       140
       140
       +
       

     

       141
       141
       +
       log "Public key multibase: $PUBLIC_KEY_MULTIBASE"

     

       142
       142
       +
       

     

       143
       143
       +
       # Generate the did.json file

     

       144
       144
       +
       log "Generating did.json..."

     

       145
       145
       +
       

     

       146
       146
       +
       mkdir -p "$OUTPUT_DIR"

     

       147
       147
       +
       

     

       148
       148
       +
       cat > "$OUTPUT_DIR/did.json" << EOF

     

       149
       149
       +
       {

     

       150
       150
       +
         "id": "did:web:coves.social",

     

       151
       151
       +
         "alsoKnownAs": ["at://coves.social"],

     

       152
       152
       +
         "verificationMethod": [

     

       153
       153
       +
           {

     

       154
       154
       +
             "id": "did:web:coves.social#atproto",

     

       155
       155
       +
             "type": "Multikey",

     

       156
       156
       +
             "controller": "did:web:coves.social",

     

       157
       157
       +
             "publicKeyMultibase": "$PUBLIC_KEY_MULTIBASE"

     

       158
       158
       +
           }

     

       159
       159
       +
         ],

     

       160
       160
       +
         "service": [

     

       161
       161
       +
           {

     

       162
       162
       +
             "id": "#atproto_pds",

     

       163
       163
       +
             "type": "AtprotoPersonalDataServer",

     

       164
       164
       +
             "serviceEndpoint": "https://coves.me"

     

       165
       165
       +
           }

     

       166
       166
       +
         ]

     

       167
       167
       +
       }

     

       168
       168
       +
       EOF

     

       169
       169
       +
       

     

       170
       170
       +
       log "Created: $OUTPUT_DIR/did.json"

     

       171
       171
       +
       echo ""

     

       172
       172
       +
       echo "============================================"

     

       173
       173
       +
       echo "  DID Document Generated Successfully!"

     

       174
       174
       +
       echo "============================================"

     

       175
       175
       +
       echo ""

     

       176
       176
       +
       echo "Public key multibase: $PUBLIC_KEY_MULTIBASE"

     

       177
       177
       +
       echo ""

     

       178
       178
       +
       echo "Next steps:"

     

       179
       179
       +
       echo "  1. Copy this file to your production server:"

     

       180
       180
       +
       echo "     scp $OUTPUT_DIR/did.json user@server:/opt/coves/static/.well-known/"

     

       181
       181
       +
       echo ""

     

       182
       182
       +
       echo "  2. Or if running on production, restart Caddy:"

     

       183
       183
       +
       echo "     docker compose -f docker-compose.prod.yml restart caddy"

     

       184
       184
       +
       echo ""

     

       185
       185
       +
       echo "  3. Verify it's accessible:"

     

       186
       186
       +
       echo "     curl https://coves.social/.well-known/did.json"

     

       187
       187
       +
       echo ""

+3 -2

internal/api/routes/community.go

···

       10
       10
        
       

     

       11
       11
        
       // RegisterCommunityRoutes registers community-related XRPC endpoints on the router

     

       12
       12
        
       // Implements social.coves.community.* lexicon endpoints

     

       13
       13
       -
       func RegisterCommunityRoutes(r chi.Router, service communities.Service, authMiddleware *middleware.AtProtoAuthMiddleware) {

     

       13
       13
       +
       // allowedCommunityCreators restricts who can create communities. If empty, anyone can create.

     

       14
       14
       +
       func RegisterCommunityRoutes(r chi.Router, service communities.Service, authMiddleware *middleware.AtProtoAuthMiddleware, allowedCommunityCreators []string) {

     

       14
       15
        
       	// Initialize handlers

     

       15
       15
       -
       	createHandler := community.NewCreateHandler(service)

     

       16
       16
       +
       	createHandler := community.NewCreateHandler(service, allowedCommunityCreators)

     

       16
       17
        
       	getHandler := community.NewGetHandler(service)

     

       17
       18
        
       	updateHandler := community.NewUpdateHandler(service)

     

       18
       19
        
       	listHandler := community.NewListHandler(service)

+1 -2

internal/api/handlers/aggregator/get_authorizations.go

···

       1
       1
        
       package aggregator

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"log"

     

       6
       7
        
       	"net/http"

     

       7
       8
        
       	"strconv"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/aggregators"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // GetAuthorizationsHandler handles listing authorizations for an aggregator

+1 -2

internal/api/handlers/aggregator/list_for_community.go

···

       1
       1
        
       package aggregator

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"log"

     

       6
       7
        
       	"net/http"

     

       7
       8
        
       	"strconv"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/aggregators"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // ListForCommunityHandler handles listing aggregators for a community

+1 -2

internal/api/handlers/comments/errors.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/comments"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"log"

     

       6
       7
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/comments"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // errorResponse represents a standardized JSON error response

+1 -2

internal/api/handlers/comments/service_adapter.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"net/http"

     

       5
       5
       -
       

     

       6
       4
        
       	"Coves/internal/core/comments"

     

       5
       5
       +
       	"net/http"

     

       7
       6
        
       )

     

       8
       7
        
       

     

       9
       8
        
       // ServiceAdapter adapts the core comments.Service to the handler's Service interface

+2 -3

internal/api/handlers/community/block.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/api/middleware"

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // BlockHandler handles community blocking operations

+1 -2

internal/api/handlers/community/list.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"net/http"

     

       6
       7
        
       	"strconv"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/communities"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // ListHandler handles listing communities

+2 -3

internal/api/handlers/communityFeed/get_community.go

···

       1
       1
        
       package communityFeed

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communityFeeds"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       9
        
       	"strconv"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/communityFeeds"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // GetCommunityHandler handles community feed retrieval

+2 -3

internal/api/handlers/discover/get_discover.go

···

       1
       1
        
       package discover

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/discover"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       9
        
       	"strconv"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/discover"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // GetDiscoverHandler handles discover feed retrieval

+2 -3

internal/api/handlers/post/create.go

···

       1
       1
        
       package post

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       9
        
       	"strings"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/api/middleware"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // CreateHandler handles post creation requests

+2 -3

internal/api/handlers/post/errors.go

···

       1
       1
        
       package post

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/aggregators"

     

       9
       9
       -
       	"Coves/internal/core/posts"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       type errorResponse struct {

+3 -4

internal/api/handlers/timeline/get_timeline.go

···

       1
       1
        
       package timeline

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/timeline"

     

       4
       7
        
       	"encoding/json"

     

       5
       8
        
       	"log"

     

       6
       9
        
       	"net/http"

     

       7
       10
        
       	"strconv"

     

       8
       11
        
       	"strings"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/api/middleware"

     

       11
       11
       -
       	"Coves/internal/core/posts"

     

       12
       12
       -
       	"Coves/internal/core/timeline"

     

       13
       12
        
       )

     

       14
       13
        
       

     

       15
       14
        
       // GetTimelineHandler handles timeline feed retrieval

+1 -2

internal/atproto/jetstream/aggregator_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"encoding/json"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"log"

     

       8
       9
        
       	"time"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/core/aggregators"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // AggregatorEventConsumer consumes aggregator-related events from Jetstream

+2 -3

internal/atproto/jetstream/comment_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/utils"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"database/sql"

     

       6
       8
        
       	"encoding/json"

     
···

       9
       11
        
       	"strings"

     

       10
       12
        
       	"time"

     

       11
       13
        
       

     

       12
       12
       -
       	"Coves/internal/atproto/utils"

     

       13
       13
       -
       	"Coves/internal/core/comments"

     

       14
       14
       -
       

     

       15
       14
        
       	"github.com/lib/pq"

     

       16
       15
        
       )

     

       17
       16

+3 -4

internal/atproto/jetstream/community_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/atproto/utils"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"fmt"

     
···

       9
       12
        
       	"strings"

     

       10
       13
        
       	"time"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/atproto/identity"

     

       13
       13
       -
       	"Coves/internal/atproto/utils"

     

       14
       14
       -
       	"Coves/internal/core/communities"

     

       15
       15
       -
       

     

       16
       15
        
       	lru "github.com/hashicorp/golang-lru/v2"

     

       17
       16
        
       	"golang.org/x/net/publicsuffix"

     

       18
       17
        
       	"golang.org/x/time/rate"

+3 -4

internal/atproto/jetstream/post_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"database/sql"

     

       6
       9
        
       	"encoding/json"

     
···

       8
       11
        
       	"log"

     

       9
       12
        
       	"strings"

     

       10
       13
        
       	"time"

     

       11
       11
       -
       

     

       12
       12
       -
       	"Coves/internal/core/communities"

     

       13
       13
       -
       	"Coves/internal/core/posts"

     

       14
       14
       -
       	"Coves/internal/core/users"

     

       15
       14
        
       )

     

       16
       15
        
       

     

       17
       16
        
       // PostEventConsumer consumes post-related events from Jetstream

+3 -4

internal/atproto/jetstream/vote_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/utils"

     

       5
       5
       +
       	"Coves/internal/core/users"

     

       6
       6
       +
       	"Coves/internal/core/votes"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"database/sql"

     

       6
       9
        
       	"fmt"

     

       7
       10
        
       	"log"

     

       8
       11
        
       	"strings"

     

       9
       12
        
       	"time"

     

       10
       10
       -
       

     

       11
       11
       -
       	"Coves/internal/atproto/utils"

     

       12
       12
       -
       	"Coves/internal/core/users"

     

       13
       13
       -
       	"Coves/internal/core/votes"

     

       14
       13
        
       )

     

       15
       14
        
       

     

       16
       15
        
       // VoteEventConsumer consumes vote-related events from Jetstream

+1 -2

internal/core/blobs/service.go

···

       1
       1
        
       package blobs

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"bytes"

     

       5
       6
        
       	"context"

     

       6
       7
        
       	"encoding/json"

     
···

       9
       10
        
       	"log"

     

       10
       11
        
       	"net/http"

     

       11
       12
        
       	"time"

     

       12
       12
       -
       

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       13
        
       )

     

       15
       14
        
       

     

       16
       15
        
       // Service defines the interface for blob operations

+3 -4

internal/core/comments/comment_service.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"errors"

     
···

       9
       12
        
       	"net/url"

     

       10
       13
        
       	"strings"

     

       11
       14
        
       	"time"

     

       12
       12
       -
       

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/core/users"

     

       16
       15
        
       )

     

       17
       16
        
       

     

       18
       17
        
       const (

+5 -6

internal/core/comments/comment_service_test.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"errors"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       11
        
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       11
       -
       	"Coves/internal/core/users"

     

       12
       12
       -
       

     

       13
       12
        
       	"github.com/stretchr/testify/assert"

     

       14
       13
        
       )

     

       15
       14
        
       

     
···

       232
       231
        
       	return nil

     

       233
       232
        
       }

     

       234
       233
        
       

     

       235
       235
       -
       func (m *mockCommunityRepo) List(ctx context.Context, req communities.ListCommunitiesRequest) ([]*communities.Community, int, error) {

     

       236
       236
       -
       	return nil, 0, nil

     

       234
       234
       +
       func (m *mockCommunityRepo) List(ctx context.Context, req communities.ListCommunitiesRequest) ([]*communities.Community, error) {

     

       235
       235
       +
       	return nil, nil

     

       237
       236
        
       }

     

       238
       237
        
       

     

       239
       238
        
       func (m *mockCommunityRepo) Search(ctx context.Context, req communities.SearchCommunitiesRequest) ([]*communities.Community, int, error) {

+1 -2

internal/core/communities/service.go

···

       1
       1
        
       package communities

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/utils"

     

       4
       5
        
       	"bytes"

     

       5
       6
        
       	"context"

     

       6
       7
        
       	"encoding/json"

     
···

       13
       14
        
       	"strings"

     

       14
       15
        
       	"sync"

     

       15
       16
        
       	"time"

     

       16
       16
       -
       

     

       17
       17
       -
       	"Coves/internal/atproto/utils"

     

       18
       17
        
       )

     

       19
       18
        
       

     

       20
       19
        
       // Community handle validation regex (DNS-valid handle: name.community.instance.com)

+5 -6

internal/core/posts/service.go

···

       1
       1
        
       package posts

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/aggregators"

     

       6
       6
       +
       	"Coves/internal/core/blobs"

     

       7
       7
       +
       	"Coves/internal/core/communities"

     

       8
       8
       +
       	"Coves/internal/core/unfurl"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"context"

     

       6
       11
        
       	"encoding/json"

     
···

       10
       15
        
       	"net/http"

     

       11
       16
        
       	"os"

     

       12
       17
        
       	"time"

     

       13
       13
       -
       

     

       14
       14
       -
       	"Coves/internal/api/middleware"

     

       15
       15
       -
       	"Coves/internal/core/aggregators"

     

       16
       16
       -
       	"Coves/internal/core/blobs"

     

       17
       17
       -
       	"Coves/internal/core/communities"

     

       18
       18
       -
       	"Coves/internal/core/unfurl"

     

       19
       18
        
       )

     

       20
       19
        
       

     

       21
       20
        
       type postService struct {

+1 -2

internal/db/postgres/aggregator_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"strings"

     

       8
       9
        
       	"time"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/core/aggregators"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       type postgresAggregatorRepo struct {

+1 -2

internal/db/postgres/comment_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/comments"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"encoding/base64"

     
···

       8
       9
        
       	"log"

     

       9
       10
        
       	"strings"

     

       10
       11
        
       

     

       11
       11
       -
       	"Coves/internal/core/comments"

     

       12
       12
       -
       

     

       13
       12
        
       	"github.com/lib/pq"

     

       14
       13
        
       )

     

       15
       14

+1 -2

internal/db/postgres/feed_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communityFeeds"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/communityFeeds"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       type postgresFeedRepo struct {

+1 -2

internal/db/postgres/feed_repo_base.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/posts"

     

       4
       5
        
       	"crypto/hmac"

     

       5
       6
        
       	"crypto/sha256"

     

       6
       7
        
       	"database/sql"

     
···

       11
       12
        
       	"strconv"

     

       12
       13
        
       	"strings"

     

       13
       14
        
       	"time"

     

       14
       14
       -
       

     

       15
       15
       -
       	"Coves/internal/core/posts"

     

       16
       15
        
       )

     

       17
       16
        
       

     

       18
       17
        
       // feedRepoBase contains shared logic for timeline and discover feed repositories

+1 -2

internal/db/postgres/post_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/posts"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"strings"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/posts"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       type postgresPostRepo struct {

+1 -2

internal/db/postgres/vote_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/votes"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"strings"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/votes"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       type postgresVoteRepo struct {

+1 -2

internal/db/postgres/vote_repo_test.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/votes"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"os"

     

       7
       8
        
       	"testing"

     

       8
       9
        
       	"time"

     

       9
       10
        
       

     

       10
       10
       -
       	"Coves/internal/core/votes"

     

       11
       11
       -
       

     

       12
       11
        
       	_ "github.com/lib/pq"

     

       13
       12
        
       	"github.com/pressly/goose/v3"

     

       14
       13
        
       	"github.com/stretchr/testify/assert"

+7 -8

tests/e2e/error_recovery_test.go

···

       1
       1
        
       package e2e

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/atproto/jetstream"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       7
       7
       +
       	"Coves/internal/db/postgres"

     

       4
       8
        
       	"context"

     

       5
       9
        
       	"database/sql"

     

       6
       10
        
       	"fmt"

     
···

       12
       16
        
       	"testing"

     

       13
       17
        
       	"time"

     

       14
       18
        
       

     

       15
       15
       -
       	"Coves/internal/atproto/identity"

     

       16
       16
       -
       	"Coves/internal/atproto/jetstream"

     

       17
       17
       -
       	"Coves/internal/core/users"

     

       18
       18
       -
       	"Coves/internal/db/postgres"

     

       19
       19
       -
       

     

       20
       19
        
       	_ "github.com/lib/pq"

     

       21
       20
        
       	"github.com/pressly/goose/v3"

     

       22
       21
        
       )

     
···

       138
       137
        
       

     

       139
       138
        
       	testCases := []struct {

     

       140
       139
        
       		name      string

     

       141
       141
       -
       		event     jetstream.JetstreamEvent

     

       142
       140
        
       		shouldLog string

     

       141
       141
       +
       		event     jetstream.JetstreamEvent

     

       143
       142
        
       	}{

     

       144
       143
        
       		{

     

       145
       144
        
       			name: "Nil identity data",

     
···

       348
       347
        
       		if shouldFail.Load() {

     

       349
       348
        
       			t.Logf("Mock PDS: Simulating unavailability (request #%d)", requestCount.Load())

     

       350
       349
        
       			w.WriteHeader(http.StatusServiceUnavailable)

     

       351
       351
       -
       			w.Write([]byte(`{"error":"ServiceUnavailable","message":"PDS temporarily unavailable"}`))

     

       350
       350
       +
       			_, _ = w.Write([]byte(`{"error":"ServiceUnavailable","message":"PDS temporarily unavailable"}`))

     

       352
       351
        
       			return

     

       353
       352
        
       		}

     

       354
       353
        
       

     

       355
       354
        
       		t.Logf("Mock PDS: Serving request successfully (request #%d)", requestCount.Load())

     

       356
       355
        
       		// Simulate successful PDS response

     

       357
       356
        
       		w.WriteHeader(http.StatusOK)

     

       358
       358
       -
       		w.Write([]byte(`{"did":"did:plc:pdstest123","handle":"pds.test"}`))

     

       357
       357
       +
       		_, _ = w.Write([]byte(`{"did":"did:plc:pdstest123","handle":"pds.test"}`))

     

       359
       358
        
       	}))

     

       360
       359
        
       	defer mockPDS.Close()

     

       361
       360

+3 -4

tests/integration/aggregator_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"fmt"

     

       7
       10
        
       	"testing"

     

       8
       11
        
       	"time"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/core/aggregators"

     

       11
       11
       -
       	"Coves/internal/core/communities"

     

       12
       12
       -
       	"Coves/internal/db/postgres"

     

       13
       12
        
       )

     

       14
       13
        
       

     

       15
       14
        
       // TestAggregatorRepository_Create tests basic aggregator creation

+13 -14

tests/integration/blob_upload_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/atproto/jetstream"

     

       6
       6
       +
       	"Coves/internal/core/blobs"

     

       7
       7
       +
       	"Coves/internal/core/communities"

     

       8
       8
       +
       	"Coves/internal/core/posts"

     

       9
       9
       +
       	"Coves/internal/core/users"

     

       10
       10
       +
       	"Coves/internal/db/postgres"

     

       4
       11
        
       	"bytes"

     

       5
       12
        
       	"context"

     

       6
       13
        
       	"encoding/json"

     
···

       15
       22
        
       	"testing"

     

       16
       23
        
       	"time"

     

       17
       24
        
       

     

       18
       18
       -
       	"Coves/internal/atproto/identity"

     

       19
       19
       -
       	"Coves/internal/atproto/jetstream"

     

       20
       20
       -
       	"Coves/internal/core/blobs"

     

       21
       21
       -
       	"Coves/internal/core/communities"

     

       22
       22
       -
       	"Coves/internal/core/posts"

     

       23
       23
       -
       	"Coves/internal/core/users"

     

       24
       24
       -
       	"Coves/internal/db/postgres"

     

       25
       25
       -
       

     

       26
       25
        
       	"github.com/stretchr/testify/assert"

     

       27
       26
        
       	"github.com/stretchr/testify/require"

     

       28
       27
        
       )

     
···

       49
       48
        
       	if err != nil {

     

       50
       49
        
       		t.Skipf("PDS not running at %s: %v. Run 'make dev-up' to start PDS.", pdsURL, err)

     

       51
       50
        
       	}

     

       52
       52
       -
       	defer healthResp.Body.Close()

     

       51
       51
       +
       	defer func() { _ = healthResp.Body.Close() }()

     

       53
       52
        
       	if healthResp.StatusCode != http.StatusOK {

     

       54
       53
        
       		t.Skipf("PDS health check failed at %s: status %d", pdsURL, healthResp.StatusCode)

     

       55
       54
        
       	}

     
···

       357
       356
        
       	if err != nil {

     

       358
       357
        
       		t.Skipf("PDS not running at %s: %v. Run 'make dev-up' to start PDS.", pdsURL, err)

     

       359
       358
        
       	}

     

       360
       360
       -
       	defer healthResp.Body.Close()

     

       359
       359
       +
       	defer func() { _ = healthResp.Body.Close() }()

     

       361
       360
        
       	if healthResp.StatusCode != http.StatusOK {

     

       362
       361
        
       		t.Skipf("PDS health check failed at %s: status %d", pdsURL, healthResp.StatusCode)

     

       363
       362
        
       	}

     
···

       545
       544
        
       

     

       546
       545
        
       	t.Run("Accept matching image formats with correct MIME types", func(t *testing.T) {

     

       547
       546
        
       		testCases := []struct {

     

       547
       547
       +
       			createFunc func(*testing.T, int, int, color.Color) []byte

     

       548
       548
        
       			format     string

     

       549
       549
        
       			mimeType   string

     

       550
       550
       -
       			createFunc func(*testing.T, int, int, color.Color) []byte

     

       551
       550
        
       		}{

     

       552
       552
       -
       			{"PNG", "image/png", createTestPNG},

     

       553
       553
       -
       			{"JPEG", "image/jpeg", createTestJPEG},

     

       551
       551
       +
       			{createTestPNG, "PNG", "image/png"},

     

       552
       552
       +
       			{createTestJPEG, "JPEG", "image/jpeg"},

     

       554
       553
        
       			// Note: WebP requires external library (golang.org/x/image/webp)

     

       555
       554
        
       			// For now, we test that the MIME type is accepted even with PNG data

     

       556
       555
        
       			// In production, actual WebP validation would happen at PDS

     

       557
       557
       -
       			{"WebP (MIME only)", "image/webp", createTestPNG},

     

       556
       556
       +
       			{createTestPNG, "WebP (MIME only)", "image/webp"},

     

       558
       557
        
       		}

     

       559
       558
        
       

     

       560
       559
        
       		for _, tc := range testCases {

+14 -14

tests/integration/block_handle_resolution_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/community"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       4
       7
        
       	"bytes"

     

       5
       8
        
       	"context"

     

       6
       9
        
       	"encoding/json"

     
···

       9
       12
        
       	"net/http/httptest"

     

       10
       13
        
       	"testing"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/community"

     

       13
       13
       -
       	"Coves/internal/api/middleware"

     

       14
       14
       -
       	"Coves/internal/core/communities"

     

       15
       15
        
       	postgresRepo "Coves/internal/db/postgres"

     

       16
       16
        
       )

     

       17
       17
        
       

     
···

       73
       73
        
       		// We expect 401 (no auth) but verify the error is NOT "Community not found"

     

       74
       74
        
       		// If handle resolution worked, we'd get past that validation

     

       75
       75
        
       		resp := w.Result()

     

       76
       76
       -
       		defer resp.Body.Close()

     

       76
       76
       +
       		defer func() { _ = resp.Body.Close() }()

     

       77
       77
        
       

     

       78
       78
        
       		if resp.StatusCode == http.StatusNotFound {

     

       79
       79
        
       			t.Errorf("Handle resolution failed - got 404 CommunityNotFound")

     
···

       82
       82
        
       		// Expected: 401 Unauthorized (because we didn't add auth context)

     

       83
       83
        
       		if resp.StatusCode != http.StatusUnauthorized {

     

       84
       84
        
       			var errorResp map[string]interface{}

     

       85
       85
       -
       			json.NewDecoder(resp.Body).Decode(&errorResp)

     

       85
       85
       +
       			_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       86
       86
        
       			t.Logf("Response status: %d, body: %+v", resp.StatusCode, errorResp)

     

       87
       87
        
       		}

     

       88
       88
        
       	})

     
···

       100
       100
        
       		blockHandler.HandleBlock(w, req)

     

       101
       101
        
       

     

       102
       102
        
       		resp := w.Result()

     

       103
       103
       -
       		defer resp.Body.Close()

     

       103
       103
       +
       		defer func() { _ = resp.Body.Close() }()

     

       104
       104
        
       

     

       105
       105
        
       		if resp.StatusCode == http.StatusNotFound {

     

       106
       106
        
       			t.Errorf("@-prefixed handle resolution failed - got 404 CommunityNotFound")

     
···

       121
       121
        
       		blockHandler.HandleBlock(w, req)

     

       122
       122
        
       

     

       123
       123
        
       		resp := w.Result()

     

       124
       124
       -
       		defer resp.Body.Close()

     

       124
       124
       +
       		defer func() { _ = resp.Body.Close() }()

     

       125
       125
        
       

     

       126
       126
        
       		if resp.StatusCode == http.StatusNotFound {

     

       127
       127
        
       			t.Errorf("Scoped format resolution failed - got 404 CommunityNotFound")

     
···

       141
       141
        
       		blockHandler.HandleBlock(w, req)

     

       142
       142
        
       

     

       143
       143
        
       		resp := w.Result()

     

       144
       144
       -
       		defer resp.Body.Close()

     

       144
       144
       +
       		defer func() { _ = resp.Body.Close() }()

     

       145
       145
        
       

     

       146
       146
        
       		if resp.StatusCode == http.StatusNotFound {

     

       147
       147
        
       			t.Errorf("DID resolution failed - got 404 CommunityNotFound")

     
···

       202
       202
        
       				blockHandler.HandleBlock(w, req)

     

       203
       203
        
       

     

       204
       204
        
       				resp := w.Result()

     

       205
       205
       -
       				defer resp.Body.Close()

     

       205
       205
       +
       				defer func() { _ = resp.Body.Close() }()

     

       206
       206
        
       

     

       207
       207
        
       				// Should return 400 Bad Request for validation errors

     

       208
       208
        
       				if resp.StatusCode != http.StatusBadRequest {

     
···

       210
       210
        
       				}

     

       211
       211
        
       

     

       212
       212
        
       				var errorResp map[string]interface{}

     

       213
       213
       -
       				json.NewDecoder(resp.Body).Decode(&errorResp)

     

       213
       213
       +
       				_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       214
       214
        
       

     

