comparing feat/comment-query-api-phase2a and feat/vote-xrpc-endpoints on bretton.dev/coves

+200

internal/core/unfurl/circuit_breaker.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"log"

     

       6
       6
       +
       	"sync"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // circuitState represents the state of a circuit breaker

     

       11
       11
       +
       type circuitState int

     

       12
       12
       +
       

     

       13
       13
       +
       const (

     

       14
       14
       +
       	stateClosed   circuitState = iota // Normal operation

     

       15
       15
       +
       	stateOpen                         // Circuit is open (provider failing)

     

       16
       16
       +
       	stateHalfOpen                     // Testing if provider recovered

     

       17
       17
       +
       )

     

       18
       18
       +
       

     

       19
       19
       +
       // circuitBreaker tracks failures per provider and stops trying failing providers

     

       20
       20
       +
       type circuitBreaker struct {

     

       21
       21
       +
       	failures         map[string]int

     

       22
       22
       +
       	lastFailure      map[string]time.Time

     

       23
       23
       +
       	state            map[string]circuitState

     

       24
       24
       +
       	lastStateLog     map[string]time.Time

     

       25
       25
       +
       	failureThreshold int

     

       26
       26
       +
       	openDuration     time.Duration

     

       27
       27
       +
       	mu               sync.RWMutex

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       // newCircuitBreaker creates a circuit breaker with default settings

     

       31
       31
       +
       func newCircuitBreaker() *circuitBreaker {

     

       32
       32
       +
       	return &circuitBreaker{

     

       33
       33
       +
       		failureThreshold: 3,               // Open after 3 consecutive failures

     

       34
       34
       +
       		openDuration:     5 * time.Minute, // Keep open for 5 minutes

     

       35
       35
       +
       		failures:         make(map[string]int),

     

       36
       36
       +
       		lastFailure:      make(map[string]time.Time),

     

       37
       37
       +
       		state:            make(map[string]circuitState),

     

       38
       38
       +
       		lastStateLog:     make(map[string]time.Time),

     

       39
       39
       +
       	}

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       // canAttempt checks if we should attempt to call this provider

     

       43
       43
       +
       // Returns true if circuit is closed or half-open (ready to retry)

     

       44
       44
       +
       func (cb *circuitBreaker) canAttempt(provider string) (bool, error) {

     

       45
       45
       +
       	cb.mu.RLock()

     

       46
       46
       +
       	defer cb.mu.RUnlock()

     

       47
       47
       +
       

     

       48
       48
       +
       	state := cb.getState(provider)

     

       49
       49
       +
       

     

       50
       50
       +
       	switch state {

     

       51
       51
       +
       	case stateClosed:

     

       52
       52
       +
       		return true, nil

     

       53
       53
       +
       	case stateOpen:

     

       54
       54
       +
       		// Check if we should transition to half-open

     

       55
       55
       +
       		lastFail := cb.lastFailure[provider]

     

       56
       56
       +
       		if time.Since(lastFail) > cb.openDuration {

     

       57
       57
       +
       			// Transition to half-open (allow one retry)

     

       58
       58
       +
       			cb.mu.RUnlock()

     

       59
       59
       +
       			cb.mu.Lock()

     

       60
       60
       +
       			cb.state[provider] = stateHalfOpen

     

       61
       61
       +
       			cb.logStateChange(provider, stateHalfOpen)

     

       62
       62
       +
       			cb.mu.Unlock()

     

       63
       63
       +
       			cb.mu.RLock()

     

       64
       64
       +
       			return true, nil

     

       65
       65
       +
       		}

     

       66
       66
       +
       		// Still in open period

     

       67
       67
       +
       		failCount := cb.failures[provider]

     

       68
       68
       +
       		nextRetry := lastFail.Add(cb.openDuration)

     

       69
       69
       +
       		return false, fmt.Errorf(

     

       70
       70
       +
       			"circuit breaker open for provider '%s' (failures: %d, next retry: %s)",

     

       71
       71
       +
       			provider,

     

       72
       72
       +
       			failCount,

     

       73
       73
       +
       			nextRetry.Format("15:04:05"),

     

       74
       74
       +
       		)

     

       75
       75
       +
       	case stateHalfOpen:

     

       76
       76
       +
       		return true, nil

     

       77
       77
       +
       	default:

     

       78
       78
       +
       		return true, nil

     

       79
       79
       +
       	}

     

       80
       80
       +
       }

     