       215
       215
        
       				if errorCode, ok := errorResp["error"].(string); !ok || errorCode != "InvalidRequest" {

     

       216
       216
        
       					t.Errorf("Expected error code 'InvalidRequest', got %v", errorResp["error"])

     
···

       242
       242
        
       		blockHandler.HandleBlock(w, req)

     

       243
       243
        
       

     

       244
       244
        
       		resp := w.Result()

     

       245
       245
       -
       		defer resp.Body.Close()

     

       245
       245
       +
       		defer func() { _ = resp.Body.Close() }()

     

       246
       246
        
       

     

       247
       247
        
       		// Expected: 401 (auth check happens before resolution)

     

       248
       248
        
       		// In a real scenario with auth, invalid handle would return 404

     
···

       299
       299
        
       		blockHandler.HandleUnblock(w, req)

     

       300
       300
        
       

     

       301
       301
        
       		resp := w.Result()

     

       302
       302
       -
       		defer resp.Body.Close()

     

       302
       302
       +
       		defer func() { _ = resp.Body.Close() }()

     

       303
       303
        
       

     

       304
       304
        
       		// Should NOT be 404 (handle resolution should work)

     

       305
       305
        
       		if resp.StatusCode == http.StatusNotFound {

     
···

       309
       309
        
       		// Expected: 401 (no auth context)

     

       310
       310
        
       		if resp.StatusCode != http.StatusUnauthorized {

     

       311
       311
        
       			var errorResp map[string]interface{}

     

       312
       312
       -
       			json.NewDecoder(resp.Body).Decode(&errorResp)

     

       312
       312
       +
       			_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       313
       313
        
       			t.Logf("Response: status=%d, body=%+v", resp.StatusCode, errorResp)

     

       314
       314
        
       		}

     

       315
       315
        
       	})

     
···

       328
       328
        
       		blockHandler.HandleUnblock(w, req)

     

       329
       329
        
       

     

       330
       330
        
       		resp := w.Result()

     

       331
       331
       -
       		defer resp.Body.Close()

     

       331
       331
       +
       		defer func() { _ = resp.Body.Close() }()

     

       332
       332
        
       

     

       333
       333
        
       		// Expected: 401 (auth check happens before resolution)

     

       334
       334
        
       		if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusNotFound {

+3 -4

tests/integration/comment_consumer_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/comments"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       func TestCommentConsumer_CreateComment(t *testing.T) {

+3 -4

tests/integration/comment_query_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"database/sql"

     

       6
       9
        
       	"encoding/json"

     
···

       11
       14
        
       	"testing"

     

       12
       15
        
       	"time"

     

       13
       16
        
       

     

       14
       14
       -
       	"Coves/internal/atproto/jetstream"

     

       15
       15
       -
       	"Coves/internal/core/comments"

     

       16
       16
       -
       	"Coves/internal/db/postgres"

     

       17
       17
       -
       

     

       18
       17
        
       	"github.com/stretchr/testify/assert"

     

       19
       18
        
       	"github.com/stretchr/testify/require"

     

       20
       19
        
       )

+4 -5

tests/integration/comment_vote_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"testing"

     

       7
       7
       -
       	"time"

     

       8
       8
       -
       

     

       9
       4
        
       	"Coves/internal/atproto/jetstream"

     

       10
       5
        
       	"Coves/internal/core/comments"

     

       11
       6
        
       	"Coves/internal/core/users"

     

       12
       7
        
       	"Coves/internal/db/postgres"

     

       8
       8
       +
       	"context"

     

       9
       9
       +
       	"fmt"

     

       10
       10
       +
       	"testing"

     

       11
       11
       +
       	"time"

     

       13
       12
        
       )

     

       14
       13
        
       

     

       15
       14
        
       // TestCommentVote_CreateAndUpdate tests voting on comments and vote count updates

+2 -3

tests/integration/community_blocking_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"database/sql"

     

       6
       8
        
       	"fmt"

     

       7
       9
        
       	"testing"

     

       8
       10
        
       	"time"

     

       9
       11
        
       

     

       10
       10
       -
       	"Coves/internal/atproto/jetstream"

     

       11
       11
       -
       	"Coves/internal/core/communities"

     

       12
       12
       -
       

     

       13
       12
        
       	postgresRepo "Coves/internal/db/postgres"

     

       14
       13
        
       )

     

       15
       14

+13 -14

tests/integration/community_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/api/routes"

     

       6
       6
       +
       	"Coves/internal/atproto/identity"

     

       7
       7
       +
       	"Coves/internal/atproto/jetstream"

     

       8
       8
       +
       	"Coves/internal/atproto/utils"

     

       9
       9
       +
       	"Coves/internal/core/communities"

     

       10
       10
       +
       	"Coves/internal/core/users"

     

       11
       11
       +
       	"Coves/internal/db/postgres"

     

       4
       12
        
       	"bytes"

     

       5
       13
        
       	"context"

     

       6
       14
        
       	"database/sql"

     
···

       15
       23
        
       	"testing"

     

       16
       24
        
       	"time"

     

       17
       25
        
       

     

       18
       18
       -
       	"Coves/internal/api/middleware"

     

       19
       19
       -
       	"Coves/internal/api/routes"

     

       20
       20
       -
       	"Coves/internal/atproto/identity"

     

       21
       21
       -
       	"Coves/internal/atproto/jetstream"

     

       22
       22
       -
       	"Coves/internal/atproto/utils"

     

       23
       23
       -
       	"Coves/internal/core/communities"

     

       24
       24
       -
       	"Coves/internal/core/users"

     

       25
       25
       -
       	"Coves/internal/db/postgres"

     

       26
       26
       -
       

     

       27
       26
        
       	"github.com/go-chi/chi/v5"

     

       28
       27
        
       	"github.com/gorilla/websocket"

     

       29
       28
        
       	_ "github.com/lib/pq"

     
···

       535
       534
        
       			}

     

       536
       535
        
       

     

       537
       536
        
       			var listResp struct {

     

       538
       538
       -
       				Communities []communities.Community `json:"communities"`

     

       539
       537
        
       				Cursor      string                  `json:"cursor"`

     

       538
       538
       +
       				Communities []communities.Community `json:"communities"`

     

       540
       539
        
       			}

     

       541
       540
        
       

     

       542
       541
        
       			if err := json.NewDecoder(resp.Body).Decode(&listResp); err != nil {

     
···

       564
       563
        
       			}

     

       565
       564
        
       

     

       566
       565
        
       			var listResp struct {

     

       567
       567
       -
       				Communities []communities.Community `json:"communities"`

     

       568
       566
        
       				Cursor      string                  `json:"cursor"`

     

       567
       567
       +
       				Communities []communities.Community `json:"communities"`

     

       569
       568
        
       			}

     

       570
       569
        
       			if err := json.NewDecoder(resp.Body).Decode(&listResp); err != nil {

     

       571
       570
        
       				t.Fatalf("Failed to decode response: %v", err)

     
···

       620
       619
        
       			}

     

       621
       620
        
       

     

       622
       621
        
       			var listResp struct {

     

       623
       623
       -
       				Communities []communities.Community `json:"communities"`

     

       624
       622
        
       				Cursor      string                  `json:"cursor"`

     

       623
       623
       +
       				Communities []communities.Community `json:"communities"`

     

       625
       624
        
       			}

     

       626
       625
        
       			if err := json.NewDecoder(resp.Body).Decode(&listResp); err != nil {

     

       627
       626
        
       				t.Fatalf("Failed to decode response: %v", err)

     
···

       670
       669
        
       			}

     

       671
       670
        
       

     

       672
       671
        
       			var listResp struct {

     

       673
       673
       -
       				Communities []communities.Community `json:"communities"`

     

       674
       672
        
       				Cursor      string                  `json:"cursor"`

     

       673
       673
       +
       				Communities []communities.Community `json:"communities"`

     

       675
       674
        
       			}

     

       676
       675
        
       			if err := json.NewDecoder(resp.Body).Decode(&listResp); err != nil {

     

       677
       676
        
       				t.Fatalf("Failed to decode response: %v", err)

     
···

       720
       719
        
       			}

     

       721
       720
        
       

     

       722
       721
        
       			var listResp struct {

     

       723
       723
       -
       				Communities []communities.Community `json:"communities"`

     

       724
       722
        
       				Cursor      string                  `json:"cursor"`

     

       723
       723
       +
       				Communities []communities.Community `json:"communities"`

     

       725
       724
        
       			}

     

       726
       725
        
       			if err := json.NewDecoder(resp.Body).Decode(&listResp); err != nil {

     

       727
       726
        
       				t.Fatalf("Failed to decode response: %v", err)

+2 -3

tests/integration/community_repo_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"fmt"

     

       6
       8
        
       	"testing"

     

       7
       9
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       10
       -
       	"Coves/internal/db/postgres"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       func TestCommunityRepository_Create(t *testing.T) {

+3 -4

tests/integration/community_v2_validation_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/communities"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       // TestCommunityConsumer_V2RKeyValidation tests that only V2 communities (rkey="self") are accepted

+6 -7

tests/integration/concurrent_scenarios_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"sync"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       	"time"

     

       9
       9
       -
       

     

       10
       4
        
       	"Coves/internal/atproto/jetstream"

     

       11
       5
        
       	"Coves/internal/core/comments"

     

       12
       6
        
       	"Coves/internal/core/communities"

     

       13
       7
        
       	"Coves/internal/core/users"

     

       14
       8
        
       	"Coves/internal/db/postgres"

     

       9
       9
       +
       	"context"

     

       10
       10
       +
       	"fmt"

     

       11
       11
       +
       	"sync"

     

       12
       12
       +
       	"testing"

     

       13
       13
       +
       	"time"

     

       15
       14
        
       )

     

       16
       15
        
       

     

       17
       16
        
       // TestConcurrentVoting_MultipleUsersOnSamePost tests race conditions when multiple users

     
···

       611
       610
        
       		wg.Add(numAttempts)

     

       612
       611
        
       

     

       613
       612
        
       		type result struct {

     

       614
       614
       -
       			success bool

     

       615
       613
        
       			err     error

     

       614
       614
       +
       			success bool

     

       616
       615
        
       		}

     

       617
       616
        
       		results := make(chan result, numAttempts)

     

       618
       617

+2 -3

tests/integration/discover_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/discover"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"encoding/json"

     

       6
       8
        
       	"fmt"

     
···

       9
       11
        
       	"testing"

     

       10
       12
        
       	"time"

     

       11
       13
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/discover"

     

       13
       13
       -
       	"Coves/internal/db/postgres"

     

       14
       14
       -
       

     

       15
       14
        
       	discoverCore "Coves/internal/core/discover"

     

       16
       15
        
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

+4 -5

tests/integration/feed_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/communityFeed"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       6
       6
       +
       	"Coves/internal/core/communityFeeds"

     

       7
       7
       +
       	"Coves/internal/db/postgres"

     

       4
       8
        
       	"context"

     

       5
       9
        
       	"encoding/json"

     

       6
       10
        
       	"fmt"

     
···

       9
       13
        
       	"testing"

     

       10
       14
        
       	"time"

     

       11
       15
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/communityFeed"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/communityFeeds"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+3 -4

tests/integration/jwt_verification_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/atproto/auth"

     

       4
       6
        
       	"fmt"

     

       5
       7
        
       	"net/http"

     

       6
       8
        
       	"net/http/httptest"

     
···

       8
       10
        
       	"strings"

     

       9
       11
        
       	"testing"

     

       10
       12
        
       	"time"

     

       11
       11
       -
       

     

       12
       12
       -
       	"Coves/internal/api/middleware"

     

       13
       13
       -
       	"Coves/internal/atproto/auth"

     

       14
       13
        
       )

     

       15
       14
        
       

     

       16
       15
        
       // TestJWTSignatureVerification tests end-to-end JWT signature verification

     
···

       46
       45
        
       	// Check if JWKS is available (production PDS) or symmetric secret (dev PDS)

     

       47
       46
        
       	jwksResp, _ := http.Get(pdsURL + "/oauth/jwks")

     

       48
       47
        
       	if jwksResp != nil {

     

       49
       49
       -
       		defer jwksResp.Body.Close()

     

       48
       48
       +
       		defer func() { _ = jwksResp.Body.Close() }()

     

       50
       49
        
       	}

     

       51
       50
        
       

     

       52
       51
        
       	t.Run("JWT parsing and middleware integration", func(t *testing.T) {

+3 -4

tests/integration/post_consumer_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/users"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/users"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       // TestPostConsumer_CommentCountReconciliation tests that post comment_count

+8 -9

tests/integration/post_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/post"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/atproto/identity"

     

       7
       7
       +
       	"Coves/internal/atproto/jetstream"

     

       8
       8
       +
       	"Coves/internal/core/communities"

     

       9
       9
       +
       	"Coves/internal/core/posts"

     

       10
       10
       +
       	"Coves/internal/core/users"

     

       11
       11
       +
       	"Coves/internal/db/postgres"

     

       4
       12
        
       	"bytes"

     

       5
       13
        
       	"context"

     

       6
       14
        
       	"database/sql"

     
···

       14
       22
        
       	"testing"

     

       15
       23
        
       	"time"

     

       16
       24
        
       

     

       17
       17
       -
       	"Coves/internal/api/handlers/post"

     

       18
       18
       -
       	"Coves/internal/api/middleware"

     

       19
       19
       -
       	"Coves/internal/atproto/identity"

     

       20
       20
       -
       	"Coves/internal/atproto/jetstream"

     

       21
       21
       -
       	"Coves/internal/core/communities"

     

       22
       22
       -
       	"Coves/internal/core/posts"

     

       23
       23
       -
       	"Coves/internal/core/users"

     

       24
       24
       -
       	"Coves/internal/db/postgres"

     

       25
       25
       -
       

     

       26
       25
        
       	"github.com/gorilla/websocket"

     

       27
       26
        
       	_ "github.com/lib/pq"

     

       28
       27
        
       	"github.com/pressly/goose/v3"

+5 -6

tests/integration/post_handler_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/post"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       7
       7
       +
       	"Coves/internal/core/posts"

     

       8
       8
       +
       	"Coves/internal/db/postgres"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"encoding/json"

     

       6
       11
        
       	"net/http"

     
···

       8
       13
        
       	"strings"

     

       9
       14
        
       	"testing"

     

       10
       15
        
       

     

       11
       11
       -
       	"Coves/internal/api/handlers/post"

     

       12
       12
       -
       	"Coves/internal/api/middleware"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+5 -6

tests/integration/post_thumb_validation_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/post"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       7
       7
       +
       	"Coves/internal/core/posts"

     

       8
       8
       +
       	"Coves/internal/db/postgres"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"context"

     

       6
       11
        
       	"encoding/json"

     
···

       8
       13
        
       	"net/http/httptest"

     

       9
       14
        
       	"testing"

     

       10
       15
        
       

     

       11
       11
       -
       	"Coves/internal/api/handlers/post"

     

       12
       12
       -
       	"Coves/internal/api/middleware"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+5 -6

tests/integration/post_unfurl_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"encoding/json"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       	"time"

     

       9
       9
       -
       

     

       10
       4
        
       	"Coves/internal/api/middleware"

     

       11
       5
        
       	"Coves/internal/atproto/identity"

     

       12
       6
        
       	"Coves/internal/atproto/jetstream"

     
···

       15
       9
        
       	"Coves/internal/core/unfurl"

     

       16
       10
        
       	"Coves/internal/core/users"

     

       17
       11
        
       	"Coves/internal/db/postgres"

     

       12
       12
       +
       	"context"

     

       13
       13
       +
       	"encoding/json"

     

       14
       14
       +
       	"fmt"

     

       15
       15
       +
       	"testing"

     

       16
       16
       +
       	"time"

     

       18
       17
        
       

     

       19
       18
        
       	"github.com/stretchr/testify/assert"

     

       20
       19
        
       	"github.com/stretchr/testify/require"

+2 -3

tests/integration/subscription_indexing_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"database/sql"

     

       6
       8
        
       	"fmt"

     

       7
       9
        
       	"testing"

     

       8
       10
        
       	"time"

     

       9
       11
        
       

     

       10
       10
       -
       	"Coves/internal/atproto/jetstream"

     

       11
       11
       -
       	"Coves/internal/core/communities"

     

       12
       12
       -
       

     

       13
       12
        
       	postgresRepo "Coves/internal/db/postgres"

     

       14
       13
        
       )

     

       15
       14

+3 -4

tests/integration/timeline_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/timeline"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"fmt"

     
···

       9
       12
        
       	"testing"

     

       10
       13
        
       	"time"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/timeline"

     

       13
       13
       -
       	"Coves/internal/api/middleware"

     

       14
       14
       -
       	"Coves/internal/db/postgres"

     

       15
       15
       -
       

     

       16
       15
        
       	timelineCore "Coves/internal/core/timeline"

     

       17
       16
        
       

     

       18
       17
        
       	"github.com/stretchr/testify/assert"

+11 -11

tests/integration/user_journey_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/api/routes"

     

       6
       6
       +
       	"Coves/internal/atproto/identity"

     

       7
       7
       +
       	"Coves/internal/atproto/jetstream"

     

       8
       8
       +
       	"Coves/internal/core/communities"

     

       9
       9
       +
       	"Coves/internal/core/posts"

     

       10
       10
       +
       	"Coves/internal/core/users"

     

       11
       11
       +
       	"Coves/internal/db/postgres"

     

       4
       12
        
       	"bytes"

     

       5
       13
        
       	"context"

     

       6
       14
        
       	"database/sql"

     
···

       14
       22
        
       	"testing"

     

       15
       23
        
       	"time"

     

       16
       24
        
       

     

       17
       17
       -
       	"Coves/internal/api/middleware"

     

       18
       18
       -
       	"Coves/internal/api/routes"

     

       19
       19
       -
       	"Coves/internal/atproto/identity"

     

       20
       20
       -
       	"Coves/internal/atproto/jetstream"

     

       21
       21
       -
       	"Coves/internal/core/communities"

     

       22
       22
       -
       	"Coves/internal/core/posts"

     

       23
       25
        
       	timelineCore "Coves/internal/core/timeline"

     

       24
       24
       -
       	"Coves/internal/core/users"

     

       25
       25
       -
       	"Coves/internal/db/postgres"

     

       26
       26
        
       

     

       27
       27
        
       	"github.com/go-chi/chi/v5"

     

       28
       28
        
       	"github.com/gorilla/websocket"

     
···

       234
       234
        
       

     

       235
       235
        
       		resp, err := http.DefaultClient.Do(req)

     

       236
       236
        
       		require.NoError(t, err)

     

       237
       237
       -
       		defer resp.Body.Close()

     

       237
       237
       +
       		defer func() { _ = resp.Body.Close() }()

     

       238
       238
        
       

     

       239
       239
        
       		require.Equal(t, http.StatusOK, resp.StatusCode, "Community creation should succeed")

     

       240
       240
        
       

     
···

       318
       318
        
       

     

       319
       319
        
       		resp, err := http.DefaultClient.Do(req)

     

       320
       320
        
       		require.NoError(t, err)

     

       321
       321
       -
       		defer resp.Body.Close()

     

       321
       321
       +
       		defer func() { _ = resp.Body.Close() }()

     

       322
       322
        
       

     

       323
       323
        
       		require.Equal(t, http.StatusOK, resp.StatusCode, "Post creation should succeed")

     

       324
       324
        
       

     
···

       425
       425
        
       

     

       426
       426
        
       		resp, err := http.DefaultClient.Do(req)

     

       427
       427
        
       		require.NoError(t, err)

     

       428
       428
       -
       		defer resp.Body.Close()

     

       428
       428
       +
       		defer func() { _ = resp.Body.Close() }()

     

       429
       429
        
       

     

       430
       430
        
       		require.Equal(t, http.StatusOK, resp.StatusCode, "Subscription should succeed")

     

       431
       431

+23

static/.well-known/did.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "@context": [

     

       3
       3
       +
           "https://www.w3.org/ns/did/v1",

     

       4
       4
       +
           "https://w3id.org/security/multikey/v1"

     

       5
       5
       +
         ],

     

       6
       6
       +
         "id": "did:web:coves.social",

     

       7
       7
       +
         "alsoKnownAs": ["at://coves.social"],

     

       8
       8
       +
         "verificationMethod": [

     

       9
       9
       +
           {

     

       10
       10
       +
             "id": "did:web:coves.social#atproto",

     

       11
       11
       +
             "type": "Multikey",

     

       12
       12
       +
             "controller": "did:web:coves.social",

     

       13
       13
       +
             "publicKeyMultibase": "zQ3shu1T3Y3MYoC1n7fCqkZqyrk8FiY3PV3BYM2JwyqcXFY6s"

     

       14
       14
       +
           }

     

       15
       15
       +
         ],

     

       16
       16
       +
         "service": [

     

       17
       17
       +
           {

     

       18
       18
       +
             "id": "#atproto_pds",

     

       19
       19
       +
             "type": "AtprotoPersonalDataServer",

     

       20
       20
       +
             "serviceEndpoint": "https://pds.coves.me"

     

       21
       21
       +
           }

     

       22
       22
       +
         ]

     

       23
       23
       +
       }

+1 -1

docs/E2E_TESTING.md

···

       93
       93
        
       

     

       94
       94
        
       Query via API:

     

       95
       95
        
       ```bash

     

       96
       96
       -
       curl "http://localhost:8081/xrpc/social.coves.actor.getProfile?actor=alice.local.coves.dev"

     

       96
       96
       +
       curl "http://localhost:8081/xrpc/social.coves.actor.getprofile?actor=alice.local.coves.dev"

     

       97
       97
        
       ```

     

       98
       98
        
       

     

       99
       99
        
       Expected response:

+3 -3

internal/api/routes/user.go

···

       28
       28
        
       func RegisterUserRoutes(r chi.Router, service users.UserService) {

     

       29
       29
        
       	h := NewUserHandler(service)

     

       30
       30
        
       

     

       31
       31
       -
       	// social.coves.actor.getProfile - query endpoint

     

       32
       32
       -
       	r.Get("/xrpc/social.coves.actor.getProfile", h.GetProfile)

     

       31
       31
       +
       	// social.coves.actor.getprofile - query endpoint

     

       32
       32
       +
       	r.Get("/xrpc/social.coves.actor.getprofile", h.GetProfile)

     

       33
       33
        
       

     

       34
       34
        
       	// social.coves.actor.signup - procedure endpoint

     

       35
       35
        
       	r.Post("/xrpc/social.coves.actor.signup", h.Signup)

     

       36
       36
        
       }

     

       37
       37
        
       

     

       38
       38
       -
       // GetProfile handles social.coves.actor.getProfile

     

       38
       38
       +
       // GetProfile handles social.coves.actor.getprofile

     

       39
       39
        
       // Query endpoint that retrieves a user profile by DID or handle

     

       40
       40
        
       func (h *UserHandler) GetProfile(w http.ResponseWriter, r *http.Request) {

     

       41
       41
        
       	ctx := r.Context()

+44 -5

internal/atproto/lexicon/social/coves/embed/external.json

···

       4
       4
        
         "defs": {

     

       5
       5
        
           "main": {

     

       6
       6
        
             "type": "object",

     

       7
       7
       -
             "description": "External link embed with preview metadata and provider support",

     

       7
       7
       +
             "description": "External link embed with optional aggregated sources for megathreads",

     

       8
       8
        
             "required": ["external"],

     

       9
       9
        
             "properties": {

     

       10
       10
        
               "external": {

     
···

       15
       15
        
           },

     

       16
       16
        
           "external": {

     

       17
       17
        
             "type": "object",

     

       18
       18
       -
             "description": "External link metadata",

     

       18
       18
       +
             "description": "Primary external link metadata",

     

       19
       19
        
             "required": ["uri"],

     

       20
       20
        
             "properties": {

     

       21
       21
        
               "uri": {

     

       22
       22
        
                 "type": "string",

     

       23
       23
        
                 "format": "uri",

     

       24
       24
       -
                 "description": "URI of the external content"

     

       24
       24
       +
                 "description": "URI of the primary external content"

     

       25
       25
        
               },

     

       26
       26
        
               "title": {

     

       27
       27
        
                 "type": "string",

     
···

       39
       39
        
                 "type": "blob",

     

       40
       40
        
                 "accept": ["image/png", "image/jpeg", "image/webp"],

     

       41
       41
        
                 "maxSize": 1000000,

     

       42
       42
       -
                 "description": "Thumbnail image for the link"

     

       42
       42
       +
                 "description": "Thumbnail image for the post (applies to primary link)"

     

       43
       43
        
               },

     

       44
       44
        
               "domain": {

     

       45
       45
        
                 "type": "string",

     

       46
       46
       -
                 "description": "Domain of the linked content"

     

       46
       46
       +
                 "maxLength": 253,

     

       47
       47
       +
                 "description": "Domain of the linked content (e.g., nytimes.com)"

     

       47
       48
        
               },

     

       48
       49
        
               "embedType": {

     

       49
       50
        
                 "type": "string",

     
···

       52
       53
        
               },

     

       53
       54
        
               "provider": {

     

       54
       55
        
                 "type": "string",

     

       56
       56
       +
                 "maxLength": 100,

     

       55
       57
        
                 "description": "Service provider name (e.g., imgur, streamable)"

     

       56
       58
        
               },

     

       57
       59
        
               "images": {

     
···

       67
       69
        
                 "type": "integer",

     

       68
       70
        
                 "minimum": 0,

     

       69
       71
        
                 "description": "Total number of items if more than displayed (for galleries)"

     

       72
       72
       +
               },

     

       73
       73
       +
               "sources": {

     

       74
       74
       +
                 "type": "array",

     

       75
       75
       +
                 "description": "Aggregated source links for megathreads. Each source references an original article and optionally the Coves post that shared it",

     

       76
       76
       +
                 "maxLength": 50,

     

       77
       77
       +
                 "items": {

     

       78
       78
       +
                   "type": "ref",

     

       79
       79
       +
                   "ref": "#source"

     

       80
       80
       +
                 }

     

       81
       81
       +
               }

     

       82
       82
       +
             }

     

       83
       83
       +
           },

     

       84
       84
       +
           "source": {

     

       85
       85
       +
             "type": "object",

     

       86
       86
       +
             "description": "A source link aggregated into a megathread",

     

       87
       87
       +
             "required": ["uri"],

     

       88
       88
       +
             "properties": {

     

       89
       89
       +
               "uri": {

     

       90
       90
       +
                 "type": "string",

     

       91
       91
       +
                 "format": "uri",

     

       92
       92
       +
                 "description": "URI of the source article"

     

       93
       93
       +
               },

     

       94
       94
       +
               "title": {

     

       95
       95
       +
                 "type": "string",

     

       96
       96
       +
                 "maxLength": 500,

     

       97
       97
       +
                 "maxGraphemes": 500,

     

       98
       98
       +
                 "description": "Title of the source article"

     

       99
       99
       +
               },

     

       100
       100
       +
               "domain": {

     

       101
       101
       +
                 "type": "string",

     

       102
       102
       +
                 "maxLength": 253,

     

       103
       103
       +
                 "description": "Domain of the source (e.g., nytimes.com)"

     

       104
       104
       +
               },

     

       105
       105
       +
               "sourcePost": {

     

       106
       106
       +
                 "type": "ref",

     

       107
       107
       +
                 "ref": "com.atproto.repo.strongRef",

     

       108
       108
       +
                 "description": "Reference to the Coves post that originally shared this link. Used for feed deprioritization of rolled-up posts"

     

       70
       109
        
               }

     

       71
       110
        
             }

     

       72
       111
        
           }

+52

internal/atproto/auth/combined_key_fetcher.go

···

       1
       1
       +
       package auth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       

     

       8
       8
       +
       	indigoIdentity "github.com/bluesky-social/indigo/atproto/identity"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // CombinedKeyFetcher handles JWT public key fetching for both:

     

       12
       12
       +
       // - DID issuers (did:plc:, did:web:) → resolves via DID document

     

       13
       13
       +
       // - URL issuers (https://) → fetches via JWKS endpoint (legacy/fallback)

     

       14
       14
       +
       //

     

       15
       15
       +
       // For atproto service authentication, the issuer is typically the user's DID,

     

       16
       16
       +
       // and the signing key is published in their DID document.

     

       17
       17
       +
       type CombinedKeyFetcher struct {

     

       18
       18
       +
       	didFetcher  *DIDKeyFetcher

     

       19
       19
       +
       	jwksFetcher JWKSFetcher

     

       20
       20
       +
       }

     

       21
       21
       +
       

     

       22
       22
       +
       // NewCombinedKeyFetcher creates a key fetcher that supports both DID and URL issuers.

     

       23
       23
       +
       // Parameters:

     

       24
       24
       +
       //   - directory: Indigo's identity directory for DID resolution

     

       25
       25
       +
       //   - jwksFetcher: fallback JWKS fetcher for URL issuers (can be nil if not needed)

     

       26
       26
       +
       func NewCombinedKeyFetcher(directory indigoIdentity.Directory, jwksFetcher JWKSFetcher) *CombinedKeyFetcher {

     

       27
       27
       +
       	return &CombinedKeyFetcher{

     

       28
       28
       +
       		didFetcher:  NewDIDKeyFetcher(directory),

     

       29
       29
       +
       		jwksFetcher: jwksFetcher,

     

       30
       30
       +
       	}

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       // FetchPublicKey fetches the public key for verifying a JWT.

     

       34
       34
       +
       // Routes to the appropriate fetcher based on issuer format:

     

       35
       35
       +
       // - DID (did:plc:, did:web:) → DIDKeyFetcher

     

       36
       36
       +
       // - URL (https://) → JWKSFetcher

     

       37
       37
       +
       func (f *CombinedKeyFetcher) FetchPublicKey(ctx context.Context, issuer, token string) (interface{}, error) {

     

       38
       38
       +
       	// Check if issuer is a DID

     

       39
       39
       +
       	if strings.HasPrefix(issuer, "did:") {

     

       40
       40
       +
       		return f.didFetcher.FetchPublicKey(ctx, issuer, token)

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// Check if issuer is a URL (https:// or http:// in dev)

     

       44
       44
       +
       	if strings.HasPrefix(issuer, "https://") || strings.HasPrefix(issuer, "http://") {

     

       45
       45
       +
       		if f.jwksFetcher == nil {

     

       46
       46
       +
       			return nil, fmt.Errorf("URL issuer %s requires JWKS fetcher, but none configured", issuer)

     

       47
       47
       +
       		}

     

       48
       48
       +
       		return f.jwksFetcher.FetchPublicKey(ctx, issuer, token)

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	return nil, fmt.Errorf("unsupported issuer format: %s (expected DID or URL)", issuer)

     

       52
       52
       +
       }

+116

internal/atproto/auth/did_key_fetcher.go

···

       1
       1
       +
       package auth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"crypto/ecdsa"

     

       6
       6
       +
       	"crypto/elliptic"

     

       7
       7
       +
       	"encoding/base64"

     

       8
       8
       +
       	"fmt"

     

       9
       9
       +
       	"math/big"

     

       10
       10
       +
       	"strings"

     

       11
       11
       +
       

     

       12
       12
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       13
       13
       +
       	indigoIdentity "github.com/bluesky-social/indigo/atproto/identity"

     

       14
       14
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       15
       15
       +
       )

     

       16
       16
       +
       

     

       17
       17
       +
       // DIDKeyFetcher fetches public keys from DID documents for JWT verification.

     

       18
       18
       +
       // This is the primary method for atproto service authentication, where:

     

       19
       19
       +
       // - The JWT issuer is the user's DID (e.g., did:plc:abc123)

     

       20
       20
       +
       // - The signing key is published in the user's DID document

     

       21
       21
       +
       // - Verification happens by resolving the DID and checking the signature

     

       22
       22
       +
       type DIDKeyFetcher struct {

     

       23
       23
       +
       	directory indigoIdentity.Directory

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       // NewDIDKeyFetcher creates a new DID-based key fetcher.

     

       27
       27
       +
       func NewDIDKeyFetcher(directory indigoIdentity.Directory) *DIDKeyFetcher {

     

       28
       28
       +
       	return &DIDKeyFetcher{

     

       29
       29
       +
       		directory: directory,

     

       30
       30
       +
       	}

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       // FetchPublicKey fetches the public key for verifying a JWT from the issuer's DID document.

     

       34
       34
       +
       // For DID issuers (did:plc: or did:web:), resolves the DID and extracts the signing key.

     

       35
       35
       +
       // Returns an *ecdsa.PublicKey suitable for use with jwt-go.

     

       36
       36
       +
       func (f *DIDKeyFetcher) FetchPublicKey(ctx context.Context, issuer, token string) (interface{}, error) {

     

       37
       37
       +
       	// Only handle DID issuers

     

       38
       38
       +
       	if !strings.HasPrefix(issuer, "did:") {

     

       39
       39
       +
       		return nil, fmt.Errorf("DIDKeyFetcher only handles DID issuers, got: %s", issuer)

     

       40
       40
       +
       	}

     

       41
       41
       +
       

     

       42
       42
       +
       	// Parse the DID

     

       43
       43
       +
       	did, err := syntax.ParseDID(issuer)

     

       44
       44
       +
       	if err != nil {

     

       45
       45
       +
       		return nil, fmt.Errorf("invalid DID format: %w", err)

     

       46
       46
       +
       	}

     

       47
       47
       +
       

     

       48
       48
       +
       	// Resolve the DID to get the identity (includes public keys)

     

       49
       49
       +
       	ident, err := f.directory.LookupDID(ctx, did)

     

       50
       50
       +
       	if err != nil {

     

       51
       51
       +
       		return nil, fmt.Errorf("failed to resolve DID %s: %w", issuer, err)

     

       52
       52
       +
       	}

     

       53
       53
       +
       

     

       54
       54
       +
       	// Get the atproto signing key from the DID document

     

       55
       55
       +
       	pubKey, err := ident.PublicKey()

     

       56
       56
       +
       	if err != nil {

     

       57
       57
       +
       		return nil, fmt.Errorf("failed to get public key from DID document: %w", err)

     

       58
       58
       +
       	}

     

       59
       59
       +
       

     

       60
       60
       +
       	// Convert to JWK format to extract coordinates

     

       61
       61
       +
       	jwk, err := pubKey.JWK()

     

       62
       62
       +
       	if err != nil {

     

       63
       63
       +
       		return nil, fmt.Errorf("failed to convert public key to JWK: %w", err)

     

       64
       64
       +
       	}

     

       65
       65
       +
       

     

       66
       66
       +
       	// Convert atcrypto JWK to Go ecdsa.PublicKey

     

       67
       67
       +
       	return atcryptoJWKToECDSA(jwk)

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       // atcryptoJWKToECDSA converts an atcrypto.JWK to a Go ecdsa.PublicKey

     

       71
       71
       +
       func atcryptoJWKToECDSA(jwk *atcrypto.JWK) (*ecdsa.PublicKey, error) {

     

       72
       72
       +
       	if jwk.KeyType != "EC" {

     

       73
       73
       +
       		return nil, fmt.Errorf("unsupported JWK key type: %s (expected EC)", jwk.KeyType)

     

       74
       74
       +
       	}

     

       75
       75
       +
       

     

       76
       76
       +
       	// Decode X and Y coordinates (base64url, no padding)

     

       77
       77
       +
       	xBytes, err := base64.RawURLEncoding.DecodeString(jwk.X)

     

       78
       78
       +
       	if err != nil {

     

       79
       79
       +
       		return nil, fmt.Errorf("invalid JWK X coordinate encoding: %w", err)

     

       80
       80
       +
       	}

     

       81
       81
       +
       	yBytes, err := base64.RawURLEncoding.DecodeString(jwk.Y)

     

       82
       82
       +
       	if err != nil {

     

       83
       83
       +
       		return nil, fmt.Errorf("invalid JWK Y coordinate encoding: %w", err)

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	var ecCurve elliptic.Curve

     

       87
       87
       +
       	switch jwk.Curve {

     

       88
       88
       +
       	case "P-256":

     

       89
       89
       +
       		ecCurve = elliptic.P256()

     

       90
       90
       +
       	case "P-384":

     

       91
       91
       +
       		ecCurve = elliptic.P384()

     

       92
       92
       +
       	case "P-521":

     

       93
       93
       +
       		ecCurve = elliptic.P521()

     

       94
       94
       +
       	case "secp256k1":

     

       95
       95
       +
       		// secp256k1 (K-256) is used by some atproto implementations

     

       96
       96
       +
       		// Go's standard library doesn't include secp256k1, but we can still

     

       97
       97
       +
       		// construct the key - jwt-go may not support it directly

     

       98
       98
       +
       		return nil, fmt.Errorf("secp256k1 curve requires special handling for JWT verification")

     

       99
       99
       +
       	default:

     

       100
       100
       +
       		return nil, fmt.Errorf("unsupported JWK curve: %s", jwk.Curve)

     

       101
       101
       +
       	}

     

       102
       102
       +
       

     

       103
       103
       +
       	// Create the public key

     

       104
       104
       +
       	pubKey := &ecdsa.PublicKey{

     

       105
       105
       +
       		Curve: ecCurve,

     

       106
       106
       +
       		X:     new(big.Int).SetBytes(xBytes),

     

       107
       107
       +
       		Y:     new(big.Int).SetBytes(yBytes),

     

       108
       108
       +
       	}

     

       109
       109
       +
       

     

       110
       110
       +
       	// Validate point is on curve

     

       111
       111
       +
       	if !ecCurve.IsOnCurve(pubKey.X, pubKey.Y) {

     

       112
       112
       +
       		return nil, fmt.Errorf("invalid public key: point not on curve")

     

       113
       113
       +
       	}

     

       114
       114
       +
       

     

       115
       115
       +
       	return pubKey, nil

     

       116
       116
       +
       }

+24 -3

cmd/server/main.go

···

       36
       36
        
       	commentsAPI "Coves/internal/api/handlers/comments"

     

       37
       37
        
       

     

       38
       38
        
       	postgresRepo "Coves/internal/db/postgres"

     

       39
       39
       +
       

     

       40
       40
       +
       	indigoIdentity "github.com/bluesky-social/indigo/atproto/identity"

     

       39
       41
        
       )

     

       40
       42
        
       

     

       41
       43
        
       func main() {

     
···

       142
       144
        
       		log.Println("   Set AUTH_SKIP_VERIFY=false for production")

     

       143
       145
        
       	}

     

       144
       146
        
       

     

       145
       145
       -
       	jwksCacheTTL := 1 * time.Hour // Cache public keys for 1 hour

     

       147
       147
       +
       	// Initialize Indigo directory for DID resolution (used by auth)

     

       148
       148
       +
       	plcURL := os.Getenv("PLC_DIRECTORY_URL")

     

       149
       149
       +
       	if plcURL == "" {

     

       150
       150
       +
       		plcURL = "https://plc.directory"

     

       151
       151
       +
       	}

     

       152
       152
       +
       	indigoDir := &indigoIdentity.BaseDirectory{

     

       153
       153
       +
       		PLCURL:     plcURL,

     

       154
       154
       +
       		HTTPClient: http.Client{Timeout: 10 * time.Second},

     

       155
       155
       +
       	}

     

       156
       156
       +
       

     

       157
       157
       +
       	// Initialize JWT config early to cache HS256_ISSUERS and PDS_JWT_SECRET

     

       158
       158
       +
       	// This avoids reading env vars on every request

     

       159
       159
       +
       	auth.InitJWTConfig()

     

       160
       160
       +
       

     

       161
       161
       +
       	// Create combined key fetcher for both DID and URL issuers

     

       162
       162
       +
       	// - DID issuers (did:plc:, did:web:) → resolved via DID document keys (ES256)

     

       163
       163
       +
       	// - URL issuers → JWKS endpoint (fallback for legacy tokens)

     

       164
       164
       +
       	jwksCacheTTL := 1 * time.Hour

     

       146
       165
        
       	jwksFetcher := auth.NewCachedJWKSFetcher(jwksCacheTTL)

     

       147
       147
       -
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(jwksFetcher, skipVerify)

     

       148
       148
       -
       	log.Println("✅ atProto auth middleware initialized")

     

       166
       166
       +
       	keyFetcher := auth.NewCombinedKeyFetcher(indigoDir, jwksFetcher)

     

       167
       167
       +
       

     

       168
       168
       +
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(keyFetcher, skipVerify)

     

       169
       169
       +
       	log.Println("✅ atProto auth middleware initialized (DID + JWKS key resolution)")

     

       149
       170
        
       

     

       150
       171
        
       	// Initialize repositories and services

     

       151
       172
        
       	userRepo := postgresRepo.NewUserRepository(db)

+5

.env.dev

···

       152
       152
        
       # When false, verifies JWT signature against issuer's JWKS

     

       153
       153
        
       AUTH_SKIP_VERIFY=true

     

       154
       154
        
       

     

       155
       155
       +
       # HS256 Issuers: PDSes allowed to use HS256 (shared secret) authentication

     

       156
       156
       +
       # Must share PDS_JWT_SECRET with Coves instance. External PDSes use ES256 via DID resolution.

     

       157
       157
       +
       # For local dev, allow the local PDS or turn AUTH_SKIP_VERIFY = true

     

       158
       158
       +
       HS256_ISSUERS=http://localhost:3001

     

       159
       159
       +
       

     

       155
       160
        
       # Logging

     

       156
       161
        
       LOG_LEVEL=debug

     

       157
       162
        
       LOG_ENABLED=true

+484

internal/atproto/auth/dpop.go

···

       1
       1
       +
       package auth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"crypto/ecdsa"

     

       5
       5
       +
       	"crypto/elliptic"

     

       6
       6
       +
       	"crypto/sha256"

     

       7
       7
       +
       	"encoding/base64"

     

       8
       8
       +
       	"encoding/json"

     

       9
       9
       +
       	"fmt"

     

       10
       10
       +
       	"math/big"

     

       11
       11
       +
       	"strings"

     

       12
       12
       +
       	"sync"

     

       13
       13
       +
       	"time"

     

       14
       14
       +
       

     

       15
       15
       +
       	indigoCrypto "github.com/bluesky-social/indigo/atproto/atcrypto"

     

       16
       16
       +
       	"github.com/golang-jwt/jwt/v5"

     

       17
       17
       +
       )

     

       18
       18
       +
       

     

       19
       19
       +
       // NonceCache provides replay protection for DPoP proofs by tracking seen jti values.

     

       20
       20
       +
       // This prevents an attacker from reusing a captured DPoP proof within the validity window.

     

       21
       21
       +
       // Per RFC 9449 Section 11.1, servers SHOULD prevent replay attacks.

     

       22
       22
       +
       type NonceCache struct {

     

       23
       23
       +
       	seen    map[string]time.Time // jti -> expiration time

     

       24
       24
       +
       	stopCh  chan struct{}

     

       25
       25
       +
       	maxAge  time.Duration // How long to keep entries

     

       26
       26
       +
       	cleanup time.Duration // How often to clean up expired entries

     

       27
       27
       +
       	mu      sync.RWMutex

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       // NewNonceCache creates a new nonce cache for DPoP replay protection.

     

       31
       31
       +
       // maxAge should match or exceed DPoPVerifier.MaxProofAge.

     

       32
       32
       +
       func NewNonceCache(maxAge time.Duration) *NonceCache {

     

       33
       33
       +
       	nc := &NonceCache{

     

       34
       34
       +
       		seen:    make(map[string]time.Time),

     

       35
       35
       +
       		maxAge:  maxAge,

     

       36
       36
       +
       		cleanup: maxAge / 2, // Clean up at half the max age

     

       37
       37
       +
       		stopCh:  make(chan struct{}),

     

       38
       38
       +
       	}

     

       39
       39
       +
       

     

       40
       40
       +
       	// Start background cleanup goroutine

     

       41
       41
       +
       	go nc.cleanupLoop()

     

       42
       42
       +
       

     

       43
       43
       +
       	return nc

     

       44
       44
       +
       }

     

       45
       45
       +
       

     

       46
       46
       +
       // CheckAndStore checks if a jti has been seen before and stores it if not.

     

       47
       47
       +
       // Returns true if the jti is fresh (not a replay), false if it's a replay.

     

       48
       48
       +
       func (nc *NonceCache) CheckAndStore(jti string) bool {

     

       49
       49
       +
       	nc.mu.Lock()

     

       50
       50
       +
       	defer nc.mu.Unlock()

     

       51
       51
       +
       

     

       52
       52
       +
       	now := time.Now()

     

       53
       53
       +
       	expiry := now.Add(nc.maxAge)

     

       54
       54
       +
       

     

       55
       55
       +
       	// Check if already seen

     

       56
       56
       +
       	if existingExpiry, seen := nc.seen[jti]; seen {

     

       57
       57
       +
       		// Still valid (not expired) - this is a replay

     

       58
       58
       +
       		if existingExpiry.After(now) {

     

       59
       59
       +
       			return false

     

       60
       60
       +
       		}

     

       61
       61
       +
       		// Expired entry - allow reuse and update expiry

     

       62
       62
       +
       	}

     

       63
       63
       +
       

     

       64
       64
       +
       	// Store the new jti

     

       65
       65
       +
       	nc.seen[jti] = expiry

     

       66
       66
       +
       	return true

     

       67
       67
       +
       }

     

       68
       68
       +
       

     

       69
       69
       +
       // cleanupLoop periodically removes expired entries from the cache

     

       70
       70
       +
       func (nc *NonceCache) cleanupLoop() {

     

       71
       71
       +
       	ticker := time.NewTicker(nc.cleanup)

     

       72
       72
       +
       	defer ticker.Stop()

     

       73
       73
       +
       

     

       74
       74
       +
       	for {

     

       75
       75
       +
       		select {

     

       76
       76
       +
       		case <-ticker.C:

     

       77
       77
       +
       			nc.cleanupExpired()

     

       78
       78
       +
       		case <-nc.stopCh:

     

       79
       79
       +
       			return

     

       80
       80
       +
       		}

     

       81
       81
       +
       	}

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       // cleanupExpired removes expired entries from the cache

     

       85
       85
       +
       func (nc *NonceCache) cleanupExpired() {

     

       86
       86
       +
       	nc.mu.Lock()

     

       87
       87
       +
       	defer nc.mu.Unlock()

     

       88
       88
       +
       

     

       89
       89
       +
       	now := time.Now()

     

       90
       90
       +
       	for jti, expiry := range nc.seen {

     

       91
       91
       +
       		if expiry.Before(now) {

     

       92
       92
       +
       			delete(nc.seen, jti)

     

       93
       93
       +
       		}

     

       94
       94
       +
       	}

     

       95
       95
       +
       }

     

       96
       96
       +
       

     

       97
       97
       +
       // Stop stops the cleanup goroutine. Call this when done with the cache.

     

       98
       98
       +
       func (nc *NonceCache) Stop() {

     

       99
       99
       +
       	close(nc.stopCh)

     

       100
       100
       +
       }

     

       101
       101
       +
       

     

       102
       102
       +
       // Size returns the number of entries in the cache (for testing/monitoring)

     

       103
       103
       +
       func (nc *NonceCache) Size() int {

     

       104
       104
       +
       	nc.mu.RLock()

     

       105
       105
       +
       	defer nc.mu.RUnlock()

     

       106
       106
       +
       	return len(nc.seen)

     

       107
       107
       +
       }

     

       108
       108
       +
       

     

       109
       109
       +
       // DPoPClaims represents the claims in a DPoP proof JWT (RFC 9449)

     

       110
       110
       +
       type DPoPClaims struct {

     

       111
       111
       +
       	jwt.RegisteredClaims

     

       112
       112
       +
       

     

       113
       113
       +
       	// HTTP method of the request (e.g., "GET", "POST")

     

       114
       114
       +
       	HTTPMethod string `json:"htm"`

     

       115
       115
       +
       

     

       116
       116
       +
       	// HTTP URI of the request (without query and fragment parts)

     

       117
       117
       +
       	HTTPURI string `json:"htu"`

     

       118
       118
       +
       

     

       119
       119
       +
       	// Access token hash (optional, for token binding)

     

       120
       120
       +
       	AccessTokenHash string `json:"ath,omitempty"`

     

       121
       121
       +
       }

     

       122
       122
       +
       

     

       123
       123
       +
       // DPoPProof represents a parsed and verified DPoP proof

     

       124
       124
       +
       type DPoPProof struct {

     

       125
       125
       +
       	RawPublicJWK map[string]interface{}

     

       126
       126
       +
       	Claims       *DPoPClaims

     

       127
       127
       +
       	PublicKey    interface{} // *ecdsa.PublicKey or similar

     

       128
       128
       +
       	Thumbprint   string      // JWK thumbprint (base64url)

     

       129
       129
       +
       }

     

       130
       130
       +
       

     

       131
       131
       +
       // DPoPVerifier verifies DPoP proofs for OAuth token binding

     

       132
       132
       +
       type DPoPVerifier struct {

     

       133
       133
       +
       	// Optional: custom nonce validation function (for server-issued nonces)

     

       134
       134
       +
       	ValidateNonce func(nonce string) bool

     

       135
       135
       +
       

     

       136
       136
       +
       	// NonceCache for replay protection (optional but recommended)

     

       137
       137
       +
       	// If nil, jti replay protection is disabled

     

       138
       138
       +
       	NonceCache *NonceCache

     

       139
       139
       +
       

     

       140
       140
       +
       	// Maximum allowed clock skew for timestamp validation

     

       141
       141
       +
       	MaxClockSkew time.Duration

     

       142
       142
       +
       

     

       143
       143
       +
       	// Maximum age of DPoP proof (prevents replay with old proofs)

     

       144
       144
       +
       	MaxProofAge time.Duration

     

       145
       145
       +
       }

     

       146
       146
       +
       

     

       147
       147
       +
       // NewDPoPVerifier creates a DPoP verifier with sensible defaults including replay protection

     

       148
       148
       +
       func NewDPoPVerifier() *DPoPVerifier {

     

       149
       149
       +
       	maxProofAge := 5 * time.Minute

     

       150
       150
       +
       	return &DPoPVerifier{

     

       151
       151
       +
       		MaxClockSkew: 30 * time.Second,

     

       152
       152
       +
       		MaxProofAge:  maxProofAge,

     

       153
       153
       +
       		NonceCache:   NewNonceCache(maxProofAge),

     

       154
       154
       +
       	}

     

       155
       155
       +
       }

     

       156
       156
       +
       

     

       157
       157
       +
       // NewDPoPVerifierWithoutReplayProtection creates a DPoP verifier without replay protection.

     

       158
       158
       +
       // This should only be used in testing or when replay protection is handled externally.

     

       159
       159
       +
       func NewDPoPVerifierWithoutReplayProtection() *DPoPVerifier {

     

       160
       160
       +
       	return &DPoPVerifier{

     

       161
       161
       +
       		MaxClockSkew: 30 * time.Second,

     

       162
       162
       +
       		MaxProofAge:  5 * time.Minute,

     

       163
       163
       +
       		NonceCache:   nil, // No replay protection

     

       164
       164
       +
       	}

     

       165
       165
       +
       }

     

       166
       166
       +
       

     

       167
       167
       +
       // Stop stops background goroutines. Call this when shutting down.