       81
       81
       +
       

     

       82
       82
       +
       // recordSuccess records a successful unfurl, resetting failure count

     

       83
       83
       +
       func (cb *circuitBreaker) recordSuccess(provider string) {

     

       84
       84
       +
       	cb.mu.Lock()

     

       85
       85
       +
       	defer cb.mu.Unlock()

     

       86
       86
       +
       

     

       87
       87
       +
       	oldState := cb.getState(provider)

     

       88
       88
       +
       

     

       89
       89
       +
       	// Reset failure tracking

     

       90
       90
       +
       	delete(cb.failures, provider)

     

       91
       91
       +
       	delete(cb.lastFailure, provider)

     

       92
       92
       +
       	cb.state[provider] = stateClosed

     

       93
       93
       +
       

     

       94
       94
       +
       	// Log recovery if we were in a failure state

     

       95
       95
       +
       	if oldState != stateClosed {

     

       96
       96
       +
       		cb.logStateChange(provider, stateClosed)

     

       97
       97
       +
       	}

     

       98
       98
       +
       }

     

       99
       99
       +
       

     

       100
       100
       +
       // recordFailure records a failed unfurl attempt

     

       101
       101
       +
       func (cb *circuitBreaker) recordFailure(provider string, err error) {

     

       102
       102
       +
       	cb.mu.Lock()

     

       103
       103
       +
       	defer cb.mu.Unlock()

     

       104
       104
       +
       

     

       105
       105
       +
       	// Increment failure count

     

       106
       106
       +
       	cb.failures[provider]++

     

       107
       107
       +
       	cb.lastFailure[provider] = time.Now()

     

       108
       108
       +
       

     

       109
       109
       +
       	failCount := cb.failures[provider]

     

       110
       110
       +
       

     

       111
       111
       +
       	// Check if we should open the circuit

     

       112
       112
       +
       	if failCount >= cb.failureThreshold {

     

       113
       113
       +
       		oldState := cb.getState(provider)

     

       114
       114
       +
       		cb.state[provider] = stateOpen

     

       115
       115
       +
       		if oldState != stateOpen {

     

       116
       116
       +
       			log.Printf(

     

       117
       117
       +
       				"[UNFURL-CIRCUIT] Opening circuit for provider '%s' after %d consecutive failures. Last error: %v",

     

       118
       118
       +
       				provider,

     

       119
       119
       +
       				failCount,

     

       120
       120
       +
       				err,

     

       121
       121
       +
       			)

     

       122
       122
       +
       			cb.lastStateLog[provider] = time.Now()

     

       123
       123
       +
       		}

     

       124
       124
       +
       	} else {

     

       125
       125
       +
       		log.Printf(

     

       126
       126
       +
       			"[UNFURL-CIRCUIT] Failure %d/%d for provider '%s': %v",

     

       127
       127
       +
       			failCount,

     

       128
       128
       +
       			cb.failureThreshold,

     

       129
       129
       +
       			provider,

     

       130
       130
       +
       			err,

     

       131
       131
       +
       		)

     

       132
       132
       +
       	}

     

       133
       133
       +
       }

     

       134
       134
       +
       

     

       135
       135
       +
       // getState returns the current state (must be called with lock held)

     

       136
       136
       +
       func (cb *circuitBreaker) getState(provider string) circuitState {

     

       137
       137
       +
       	if state, exists := cb.state[provider]; exists {

     

       138
       138
       +
       		return state

     

       139
       139
       +
       	}

     

       140
       140
       +
       	return stateClosed

     

       141
       141
       +
       }

     

       142
       142
       +
       

     

       143
       143
       +
       // logStateChange logs state transitions (must be called with lock held)

     

       144
       144
       +
       // Debounced to avoid log spam (max once per minute per provider)

     

       145
       145
       +
       func (cb *circuitBreaker) logStateChange(provider string, newState circuitState) {

     

       146
       146
       +
       	lastLog, exists := cb.lastStateLog[provider]

     

       147
       147
       +
       	if exists && time.Since(lastLog) < time.Minute {

     

       148
       148
       +
       		return // Don't spam logs

     

       149
       149
       +
       	}

     

       150
       150
       +
       

     

       151
       151
       +
       	var stateStr string

     

       152
       152
       +
       	switch newState {

     

       153
       153
       +
       	case stateClosed:

     

       154
       154
       +
       		stateStr = "CLOSED (recovered)"