     

       168
       168
       +
       func (v *DPoPVerifier) Stop() {

     

       169
       169
       +
       	if v.NonceCache != nil {

     

       170
       170
       +
       		v.NonceCache.Stop()

     

       171
       171
       +
       	}

     

       172
       172
       +
       }

     

       173
       173
       +
       

     

       174
       174
       +
       // VerifyDPoPProof verifies a DPoP proof JWT and returns the parsed proof

     

       175
       175
       +
       func (v *DPoPVerifier) VerifyDPoPProof(dpopProof, httpMethod, httpURI string) (*DPoPProof, error) {

     

       176
       176
       +
       	// Parse the DPoP JWT without verification first to extract the header

     

       177
       177
       +
       	parser := jwt.NewParser(jwt.WithoutClaimsValidation())

     

       178
       178
       +
       	token, _, err := parser.ParseUnverified(dpopProof, &DPoPClaims{})

     

       179
       179
       +
       	if err != nil {

     

       180
       180
       +
       		return nil, fmt.Errorf("failed to parse DPoP proof: %w", err)

     

       181
       181
       +
       	}

     

       182
       182
       +
       

     

       183
       183
       +
       	// Extract and validate the header

     

       184
       184
       +
       	header, ok := token.Header["typ"].(string)

     

       185
       185
       +
       	if !ok || header != "dpop+jwt" {

     

       186
       186
       +
       		return nil, fmt.Errorf("invalid DPoP proof: typ must be 'dpop+jwt', got '%s'", header)

     

       187
       187
       +
       	}

     

       188
       188
       +
       

     

       189
       189
       +
       	alg, ok := token.Header["alg"].(string)

     

       190
       190
       +
       	if !ok {

     

       191
       191
       +
       		return nil, fmt.Errorf("invalid DPoP proof: missing alg header")

     

       192
       192
       +
       	}

     

       193
       193
       +
       

     

       194
       194
       +
       	// Extract the JWK from the header

     

       195
       195
       +
       	jwkRaw, ok := token.Header["jwk"]

     

       196
       196
       +
       	if !ok {

     

       197
       197
       +
       		return nil, fmt.Errorf("invalid DPoP proof: missing jwk header")

     

       198
       198
       +
       	}

     

       199
       199
       +
       

     

       200
       200
       +
       	jwkMap, ok := jwkRaw.(map[string]interface{})

     

       201
       201
       +
       	if !ok {

     

       202
       202
       +
       		return nil, fmt.Errorf("invalid DPoP proof: jwk must be an object")

     

       203
       203
       +
       	}

     

       204
       204
       +
       

     

       205
       205
       +
       	// Parse the public key from JWK

     

       206
       206
       +
       	publicKey, err := parseJWKToPublicKey(jwkMap)

     

       207
       207
       +
       	if err != nil {

     

       208
       208
       +
       		return nil, fmt.Errorf("invalid DPoP proof JWK: %w", err)

     

       209
       209
       +
       	}

     

       210
       210
       +
       

     

       211
       211
       +
       	// Calculate the JWK thumbprint

     

       212
       212
       +
       	thumbprint, err := CalculateJWKThumbprint(jwkMap)

     

       213
       213
       +
       	if err != nil {

     

       214
       214
       +
       		return nil, fmt.Errorf("failed to calculate JWK thumbprint: %w", err)

     

       215
       215
       +
       	}

     

       216
       216
       +
       

     

       217
       217
       +
       	// Now verify the signature

     

       218
       218
       +
       	verifiedToken, err := jwt.ParseWithClaims(dpopProof, &DPoPClaims{}, func(token *jwt.Token) (interface{}, error) {

     

       219
       219
       +
       		// Verify the signing method matches what we expect

     

       220
       220
       +
       		switch alg {

     

       221
       221
       +
       		case "ES256":

     

       222
       222
       +
       			if _, ok := token.Method.(*jwt.SigningMethodECDSA); !ok {

     

       223
       223
       +
       				return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])

     

       224
       224
       +
       			}

     

       225
       225
       +
       		case "ES384", "ES512":

     

       226
       226
       +
       			if _, ok := token.Method.(*jwt.SigningMethodECDSA); !ok {

     

       227
       227
       +
       				return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])

     

       228
       228
       +
       			}

     

       229
       229
       +
       		case "RS256", "RS384", "RS512", "PS256", "PS384", "PS512":

     

       230
       230
       +
       			// RSA methods - we primarily support ES256 for atproto

     

       231
       231
       +
       			return nil, fmt.Errorf("RSA algorithms not yet supported for DPoP: %s", alg)

     

       232
       232
       +
       		default:

     

       233
       233
       +
       			return nil, fmt.Errorf("unsupported DPoP algorithm: %s", alg)

     

       234
       234
       +
       		}

     

       235
       235
       +
       		return publicKey, nil

     

       236
       236
       +
       	})

     

       237
       237
       +
       	if err != nil {

     

       238
       238
       +
       		return nil, fmt.Errorf("DPoP proof signature verification failed: %w", err)

     

       239
       239
       +
       	}

     

       240
       240
       +
       

     

       241
       241
       +
       	claims, ok := verifiedToken.Claims.(*DPoPClaims)

     

       242
       242
       +
       	if !ok {

     

       243
       243
       +
       		return nil, fmt.Errorf("invalid DPoP claims type")

     

       244
       244
       +
       	}

     

       245
       245
       +
       

     

       246
       246
       +
       	// Validate the claims

     

       247
       247
       +
       	if err := v.validateDPoPClaims(claims, httpMethod, httpURI); err != nil {

     

       248
       248
       +
       		return nil, err

     

       249
       249
       +
       	}

     

       250
       250
       +
       

     

       251
       251
       +
       	return &DPoPProof{

     

       252
       252
       +
       		Claims:       claims,

     

       253
       253
       +
       		PublicKey:    publicKey,

     

       254
       254
       +
       		Thumbprint:   thumbprint,

     

       255
       255
       +
       		RawPublicJWK: jwkMap,

     

       256
       256
       +
       	}, nil

     

       257
       257
       +
       }

     

       258
       258
       +
       

     

       259
       259
       +
       // validateDPoPClaims validates the DPoP proof claims

     

       260
       260
       +
       func (v *DPoPVerifier) validateDPoPClaims(claims *DPoPClaims, expectedMethod, expectedURI string) error {

     

       261
       261
       +
       	// Validate jti (unique identifier) is present

     

       262
       262
       +
       	if claims.ID == "" {

     

       263
       263
       +
       		return fmt.Errorf("DPoP proof missing jti claim")

     

       264
       264
       +
       	}

     

       265
       265
       +
       

     

       266
       266
       +
       	// Validate htm (HTTP method)

     

       267
       267
       +
       	if !strings.EqualFold(claims.HTTPMethod, expectedMethod) {

     

       268
       268
       +
       		return fmt.Errorf("DPoP proof htm mismatch: expected %s, got %s", expectedMethod, claims.HTTPMethod)

     

       269
       269
       +
       	}

     

       270
       270
       +
       

     

       271
       271
       +
       	// Validate htu (HTTP URI) - compare without query/fragment

     

       272
       272
       +
       	expectedURIBase := stripQueryFragment(expectedURI)

     

       273
       273
       +
       	claimURIBase := stripQueryFragment(claims.HTTPURI)

     

       274
       274
       +
       	if expectedURIBase != claimURIBase {

     

       275
       275
       +
       		return fmt.Errorf("DPoP proof htu mismatch: expected %s, got %s", expectedURIBase, claimURIBase)

     

       276
       276
       +
       	}

     

       277
       277
       +
       

     

       278
       278
       +
       	// Validate iat (issued at) is present and recent

     

       279
       279
       +
       	if claims.IssuedAt == nil {

     

       280
       280
       +
       		return fmt.Errorf("DPoP proof missing iat claim")

     

       281
       281
       +
       	}

     

       282
       282
       +
       

     

       283
       283
       +
       	now := time.Now()

     

       284
       284
       +
       	iat := claims.IssuedAt.Time

     

       285
       285
       +
       

     

       286
       286
       +
       	// Check clock skew (not too far in the future)

     

       287
       287
       +
       	if iat.After(now.Add(v.MaxClockSkew)) {

     

       288
       288
       +
       		return fmt.Errorf("DPoP proof iat is in the future")

     

       289
       289
       +
       	}

     

       290
       290
       +
       

     

       291
       291
       +
       	// Check proof age (not too old)

     

       292
       292
       +
       	if now.Sub(iat) > v.MaxProofAge {

     

       293
       293
       +
       		return fmt.Errorf("DPoP proof is too old (issued %v ago, max %v)", now.Sub(iat), v.MaxProofAge)

     

       294
       294
       +
       	}

     

       295
       295
       +
       

     

       296
       296
       +
       	// SECURITY: Check for replay attack using jti

     

       297
       297
       +
       	// Per RFC 9449 Section 11.1, servers SHOULD prevent replay attacks

     

       298
       298
       +
       	if v.NonceCache != nil {

     

       299
       299
       +
       		if !v.NonceCache.CheckAndStore(claims.ID) {

     

       300
       300
       +
       			return fmt.Errorf("DPoP proof replay detected: jti %s already used", claims.ID)

     

       301
       301
       +
       		}

     

       302
       302
       +
       	}

     

       303
       303
       +
       

     

       304
       304
       +
       	return nil

     

       305
       305
       +
       }

     

       306
       306
       +
       

     

       307
       307
       +
       // VerifyTokenBinding verifies that the DPoP proof binds to the access token

     

       308
       308
       +
       // by comparing the proof's thumbprint to the token's cnf.jkt claim

     

       309
       309
       +
       func (v *DPoPVerifier) VerifyTokenBinding(proof *DPoPProof, expectedThumbprint string) error {

     

       310
       310
       +
       	if proof.Thumbprint != expectedThumbprint {

     

       311
       311
       +
       		return fmt.Errorf("DPoP proof thumbprint mismatch: token expects %s, proof has %s",

     

       312
       312
       +
       			expectedThumbprint, proof.Thumbprint)

     

       313
       313
       +
       	}

     

       314
       314
       +
       	return nil

     

       315
       315
       +
       }

     

       316
       316
       +
       

     

       317
       317
       +
       // CalculateJWKThumbprint calculates the JWK thumbprint per RFC 7638

     

       318
       318
       +
       // The thumbprint is the base64url-encoded SHA-256 hash of the canonical JWK representation

     

       319
       319
       +
       func CalculateJWKThumbprint(jwk map[string]interface{}) (string, error) {

     

       320
       320
       +
       	kty, ok := jwk["kty"].(string)

     

       321
       321
       +
       	if !ok {

     

       322
       322
       +
       		return "", fmt.Errorf("JWK missing kty")

     

       323
       323
       +
       	}

     

       324
       324
       +
       

     

       325
       325
       +
       	// Build the canonical JWK representation based on key type

     

       326
       326
       +
       	// Per RFC 7638, only specific members are included, in lexicographic order

     

       327
       327
       +
       	var canonical map[string]string

     

       328
       328
       +
       

     

       329
       329
       +
       	switch kty {

     

       330
       330
       +
       	case "EC":

     

       331
       331
       +
       		crv, ok := jwk["crv"].(string)

     

       332
       332
       +
       		if !ok {

     

       333
       333
       +
       			return "", fmt.Errorf("EC JWK missing crv")

     

       334
       334
       +
       		}

     

       335
       335
       +
       		x, ok := jwk["x"].(string)

     

       336
       336
       +
       		if !ok {

     

       337
       337
       +
       			return "", fmt.Errorf("EC JWK missing x")

     

       338
       338
       +
       		}

     

       339
       339
       +
       		y, ok := jwk["y"].(string)

     

       340
       340
       +
       		if !ok {

     

       341
       341
       +
       			return "", fmt.Errorf("EC JWK missing y")

     

       342
       342
       +
       		}

     

       343
       343
       +
       		// Lexicographic order: crv, kty, x, y

     

       344
       344
       +
       		canonical = map[string]string{

     

       345
       345
       +
       			"crv": crv,

     

       346
       346
       +
       			"kty": kty,

     

       347
       347
       +
       			"x":   x,

     

       348
       348
       +
       			"y":   y,

     

       349
       349
       +
       		}

     

       350
       350
       +
       	case "RSA":

     

       351
       351
       +
       		e, ok := jwk["e"].(string)

     

       352
       352
       +
       		if !ok {

     

       353
       353
       +
       			return "", fmt.Errorf("RSA JWK missing e")

     

       354
       354
       +
       		}

     

       355
       355
       +
       		n, ok := jwk["n"].(string)

     

       356
       356
       +
       		if !ok {

     

       357
       357
       +
       			return "", fmt.Errorf("RSA JWK missing n")

     

       358
       358
       +
       		}

     

       359
       359
       +
       		// Lexicographic order: e, kty, n

     

       360
       360
       +
       		canonical = map[string]string{

     

       361
       361
       +
       			"e":   e,

     

       362
       362
       +
       			"kty": kty,

     

       363
       363
       +
       			"n":   n,

     

       364
       364
       +
       		}

     

       365
       365
       +
       	case "OKP":

     

       366
       366
       +
       		crv, ok := jwk["crv"].(string)

     

       367
       367
       +
       		if !ok {

     

       368
       368
       +
       			return "", fmt.Errorf("OKP JWK missing crv")

     

       369
       369
       +
       		}

     

       370
       370
       +
       		x, ok := jwk["x"].(string)

     

       371
       371
       +
       		if !ok {

     

       372
       372
       +
       			return "", fmt.Errorf("OKP JWK missing x")

     

       373
       373
       +
       		}

     

       374
       374
       +
       		// Lexicographic order: crv, kty, x

     

       375
       375
       +
       		canonical = map[string]string{

     

       376
       376
       +
       			"crv": crv,

     

       377
       377
       +
       			"kty": kty,

     

       378
       378
       +
       			"x":   x,

     

       379
       379
       +
       		}

     

       380
       380
       +
       	default:

     

       381
       381
       +
       		return "", fmt.Errorf("unsupported JWK key type: %s", kty)

     

       382
       382
       +
       	}

     

       383
       383
       +
       

     

       384
       384
       +
       	// Serialize to JSON (Go's json.Marshal produces lexicographically ordered keys for map[string]string)

     

       385
       385
       +
       	canonicalJSON, err := json.Marshal(canonical)

     

       386
       386
       +
       	if err != nil {

     

       387
       387
       +
       		return "", fmt.Errorf("failed to serialize canonical JWK: %w", err)

     

       388
       388
       +
       	}

     

       389
       389
       +
       

     

       390
       390
       +
       	// SHA-256 hash

     

       391
       391
       +
       	hash := sha256.Sum256(canonicalJSON)

     

       392
       392
       +
       

     

       393
       393
       +
       	// Base64url encode (no padding)

     

       394
       394
       +
       	thumbprint := base64.RawURLEncoding.EncodeToString(hash[:])

     

       395
       395
       +
       

     

       396
       396
       +
       	return thumbprint, nil

     

       397
       397
       +
       }

     

       398
       398
       +
       

     

       399
       399
       +
       // parseJWKToPublicKey parses a JWK map to a Go public key

     

       400
       400
       +
       func parseJWKToPublicKey(jwkMap map[string]interface{}) (interface{}, error) {

     

       401
       401
       +
       	// Convert map to JSON bytes for indigo's parser

     

       402
       402
       +
       	jwkBytes, err := json.Marshal(jwkMap)

     

       403
       403
       +
       	if err != nil {

     

       404
       404
       +
       		return nil, fmt.Errorf("failed to serialize JWK: %w", err)

     

       405
       405
       +
       	}

     

       406
       406
       +
       

     

       407
       407
       +
       	// Try to parse with indigo's crypto package

     

       408
       408
       +
       	pubKey, err := indigoCrypto.ParsePublicJWKBytes(jwkBytes)

     

       409
       409
       +
       	if err != nil {

     

       410
       410
       +
       		return nil, fmt.Errorf("failed to parse JWK: %w", err)

     

       411
       411
       +
       	}

     

       412
       412
       +
       

     

       413
       413
       +
       	// Convert indigo's PublicKey to Go's ecdsa.PublicKey

     

       414
       414
       +
       	jwk, err := pubKey.JWK()

     

       415
       415
       +
       	if err != nil {

     

       416
       416
       +
       		return nil, fmt.Errorf("failed to get JWK from public key: %w", err)

     

       417
       417
       +
       	}

     

       418
       418
       +
       

     

       419
       419
       +
       	// Use our existing conversion function

     

       420
       420
       +
       	return atcryptoJWKToECDSAFromIndigoJWK(jwk)

     

       421
       421
       +
       }

     

       422
       422
       +
       

     

       423
       423
       +
       // atcryptoJWKToECDSAFromIndigoJWK converts an indigo JWK to Go ecdsa.PublicKey

     

       424
       424
       +
       func atcryptoJWKToECDSAFromIndigoJWK(jwk *indigoCrypto.JWK) (*ecdsa.PublicKey, error) {

     

       425
       425
       +
       	if jwk.KeyType != "EC" {

     

       426
       426
       +
       		return nil, fmt.Errorf("unsupported JWK key type: %s (expected EC)", jwk.KeyType)

     

       427
       427
       +
       	}

     

       428
       428
       +
       

     

       429
       429
       +
       	xBytes, err := base64.RawURLEncoding.DecodeString(jwk.X)

     

       430
       430
       +
       	if err != nil {

     

       431
       431
       +
       		return nil, fmt.Errorf("invalid JWK X coordinate: %w", err)

     

       432
       432
       +
       	}

     

       433
       433
       +
       	yBytes, err := base64.RawURLEncoding.DecodeString(jwk.Y)

     

       434
       434
       +
       	if err != nil {

     

       435
       435
       +
       		return nil, fmt.Errorf("invalid JWK Y coordinate: %w", err)

     

       436
       436
       +
       	}

     

       437
       437
       +
       

     

       438
       438
       +
       	var curve ecdsa.PublicKey

     

       439
       439
       +
       	switch jwk.Curve {

     

       440
       440
       +
       	case "P-256":

     

       441
       441
       +
       		curve.Curve = ecdsaP256Curve()

     

       442
       442
       +
       	case "P-384":

     

       443
       443
       +
       		curve.Curve = ecdsaP384Curve()

     

       444
       444
       +
       	case "P-521":

     

       445
       445
       +
       		curve.Curve = ecdsaP521Curve()

     

       446
       446
       +
       	default:

     

       447
       447
       +
       		return nil, fmt.Errorf("unsupported curve: %s", jwk.Curve)

     

       448
       448
       +
       	}

     

       449
       449
       +
       

     

       450
       450
       +
       	curve.X = new(big.Int).SetBytes(xBytes)

     

       451
       451
       +
       	curve.Y = new(big.Int).SetBytes(yBytes)

     

       452
       452
       +
       

     

       453
       453
       +
       	return &curve, nil

     

       454
       454
       +
       }

     

       455
       455
       +
       

     

       456
       456
       +
       // Helper functions for elliptic curves

     

       457
       457
       +
       func ecdsaP256Curve() elliptic.Curve { return elliptic.P256() }

     

       458
       458
       +
       func ecdsaP384Curve() elliptic.Curve { return elliptic.P384() }

     

       459
       459
       +
       func ecdsaP521Curve() elliptic.Curve { return elliptic.P521() }

     

       460
       460
       +
       

     

       461
       461
       +
       // stripQueryFragment removes query and fragment from a URI

     

       462
       462
       +
       func stripQueryFragment(uri string) string {

     

       463
       463
       +
       	if idx := strings.Index(uri, "?"); idx != -1 {

     

       464
       464
       +
       		uri = uri[:idx]

     

       465
       465
       +
       	}

     

       466
       466
       +
       	if idx := strings.Index(uri, "#"); idx != -1 {

     

       467
       467
       +
       		uri = uri[:idx]

     

       468
       468
       +
       	}

     

       469
       469
       +
       	return uri

     

       470
       470
       +
       }

     

       471
       471
       +
       

     

       472
       472
       +
       // ExtractCnfJkt extracts the cnf.jkt (confirmation key thumbprint) from JWT claims

     

       473
       473
       +
       func ExtractCnfJkt(claims *Claims) (string, error) {

     

       474
       474
       +
       	if claims.Confirmation == nil {

     

       475
       475
       +
       		return "", fmt.Errorf("token missing cnf claim (no DPoP binding)")

     

       476
       476
       +
       	}

     

       477
       477
       +
       

     

       478
       478
       +
       	jkt, ok := claims.Confirmation["jkt"].(string)

     

       479
       479
       +
       	if !ok || jkt == "" {

     

       480
       480
       +
       		return "", fmt.Errorf("token cnf claim missing jkt (DPoP key thumbprint)")

     

       481
       481
       +
       	}

     

       482
       482
       +
       

     

       483
       483
       +
       	return jkt, nil

     

       484
       484
       +
       }

+921

internal/atproto/auth/dpop_test.go

···

       1
       1
       +
       package auth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"crypto/ecdsa"

     

       5
       5
       +
       	"crypto/elliptic"

     

       6
       6
       +
       	"crypto/rand"

     

       7
       7
       +
       	"crypto/sha256"

     

       8
       8
       +
       	"encoding/base64"

     

       9
       9
       +
       	"encoding/json"

     

       10
       10
       +
       	"strings"

     

       11
       11
       +
       	"testing"

     

       12
       12
       +
       	"time"

     

       13
       13
       +
       

     

       14
       14
       +
       	"github.com/golang-jwt/jwt/v5"

     

       15
       15
       +
       	"github.com/google/uuid"

     

       16
       16
       +
       )

     

       17
       17
       +
       

     

       18
       18
       +
       // === Test Helpers ===

     

       19
       19
       +
       

     

       20
       20
       +
       // testECKey holds a test ES256 key pair

     

       21
       21
       +
       type testECKey struct {

     

       22
       22
       +
       	privateKey *ecdsa.PrivateKey

     

       23
       23
       +
       	publicKey  *ecdsa.PublicKey

     

       24
       24
       +
       	jwk        map[string]interface{}

     

       25
       25
       +
       	thumbprint string

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       // generateTestES256Key generates a test ES256 key pair and JWK

     

       29
       29
       +
       func generateTestES256Key(t *testing.T) *testECKey {

     

       30
       30
       +
       	t.Helper()

     

       31
       31
       +
       

     

       32
       32
       +
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       33
       33
       +
       	if err != nil {

     

       34
       34
       +
       		t.Fatalf("Failed to generate test key: %v", err)

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	// Encode public key coordinates as base64url

     

       38
       38
       +
       	xBytes := privateKey.PublicKey.X.Bytes()

     

       39
       39
       +
       	yBytes := privateKey.PublicKey.Y.Bytes()

     

       40
       40
       +
       

     

       41
       41
       +
       	// P-256 coordinates must be 32 bytes (pad if needed)

     

       42
       42
       +
       	xBytes = padTo32Bytes(xBytes)

     

       43
       43
       +
       	yBytes = padTo32Bytes(yBytes)

     

       44
       44
       +
       

     

       45
       45
       +
       	x := base64.RawURLEncoding.EncodeToString(xBytes)

     

       46
       46
       +
       	y := base64.RawURLEncoding.EncodeToString(yBytes)

     

       47
       47
       +
       

     

       48
       48
       +
       	jwk := map[string]interface{}{

     

       49
       49
       +
       		"kty": "EC",

     

       50
       50
       +
       		"crv": "P-256",

     

       51
       51
       +
       		"x":   x,

     

       52
       52
       +
       		"y":   y,

     

       53
       53
       +
       	}

     

       54
       54
       +
       

     

       55
       55
       +
       	// Calculate thumbprint

     

       56
       56
       +
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       57
       57
       +
       	if err != nil {

     

       58
       58
       +
       		t.Fatalf("Failed to calculate thumbprint: %v", err)

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	return &testECKey{

     

       62
       62
       +
       		privateKey: privateKey,

     

       63
       63
       +
       		publicKey:  &privateKey.PublicKey,

     

       64
       64
       +
       		jwk:        jwk,

     

       65
       65
       +
       		thumbprint: thumbprint,

     

       66
       66
       +
       	}

     

       67
       67
       +
       }

     

       68
       68
       +
       

     

       69
       69
       +
       // padTo32Bytes pads a byte slice to 32 bytes (required for P-256 coordinates)

     

       70
       70
       +
       func padTo32Bytes(b []byte) []byte {

     

       71
       71
       +
       	if len(b) >= 32 {

     

       72
       72
       +
       		return b

     

       73
       73
       +
       	}

     

       74
       74
       +
       	padded := make([]byte, 32)

     

       75
       75
       +
       	copy(padded[32-len(b):], b)

     

       76
       76
       +
       	return padded

     

       77
       77
       +
       }

     

       78
       78
       +
       

     

       79
       79
       +
       // createDPoPProof creates a DPoP proof JWT for testing

     

       80
       80
       +
       func createDPoPProof(t *testing.T, key *testECKey, method, uri string, iat time.Time, jti string) string {

     

       81
       81
       +
       	t.Helper()

     

       82
       82
       +
       

     

       83
       83
       +
       	claims := &DPoPClaims{

     

       84
       84
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       85
       85
       +
       			ID:       jti,

     

       86
       86
       +
       			IssuedAt: jwt.NewNumericDate(iat),

     

       87
       87
       +
       		},

     

       88
       88
       +
       		HTTPMethod: method,

     

       89
       89
       +
       		HTTPURI:    uri,

     

       90
       90
       +
       	}

     

       91
       91
       +
       

     

       92
       92
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       93
       93
       +
       	token.Header["typ"] = "dpop+jwt"

     

       94
       94
       +
       	token.Header["jwk"] = key.jwk

     

       95
       95
       +
       

     

       96
       96
       +
       	tokenString, err := token.SignedString(key.privateKey)

     

       97
       97
       +
       	if err != nil {

     

       98
       98
       +
       		t.Fatalf("Failed to create DPoP proof: %v", err)

     

       99
       99
       +
       	}

     

       100
       100
       +
       

     

       101
       101
       +
       	return tokenString

     

       102
       102
       +
       }

     

       103
       103
       +
       

     

       104
       104
       +
       // === JWK Thumbprint Tests (RFC 7638) ===

     

       105
       105
       +
       

     

       106
       106
       +
       func TestCalculateJWKThumbprint_EC_P256(t *testing.T) {

     

       107
       107
       +
       	// Test with known values from RFC 7638 Appendix A (adapted for P-256)

     

       108
       108
       +
       	jwk := map[string]interface{}{

     

       109
       109
       +
       		"kty": "EC",

     

       110
       110
       +
       		"crv": "P-256",

     

       111
       111
       +
       		"x":   "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",

     

       112
       112
       +
       		"y":   "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE",

     

       113
       113
       +
       	}

     

       114
       114
       +
       

     

       115
       115
       +
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       116
       116
       +
       	if err != nil {

     