     

       155
       155
       +
       	case stateOpen:

     

       156
       156
       +
       		stateStr = "OPEN (failing)"

     

       157
       157
       +
       	case stateHalfOpen:

     

       158
       158
       +
       		stateStr = "HALF-OPEN (testing)"

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	log.Printf("[UNFURL-CIRCUIT] Circuit for provider '%s' is now %s", provider, stateStr)

     

       162
       162
       +
       	cb.lastStateLog[provider] = time.Now()

     

       163
       163
       +
       }

     

       164
       164
       +
       

     

       165
       165
       +
       // getStats returns current circuit breaker stats (for debugging/monitoring)

     

       166
       166
       +
       func (cb *circuitBreaker) getStats() map[string]interface{} {

     

       167
       167
       +
       	cb.mu.RLock()

     

       168
       168
       +
       	defer cb.mu.RUnlock()

     

       169
       169
       +
       

     

       170
       170
       +
       	stats := make(map[string]interface{})

     

       171
       171
       +
       

     

       172
       172
       +
       	// Collect all providers with any activity (state, failures, or both)

     

       173
       173
       +
       	providers := make(map[string]bool)

     

       174
       174
       +
       	for provider := range cb.state {

     

       175
       175
       +
       		providers[provider] = true

     

       176
       176
       +
       	}

     

       177
       177
       +
       	for provider := range cb.failures {

     

       178
       178
       +
       		providers[provider] = true

     

       179
       179
       +
       	}

     

       180
       180
       +
       

     

       181
       181
       +
       	for provider := range providers {

     

       182
       182
       +
       		state := cb.getState(provider)

     

       183
       183
       +
       		var stateStr string

     

       184
       184
       +
       		switch state {

     

       185
       185
       +
       		case stateClosed:

     

       186
       186
       +
       			stateStr = "closed"

     

       187
       187
       +
       		case stateOpen:

     

       188
       188
       +
       			stateStr = "open"

     

       189
       189
       +
       		case stateHalfOpen:

     

       190
       190
       +
       			stateStr = "half-open"

     

       191
       191
       +
       		}

     

       192
       192
       +
       

     

       193
       193
       +
       		stats[provider] = map[string]interface{}{

     

       194
       194
       +
       			"state":        stateStr,

     

       195
       195
       +
       			"failures":     cb.failures[provider],

     

       196
       196
       +
       			"last_failure": cb.lastFailure[provider],

     

       197
       197
       +
       		}

     

       198
       198
       +
       	}

     

       199
       199
       +
       	return stats

     

       200
       200
       +
       }

+175

internal/core/unfurl/circuit_breaker_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"testing"

     

       6
       6
       +
       	"time"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       func TestCircuitBreaker_Basic(t *testing.T) {

     

       10
       10
       +
       	cb := newCircuitBreaker()

     

       11
       11
       +
       

     

       12
       12
       +
       	provider := "test-provider"

     

       13
       13
       +
       

     

       14
       14
       +
       	// Should start closed (allow attempts)

     

       15
       15
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       16
       16
       +
       	if !canAttempt {

     

       17
       17
       +
       		t.Errorf("Expected circuit to be closed initially, but got error: %v", err)

     

       18
       18
       +
       	}

     

       19
       19
       +
       

     

       20
       20
       +
       	// Record success

     

       21
       21
       +
       	cb.recordSuccess(provider)

     

       22
       22
       +
       	canAttempt, _ = cb.canAttempt(provider)

     

       23
       23
       +
       	if !canAttempt {

     

       24
       24
       +
       		t.Error("Expected circuit to remain closed after success")

     

       25
       25
       +
       	}

     

       26
       26
       +
       }

     

       27
       27
       +
       

     

       28
       28
       +
       func TestCircuitBreaker_OpensAfterFailures(t *testing.T) {

     

       29
       29
       +
       	cb := newCircuitBreaker()

     

       30
       30
       +
       	provider := "failing-provider"

     

       31
       31
       +
       

     

       32
       32
       +
       	// Record failures up to threshold

     

       33
       33
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       34
       34
       +
       		cb.recordFailure(provider, fmt.Errorf("test error %d", i))

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	// Circuit should now be open

     

       38
       38
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       39
       39
       +
       	if canAttempt {

     

       40
       40
       +
       		t.Error("Expected circuit to be open after threshold failures")

     

       41
       41
       +
       	}

     

       42
       42
       +
       	if err == nil {

     