       117
       117
       +
       		t.Fatalf("CalculateJWKThumbprint failed: %v", err)

     

       118
       118
       +
       	}

     

       119
       119
       +
       

     

       120
       120
       +
       	if thumbprint == "" {

     

       121
       121
       +
       		t.Error("Expected non-empty thumbprint")

     

       122
       122
       +
       	}

     

       123
       123
       +
       

     

       124
       124
       +
       	// Verify it's valid base64url

     

       125
       125
       +
       	_, err = base64.RawURLEncoding.DecodeString(thumbprint)

     

       126
       126
       +
       	if err != nil {

     

       127
       127
       +
       		t.Errorf("Thumbprint is not valid base64url: %v", err)

     

       128
       128
       +
       	}

     

       129
       129
       +
       

     

       130
       130
       +
       	// Verify length (SHA-256 produces 32 bytes = 43 base64url chars)

     

       131
       131
       +
       	if len(thumbprint) != 43 {

     

       132
       132
       +
       		t.Errorf("Expected thumbprint length 43, got %d", len(thumbprint))

     

       133
       133
       +
       	}

     

       134
       134
       +
       }

     

       135
       135
       +
       

     

       136
       136
       +
       func TestCalculateJWKThumbprint_Deterministic(t *testing.T) {

     

       137
       137
       +
       	// Same key should produce same thumbprint

     

       138
       138
       +
       	jwk := map[string]interface{}{

     

       139
       139
       +
       		"kty": "EC",

     

       140
       140
       +
       		"crv": "P-256",

     

       141
       141
       +
       		"x":   "test-x-coordinate",

     

       142
       142
       +
       		"y":   "test-y-coordinate",

     

       143
       143
       +
       	}

     

       144
       144
       +
       

     

       145
       145
       +
       	thumbprint1, err := CalculateJWKThumbprint(jwk)

     

       146
       146
       +
       	if err != nil {

     

       147
       147
       +
       		t.Fatalf("First CalculateJWKThumbprint failed: %v", err)

     

       148
       148
       +
       	}

     

       149
       149
       +
       

     

       150
       150
       +
       	thumbprint2, err := CalculateJWKThumbprint(jwk)

     

       151
       151
       +
       	if err != nil {

     

       152
       152
       +
       		t.Fatalf("Second CalculateJWKThumbprint failed: %v", err)

     

       153
       153
       +
       	}

     

       154
       154
       +
       

     

       155
       155
       +
       	if thumbprint1 != thumbprint2 {

     

       156
       156
       +
       		t.Errorf("Thumbprints are not deterministic: %s != %s", thumbprint1, thumbprint2)

     

       157
       157
       +
       	}

     

       158
       158
       +
       }

     

       159
       159
       +
       

     

       160
       160
       +
       func TestCalculateJWKThumbprint_DifferentKeys(t *testing.T) {

     

       161
       161
       +
       	// Different keys should produce different thumbprints

     

       162
       162
       +
       	jwk1 := map[string]interface{}{

     

       163
       163
       +
       		"kty": "EC",

     

       164
       164
       +
       		"crv": "P-256",

     

       165
       165
       +
       		"x":   "coordinate-x-1",

     

       166
       166
       +
       		"y":   "coordinate-y-1",

     

       167
       167
       +
       	}

     

       168
       168
       +
       

     

       169
       169
       +
       	jwk2 := map[string]interface{}{

     

       170
       170
       +
       		"kty": "EC",

     

       171
       171
       +
       		"crv": "P-256",

     

       172
       172
       +
       		"x":   "coordinate-x-2",

     

       173
       173
       +
       		"y":   "coordinate-y-2",

     

       174
       174
       +
       	}

     

       175
       175
       +
       

     

       176
       176
       +
       	thumbprint1, err := CalculateJWKThumbprint(jwk1)

     

       177
       177
       +
       	if err != nil {

     

       178
       178
       +
       		t.Fatalf("First CalculateJWKThumbprint failed: %v", err)

     

       179
       179
       +
       	}

     

       180
       180
       +
       

     

       181
       181
       +
       	thumbprint2, err := CalculateJWKThumbprint(jwk2)

     

       182
       182
       +
       	if err != nil {

     

       183
       183
       +
       		t.Fatalf("Second CalculateJWKThumbprint failed: %v", err)

     

       184
       184
       +
       	}

     

       185
       185
       +
       

     

       186
       186
       +
       	if thumbprint1 == thumbprint2 {

     

       187
       187
       +
       		t.Error("Different keys produced same thumbprint (collision)")

     

       188
       188
       +
       	}

     

       189
       189
       +
       }

     

       190
       190
       +
       

     

       191
       191
       +
       func TestCalculateJWKThumbprint_MissingKty(t *testing.T) {

     

       192
       192
       +
       	jwk := map[string]interface{}{

     

       193
       193
       +
       		"crv": "P-256",

     

       194
       194
       +
       		"x":   "test-x",

     

       195
       195
       +
       		"y":   "test-y",

     

       196
       196
       +
       	}

     

       197
       197
       +
       

     

       198
       198
       +
       	_, err := CalculateJWKThumbprint(jwk)

     

       199
       199
       +
       	if err == nil {

     

       200
       200
       +
       		t.Error("Expected error for missing kty, got nil")

     

       201
       201
       +
       	}

     

       202
       202
       +
       	if err != nil && !contains(err.Error(), "missing kty") {

     

       203
       203
       +
       		t.Errorf("Expected error about missing kty, got: %v", err)

     

       204
       204
       +
       	}

     

       205
       205
       +
       }

     

       206
       206
       +
       

     

       207
       207
       +
       func TestCalculateJWKThumbprint_EC_MissingCrv(t *testing.T) {

     

       208
       208
       +
       	jwk := map[string]interface{}{

     

       209
       209
       +
       		"kty": "EC",

     

       210
       210
       +
       		"x":   "test-x",

     

       211
       211
       +
       		"y":   "test-y",

     

       212
       212
       +
       	}

     

       213
       213
       +
       

     

       214
       214
       +
       	_, err := CalculateJWKThumbprint(jwk)

     

       215
       215
       +
       	if err == nil {

     

       216
       216
       +
       		t.Error("Expected error for missing crv, got nil")

     

       217
       217
       +
       	}

     

       218
       218
       +
       	if err != nil && !contains(err.Error(), "missing crv") {

     

       219
       219
       +
       		t.Errorf("Expected error about missing crv, got: %v", err)

     

       220
       220
       +
       	}

     

       221
       221
       +
       }

     

       222
       222
       +
       

     

       223
       223
       +
       func TestCalculateJWKThumbprint_EC_MissingX(t *testing.T) {

     

       224
       224
       +
       	jwk := map[string]interface{}{

     

       225
       225
       +
       		"kty": "EC",

     

       226
       226
       +
       		"crv": "P-256",

     

       227
       227
       +
       		"y":   "test-y",

     

       228
       228
       +
       	}

     

       229
       229
       +
       

     

       230
       230
       +
       	_, err := CalculateJWKThumbprint(jwk)

     

       231
       231
       +
       	if err == nil {

     

       232
       232
       +
       		t.Error("Expected error for missing x, got nil")

     

       233
       233
       +
       	}

     

       234
       234
       +
       	if err != nil && !contains(err.Error(), "missing x") {

     

       235
       235
       +
       		t.Errorf("Expected error about missing x, got: %v", err)

     

       236
       236
       +
       	}

     

       237
       237
       +
       }

     

       238
       238
       +
       

     

       239
       239
       +
       func TestCalculateJWKThumbprint_EC_MissingY(t *testing.T) {

     

       240
       240
       +
       	jwk := map[string]interface{}{

     

       241
       241
       +
       		"kty": "EC",

     

       242
       242
       +
       		"crv": "P-256",

     

       243
       243
       +
       		"x":   "test-x",

     

       244
       244
       +
       	}

     

       245
       245
       +
       

     

       246
       246
       +
       	_, err := CalculateJWKThumbprint(jwk)

     

       247
       247
       +
       	if err == nil {

     

       248
       248
       +
       		t.Error("Expected error for missing y, got nil")

     

       249
       249
       +
       	}

     

       250
       250
       +
       	if err != nil && !contains(err.Error(), "missing y") {

     

       251
       251
       +
       		t.Errorf("Expected error about missing y, got: %v", err)

     

       252
       252
       +
       	}

     

       253
       253
       +
       }

     

       254
       254
       +
       

     

       255
       255
       +
       func TestCalculateJWKThumbprint_RSA(t *testing.T) {

     

       256
       256
       +
       	// Test RSA key thumbprint calculation

     

       257
       257
       +
       	jwk := map[string]interface{}{

     

       258
       258
       +
       		"kty": "RSA",

     

       259
       259
       +
       		"e":   "AQAB",

     

       260
       260
       +
       		"n":   "test-modulus",

     

       261
       261
       +
       	}

     

       262
       262
       +
       

     

       263
       263
       +
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       264
       264
       +
       	if err != nil {

     

       265
       265
       +
       		t.Fatalf("CalculateJWKThumbprint failed for RSA: %v", err)

     

       266
       266
       +
       	}

     

       267
       267
       +
       

     

       268
       268
       +
       	if thumbprint == "" {

     

       269
       269
       +
       		t.Error("Expected non-empty thumbprint for RSA key")

     

       270
       270
       +
       	}

     

       271
       271
       +
       }

     

       272
       272
       +
       

     

       273
       273
       +
       func TestCalculateJWKThumbprint_OKP(t *testing.T) {

     

       274
       274
       +
       	// Test OKP (Octet Key Pair) thumbprint calculation

     

       275
       275
       +
       	jwk := map[string]interface{}{

     

       276
       276
       +
       		"kty": "OKP",

     

       277
       277
       +
       		"crv": "Ed25519",

     

       278
       278
       +
       		"x":   "test-x-coordinate",

     

       279
       279
       +
       	}

     

       280
       280
       +
       

     

       281
       281
       +
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       282
       282
       +
       	if err != nil {

     

       283
       283
       +
       		t.Fatalf("CalculateJWKThumbprint failed for OKP: %v", err)

     

       284
       284
       +
       	}

     

       285
       285
       +
       

     

       286
       286
       +
       	if thumbprint == "" {

     

       287
       287
       +
       		t.Error("Expected non-empty thumbprint for OKP key")

     

       288
       288
       +
       	}

     

       289
       289
       +
       }

     

       290
       290
       +
       

     

       291
       291
       +
       func TestCalculateJWKThumbprint_UnsupportedKeyType(t *testing.T) {

     

       292
       292
       +
       	jwk := map[string]interface{}{

     

       293
       293
       +
       		"kty": "UNKNOWN",

     

       294
       294
       +
       	}

     

       295
       295
       +
       

     

       296
       296
       +
       	_, err := CalculateJWKThumbprint(jwk)

     

       297
       297
       +
       	if err == nil {

     

       298
       298
       +
       		t.Error("Expected error for unsupported key type, got nil")

     

       299
       299
       +
       	}

     

       300
       300
       +
       	if err != nil && !contains(err.Error(), "unsupported JWK key type") {

     

       301
       301
       +
       		t.Errorf("Expected error about unsupported key type, got: %v", err)

     

       302
       302
       +
       	}

     

       303
       303
       +
       }

     

       304
       304
       +
       

     

       305
       305
       +
       func TestCalculateJWKThumbprint_CanonicalJSON(t *testing.T) {

     

       306
       306
       +
       	// RFC 7638 requires lexicographic ordering of keys in canonical JSON

     

       307
       307
       +
       	// This test verifies that the canonical JSON is correctly ordered

     

       308
       308
       +
       

     

       309
       309
       +
       	jwk := map[string]interface{}{

     

       310
       310
       +
       		"kty": "EC",

     

       311
       311
       +
       		"crv": "P-256",

     

       312
       312
       +
       		"x":   "x-coord",

     

       313
       313
       +
       		"y":   "y-coord",

     

       314
       314
       +
       	}

     

       315
       315
       +
       

     

       316
       316
       +
       	// The canonical JSON should be: {"crv":"P-256","kty":"EC","x":"x-coord","y":"y-coord"}

     

       317
       317
       +
       	// (lexicographically ordered: crv, kty, x, y)

     

       318
       318
       +
       

     

       319
       319
       +
       	canonical := map[string]string{

     

       320
       320
       +
       		"crv": "P-256",

     

       321
       321
       +
       		"kty": "EC",

     

       322
       322
       +
       		"x":   "x-coord",

     

       323
       323
       +
       		"y":   "y-coord",

     

       324
       324
       +
       	}

     

       325
       325
       +
       

     

       326
       326
       +
       	canonicalJSON, err := json.Marshal(canonical)

     

       327
       327
       +
       	if err != nil {

     

       328
       328
       +
       		t.Fatalf("Failed to marshal canonical JSON: %v", err)

     

       329
       329
       +
       	}

     

       330
       330
       +
       

     

       331
       331
       +
       	expectedHash := sha256.Sum256(canonicalJSON)

     

       332
       332
       +
       	expectedThumbprint := base64.RawURLEncoding.EncodeToString(expectedHash[:])

     

       333
       333
       +
       

     

       334
       334
       +
       	actualThumbprint, err := CalculateJWKThumbprint(jwk)

     

       335
       335
       +
       	if err != nil {

     

       336
       336
       +
       		t.Fatalf("CalculateJWKThumbprint failed: %v", err)

     

       337
       337
       +
       	}

     

       338
       338
       +
       

     

       339
       339
       +
       	if actualThumbprint != expectedThumbprint {

     

       340
       340
       +
       		t.Errorf("Thumbprint doesn't match expected canonical JSON hash\nExpected: %s\nGot: %s",

     

       341
       341
       +
       			expectedThumbprint, actualThumbprint)

     

       342
       342
       +
       	}

     

       343
       343
       +
       }

     

       344
       344
       +
       

     

       345
       345
       +
       // === DPoP Proof Verification Tests ===

     

       346
       346
       +
       

     

       347
       347
       +
       func TestVerifyDPoPProof_Valid(t *testing.T) {

     

       348
       348
       +
       	verifier := NewDPoPVerifier()

     

       349
       349
       +
       	key := generateTestES256Key(t)

     

       350
       350
       +
       

     

       351
       351
       +
       	method := "POST"

     

       352
       352
       +
       	uri := "https://api.example.com/resource"

     

       353
       353
       +
       	iat := time.Now()

     

       354
       354
       +
       	jti := uuid.New().String()

     

       355
       355
       +
       

     

       356
       356
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       357
       357
       +
       

     

       358
       358
       +
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       359
       359
       +
       	if err != nil {

     

       360
       360
       +
       		t.Fatalf("VerifyDPoPProof failed for valid proof: %v", err)

     

       361
       361
       +
       	}

     

       362
       362
       +
       

     

       363
       363
       +
       	if result == nil {

     

       364
       364
       +
       		t.Fatal("Expected non-nil proof result")

     

       365
       365
       +
       	}

     

       366
       366
       +
       

     

       367
       367
       +
       	if result.Claims.HTTPMethod != method {

     

       368
       368
       +
       		t.Errorf("Expected method %s, got %s", method, result.Claims.HTTPMethod)

     

       369
       369
       +
       	}

     

       370
       370
       +
       

     

       371
       371
       +
       	if result.Claims.HTTPURI != uri {

     

       372
       372
       +
       		t.Errorf("Expected URI %s, got %s", uri, result.Claims.HTTPURI)

     

       373
       373
       +
       	}

     

       374
       374
       +
       

     

       375
       375
       +
       	if result.Claims.ID != jti {

     

       376
       376
       +
       		t.Errorf("Expected jti %s, got %s", jti, result.Claims.ID)

     

       377
       377
       +
       	}

     

       378
       378
       +
       

     

       379
       379
       +
       	if result.Thumbprint != key.thumbprint {

     

       380
       380
       +
       		t.Errorf("Expected thumbprint %s, got %s", key.thumbprint, result.Thumbprint)

     

       381
       381
       +
       	}

     

       382
       382
       +
       }

     

       383
       383
       +
       

     

       384
       384
       +
       func TestVerifyDPoPProof_InvalidSignature(t *testing.T) {

     

       385
       385
       +
       	verifier := NewDPoPVerifier()

     

       386
       386
       +
       	key := generateTestES256Key(t)

     

       387
       387
       +
       	wrongKey := generateTestES256Key(t)

     

       388
       388
       +
       

     

       389
       389
       +
       	method := "POST"

     

       390
       390
       +
       	uri := "https://api.example.com/resource"

     

       391
       391
       +
       	iat := time.Now()

     

       392
       392
       +
       	jti := uuid.New().String()

     

       393
       393
       +
       

     

       394
       394
       +
       	// Create proof with one key

     

       395
       395
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       396
       396
       +
       

     

       397
       397
       +
       	// Parse and modify to use wrong key's JWK in header (signature won't match)

     

       398
       398
       +
       	parts := splitJWT(proof)

     

       399
       399
       +
       	header := parseJWTHeader(t, parts[0])

     

       400
       400
       +
       	header["jwk"] = wrongKey.jwk

     

       401
       401
       +
       	modifiedHeader := encodeJSON(t, header)

     

       402
       402
       +
       	tamperedProof := modifiedHeader + "." + parts[1] + "." + parts[2]

     

       403
       403
       +
       

     

       404
       404
       +
       	_, err := verifier.VerifyDPoPProof(tamperedProof, method, uri)

     

       405
       405
       +
       	if err == nil {

     

       406
       406
       +
       		t.Error("Expected error for invalid signature, got nil")

     

       407
       407
       +
       	}

     

       408
       408
       +
       	if err != nil && !contains(err.Error(), "signature verification failed") {

     

       409
       409
       +
       		t.Errorf("Expected signature verification error, got: %v", err)

     

       410
       410
       +
       	}

     

       411
       411
       +
       }

     

       412
       412
       +
       

     

       413
       413
       +
       func TestVerifyDPoPProof_WrongHTTPMethod(t *testing.T) {

     

       414
       414
       +
       	verifier := NewDPoPVerifier()

     

       415
       415
       +
       	key := generateTestES256Key(t)

     

       416
       416
       +
       

     

       417
       417
       +
       	method := "POST"

     

       418
       418
       +
       	wrongMethod := "GET"

     

       419
       419
       +
       	uri := "https://api.example.com/resource"

     

       420
       420
       +
       	iat := time.Now()

     

       421
       421
       +
       	jti := uuid.New().String()

     

       422
       422
       +
       

     

       423
       423
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       424
       424
       +
       

     

       425
       425
       +
       	_, err := verifier.VerifyDPoPProof(proof, wrongMethod, uri)

     

       426
       426
       +
       	if err == nil {

     

       427
       427
       +
       		t.Error("Expected error for HTTP method mismatch, got nil")

     

       428
       428
       +
       	}

     

       429
       429
       +
       	if err != nil && !contains(err.Error(), "htm mismatch") {

     

       430
       430
       +
       		t.Errorf("Expected htm mismatch error, got: %v", err)

     

       431
       431
       +
       	}

     

       432
       432
       +
       }

     

       433
       433
       +
       

     

       434
       434
       +
       func TestVerifyDPoPProof_WrongURI(t *testing.T) {

     

       435
       435
       +
       	verifier := NewDPoPVerifier()

     

       436
       436
       +
       	key := generateTestES256Key(t)

     

       437
       437
       +
       

     

       438
       438
       +
       	method := "POST"

     

       439
       439
       +
       	uri := "https://api.example.com/resource"

     

       440
       440
       +
       	wrongURI := "https://api.example.com/different"

     

       441
       441
       +
       	iat := time.Now()

     

       442
       442
       +
       	jti := uuid.New().String()

     

       443
       443
       +
       

     

       444
       444
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       445
       445
       +
       

     

       446
       446
       +
       	_, err := verifier.VerifyDPoPProof(proof, method, wrongURI)

     

       447
       447
       +
       	if err == nil {

     

       448
       448
       +
       		t.Error("Expected error for URI mismatch, got nil")

     

       449
       449
       +
       	}

     

       450
       450
       +
       	if err != nil && !contains(err.Error(), "htu mismatch") {

     

       451
       451
       +
       		t.Errorf("Expected htu mismatch error, got: %v", err)

     

       452
       452
       +
       	}

     

       453
       453
       +
       }

     

       454
       454
       +
       

     

       455
       455
       +
       func TestVerifyDPoPProof_URIWithQuery(t *testing.T) {

     

       456
       456
       +
       	// URI comparison should strip query and fragment

     

       457
       457
       +
       	verifier := NewDPoPVerifier()

     

       458
       458
       +
       	key := generateTestES256Key(t)

     

       459
       459
       +
       

     

       460
       460
       +
       	method := "POST"

     

       461
       461
       +
       	baseURI := "https://api.example.com/resource"

     

       462
       462
       +
       	uriWithQuery := baseURI + "?param=value"

     

       463
       463
       +
       	iat := time.Now()

     

       464
       464
       +
       	jti := uuid.New().String()

     

       465
       465
       +
       

     

       466
       466
       +
       	proof := createDPoPProof(t, key, method, baseURI, iat, jti)

     

       467
       467
       +
       

     

       468
       468
       +
       	// Should succeed because query is stripped

     

       469
       469
       +
       	_, err := verifier.VerifyDPoPProof(proof, method, uriWithQuery)

     

       470
       470
       +
       	if err != nil {

     

       471
       471
       +
       		t.Fatalf("VerifyDPoPProof failed for URI with query: %v", err)

     

       472
       472
       +
       	}

     

       473
       473
       +
       }

     

       474
       474
       +
       

     

       475
       475
       +
       func TestVerifyDPoPProof_URIWithFragment(t *testing.T) {

     

       476
       476
       +
       	// URI comparison should strip query and fragment

     

       477
       477
       +
       	verifier := NewDPoPVerifier()

     

       478
       478
       +
       	key := generateTestES256Key(t)

     

       479
       479
       +
       

     

       480
       480
       +
       	method := "POST"

     

       481
       481
       +
       	baseURI := "https://api.example.com/resource"

     

       482
       482
       +
       	uriWithFragment := baseURI + "#section"

     

       483
       483
       +
       	iat := time.Now()

     

       484
       484
       +
       	jti := uuid.New().String()

     

       485
       485
       +
       

     

       486
       486
       +
       	proof := createDPoPProof(t, key, method, baseURI, iat, jti)

     

       487
       487
       +
       

     

       488
       488
       +
       	// Should succeed because fragment is stripped

     

       489
       489
       +
       	_, err := verifier.VerifyDPoPProof(proof, method, uriWithFragment)

     

       490
       490
       +
       	if err != nil {

     

       491
       491
       +
       		t.Fatalf("VerifyDPoPProof failed for URI with fragment: %v", err)

     

       492
       492
       +
       	}

     

       493
       493
       +
       }

     

       494
       494
       +
       

     

       495
       495
       +
       func TestVerifyDPoPProof_ExpiredProof(t *testing.T) {

     

       496
       496
       +
       	verifier := NewDPoPVerifier()

     

       497
       497
       +
       	key := generateTestES256Key(t)

     

       498
       498
       +
       

     

       499
       499
       +
       	method := "POST"

     

       500
       500
       +
       	uri := "https://api.example.com/resource"

     

       501
       501
       +
       	// Proof issued 10 minutes ago (exceeds default MaxProofAge of 5 minutes)

     

       502
       502
       +
       	iat := time.Now().Add(-10 * time.Minute)

     

       503
       503
       +
       	jti := uuid.New().String()

     

       504
       504
       +
       

     

       505
       505
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       506
       506
       +
       

     

       507
       507
       +
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       508
       508
       +
       	if err == nil {

     

       509
       509
       +
       		t.Error("Expected error for expired proof, got nil")

     

       510
       510
       +
       	}

     

       511
       511
       +
       	if err != nil && !contains(err.Error(), "too old") {

     

       512
       512
       +
       		t.Errorf("Expected 'too old' error, got: %v", err)

     

       513
       513
       +
       	}

     

       514
       514
       +
       }

     

       515
       515
       +
       

     

       516
       516
       +
       func TestVerifyDPoPProof_FutureProof(t *testing.T) {

     

       517
       517
       +
       	verifier := NewDPoPVerifier()

     

       518
       518
       +
       	key := generateTestES256Key(t)

     

       519
       519
       +
       

     

       520
       520
       +
       	method := "POST"

     

       521
       521
       +
       	uri := "https://api.example.com/resource"

     

       522
       522
       +
       	// Proof issued 1 minute in the future (exceeds MaxClockSkew)

     

       523
       523
       +
       	iat := time.Now().Add(1 * time.Minute)

     

       524
       524
       +
       	jti := uuid.New().String()

     

       525
       525
       +
       

     

       526
       526
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       527
       527
       +
       

     

       528
       528
       +
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       529
       529
       +
       	if err == nil {

     

       530
       530
       +
       		t.Error("Expected error for future proof, got nil")

     

       531
       531
       +
       	}

     

       532
       532
       +
       	if err != nil && !contains(err.Error(), "in the future") {

     

       533
       533
       +
       		t.Errorf("Expected 'in the future' error, got: %v", err)

     

       534
       534
       +
       	}

     

       535
       535
       +
       }

     

       536
       536
       +
       

     

       537
       537
       +
       func TestVerifyDPoPProof_WithinClockSkew(t *testing.T) {

     

       538
       538
       +
       	verifier := NewDPoPVerifier()

     

       539
       539
       +
       	key := generateTestES256Key(t)

     

       540
       540
       +
       

     

       541
       541
       +
       	method := "POST"

     

       542
       542
       +
       	uri := "https://api.example.com/resource"

     

       543
       543
       +
       	// Proof issued 15 seconds in the future (within MaxClockSkew of 30s)

     

       544
       544
       +
       	iat := time.Now().Add(15 * time.Second)

     

       545
       545
       +
       	jti := uuid.New().String()

     

       546
       546
       +
       

     

       547
       547
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       548
       548
       +
       

     

       549
       549
       +
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       550
       550
       +
       	if err != nil {

     

       551
       551
       +
       		t.Fatalf("VerifyDPoPProof failed for proof within clock skew: %v", err)

     