       43
       43
       +
       		t.Error("Expected error when circuit is open")

     

       44
       44
       +
       	}

     

       45
       45
       +
       }

     

       46
       46
       +
       

     

       47
       47
       +
       func TestCircuitBreaker_RecoveryAfterSuccess(t *testing.T) {

     

       48
       48
       +
       	cb := newCircuitBreaker()

     

       49
       49
       +
       	provider := "recovery-provider"

     

       50
       50
       +
       

     

       51
       51
       +
       	// Record some failures

     

       52
       52
       +
       	cb.recordFailure(provider, fmt.Errorf("error 1"))

     

       53
       53
       +
       	cb.recordFailure(provider, fmt.Errorf("error 2"))

     

       54
       54
       +
       

     

       55
       55
       +
       	// Record success - should reset failure count

     

       56
       56
       +
       	cb.recordSuccess(provider)

     

       57
       57
       +
       

     

       58
       58
       +
       	// Should be able to attempt again

     

       59
       59
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       60
       60
       +
       	if !canAttempt {

     

       61
       61
       +
       		t.Errorf("Expected circuit to be closed after success, but got error: %v", err)

     

       62
       62
       +
       	}

     

       63
       63
       +
       

     

       64
       64
       +
       	// Failure count should be reset

     

       65
       65
       +
       	if count := cb.failures[provider]; count != 0 {

     

       66
       66
       +
       		t.Errorf("Expected failure count to be reset to 0, got %d", count)

     

       67
       67
       +
       	}

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       func TestCircuitBreaker_HalfOpenTransition(t *testing.T) {

     

       71
       71
       +
       	cb := newCircuitBreaker()

     

       72
       72
       +
       	cb.openDuration = 100 * time.Millisecond // Short duration for testing

     

       73
       73
       +
       	provider := "half-open-provider"

     

       74
       74
       +
       

     

       75
       75
       +
       	// Open the circuit

     

       76
       76
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       77
       77
       +
       		cb.recordFailure(provider, fmt.Errorf("error %d", i))

     

       78
       78
       +
       	}

     

       79
       79
       +
       

     

       80
       80
       +
       	// Should be open

     

       81
       81
       +
       	canAttempt, _ := cb.canAttempt(provider)

     

       82
       82
       +
       	if canAttempt {

     

       83
       83
       +
       		t.Error("Expected circuit to be open")

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	// Wait for open duration

     

       87
       87
       +
       	time.Sleep(150 * time.Millisecond)

     

       88
       88
       +
       

     

       89
       89
       +
       	// Should transition to half-open and allow one attempt

     

       90
       90
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       91
       91
       +
       	if !canAttempt {

     

       92
       92
       +
       		t.Errorf("Expected circuit to transition to half-open after duration, but got error: %v", err)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	// State should be half-open

     

       96
       96
       +
       	cb.mu.RLock()

     

       97
       97
       +
       	state := cb.state[provider]

     

       98
       98
       +
       	cb.mu.RUnlock()

     

       99
       99
       +
       

     

       100
       100
       +
       	if state != stateHalfOpen {

     

       101
       101
       +
       		t.Errorf("Expected state to be half-open, got %v", state)

     

       102
       102
       +
       	}

     

       103
       103
       +
       }

     

       104
       104
       +
       

     

       105
       105
       +
       func TestCircuitBreaker_MultipleProviders(t *testing.T) {

     

       106
       106
       +
       	cb := newCircuitBreaker()

     

       107
       107
       +
       

     

       108
       108
       +
       	// Open circuit for provider A

     

       109
       109
       +
       	for i := 0; i < cb.failureThreshold; i++ {

     

       110
       110
       +
       		cb.recordFailure("providerA", fmt.Errorf("error"))

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	// Provider A should be blocked

     

       114
       114
       +
       	canAttemptA, _ := cb.canAttempt("providerA")

     

       115
       115
       +
       	if canAttemptA {

     

       116
       116
       +
       		t.Error("Expected providerA circuit to be open")

     

       117
       117
       +
       	}

     

       118
       118
       +
       

     

       119
       119
       +
       	// Provider B should still be open (independent circuits)

     

       120
       120
       +
       	canAttemptB, err := cb.canAttempt("providerB")

     

       121
       121
       +
       	if !canAttemptB {

     

       122
       122
       +
       		t.Errorf("Expected providerB circuit to be closed, but got error: %v", err)