       552
       552
       +
       	}

     

       553
       553
       +
       }

     

       554
       554
       +
       

     

       555
       555
       +
       func TestVerifyDPoPProof_MissingJti(t *testing.T) {

     

       556
       556
       +
       	verifier := NewDPoPVerifier()

     

       557
       557
       +
       	key := generateTestES256Key(t)

     

       558
       558
       +
       

     

       559
       559
       +
       	method := "POST"

     

       560
       560
       +
       	uri := "https://api.example.com/resource"

     

       561
       561
       +
       	iat := time.Now()

     

       562
       562
       +
       

     

       563
       563
       +
       	claims := &DPoPClaims{

     

       564
       564
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       565
       565
       +
       			// No ID (jti)

     

       566
       566
       +
       			IssuedAt: jwt.NewNumericDate(iat),

     

       567
       567
       +
       		},

     

       568
       568
       +
       		HTTPMethod: method,

     

       569
       569
       +
       		HTTPURI:    uri,

     

       570
       570
       +
       	}

     

       571
       571
       +
       

     

       572
       572
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       573
       573
       +
       	token.Header["typ"] = "dpop+jwt"

     

       574
       574
       +
       	token.Header["jwk"] = key.jwk

     

       575
       575
       +
       

     

       576
       576
       +
       	proof, err := token.SignedString(key.privateKey)

     

       577
       577
       +
       	if err != nil {

     

       578
       578
       +
       		t.Fatalf("Failed to create test proof: %v", err)

     

       579
       579
       +
       	}

     

       580
       580
       +
       

     

       581
       581
       +
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       582
       582
       +
       	if err == nil {

     

       583
       583
       +
       		t.Error("Expected error for missing jti, got nil")

     

       584
       584
       +
       	}

     

       585
       585
       +
       	if err != nil && !contains(err.Error(), "missing jti") {

     

       586
       586
       +
       		t.Errorf("Expected missing jti error, got: %v", err)

     

       587
       587
       +
       	}

     

       588
       588
       +
       }

     

       589
       589
       +
       

     

       590
       590
       +
       func TestVerifyDPoPProof_MissingTypHeader(t *testing.T) {

     

       591
       591
       +
       	verifier := NewDPoPVerifier()

     

       592
       592
       +
       	key := generateTestES256Key(t)

     

       593
       593
       +
       

     

       594
       594
       +
       	method := "POST"

     

       595
       595
       +
       	uri := "https://api.example.com/resource"

     

       596
       596
       +
       	iat := time.Now()

     

       597
       597
       +
       	jti := uuid.New().String()

     

       598
       598
       +
       

     

       599
       599
       +
       	claims := &DPoPClaims{

     

       600
       600
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       601
       601
       +
       			ID:       jti,

     

       602
       602
       +
       			IssuedAt: jwt.NewNumericDate(iat),

     

       603
       603
       +
       		},

     

       604
       604
       +
       		HTTPMethod: method,

     

       605
       605
       +
       		HTTPURI:    uri,

     

       606
       606
       +
       	}

     

       607
       607
       +
       

     

       608
       608
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       609
       609
       +
       	// Don't set typ header

     

       610
       610
       +
       	token.Header["jwk"] = key.jwk

     

       611
       611
       +
       

     

       612
       612
       +
       	proof, err := token.SignedString(key.privateKey)

     

       613
       613
       +
       	if err != nil {

     

       614
       614
       +
       		t.Fatalf("Failed to create test proof: %v", err)

     

       615
       615
       +
       	}

     

       616
       616
       +
       

     

       617
       617
       +
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       618
       618
       +
       	if err == nil {

     

       619
       619
       +
       		t.Error("Expected error for missing typ header, got nil")

     

       620
       620
       +
       	}

     

       621
       621
       +
       	if err != nil && !contains(err.Error(), "typ must be 'dpop+jwt'") {

     

       622
       622
       +
       		t.Errorf("Expected typ header error, got: %v", err)

     

       623
       623
       +
       	}

     

       624
       624
       +
       }

     

       625
       625
       +
       

     

       626
       626
       +
       func TestVerifyDPoPProof_WrongTypHeader(t *testing.T) {

     

       627
       627
       +
       	verifier := NewDPoPVerifier()

     

       628
       628
       +
       	key := generateTestES256Key(t)

     

       629
       629
       +
       

     

       630
       630
       +
       	method := "POST"

     

       631
       631
       +
       	uri := "https://api.example.com/resource"

     

       632
       632
       +
       	iat := time.Now()

     

       633
       633
       +
       	jti := uuid.New().String()

     

       634
       634
       +
       

     

       635
       635
       +
       	claims := &DPoPClaims{

     

       636
       636
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       637
       637
       +
       			ID:       jti,

     

       638
       638
       +
       			IssuedAt: jwt.NewNumericDate(iat),

     

       639
       639
       +
       		},

     

       640
       640
       +
       		HTTPMethod: method,

     

       641
       641
       +
       		HTTPURI:    uri,

     

       642
       642
       +
       	}

     

       643
       643
       +
       

     

       644
       644
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       645
       645
       +
       	token.Header["typ"] = "JWT" // Wrong typ

     

       646
       646
       +
       	token.Header["jwk"] = key.jwk

     

       647
       647
       +
       

     

       648
       648
       +
       	proof, err := token.SignedString(key.privateKey)

     

       649
       649
       +
       	if err != nil {

     

       650
       650
       +
       		t.Fatalf("Failed to create test proof: %v", err)

     

       651
       651
       +
       	}

     

       652
       652
       +
       

     

       653
       653
       +
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       654
       654
       +
       	if err == nil {

     

       655
       655
       +
       		t.Error("Expected error for wrong typ header, got nil")

     

       656
       656
       +
       	}

     

       657
       657
       +
       	if err != nil && !contains(err.Error(), "typ must be 'dpop+jwt'") {

     

       658
       658
       +
       		t.Errorf("Expected typ header error, got: %v", err)

     

       659
       659
       +
       	}

     

       660
       660
       +
       }

     

       661
       661
       +
       

     

       662
       662
       +
       func TestVerifyDPoPProof_MissingJWK(t *testing.T) {

     

       663
       663
       +
       	verifier := NewDPoPVerifier()

     

       664
       664
       +
       	key := generateTestES256Key(t)

     

       665
       665
       +
       

     

       666
       666
       +
       	method := "POST"

     

       667
       667
       +
       	uri := "https://api.example.com/resource"

     

       668
       668
       +
       	iat := time.Now()

     

       669
       669
       +
       	jti := uuid.New().String()

     

       670
       670
       +
       

     

       671
       671
       +
       	claims := &DPoPClaims{

     

       672
       672
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       673
       673
       +
       			ID:       jti,

     

       674
       674
       +
       			IssuedAt: jwt.NewNumericDate(iat),

     

       675
       675
       +
       		},

     

       676
       676
       +
       		HTTPMethod: method,

     

       677
       677
       +
       		HTTPURI:    uri,

     

       678
       678
       +
       	}

     

       679
       679
       +
       

     

       680
       680
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       681
       681
       +
       	token.Header["typ"] = "dpop+jwt"

     

       682
       682
       +
       	// Don't include JWK

     

       683
       683
       +
       

     

       684
       684
       +
       	proof, err := token.SignedString(key.privateKey)

     

       685
       685
       +
       	if err != nil {

     

       686
       686
       +
       		t.Fatalf("Failed to create test proof: %v", err)

     

       687
       687
       +
       	}

     

       688
       688
       +
       

     

       689
       689
       +
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       690
       690
       +
       	if err == nil {

     

       691
       691
       +
       		t.Error("Expected error for missing jwk header, got nil")

     

       692
       692
       +
       	}

     

       693
       693
       +
       	if err != nil && !contains(err.Error(), "missing jwk") {

     

       694
       694
       +
       		t.Errorf("Expected missing jwk error, got: %v", err)

     

       695
       695
       +
       	}

     

       696
       696
       +
       }

     

       697
       697
       +
       

     

       698
       698
       +
       func TestVerifyDPoPProof_CustomTimeSettings(t *testing.T) {

     

       699
       699
       +
       	verifier := &DPoPVerifier{

     

       700
       700
       +
       		MaxClockSkew: 1 * time.Minute,

     

       701
       701
       +
       		MaxProofAge:  10 * time.Minute,

     

       702
       702
       +
       	}

     

       703
       703
       +
       	key := generateTestES256Key(t)

     

       704
       704
       +
       

     

       705
       705
       +
       	method := "POST"

     

       706
       706
       +
       	uri := "https://api.example.com/resource"

     

       707
       707
       +
       	// Proof issued 50 seconds in the future (within custom MaxClockSkew)

     

       708
       708
       +
       	iat := time.Now().Add(50 * time.Second)

     

       709
       709
       +
       	jti := uuid.New().String()

     

       710
       710
       +
       

     

       711
       711
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       712
       712
       +
       

     

       713
       713
       +
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       714
       714
       +
       	if err != nil {

     

       715
       715
       +
       		t.Fatalf("VerifyDPoPProof failed with custom time settings: %v", err)

     

       716
       716
       +
       	}

     

       717
       717
       +
       }

     

       718
       718
       +
       

     

       719
       719
       +
       func TestVerifyDPoPProof_HTTPMethodCaseInsensitive(t *testing.T) {

     

       720
       720
       +
       	// HTTP method comparison should be case-insensitive per spec

     

       721
       721
       +
       	verifier := NewDPoPVerifier()

     

       722
       722
       +
       	key := generateTestES256Key(t)

     

       723
       723
       +
       

     

       724
       724
       +
       	method := "post"

     

       725
       725
       +
       	uri := "https://api.example.com/resource"

     

       726
       726
       +
       	iat := time.Now()

     

       727
       727
       +
       	jti := uuid.New().String()

     

       728
       728
       +
       

     

       729
       729
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       730
       730
       +
       

     

       731
       731
       +
       	// Verify with uppercase method

     

       732
       732
       +
       	_, err := verifier.VerifyDPoPProof(proof, "POST", uri)

     

       733
       733
       +
       	if err != nil {

     

       734
       734
       +
       		t.Fatalf("VerifyDPoPProof failed for case-insensitive method: %v", err)

     

       735
       735
       +
       	}

     

       736
       736
       +
       }

     

       737
       737
       +
       

     

       738
       738
       +
       // === Token Binding Verification Tests ===

     

       739
       739
       +
       

     

       740
       740
       +
       func TestVerifyTokenBinding_Matching(t *testing.T) {

     

       741
       741
       +
       	verifier := NewDPoPVerifier()

     

       742
       742
       +
       	key := generateTestES256Key(t)

     

       743
       743
       +
       

     

       744
       744
       +
       	method := "POST"

     

       745
       745
       +
       	uri := "https://api.example.com/resource"

     

       746
       746
       +
       	iat := time.Now()

     

       747
       747
       +
       	jti := uuid.New().String()

     

       748
       748
       +
       

     

       749
       749
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       750
       750
       +
       

     

       751
       751
       +
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       752
       752
       +
       	if err != nil {

     

       753
       753
       +
       		t.Fatalf("VerifyDPoPProof failed: %v", err)

     

       754
       754
       +
       	}

     

       755
       755
       +
       

     

       756
       756
       +
       	// Verify token binding with matching thumbprint

     

       757
       757
       +
       	err = verifier.VerifyTokenBinding(result, key.thumbprint)

     

       758
       758
       +
       	if err != nil {

     

       759
       759
       +
       		t.Fatalf("VerifyTokenBinding failed for matching thumbprint: %v", err)

     

       760
       760
       +
       	}

     

       761
       761
       +
       }

     

       762
       762
       +
       

     

       763
       763
       +
       func TestVerifyTokenBinding_Mismatch(t *testing.T) {

     

       764
       764
       +
       	verifier := NewDPoPVerifier()

     

       765
       765
       +
       	key := generateTestES256Key(t)

     

       766
       766
       +
       	wrongKey := generateTestES256Key(t)

     

       767
       767
       +
       

     

       768
       768
       +
       	method := "POST"

     

       769
       769
       +
       	uri := "https://api.example.com/resource"

     

       770
       770
       +
       	iat := time.Now()

     

       771
       771
       +
       	jti := uuid.New().String()

     

       772
       772
       +
       

     

       773
       773
       +
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       774
       774
       +
       

     

       775
       775
       +
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       776
       776
       +
       	if err != nil {

     

       777
       777
       +
       		t.Fatalf("VerifyDPoPProof failed: %v", err)

     

       778
       778
       +
       	}

     

       779
       779
       +
       

     

       780
       780
       +
       	// Verify token binding with wrong thumbprint

     

       781
       781
       +
       	err = verifier.VerifyTokenBinding(result, wrongKey.thumbprint)

     

       782
       782
       +
       	if err == nil {

     

       783
       783
       +
       		t.Error("Expected error for thumbprint mismatch, got nil")

     

       784
       784
       +
       	}

     

       785
       785
       +
       	if err != nil && !contains(err.Error(), "thumbprint mismatch") {

     

       786
       786
       +
       		t.Errorf("Expected thumbprint mismatch error, got: %v", err)

     

       787
       787
       +
       	}

     

       788
       788
       +
       }

     

       789
       789
       +
       

     

       790
       790
       +
       // === ExtractCnfJkt Tests ===

     

       791
       791
       +
       

     

       792
       792
       +
       func TestExtractCnfJkt_Valid(t *testing.T) {

     

       793
       793
       +
       	expectedJkt := "test-thumbprint-123"

     

       794
       794
       +
       	claims := &Claims{

     

       795
       795
       +
       		Confirmation: map[string]interface{}{

     

       796
       796
       +
       			"jkt": expectedJkt,

     

       797
       797
       +
       		},

     

       798
       798
       +
       	}

     

       799
       799
       +
       

     

       800
       800
       +
       	jkt, err := ExtractCnfJkt(claims)

     

       801
       801
       +
       	if err != nil {

     

       802
       802
       +
       		t.Fatalf("ExtractCnfJkt failed for valid claims: %v", err)

     

       803
       803
       +
       	}

     

       804
       804
       +
       

     

       805
       805
       +
       	if jkt != expectedJkt {

     

       806
       806
       +
       		t.Errorf("Expected jkt %s, got %s", expectedJkt, jkt)

     

       807
       807
       +
       	}

     

       808
       808
       +
       }

     

       809
       809
       +
       

     

       810
       810
       +
       func TestExtractCnfJkt_MissingCnf(t *testing.T) {

     

       811
       811
       +
       	claims := &Claims{

     

       812
       812
       +
       		// No Confirmation

     

       813
       813
       +
       	}

     

       814
       814
       +
       

     

       815
       815
       +
       	_, err := ExtractCnfJkt(claims)

     

       816
       816
       +
       	if err == nil {

     

       817
       817
       +
       		t.Error("Expected error for missing cnf, got nil")

     

       818
       818
       +
       	}

     

       819
       819
       +
       	if err != nil && !contains(err.Error(), "missing cnf claim") {

     

       820
       820
       +
       		t.Errorf("Expected missing cnf error, got: %v", err)

     

       821
       821
       +
       	}

     

       822
       822
       +
       }

     

       823
       823
       +
       

     

       824
       824
       +
       func TestExtractCnfJkt_NilCnf(t *testing.T) {

     

       825
       825
       +
       	claims := &Claims{

     

       826
       826
       +
       		Confirmation: nil,

     

       827
       827
       +
       	}

     

       828
       828
       +
       

     

       829
       829
       +
       	_, err := ExtractCnfJkt(claims)

     

       830
       830
       +
       	if err == nil {

     

       831
       831
       +
       		t.Error("Expected error for nil cnf, got nil")

     

       832
       832
       +
       	}

     

       833
       833
       +
       	if err != nil && !contains(err.Error(), "missing cnf claim") {

     

       834
       834
       +
       		t.Errorf("Expected missing cnf error, got: %v", err)

     

       835
       835
       +
       	}

     

       836
       836
       +
       }

     

       837
       837
       +
       

     

       838
       838
       +
       func TestExtractCnfJkt_MissingJkt(t *testing.T) {

     

       839
       839
       +
       	claims := &Claims{

     

       840
       840
       +
       		Confirmation: map[string]interface{}{

     

       841
       841
       +
       			"other": "value",

     

       842
       842
       +
       		},

     

       843
       843
       +
       	}

     

       844
       844
       +
       

     

       845
       845
       +
       	_, err := ExtractCnfJkt(claims)

     

       846
       846
       +
       	if err == nil {

     

       847
       847
       +
       		t.Error("Expected error for missing jkt, got nil")

     

       848
       848
       +
       	}

     

       849
       849
       +
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       850
       850
       +
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       851
       851
       +
       	}

     

       852
       852
       +
       }

     

       853
       853
       +
       

     

       854
       854
       +
       func TestExtractCnfJkt_EmptyJkt(t *testing.T) {

     

       855
       855
       +
       	claims := &Claims{

     

       856
       856
       +
       		Confirmation: map[string]interface{}{

     

       857
       857
       +
       			"jkt": "",

     

       858
       858
       +
       		},

     

       859
       859
       +
       	}

     

       860
       860
       +
       

     

       861
       861
       +
       	_, err := ExtractCnfJkt(claims)

     

       862
       862
       +
       	if err == nil {

     

       863
       863
       +
       		t.Error("Expected error for empty jkt, got nil")

     

       864
       864
       +
       	}

     

       865
       865
       +
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       866
       866
       +
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       867
       867
       +
       	}

     

       868
       868
       +
       }

     

       869
       869
       +
       

     

       870
       870
       +
       func TestExtractCnfJkt_WrongType(t *testing.T) {

     

       871
       871
       +
       	claims := &Claims{

     

       872
       872
       +
       		Confirmation: map[string]interface{}{

     

       873
       873
       +
       			"jkt": 123, // Not a string

     

       874
       874
       +
       		},

     

       875
       875
       +
       	}

     

       876
       876
       +
       

     

       877
       877
       +
       	_, err := ExtractCnfJkt(claims)

     

       878
       878
       +
       	if err == nil {

     

       879
       879
       +
       		t.Error("Expected error for wrong type jkt, got nil")

     

       880
       880
       +
       	}

     

       881
       881
       +
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       882
       882
       +
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       883
       883
       +
       	}

     

       884
       884
       +
       }

     

       885
       885
       +
       

     

       886
       886
       +
       // === Helper Functions for Tests ===

     

       887
       887
       +
       

     

       888
       888
       +
       // splitJWT splits a JWT into its three parts

     

       889
       889
       +
       func splitJWT(token string) []string {

     

       890
       890
       +
       	return []string{

     

       891
       891
       +
       		token[:strings.IndexByte(token, '.')],

     

       892
       892
       +
       		token[strings.IndexByte(token, '.')+1 : strings.LastIndexByte(token, '.')],

     

       893
       893
       +
       		token[strings.LastIndexByte(token, '.')+1:],

     

       894
       894
       +
       	}

     

       895
       895
       +
       }

     

       896
       896
       +
       

     

       897
       897
       +
       // parseJWTHeader parses a base64url-encoded JWT header

     

       898
       898
       +
       func parseJWTHeader(t *testing.T, encoded string) map[string]interface{} {

     

       899
       899
       +
       	t.Helper()

     

       900
       900
       +
       	decoded, err := base64.RawURLEncoding.DecodeString(encoded)

     

       901
       901
       +
       	if err != nil {

     

       902
       902
       +
       		t.Fatalf("Failed to decode header: %v", err)

     

       903
       903
       +
       	}

     

       904
       904
       +
       

     

       905
       905
       +
       	var header map[string]interface{}

     

       906
       906
       +
       	if err := json.Unmarshal(decoded, &header); err != nil {

     

       907
       907
       +
       		t.Fatalf("Failed to unmarshal header: %v", err)

     

       908
       908
       +
       	}

     

       909
       909
       +
       

     

       910
       910
       +
       	return header

     

       911
       911
       +
       }

     

       912
       912
       +
       

     

       913
       913
       +
       // encodeJSON encodes a value to base64url-encoded JSON

     

       914
       914
       +
       func encodeJSON(t *testing.T, v interface{}) string {

     

       915
       915
       +
       	t.Helper()

     

       916
       916
       +
       	data, err := json.Marshal(v)

     

       917
       917
       +
       	if err != nil {

     

       918
       918
       +
       		t.Fatalf("Failed to marshal JSON: %v", err)

     

       919
       919
       +
       	}

     

       920
       920
       +
       	return base64.RawURLEncoding.EncodeToString(data)

     

       921
       921
       +
       }

+148 -6

internal/api/middleware/auth.go

···

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/atproto/auth"

     

       5
       5
        
       	"context"

     

       6
       6
       +
       	"fmt"

     

       6
       7
        
       	"log"

     

       7
       8
        
       	"net/http"

     

       8
       9
        
       	"strings"

     
···

       15
       16
        
       	UserDIDKey      contextKey = "user_did"

     

       16
       17
        
       	JWTClaimsKey    contextKey = "jwt_claims"

     

       17
       18
        
       	UserAccessToken contextKey = "user_access_token"

     

       19
       19
       +
       	DPoPProofKey    contextKey = "dpop_proof"

     

       18
       20
        
       )

     

       19
       21
        
       

     

       20
       22
        
       // AtProtoAuthMiddleware enforces atProto OAuth authentication for protected routes

     

       21
       23
        
       // Validates JWT Bearer tokens from the Authorization header

     

       24
       24
       +
       // Supports DPoP (RFC 9449) for token binding verification

     

       22
       25
        
       type AtProtoAuthMiddleware struct {

     

       23
       23
       -
       	jwksFetcher auth.JWKSFetcher

     

       24
       24
       -
       	skipVerify  bool // For Phase 1 testing only

     

       26
       26
       +
       	jwksFetcher  auth.JWKSFetcher

     

       27
       27
       +
       	dpopVerifier *auth.DPoPVerifier

     

       28
       28
       +
       	skipVerify   bool // For Phase 1 testing only

     

       25
       29
        
       }

     

       26
       30
        
       

     

       27
       31
        
       // NewAtProtoAuthMiddleware creates a new atProto auth middleware

     

       28
       32
        
       // skipVerify: if true, only parses JWT without signature verification (Phase 1)

     

       29
       33
        
       //

     

       30
       34
        
       //	if false, performs full signature verification (Phase 2)

     

       35
       35
       +
       //

     

       36
       36
       +
       // IMPORTANT: Call Stop() when shutting down to clean up background goroutines.

     

       31
       37
        
       func NewAtProtoAuthMiddleware(jwksFetcher auth.JWKSFetcher, skipVerify bool) *AtProtoAuthMiddleware {

     

       32
       38
        
       	return &AtProtoAuthMiddleware{

     

       33
       33
       -
       		jwksFetcher: jwksFetcher,

     

       34
       34
       -
       		skipVerify:  skipVerify,

     

       39
       39
       +
       		jwksFetcher:  jwksFetcher,

     

       40
       40
       +
       		dpopVerifier: auth.NewDPoPVerifier(),

     

       41
       41
       +
       		skipVerify:   skipVerify,

     

       42
       42
       +
       	}

     

       43
       43
       +
       }

     

       44
       44
       +
       

     

       45
       45
       +
       // Stop stops background goroutines. Call this when shutting down the server.

     

       46
       46
       +
       // This prevents goroutine leaks from the DPoP verifier's replay protection cache.

     

       47
       47
       +
       func (m *AtProtoAuthMiddleware) Stop() {

     

       48
       48
       +
       	if m.dpopVerifier != nil {

     

       49
       49
       +
       		m.dpopVerifier.Stop()

     

       35
       50
        
       	}

     

       36
       51
        
       }

     

       37
       52
        
       

     
···

       70
       85
        
       			}

     

       71
       86
        
       		} else {

     

       72
       87
        
       			// Phase 2: Full verification with signature check

     

       88
       88
       +
       			//

     

       89
       89
       +
       			// SECURITY: The access token MUST be verified before trusting any claims.

     

       90
       90
       +
       			// DPoP is an ADDITIONAL security layer, not a replacement for signature verification.

     

       73
       91
        
       			claims, err = auth.VerifyJWT(r.Context(), token, m.jwksFetcher)

     

       74
       92
        
       			if err != nil {

     

       75
       75
       -
       				// Try to extract issuer for better logging

     

       93
       93
       +
       				// Token verification failed - REJECT

     

       94
       94
       +
       				// DO NOT fall back to DPoP-only verification, as that would trust unverified claims

     

       76
       95
        
       				issuer := "unknown"

     

       77
       96
        
       				if parsedClaims, parseErr := auth.ParseJWT(token); parseErr == nil {

     

       78
       97
        
       					issuer = parsedClaims.Issuer

     
···

       82
       101
        
       				writeAuthError(w, "Invalid or expired token")

     

       83
       102
        
       				return

     

       84
       103
        
       			}

     

       104
       104
       +
       

     

       105
       105
       +
       			// Token signature verified - now check if DPoP binding is required

     

       106
       106
       +
       			// If the token has a cnf.jkt claim, DPoP proof is REQUIRED

     

       107
       107
       +
       			dpopHeader := r.Header.Get("DPoP")

     

       108
       108
       +
       			hasCnfJkt := claims.Confirmation != nil && claims.Confirmation["jkt"] != nil

     

       109
       109
       +
       

     

       110
       110
       +
       			if hasCnfJkt {

     

       111
       111
       +
       				// Token has DPoP binding - REQUIRE valid DPoP proof

     

       112
       112
       +
       				if dpopHeader == "" {

     

       113
       113
       +
       					log.Printf("[AUTH_FAILURE] type=missing_dpop ip=%s method=%s path=%s error=token has cnf.jkt but no DPoP header",

     

       114
       114
       +
       						r.RemoteAddr, r.Method, r.URL.Path)

     

       115
       115
       +
       					writeAuthError(w, "DPoP proof required")

     

       116
       116
       +
       					return

     

       117
       117
       +
       				}

     

       118
       118
       +
       

     

       119
       119
       +
       				proof, err := m.verifyDPoPBinding(r, claims, dpopHeader)

     

       120
       120
       +
       				if err != nil {

     

       121
       121
       +
       					log.Printf("[AUTH_FAILURE] type=dpop_verification_failed ip=%s method=%s path=%s error=%v",

     

       122
       122
       +
       						r.RemoteAddr, r.Method, r.URL.Path, err)

     

       123
       123
       +
       					writeAuthError(w, "Invalid DPoP proof")

     

       124
       124
       +
       					return

     

       125
       125
       +
       				}

     

       126
       126
       +
       

     

       127
       127
       +
       				// Store verified DPoP proof in context

     

       128
       128
       +
       				ctx := context.WithValue(r.Context(), DPoPProofKey, proof)

     

       129
       129
       +
       				r = r.WithContext(ctx)

     

       130
       130
       +
       			} else if dpopHeader != "" {

     

       131
       131
       +
       				// DPoP header present but token doesn't have cnf.jkt - this is suspicious

     

       132
       132
       +
       				// Log warning but don't reject (could be a misconfigured client)

     

       133
       133
       +
       				log.Printf("[AUTH_WARNING] type=unexpected_dpop ip=%s method=%s path=%s warning=DPoP header present but token has no cnf.jkt",

     

       134
       134
       +
       					r.RemoteAddr, r.Method, r.URL.Path)

     

       135
       135
       +
       			}

     

       85
       136
        
       		}

     

       86
       137
        
       

     

       87
       138
        
       		// Extract user DID from 'sub' claim

     
···

       124
       175
        
       			claims, err = auth.ParseJWT(token)

     

       125
       176
        
       		} else {

     

       126
       177
        
       			// Phase 2: Full verification

     

       178
       178
       +
       			// SECURITY: Token MUST be verified before trusting claims

     

       127
       179
        
       			claims, err = auth.VerifyJWT(r.Context(), token, m.jwksFetcher)

     

       128
       180
        
       		}

     

       129
       181
        
       

     
···

       134
       186
        
       			return

     

       135
       187
        
       		}

     

       136
       188
        
       

     

       137
       137
       -
       		// Inject user info and access token into context

     

       189
       189
       +
       		// Check DPoP binding if token has cnf.jkt (after successful verification)

     

       190
       190
       +
       		// SECURITY: If token has cnf.jkt but no DPoP header, we cannot trust it

     

       191
       191
       +
       		// (could be a stolen token). Continue as unauthenticated.

     

       192
       192
       +
       		if !m.skipVerify {

     

       193
       193
       +
       			dpopHeader := r.Header.Get("DPoP")

     

       194
       194
       +
       			hasCnfJkt := claims.Confirmation != nil && claims.Confirmation["jkt"] != nil

     

       195
       195
       +
       

     

       196
       196
       +
       			if hasCnfJkt {

     

       197
       197
       +
       				if dpopHeader == "" {

     

       198
       198
       +
       					// Token requires DPoP binding but no proof provided

     

       199
       199
       +
       					// Cannot trust this token - continue without auth

     

       200
       200
       +
       					log.Printf("[AUTH_WARNING] Optional auth: token has cnf.jkt but no DPoP header - treating as unauthenticated (potential token theft)")

     

       201
       201
       +
       					next.ServeHTTP(w, r)

     

       202
       202
       +
       					return

     

       203
       203
       +
       				}

     

       204
       204
       +
       

     

       205
       205
       +
       				proof, err := m.verifyDPoPBinding(r, claims, dpopHeader)

     

       206
       206
       +
       				if err != nil {

     

       207
       207
       +
       					// DPoP verification failed - cannot trust this token

     

       208
       208
       +
       					log.Printf("[AUTH_WARNING] Optional auth: DPoP verification failed - treating as unauthenticated: %v", err)

     

       209
       209
       +
       					next.ServeHTTP(w, r)

     

       210
       210
       +
       					return

     

       211
       211
       +
       				}

     

       212
       212
       +
       

     

       213
       213
       +
       				// DPoP verified - inject proof into context

     

       214
       214
       +
       				ctx := context.WithValue(r.Context(), UserDIDKey, claims.Subject)

     

       215
       215
       +
       				ctx = context.WithValue(ctx, JWTClaimsKey, claims)

     

       216
       216
       +
       				ctx = context.WithValue(ctx, UserAccessToken, token)

     

       217
       217
       +
       				ctx = context.WithValue(ctx, DPoPProofKey, proof)

     

       218
       218
       +
       				next.ServeHTTP(w, r.WithContext(ctx))

     

       219
       219
       +
       				return

     

       220
       220
       +
       			}

     

       221
       221
       +
       		}

     

       222
       222
       +
       

     

       223
       223
       +
       		// No DPoP binding required - inject user info and access token into context

     

       138
       224
        
       		ctx := context.WithValue(r.Context(), UserDIDKey, claims.Subject)

     

       139
       225
        
       		ctx = context.WithValue(ctx, JWTClaimsKey, claims)

     

       140
       226
        
       		ctx = context.WithValue(ctx, UserAccessToken, token)

     
···

       179
       265
        
       	return token

     

       180
       266
        
       }

     

       181
       267
        
       

     

       268
       268
       +
       // GetDPoPProof extracts the DPoP proof from the request context

     

       269
       269
       +
       // Returns nil if no DPoP proof was verified

     

       270
       270
       +
       func GetDPoPProof(r *http.Request) *auth.DPoPProof {

     

       271
       271
       +
       	proof, _ := r.Context().Value(DPoPProofKey).(*auth.DPoPProof)

     

       272
       272
       +
       	return proof

     

       273
       273
       +
       }

     

       274
       274
       +
       

     

       275
       275
       +
       // verifyDPoPBinding verifies DPoP proof binding for an ALREADY VERIFIED token.

     

       276
       276
       +
       //

     

       277
       277
       +
       // SECURITY: This function ONLY verifies the DPoP proof and its binding to the token.

     

       278
       278
       +
       // The access token MUST be signature-verified BEFORE calling this function.

     

       279
       279
       +
       // DPoP is an ADDITIONAL security layer, not a replacement for signature verification.

     

       280
       280
       +
       //

     

       281
       281
       +
       // This prevents token theft attacks by proving the client possesses the private key

     

       282
       282
       +
       // corresponding to the public key thumbprint in the token's cnf.jkt claim.

     

       283
       283
       +
       func (m *AtProtoAuthMiddleware) verifyDPoPBinding(r *http.Request, claims *auth.Claims, dpopProofHeader string) (*auth.DPoPProof, error) {

     

       284
       284
       +
       	// Extract the cnf.jkt claim from the already-verified token

     

       285
       285
       +
       	jkt, err := auth.ExtractCnfJkt(claims)

     

       286
       286
       +
       	if err != nil {

     

       287
       287
       +
       		return nil, fmt.Errorf("token requires DPoP but missing cnf.jkt: %w", err)

     

       288
       288
       +
       	}

     

       289
       289
       +
       

     

       290
       290
       +
       	// Build the HTTP URI for DPoP verification

     

       291
       291
       +
       	// Use the full URL including scheme and host

     

       292
       292
       +
       	scheme := strings.TrimSpace(r.URL.Scheme)

     

       293
       293
       +
       	if forwardedProto := r.Header.Get("X-Forwarded-Proto"); forwardedProto != "" {

     

       294
       294
       +
       		// Forwarded proto may contain a comma-separated list; use the first entry

     

       295
       295
       +
       		parts := strings.Split(forwardedProto, ",")

     

       296
       296
       +
       		if len(parts) > 0 && strings.TrimSpace(parts[0]) != "" {

     

       297
       297
       +
       			scheme = strings.ToLower(strings.TrimSpace(parts[0]))

     

       298
       298
       +
       		}

     

       299
       299
       +
       	}

     

       300
       300
       +
       	if scheme == "" {

     

       301
       301
       +
       		if r.TLS != nil {

     

       302
       302
       +
       			scheme = "https"

     

       303
       303
       +
       		} else {

     

       304
       304
       +
       			scheme = "http"

     

       305
       305
       +
       		}

     

       306
       306
       +
       	}

     

       307
       307
       +
       	scheme = strings.ToLower(scheme)

     

       308
       308
       +
       	httpURI := scheme + "://" + r.Host + r.URL.Path

     

       309
       309
       +
       

     

       310
       310
       +
       	// Verify the DPoP proof

     

       311
       311
       +
       	proof, err := m.dpopVerifier.VerifyDPoPProof(dpopProofHeader, r.Method, httpURI)

     

       312
       312
       +
       	if err != nil {

     

       313
       313
       +
       		return nil, fmt.Errorf("DPoP proof verification failed: %w", err)

     

       314
       314
       +
       	}

     

       315
       315
       +
       

     

       316
       316
       +
       	// Verify the binding between the proof and the token

     

       317
       317
       +
       	if err := m.dpopVerifier.VerifyTokenBinding(proof, jkt); err != nil {

     

       318
       318
       +
       		return nil, fmt.Errorf("DPoP binding verification failed: %w", err)

     

       319
       319
       +
       	}

     

       320
       320
       +
       

     

       321
       321
       +
       	return proof, nil

     

       322
       322
       +
       }

     

       323
       323
       +
       

     

       182
       324
        
       // writeAuthError writes a JSON error response for authentication failures

     

       183
       325
        
       func writeAuthError(w http.ResponseWriter, message string) {

     

       184
       326
        
       	w.Header().Set("Content-Type", "application/json")

+416

internal/api/middleware/auth_test.go

···

       1
       1
        
       package middleware

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/auth"

     

       4
       5
        
       	"context"

     

       6
       6
       +
       	"crypto/ecdsa"

     

       7
       7
       +
       	"crypto/elliptic"

     

       8
       8
       +
       	"crypto/rand"

     

       9
       9
       +
       	"encoding/base64"

     

       5
       10
        
       	"fmt"

     

       6
       11
        
       	"net/http"

     

       7
       12
        
       	"net/http/httptest"

     
···

       9
       14
        
       	"time"

     

       10
       15
        
       

     

       11
       16
        
       	"github.com/golang-jwt/jwt/v5"

     

       17
       17
       +
       	"github.com/google/uuid"

     

       12
       18
        
       )

     

       13
       19
        
       

     

       14
       20
        
       // mockJWKSFetcher is a test double for JWKSFetcher

     
···

       326
       332
        
       		t.Errorf("expected nil claims, got %+v", claims)

     

       327
       333
        
       	}

     

       328
       334
        
       }

     

       335
       335
       +
       

     

       336
       336
       +
       // TestGetDPoPProof_NotAuthenticated tests that GetDPoPProof returns nil when no DPoP was verified

     

       337
       337
       +
       func TestGetDPoPProof_NotAuthenticated(t *testing.T) {

     

       338
       338
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       339
       339
       +
       	proof := GetDPoPProof(req)

     

       340
       340
       +
       

     

       341
       341
       +
       	if proof != nil {

     

       342
       342
       +
       		t.Errorf("expected nil proof, got %+v", proof)

     

       343
       343
       +
       	}

     

       344
       344
       +
       }

     

       345
       345
       +
       

     

       346
       346
       +
       // TestRequireAuth_WithDPoP_SecurityModel tests the correct DPoP security model:

     

       347
       347
       +
       // Token MUST be verified first, then DPoP is checked as an additional layer.

     

       348
       348
       +
       // DPoP is NOT a fallback for failed token verification.

     

       349
       349
       +
       func TestRequireAuth_WithDPoP_SecurityModel(t *testing.T) {

     

       350
       350
       +
       	// Generate an ECDSA key pair for DPoP

     

       351
       351
       +
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       352
       352
       +
       	if err != nil {

     

       353
       353
       +
       		t.Fatalf("failed to generate key: %v", err)

     

       354
       354
       +
       	}

     

       355
       355
       +
       

     

       356
       356
       +
       	// Calculate JWK thumbprint for cnf.jkt

     

       357
       357
       +
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       358
       358
       +
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       359
       359
       +
       	if err != nil {

     

       360
       360
       +
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       361
       361
       +
       	}

     

       362
       362
       +
       

     

       363
       363
       +
       	t.Run("DPoP_is_NOT_fallback_for_failed_verification", func(t *testing.T) {

     

       364
       364
       +
       		// SECURITY TEST: When token verification fails, DPoP should NOT be used as fallback

     

       365
       365
       +
       		// This prevents an attacker from forging a token with their own cnf.jkt

     

       366
       366
       +
       

     

       367
       367
       +
       		// Create a DPoP-bound access token (unsigned - will fail verification)

     

       368
       368
       +
       		claims := auth.Claims{

     

       369
       369
       +
       			RegisteredClaims: jwt.RegisteredClaims{

     

       370
       370
       +
       				Subject:   "did:plc:attacker",

     

       371
       371
       +
       				Issuer:    "https://external.pds.local",

     

       372
       372
       +
       				ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       373
       373
       +
       				IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       374
       374
       +
       			},

     

       375
       375
       +
       			Scope: "atproto",

     

       376
       376
       +
       			Confirmation: map[string]interface{}{

     

       377
       377
       +
       				"jkt": thumbprint,

     

       378
       378
       +
       			},

     

       379
       379
       +
       		}

     

       380
       380
       +
       

     

       381
       381
       +
       		token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       382
       382
       +
       		tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       383
       383
       +
       

     

       384
       384
       +
       		// Create valid DPoP proof (attacker has the private key)

     

       385
       385
       +
       		dpopProof := createDPoPProof(t, privateKey, "GET", "https://test.local/api/endpoint")

     

       386
       386
       +
       

     

       387
       387
       +
       		// Mock fetcher that fails (simulating external PDS without JWKS)

     

       388
       388
       +
       		fetcher := &mockJWKSFetcher{shouldFail: true}

     

       389
       389
       +
       		middleware := NewAtProtoAuthMiddleware(fetcher, false) // skipVerify=false

     

       390
       390
       +
       

     

       391
       391
       +
       		handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       392
       392
       +
       			t.Error("SECURITY VULNERABILITY: handler was called despite token verification failure")

     

       393
       393
       +
       		}))

     

       394
       394
       +
       

     

       395
       395
       +
       		req := httptest.NewRequest("GET", "https://test.local/api/endpoint", nil)

     

       396
       396
       +
       		req.Header.Set("Authorization", "Bearer "+tokenString)

     

       397
       397
       +
       		req.Header.Set("DPoP", dpopProof)

     

       398
       398
       +
       		w := httptest.NewRecorder()

     

       399
       399
       +
       

     

       400
       400
       +
       		handler.ServeHTTP(w, req)

     

       401
       401
       +
       

     

       402
       402
       +
       		// MUST reject - token verification failed, DPoP cannot substitute for signature verification

     

       403
       403
       +
       		if w.Code != http.StatusUnauthorized {

     

       404
       404
       +
       			t.Errorf("SECURITY: expected 401 for unverified token, got %d", w.Code)

     

       405
       405
       +
       		}

     

       406
       406
       +
       	})

     

       407
       407
       +
       

     

       408
       408
       +
       	t.Run("DPoP_required_when_cnf_jkt_present_in_verified_token", func(t *testing.T) {

     

       409
       409
       +
       		// When token has cnf.jkt, DPoP header MUST be present

     

       410
       410
       +
       		// This test uses skipVerify=true to simulate a verified token

     

       411
       411
       +
       

     

       412
       412
       +
       		claims := auth.Claims{

     

       413
       413
       +
       			RegisteredClaims: jwt.RegisteredClaims{

     

       414
       414
       +
       				Subject:   "did:plc:test123",

     

       415
       415
       +
       				Issuer:    "https://test.pds.local",

     

       416
       416
       +
       				ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       417
       417
       +
       				IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       418
       418
       +
       			},

     

       419
       419
       +
       			Scope: "atproto",

     

       420
       420
       +
       			Confirmation: map[string]interface{}{

     

       421
       421
       +
       				"jkt": thumbprint,

     

       422
       422
       +
       			},

     

       423
       423
       +
       		}

     

       424
       424
       +
       

     

       425
       425
       +
       		token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       426
       426
       +
       		tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       427
       427
       +
       

     

       428
       428
       +
       		// NO DPoP header - should fail when skipVerify is false

     

       429
       429
       +
       		// Note: with skipVerify=true, DPoP is not checked

     

       430
       430
       +
       		fetcher := &mockJWKSFetcher{}

     

       431
       431
       +
       		middleware := NewAtProtoAuthMiddleware(fetcher, true) // skipVerify=true for parsing

     

       432
       432
       +
       

     

       433
       433
       +
       		handlerCalled := false

     

       434
       434
       +
       		handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       435
       435
       +
       			handlerCalled = true

     

       436
       436
       +
       			w.WriteHeader(http.StatusOK)

     

       437
       437
       +
       		}))

     

       438
       438
       +
       

     

       439
       439
       +
       		req := httptest.NewRequest("GET", "https://test.local/api/endpoint", nil)

     

       440
       440
       +
       		req.Header.Set("Authorization", "Bearer "+tokenString)

     

       441
       441
       +
       		// No DPoP header

     

       442
       442
       +
       		w := httptest.NewRecorder()

     

       443
       443
       +
       

     

       444
       444
       +
       		handler.ServeHTTP(w, req)

     

       445
       445
       +
       

     

       446
       446
       +
       		// With skipVerify=true, DPoP is not checked, so this should succeed

     

       447
       447
       +
       		if !handlerCalled {

     

       448
       448
       +
       			t.Error("handler should be called when skipVerify=true")

     

       449
       449
       +
       		}

     

       450
       450
       +
       	})

     

       451
       451
       +
       }

     

       452
       452
       +
       

     

       453
       453
       +
       // TestRequireAuth_TokenVerificationFails_DPoPNotUsedAsFallback is the key security test.

     

       454
       454
       +
       // It ensures that DPoP cannot be used as a fallback when token signature verification fails.

     

       455
       455
       +
       func TestRequireAuth_TokenVerificationFails_DPoPNotUsedAsFallback(t *testing.T) {

     

       456
       456
       +
       	// Generate a key pair (attacker's key)

     

       457
       457
       +
       	attackerKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       458
       458
       +
       	jwk := ecdsaPublicKeyToJWK(&attackerKey.PublicKey)

     

       459
       459
       +
       	thumbprint, _ := auth.CalculateJWKThumbprint(jwk)

     

       460
       460
       +
       

     

       461
       461
       +
       	// Create a FORGED token claiming to be the victim

     

       462
       462
       +
       	claims := auth.Claims{

     

       463
       463
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       464
       464
       +
       			Subject:   "did:plc:victim_user", // Attacker claims to be victim

     

       465
       465
       +
       			Issuer:    "https://untrusted.pds",

     

       466
       466
       +
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       467
       467
       +
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       468
       468
       +
       		},

     

       469
       469
       +
       		Scope: "atproto",

     

       470
       470
       +
       		Confirmation: map[string]interface{}{

     

       471
       471
       +
       			"jkt": thumbprint, // Attacker uses their own key

     

       472
       472
       +
       		},

     

       473
       473
       +
       	}

     

       474
       474
       +
       

     

       475
       475
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       476
       476
       +
       	tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       477
       477
       +
       

     

       478
       478
       +
       	// Attacker creates a valid DPoP proof with their key

     

       479
       479
       +
       	dpopProof := createDPoPProof(t, attackerKey, "POST", "https://api.example.com/protected")

     

       480
       480
       +
       

     

       481
       481
       +
       	// Fetcher fails (external PDS without JWKS)

     

       482
       482
       +
       	fetcher := &mockJWKSFetcher{shouldFail: true}

     

       483
       483
       +
       	middleware := NewAtProtoAuthMiddleware(fetcher, false) // skipVerify=false - REAL verification

     

       484
       484
       +
       

     

       485
       485
       +
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       486
       486
       +
       		t.Fatalf("CRITICAL SECURITY FAILURE: Request authenticated as %s despite forged token!",

     

       487
       487
       +
       			GetUserDID(r))

     

       488
       488
       +
       	}))

     

       489
       489
       +
       

     

       490
       490
       +
       	req := httptest.NewRequest("POST", "https://api.example.com/protected", nil)

     

       491
       491
       +
       	req.Header.Set("Authorization", "Bearer "+tokenString)

     

       492
       492
       +
       	req.Header.Set("DPoP", dpopProof)

     

       493
       493
       +
       	w := httptest.NewRecorder()

     

       494
       494
       +
       

     

       495
       495
       +
       	handler.ServeHTTP(w, req)

     

       496
       496
       +
       

     

       497
       497
       +
       	// MUST reject - the token signature was never verified

     

       498
       498
       +
       	if w.Code != http.StatusUnauthorized {

     

       499
       499
       +
       		t.Errorf("SECURITY VULNERABILITY: Expected 401, got %d. Token was not properly verified!", w.Code)

     

       500
       500
       +
       	}

     

       501
       501
       +
       }

     

       502
       502
       +
       

     

       503
       503
       +
       // TestVerifyDPoPBinding_UsesForwardedProto ensures we honor the external HTTPS

     

       504
       504
       +
       // scheme when TLS is terminated upstream and X-Forwarded-Proto is present.

     

       505
       505
       +
       func TestVerifyDPoPBinding_UsesForwardedProto(t *testing.T) {

     

       506
       506
       +
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       507
       507
       +
       	if err != nil {

     

       508
       508
       +
       		t.Fatalf("failed to generate key: %v", err)

     

       509
       509
       +
       	}

     

       510
       510
       +
       

     

       511
       511
       +
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       512
       512
       +
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       513
       513
       +
       	if err != nil {

     

       514
       514
       +
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       515
       515
       +
       	}

     

       516
       516
       +
       

     

       517
       517
       +
       	claims := &auth.Claims{

     

       518
       518
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       519
       519
       +
       			Subject:   "did:plc:test123",

     

       520
       520
       +
       			Issuer:    "https://test.pds.local",

     

       521
       521
       +
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       522
       522
       +
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       523
       523
       +
       		},

     

       524
       524
       +
       		Scope: "atproto",

     

       525
       525
       +
       		Confirmation: map[string]interface{}{

     

       526
       526
       +
       			"jkt": thumbprint,

     

       527
       527
       +
       		},

     

       528
       528
       +
       	}

     

       529
       529
       +
       

     

       530
       530
       +
       	middleware := NewAtProtoAuthMiddleware(&mockJWKSFetcher{}, false)

     

       531
       531
       +
       	defer middleware.Stop()

     

       532
       532
       +
       

     

       533
       533
       +
       	externalURI := "https://api.example.com/protected/resource"

     

       534
       534
       +
       	dpopProof := createDPoPProof(t, privateKey, "GET", externalURI)

     

       535
       535
       +
       

     

       536
       536
       +
       	req := httptest.NewRequest("GET", "http://internal-service/protected/resource", nil)

     

       537
       537
       +
       	req.Host = "api.example.com"

     

       538
       538
       +
       	req.Header.Set("X-Forwarded-Proto", "https")

     

       539
       539
       +
       

     

       540
       540
       +
       	proof, err := middleware.verifyDPoPBinding(req, claims, dpopProof)

     

       541
       541
       +
       	if err != nil {

     

       542
       542
       +
       		t.Fatalf("expected DPoP verification to succeed with forwarded proto, got %v", err)

     

       543
       543
       +
       	}

     

       544
       544
       +
       

     

       545
       545
       +
       	if proof == nil || proof.Claims == nil {

     

       546
       546
       +
       		t.Fatal("expected DPoP proof to be returned")

     

       547
       547
       +
       	}

     

       548
       548
       +
       }

     

       549
       549
       +
       

     

       550
       550
       +
       // TestMiddlewareStop tests that the middleware can be stopped properly

     

       551
       551
       +
       func TestMiddlewareStop(t *testing.T) {

     

       552
       552
       +
       	fetcher := &mockJWKSFetcher{}

     

       553
       553
       +
       	middleware := NewAtProtoAuthMiddleware(fetcher, false)

     

       554
       554
       +
       

     

       555
       555
       +
       	// Stop should not panic and should clean up resources

     

       556
       556
       +
       	middleware.Stop()

     

       557
       557
       +
       

     

       558
       558
       +
       	// Calling Stop again should also be safe (idempotent-ish)

     

       559
       559
       +
       	// Note: The underlying DPoPVerifier.Stop() closes a channel, so this might panic

     

       560
       560
       +
       	// if not handled properly. We test that at least one Stop works.