     

       123
       123
       +
       	}

     

       124
       124
       +
       }

     

       125
       125
       +
       

     

       126
       126
       +
       func TestCircuitBreaker_GetStats(t *testing.T) {

     

       127
       127
       +
       	cb := newCircuitBreaker()

     

       128
       128
       +
       

     

       129
       129
       +
       	// Record some activity

     

       130
       130
       +
       	cb.recordFailure("provider1", fmt.Errorf("error 1"))

     

       131
       131
       +
       	cb.recordFailure("provider1", fmt.Errorf("error 2"))

     

       132
       132
       +
       

     

       133
       133
       +
       	stats := cb.getStats()

     

       134
       134
       +
       

     

       135
       135
       +
       	// Should have stats for providers with failures

     

       136
       136
       +
       	if providerStats, ok := stats["provider1"]; !ok {

     

       137
       137
       +
       		t.Error("Expected stats for provider1")

     

       138
       138
       +
       	} else {

     

       139
       139
       +
       		// Check that failure count is tracked

     

       140
       140
       +
       		statsMap := providerStats.(map[string]interface{})

     

       141
       141
       +
       		if failures, ok := statsMap["failures"].(int); !ok || failures != 2 {

     

       142
       142
       +
       			t.Errorf("Expected 2 failures for provider1, got %v", statsMap["failures"])

     

       143
       143
       +
       		}

     

       144
       144
       +
       	}

     

       145
       145
       +
       

     

       146
       146
       +
       	// Provider that succeeds is cleaned up from state

     

       147
       147
       +
       	cb.recordSuccess("provider2")

     

       148
       148
       +
       	_ = cb.getStats()

     

       149
       149
       +
       	// Provider2 should not be in stats (or have state "closed" with 0 failures)

     

       150
       150
       +
       }

     

       151
       151
       +
       

     

       152
       152
       +
       func TestCircuitBreaker_FailureThresholdExact(t *testing.T) {

     

       153
       153
       +
       	cb := newCircuitBreaker()

     

       154
       154
       +
       	provider := "exact-threshold-provider"

     

       155
       155
       +
       

     

       156
       156
       +
       	// Record failures just below threshold

     

       157
       157
       +
       	for i := 0; i < cb.failureThreshold-1; i++ {

     

       158
       158
       +
       		cb.recordFailure(provider, fmt.Errorf("error %d", i))

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	// Should still be closed

     

       162
       162
       +
       	canAttempt, err := cb.canAttempt(provider)

     

       163
       163
       +
       	if !canAttempt {

     

       164
       164
       +
       		t.Errorf("Expected circuit to be closed below threshold, but got error: %v", err)

     

       165
       165
       +
       	}

     

       166
       166
       +
       

     

       167
       167
       +
       	// One more failure should open it

     

       168
       168
       +
       	cb.recordFailure(provider, fmt.Errorf("final error"))

     

       169
       169
       +
       

     

       170
       170
       +
       	// Should now be open

     

       171
       171
       +
       	canAttempt, _ = cb.canAttempt(provider)

     

       172
       172
       +
       	if canAttempt {

     

       173
       173
       +
       		t.Error("Expected circuit to be open at threshold")

     

       174
       174
       +
       	}

     

       175
       175
       +
       }

+202

internal/core/unfurl/kagi_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       func TestFetchKagiKite_Success(t *testing.T) {

     

       15
       15
       +
       	// Mock Kagi HTML response

     

       16
       16
       +
       	mockHTML := `<!DOCTYPE html>

     

       17
       17
       +
       <html>

     

       18
       18
       +
       <head>

     

       19
       19
       +
       	<title>FAA orders 10% flight cuts at 40 airports - Kagi News</title>

     

       20
       20
       +
       	<meta property="og:title" content="FAA orders 10% flight cuts" />

     

       21
       21
       +
       	<meta property="og:description" content="Flight restrictions announced" />

     

       22
       22
       +
       </head>

     

       23
       23
       +
       <body>

     

       24
       24
       +
       	<img src="https://kagiproxy.com/img/DHdCvN_NqVDWU3UyoNZSv86b" alt="Airport runway" />

     

       25
       25
       +
       </body>

     

       26
       26
       +
       </html>`

     

       27
       27
       +
       

     

       28
       28
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       29
       29
       +
       		w.Header().Set("Content-Type", "text/html")

     

       30
       30
       +
       		w.WriteHeader(http.StatusOK)