     

       561
       561
       +
       }

     

       562
       562
       +
       

     

       563
       563
       +
       // TestOptionalAuth_DPoPBoundToken_NoDPoPHeader tests that OptionalAuth treats

     

       564
       564
       +
       // tokens with cnf.jkt but no DPoP header as unauthenticated (potential token theft)

     

       565
       565
       +
       func TestOptionalAuth_DPoPBoundToken_NoDPoPHeader(t *testing.T) {

     

       566
       566
       +
       	// Generate a key pair for DPoP binding

     

       567
       567
       +
       	privateKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       568
       568
       +
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       569
       569
       +
       	thumbprint, _ := auth.CalculateJWKThumbprint(jwk)

     

       570
       570
       +
       

     

       571
       571
       +
       	// Create a DPoP-bound token (has cnf.jkt)

     

       572
       572
       +
       	claims := auth.Claims{

     

       573
       573
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       574
       574
       +
       			Subject:   "did:plc:user123",

     

       575
       575
       +
       			Issuer:    "https://test.pds.local",

     

       576
       576
       +
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       577
       577
       +
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       578
       578
       +
       		},

     

       579
       579
       +
       		Scope: "atproto",

     

       580
       580
       +
       		Confirmation: map[string]interface{}{

     

       581
       581
       +
       			"jkt": thumbprint,

     

       582
       582
       +
       		},

     

       583
       583
       +
       	}

     

       584
       584
       +
       

     

       585
       585
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       586
       586
       +
       	tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       587
       587
       +
       

     

       588
       588
       +
       	// Use skipVerify=true to simulate a verified token

     

       589
       589
       +
       	// (In production, skipVerify would be false and VerifyJWT would be called)

     

       590
       590
       +
       	// However, for this test we need skipVerify=false to trigger DPoP checking

     

       591
       591
       +
       	// But the fetcher will fail, so let's use skipVerify=true and verify the logic

     

       592
       592
       +
       	// Actually, the DPoP check only happens when skipVerify=false

     

       593
       593
       +
       

     

       594
       594
       +
       	t.Run("with_skipVerify_false", func(t *testing.T) {

     

       595
       595
       +
       		// This will fail at JWT verification level, but that's expected

     

       596
       596
       +
       		// The important thing is the code path for DPoP checking

     

       597
       597
       +
       		fetcher := &mockJWKSFetcher{shouldFail: true}

     

       598
       598
       +
       		middleware := NewAtProtoAuthMiddleware(fetcher, false)

     

       599
       599
       +
       		defer middleware.Stop()

     

       600
       600
       +
       

     

       601
       601
       +
       		handlerCalled := false

     

       602
       602
       +
       		var capturedDID string

     

       603
       603
       +
       		handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       604
       604
       +
       			handlerCalled = true

     

       605
       605
       +
       			capturedDID = GetUserDID(r)

     

       606
       606
       +
       			w.WriteHeader(http.StatusOK)

     

       607
       607
       +
       		}))

     

       608
       608
       +
       

     

       609
       609
       +
       		req := httptest.NewRequest("GET", "/test", nil)

     

       610
       610
       +
       		req.Header.Set("Authorization", "Bearer "+tokenString)

     

       611
       611
       +
       		// Deliberately NOT setting DPoP header

     

       612
       612
       +
       		w := httptest.NewRecorder()

     

       613
       613
       +
       

     

       614
       614
       +
       		handler.ServeHTTP(w, req)

     

       615
       615
       +
       

     

       616
       616
       +
       		// Handler should be called (optional auth doesn't block)

     

       617
       617
       +
       		if !handlerCalled {

     

       618
       618
       +
       			t.Error("handler should be called")

     

       619
       619
       +
       		}

     

       620
       620
       +
       

     

       621
       621
       +
       		// But since JWT verification fails, user should not be authenticated

     

       622
       622
       +
       		if capturedDID != "" {

     

       623
       623
       +
       			t.Errorf("expected empty DID when verification fails, got %s", capturedDID)

     

       624
       624
       +
       		}

     

       625
       625
       +
       	})

     

       626
       626
       +
       

     

       627
       627
       +
       	t.Run("with_skipVerify_true_dpop_not_checked", func(t *testing.T) {

     

       628
       628
       +
       		// When skipVerify=true, DPoP is not checked (Phase 1 mode)

     

       629
       629
       +
       		fetcher := &mockJWKSFetcher{}

     

       630
       630
       +
       		middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       631
       631
       +
       		defer middleware.Stop()

     

       632
       632
       +
       

     

       633
       633
       +
       		handlerCalled := false

     

       634
       634
       +
       		var capturedDID string

     

       635
       635
       +
       		handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       636
       636
       +
       			handlerCalled = true

     

       637
       637
       +
       			capturedDID = GetUserDID(r)

     

       638
       638
       +
       			w.WriteHeader(http.StatusOK)

     

       639
       639
       +
       		}))

     

       640
       640
       +
       

     

       641
       641
       +
       		req := httptest.NewRequest("GET", "/test", nil)

     

       642
       642
       +
       		req.Header.Set("Authorization", "Bearer "+tokenString)

     

       643
       643
       +
       		// No DPoP header

     

       644
       644
       +
       		w := httptest.NewRecorder()

     

       645
       645
       +
       

     

       646
       646
       +
       		handler.ServeHTTP(w, req)

     

       647
       647
       +
       

     

       648
       648
       +
       		if !handlerCalled {

     

       649
       649
       +
       			t.Error("handler should be called")

     

       650
       650
       +
       		}

     

       651
       651
       +
       

     

       652
       652
       +
       		// With skipVerify=true, DPoP check is bypassed - token is trusted

     

       653
       653
       +
       		if capturedDID != "did:plc:user123" {

     

       654
       654
       +
       			t.Errorf("expected DID when skipVerify=true, got %s", capturedDID)

     

       655
       655
       +
       		}

     

       656
       656
       +
       	})

     

       657
       657
       +
       }

     

       658
       658
       +
       

     

       659
       659
       +
       // TestDPoPReplayProtection tests that the same DPoP proof cannot be used twice

     

       660
       660
       +
       func TestDPoPReplayProtection(t *testing.T) {

     

       661
       661
       +
       	// This tests the NonceCache functionality

     

       662
       662
       +
       	cache := auth.NewNonceCache(5 * time.Minute)

     

       663
       663
       +
       	defer cache.Stop()

     

       664
       664
       +
       

     

       665
       665
       +
       	jti := "unique-proof-id-123"

     

       666
       666
       +
       

     

       667
       667
       +
       	// First use should succeed

     

       668
       668
       +
       	if !cache.CheckAndStore(jti) {

     

       669
       669
       +
       		t.Error("First use of jti should succeed")

     

       670
       670
       +
       	}

     

       671
       671
       +
       

     

       672
       672
       +
       	// Second use should fail (replay detected)

     

       673
       673
       +
       	if cache.CheckAndStore(jti) {

     

       674
       674
       +
       		t.Error("SECURITY: Replay attack not detected - same jti accepted twice")

     

       675
       675
       +
       	}

     

       676
       676
       +
       

     

       677
       677
       +
       	// Different jti should succeed

     

       678
       678
       +
       	if !cache.CheckAndStore("different-jti-456") {

     

       679
       679
       +
       		t.Error("Different jti should succeed")

     

       680
       680
       +
       	}

     

       681
       681
       +
       }

     

       682
       682
       +
       

     

       683
       683
       +
       // Helper: createDPoPProof creates a DPoP proof JWT for testing

     

       684
       684
       +
       func createDPoPProof(t *testing.T, privateKey *ecdsa.PrivateKey, method, uri string) string {

     

       685
       685
       +
       	// Create JWK from public key

     

       686
       686
       +
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       687
       687
       +
       

     

       688
       688
       +
       	// Create DPoP claims with UUID for jti to ensure uniqueness across tests

     

       689
       689
       +
       	claims := auth.DPoPClaims{

     

       690
       690
       +
       		RegisteredClaims: jwt.RegisteredClaims{

     

       691
       691
       +
       			IssuedAt: jwt.NewNumericDate(time.Now()),

     

       692
       692
       +
       			ID:       uuid.New().String(),

     

       693
       693
       +
       		},

     

       694
       694
       +
       		HTTPMethod: method,

     

       695
       695
       +
       		HTTPURI:    uri,

     

       696
       696
       +
       	}

     

       697
       697
       +
       

     

       698
       698
       +
       	// Create token with custom header

     

       699
       699
       +
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       700
       700
       +
       	token.Header["typ"] = "dpop+jwt"

     

       701
       701
       +
       	token.Header["jwk"] = jwk

     

       702
       702
       +
       

     

       703
       703
       +
       	// Sign with private key

     

       704
       704
       +
       	signedToken, err := token.SignedString(privateKey)

     

       705
       705
       +
       	if err != nil {

     

       706
       706
       +
       		t.Fatalf("failed to sign DPoP proof: %v", err)

     

       707
       707
       +
       	}

     

       708
       708
       +
       

     

       709
       709
       +
       	return signedToken

     

       710
       710
       +
       }

     

       711
       711
       +
       

     

       712
       712
       +
       // Helper: ecdsaPublicKeyToJWK converts an ECDSA public key to JWK map

     

       713
       713
       +
       func ecdsaPublicKeyToJWK(pubKey *ecdsa.PublicKey) map[string]interface{} {

     

       714
       714
       +
       	// Get curve name

     

       715
       715
       +
       	var crv string

     

       716
       716
       +
       	switch pubKey.Curve {

     

       717
       717
       +
       	case elliptic.P256():

     

       718
       718
       +
       		crv = "P-256"

     

       719
       719
       +
       	case elliptic.P384():

     

       720
       720
       +
       		crv = "P-384"

     

       721
       721
       +
       	case elliptic.P521():

     

       722
       722
       +
       		crv = "P-521"

     

       723
       723
       +
       	default:

     

       724
       724
       +
       		panic("unsupported curve")

     

       725
       725
       +
       	}

     

       726
       726
       +
       

     

       727
       727
       +
       	// Encode coordinates

     

       728
       728
       +
       	xBytes := pubKey.X.Bytes()

     

       729
       729
       +
       	yBytes := pubKey.Y.Bytes()

     

       730
       730
       +
       

     

       731
       731
       +
       	// Ensure proper byte length (pad if needed)

     

       732
       732
       +
       	keySize := (pubKey.Curve.Params().BitSize + 7) / 8

     

       733
       733
       +
       	xPadded := make([]byte, keySize)

     

       734
       734
       +
       	yPadded := make([]byte, keySize)

     

       735
       735
       +
       	copy(xPadded[keySize-len(xBytes):], xBytes)

     

       736
       736
       +
       	copy(yPadded[keySize-len(yBytes):], yBytes)

     

       737
       737
       +
       

     

       738
       738
       +
       	return map[string]interface{}{

     

       739
       739
       +
       		"kty": "EC",

     

       740
       740
       +
       		"crv": crv,

     

       741
       741
       +
       		"x":   base64.RawURLEncoding.EncodeToString(xPadded),

     

       742
       742
       +
       		"y":   base64.RawURLEncoding.EncodeToString(yPadded),

     

       743
       743
       +
       	}

     

       744
       744
       +
       }

+4 -1

internal/atproto/auth/jwt.go

···

       87
       87
        
       // Claims represents the standard JWT claims we care about

     

       88
       88
        
       type Claims struct {

     

       89
       89
        
       	jwt.RegisteredClaims

     

       90
       90
       -
       	Scope string `json:"scope,omitempty"`

     

       90
       90
       +
       	// Confirmation claim for DPoP token binding (RFC 9449)

     

       91
       91
       +
       	// Contains "jkt" (JWK thumbprint) when token is bound to a DPoP key

     

       92
       92
       +
       	Confirmation map[string]interface{} `json:"cnf,omitempty"`

     

       93
       93
       +
       	Scope        string                 `json:"scope,omitempty"`

     

       91
       94
        
       }

     

       92
       95
        
       

     

       93
       96
        
       // stripBearerPrefix removes the "Bearer " prefix from a token string

+134 -2

internal/atproto/auth/README.md

···

       110
       110
        
       5. Find matching key by `kid` from JWT header

     

       111
       111
        
       6. Cache the JWKS for 1 hour

     

       112
       112
        
       

     

       113
       113
       +
       ## DPoP Token Binding

     

       114
       114
       +
       

     

       115
       115
       +
       DPoP (Demonstrating Proof-of-Possession) binds access tokens to client-controlled cryptographic keys, preventing token theft and replay attacks.

     

       116
       116
       +
       

     

       117
       117
       +
       ### What is DPoP?

     

       118
       118
       +
       

     

       119
       119
       +
       DPoP is an OAuth extension (RFC 9449) that adds proof-of-possession semantics to bearer tokens. When a PDS issues a DPoP-bound access token:

     

       120
       120
       +
       

     

       121
       121
       +
       1. Access token contains `cnf.jkt` claim (JWK thumbprint of client's public key)

     

       122
       122
       +
       2. Client creates a DPoP proof JWT signed with their private key

     

       123
       123
       +
       3. Server verifies the proof signature and checks it matches the token's `cnf.jkt`

     

       124
       124
       +
       

     

       125
       125
       +
       ### CRITICAL: DPoP Security Model

     

       126
       126
       +
       

     

       127
       127
       +
       > ⚠️ **DPoP is an ADDITIONAL security layer, NOT a replacement for token signature verification.**

     

       128
       128
       +
       

     

       129
       129
       +
       The correct verification order is:

     

       130
       130
       +
       1. **ALWAYS verify the access token signature first** (via JWKS, HS256 shared secret, or DID resolution)

     

       131
       131
       +
       2. **If the verified token has `cnf.jkt`, REQUIRE valid DPoP proof**

     

       132
       132
       +
       3. **NEVER use DPoP as a fallback when signature verification fails**

     

       133
       133
       +
       

     

       134
       134
       +
       **Why This Matters**: An attacker could create a fake token with `sub: "did:plc:victim"` and their own `cnf.jkt`, then present a valid DPoP proof signed with their key. If we accept DPoP as a fallback, the attacker can impersonate any user.

     

       135
       135
       +
       

     

       136
       136
       +
       ### How DPoP Works

     

       137
       137
       +
       

     

       138
       138
       +
       ```

     

       139
       139
       +
       ┌─────────────┐                          ┌─────────────┐

     

       140
       140
       +
       │   Client    │                          │   Server    │

     

       141
       141
       +
       │             │                          │  (Coves)    │

     

       142
       142
       +
       └─────────────┘                          └─────────────┘

     

       143
       143
       +
              │                                        │

     

       144
       144
       +
              │ 1. Authorization: Bearer <token>       │

     

       145
       145
       +
              │    DPoP: <proof-jwt>                  │

     

       146
       146
       +
              │───────────────────────────────────────>│

     

       147
       147
       +
              │                                        │

     

       148
       148
       +
              │                                        │ 2. VERIFY token signature

     

       149
       149
       +
              │                                        │    (REQUIRED - no fallback!)

     

       150
       150
       +
              │                                        │

     

       151
       151
       +
              │                                        │ 3. If token has cnf.jkt:

     

       152
       152
       +
              │                                        │    - Verify DPoP proof

     

       153
       153
       +
              │                                        │    - Check thumbprint match

     

       154
       154
       +
              │                                        │

     

       155
       155
       +
              │                              200 OK    │

     

       156
       156
       +
              │<───────────────────────────────────────│

     

       157
       157
       +
       ```

     

       158
       158
       +
       

     

       159
       159
       +
       ### When DPoP is Required

     

       160
       160
       +
       

     

       161
       161
       +
       DPoP verification is **REQUIRED** when:

     

       162
       162
       +
       - Access token signature has been verified AND

     

       163
       163
       +
       - Access token contains `cnf.jkt` claim (DPoP-bound)

     

       164
       164
       +
       

     

       165
       165
       +
       If the token has `cnf.jkt` but no DPoP header is present, the request is **REJECTED**.

     

       166
       166
       +
       

     

       167
       167
       +
       ### Replay Protection

     

       168
       168
       +
       

     

       169
       169
       +
       DPoP proofs include a unique `jti` (JWT ID) claim. The server tracks seen `jti` values to prevent replay attacks:

     

       170
       170
       +
       

     

       171
       171
       +
       ```go

     

       172
       172
       +
       // Create a verifier with replay protection (default)

     

       173
       173
       +
       verifier := auth.NewDPoPVerifier()

     

       174
       174
       +
       defer verifier.Stop() // Stop cleanup goroutine on shutdown

     

       175
       175
       +
       

     

       176
       176
       +
       // The verifier automatically rejects reused jti values within the proof validity window (5 minutes)

     

       177
       177
       +
       ```

     

       178
       178
       +
       

     

       179
       179
       +
       ### DPoP Implementation

     

       180
       180
       +
       

     

       181
       181
       +
       The `dpop.go` module provides:

     

       182
       182
       +
       

     

       183
       183
       +
       ```go

     

       184
       184
       +
       // Create a verifier with replay protection

     

       185
       185
       +
       verifier := auth.NewDPoPVerifier()

     

       186
       186
       +
       defer verifier.Stop()

     

       187
       187
       +
       

     

       188
       188
       +
       // Verify the DPoP proof

     

       189
       189
       +
       proof, err := verifier.VerifyDPoPProof(dpopHeader, "POST", "https://coves.social/xrpc/...")

     

       190
       190
       +
       if err != nil {

     

       191
       191
       +
           // Invalid proof (includes replay detection)

     

       192
       192
       +
       }

     

       193
       193
       +
       

     

       194
       194
       +
       // Verify it binds to the VERIFIED access token

     

       195
       195
       +
       expectedThumbprint, err := auth.ExtractCnfJkt(claims)

     

       196
       196
       +
       if err != nil {

     

       197
       197
       +
           // Token not DPoP-bound

     

       198
       198
       +
       }

     

       199
       199
       +
       

     

       200
       200
       +
       if err := verifier.VerifyTokenBinding(proof, expectedThumbprint); err != nil {

     

       201
       201
       +
           // Proof doesn't match token

     

       202
       202
       +
       }

     

       203
       203
       +
       ```

     

       204
       204
       +
       

     

       205
       205
       +
       ### DPoP Proof Format

     

       206
       206
       +
       

     

       207
       207
       +
       The DPoP header contains a JWT with:

     

       208
       208
       +
       

     

       209
       209
       +
       **Header**:

     

       210
       210
       +
       - `typ`: `"dpop+jwt"` (required)

     

       211
       211
       +
       - `alg`: `"ES256"` (or other supported algorithm)

     

       212
       212
       +
       - `jwk`: Client's public key (JWK format)

     

       213
       213
       +
       

     

       214
       214
       +
       **Claims**:

     

       215
       215
       +
       - `jti`: Unique proof identifier (tracked for replay protection)

     

       216
       216
       +
       - `htm`: HTTP method (e.g., `"POST"`)

     

       217
       217
       +
       - `htu`: HTTP URI (without query/fragment)

     

       218
       218
       +
       - `iat`: Timestamp (must be recent, within 5 minutes)

     

       219
       219
       +
       

     

       220
       220
       +
       **Example**:

     

       221
       221
       +
       ```json

     

       222
       222
       +
       {

     

       223
       223
       +
         "typ": "dpop+jwt",

     

       224
       224
       +
         "alg": "ES256",

     

       225
       225
       +
         "jwk": {

     

       226
       226
       +
           "kty": "EC",

     

       227
       227
       +
           "crv": "P-256",

     

       228
       228
       +
           "x": "...",

     

       229
       229
       +
           "y": "..."

     

       230
       230
       +
         }

     

       231
       231
       +
       }

     

       232
       232
       +
       {

     

       233
       233
       +
         "jti": "unique-id-123",

     

       234
       234
       +
         "htm": "POST",

     

       235
       235
       +
         "htu": "https://coves.social/xrpc/social.coves.community.create",

     

       236
       236
       +
         "iat": 1700000000

     

       237
       237
       +
       }

     

       238
       238
       +
       ```

     

       239
       239
       +
       

     

       113
       240
        
       ## Security Considerations

     

       114
       241
        
       

     

       115
       242
        
       ### ✅ Implemented

     
···

       120
       247
        
       - Required claims validation (sub, iss)

     

       121
       248
        
       - Key caching with TTL

     

       122
       249
        
       - Secure error messages (no internal details leaked)

     

       250
       250
       +
       - **DPoP proof verification** (proof-of-possession for token binding)

     

       251
       251
       +
       - **DPoP thumbprint validation** (prevents token theft attacks)

     

       252
       252
       +
       - **DPoP freshness checks** (5-minute proof validity window)

     

       253
       253
       +
       - **DPoP replay protection** (jti tracking with in-memory cache)

     

       254
       254
       +
       - **Secure DPoP model** (DPoP required AFTER signature verification, never as fallback)

     

       123
       255
        
       

     

       124
       256
        
       ### ⚠️ Not Yet Implemented

     

       125
       257
        
       

     

       126
       126
       -
       - DPoP validation (for replay attack prevention)

     

       258
       258
       +
       - Server-issued DPoP nonces (additional replay protection)

     

       127
       259
        
       - Scope validation (checking `scope` claim)

     

       128
       260
        
       - Audience validation (checking `aud` claim)

     

       129
       261
        
       - Rate limiting per DID

     
···

       186
       318
        
       

     

       187
       319
        
       ## Future Enhancements

     

       188
       320
        
       

     

       189
       189
       -
       - [ ] DPoP proof validation

     

       321
       321
       +
       - [ ] DPoP nonce validation (server-managed nonce for additional replay protection)

     

       190
       322
        
       - [ ] Scope-based authorization

     

       191
       323
        
       - [ ] Audience claim validation

     

       192
       324
        
       - [ ] Token revocation support

+4 -1

.gitignore

···

       47
       47
        
       

     

       48
       48
        
       # Build artifacts

     

       49
       49
        
       /validate-lexicon

     

       50
       50
       -
       /bin/
     

       50
       50
       +
       /bin/

     

       51
       51
       +
       

     

       52
       52
       +
       # Go build cache

     

       53
       53
       +
       .cache/

+5 -6

go.mod

···

       1
       1
        
       module Coves

     

       2
       2
        
       

     

       3
       3
       -
       go 1.24.0

     

       3
       3
       +
       go 1.25

     

       4
       4
        
       

     

       5
       5
        
       require (

     

       6
       6
       -
       	github.com/bluesky-social/indigo v0.0.0-20251009212240-20524de167fe

     

       6
       6
       +
       	github.com/bluesky-social/indigo v0.0.0-20251127021457-6f2658724b36

     

       7
       7
        
       	github.com/go-chi/chi/v5 v5.2.1

     

       8
       8
        
       	github.com/golang-jwt/jwt/v5 v5.3.0

     

       9
       9
        
       	github.com/gorilla/websocket v1.5.3

     
···

       11
       11
        
       	github.com/lestrrat-go/jwx/v2 v2.0.12

     

       12
       12
        
       	github.com/lib/pq v1.10.9

     

       13
       13
        
       	github.com/pressly/goose/v3 v3.22.1

     

       14
       14
       -
       	github.com/stretchr/testify v1.9.0

     

       14
       14
       +
       	github.com/stretchr/testify v1.10.0

     

       15
       15
       +
       	github.com/xeipuuv/gojsonschema v1.2.0

     

       15
       16
        
       	golang.org/x/net v0.46.0

     

       16
       17
        
       	golang.org/x/time v0.3.0

     

       17
       18
        
       )

     

       18
       19
        
       

     

       19
       20
        
       require (

     

       20
       21
        
       	github.com/beorn7/perks v1.0.1 // indirect

     

       21
       21
       -
       	github.com/carlmjohnson/versioninfo v0.22.5 // indirect

     

       22
       22
        
       	github.com/cespare/xxhash/v2 v2.2.0 // indirect

     

       23
       23
        
       	github.com/davecgh/go-spew v1.1.1 // indirect

     

       24
       24
        
       	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect

     

       25
       25
       +
       	github.com/earthboundkid/versioninfo/v2 v2.24.1 // indirect

     

       25
       26
        
       	github.com/felixge/httpsnoop v1.0.4 // indirect

     

       26
       27
        
       	github.com/go-logr/logr v1.4.1 // indirect

     

       27
       28
        
       	github.com/go-logr/stdr v1.2.2 // indirect

     
···

       71
       72
        
       	github.com/segmentio/asm v1.2.0 // indirect

     

       72
       73
        
       	github.com/sethvargo/go-retry v0.3.0 // indirect

     

       73
       74
        
       	github.com/spaolacci/murmur3 v1.1.0 // indirect

     

       74
       74
       -
       	github.com/stretchr/objx v0.5.2 // indirect

     

       75
       75
        
       	github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e // indirect

     

       76
       76
        
       	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect

     

       77
       77
        
       	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect

     

       78
       78
       -
       	github.com/xeipuuv/gojsonschema v1.2.0 // indirect

     

       79
       78
        
       	gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect

     

       80
       79
        
       	gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 // indirect

     

       81
       80
        
       	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect

+6 -8

go.sum

···

       2
       2
        
       github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=

     

       3
       3
        
       github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=

     

       4
       4
        
       github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=

     

       5
       5
       -
       github.com/bluesky-social/indigo v0.0.0-20251009212240-20524de167fe h1:VBhaqE5ewQgXbY5SfSWFZC/AwHFo7cHxZKFYi2ce9Yo=

     

       6
       6
       -
       github.com/bluesky-social/indigo v0.0.0-20251009212240-20524de167fe/go.mod h1:RuQVrCGm42QNsgumKaR6se+XkFKfCPNwdCiTvqKRUck=

     

       7
       7
       -
       github.com/carlmjohnson/versioninfo v0.22.5 h1:O00sjOLUAFxYQjlN/bzYTuZiS0y6fWDQjMRvwtKgwwc=

     

       8
       8
       -
       github.com/carlmjohnson/versioninfo v0.22.5/go.mod h1:QT9mph3wcVfISUKd0i9sZfVrPviHuSF+cUtLjm2WSf8=

     

       5
       5
       +
       github.com/bluesky-social/indigo v0.0.0-20251127021457-6f2658724b36 h1:Vc+l4sltxQfBT8qC3dm87PRYInmxlGyF1dmpjaW0WkU=

     

       6
       6
       +
       github.com/bluesky-social/indigo v0.0.0-20251127021457-6f2658724b36/go.mod h1:Pm2I1+iDXn/hLbF7XCg/DsZi6uDCiOo7hZGWprSM7k0=

     

       9
       7
        
       github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=

     

       10
       8
        
       github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=

     

       11
       9
        
       github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=

     
···

       17
       15
        
       github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=

     

       18
       16
        
       github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=

     

       19
       17
        
       github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=

     

       18
       18
       +
       github.com/earthboundkid/versioninfo/v2 v2.24.1 h1:SJTMHaoUx3GzjjnUO1QzP3ZXK6Ee/nbWyCm58eY3oUg=

     

       19
       19
       +
       github.com/earthboundkid/versioninfo/v2 v2.24.1/go.mod h1:VcWEooDEuyUJnMfbdTh0uFN4cfEIg+kHMuWB2CDCLjw=

     

       20
       20
        
       github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=

     

       21
       21
        
       github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

     

       22
       22
        
       github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=

     
···

       172
       172
        
       github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=

     

       173
       173
        
       github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=

     

       174
       174
        
       github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=

     

       175
       175
       -
       github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=

     

       176
       176
       -
       github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=

     

       177
       175
        
       github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=

     

       178
       176
        
       github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=

     

       179
       177
        
       github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=

     
···

       182
       180
        
       github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=

     

       183
       181
        
       github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=

     

       184
       182
        
       github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=

     

       185
       185
       -
       github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=

     

       186
       186
       -
       github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=

     

       183
       183
       +
       github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=

     

       184
       184
       +
       github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=

     

       187
       185
        
       github.com/urfave/cli v1.22.10/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=

     

       188
       186
        
       github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=

     

       189
       187
        
       github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=

Compare changes