     

       31
       31
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       32
       32
       +
       	}))

     

       33
       33
       +
       	defer server.Close()

     

       34
       34
       +
       

     

       35
       35
       +
       	ctx := context.Background()

     

       36
       36
       +
       

     

       37
       37
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       38
       38
       +
       

     

       39
       39
       +
       	require.NoError(t, err)

     

       40
       40
       +
       	assert.Equal(t, "article", result.Type)

     

       41
       41
       +
       	assert.Equal(t, "FAA orders 10% flight cuts", result.Title)

     

       42
       42
       +
       	assert.Equal(t, "Flight restrictions announced", result.Description)

     

       43
       43
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       44
       44
       +
       	assert.Equal(t, "kagi", result.Provider)

     

       45
       45
       +
       	assert.Equal(t, "kite.kagi.com", result.Domain)

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       func TestFetchKagiKite_NoImage(t *testing.T) {

     

       49
       49
       +
       	mockHTML := `<!DOCTYPE html>

     

       50
       50
       +
       <html>

     

       51
       51
       +
       <head><title>Test Story</title></head>

     

       52
       52
       +
       <body><p>No images here</p></body>

     

       53
       53
       +
       </html>`

     

       54
       54
       +
       

     

       55
       55
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       56
       56
       +
       		w.Header().Set("Content-Type", "text/html")

     

       57
       57
       +
       		w.WriteHeader(http.StatusOK)

     

       58
       58
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       59
       59
       +
       	}))

     

       60
       60
       +
       	defer server.Close()

     

       61
       61
       +
       

     

       62
       62
       +
       	ctx := context.Background()

     

       63
       63
       +
       

     

       64
       64
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       65
       65
       +
       

     

       66
       66
       +
       	assert.Error(t, err)

     

       67
       67
       +
       	assert.Nil(t, result)

     

       68
       68
       +
       	assert.Contains(t, err.Error(), "no image found")

     

       69
       69
       +
       }

     

       70
       70
       +
       

     

       71
       71
       +
       func TestFetchKagiKite_FallbackToTitle(t *testing.T) {

     

       72
       72
       +
       	mockHTML := `<!DOCTYPE html>

     

       73
       73
       +
       <html>

     

       74
       74
       +
       <head><title>Fallback Title</title></head>

     

       75
       75
       +
       <body>

     

       76
       76
       +
       	<img src="https://kagiproxy.com/img/test123" />

     

       77
       77
       +
       </body>

     

       78
       78
       +
       </html>`

     

       79
       79
       +
       

     

       80
       80
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       81
       81
       +
       		w.Header().Set("Content-Type", "text/html")

     

       82
       82
       +
       		w.WriteHeader(http.StatusOK)

     

       83
       83
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       84
       84
       +
       	}))

     

       85
       85
       +
       	defer server.Close()

     

       86
       86
       +
       

     

       87
       87
       +
       	ctx := context.Background()

     

       88
       88
       +
       

     

       89
       89
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       90
       90
       +
       

     

       91
       91
       +
       	require.NoError(t, err)

     

       92
       92
       +
       	assert.Equal(t, "Fallback Title", result.Title)

     

       93
       93
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       94
       94
       +
       }

     

       95
       95
       +
       

     

       96
       96
       +
       func TestFetchKagiKite_ImageWithAltText(t *testing.T) {

     

       97
       97
       +
       	mockHTML := `<!DOCTYPE html>

     

       98
       98
       +
       <html>

     

       99
       99
       +
       <head><title>News Story</title></head>

     

       100
       100
       +
       <body>

     

       101
       101
       +
       	<img src="https://kagiproxy.com/img/xyz789" alt="This is the alt text description" />

     

       102
       102
       +
       </body>

     

       103
       103
       +
       </html>`

     

       104
       104
       +
       

     

       105
       105
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       106
       106
       +
       		w.Header().Set("Content-Type", "text/html")

     

       107
       107
       +
       		w.WriteHeader(http.StatusOK)

     

       108
       108
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       109
       109
       +
       	}))

     

       110
       110
       +
       	defer server.Close()

     

       111
       111
       +
       

     

       112
       112
       +
       	ctx := context.Background()

     

       113
       113
       +
       

     

       114
       114
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       115
       115
       +
       

     

       116
       116
       +
       	require.NoError(t, err)

     

       117
       117
       +
       	assert.Equal(t, "News Story", result.Title)

     

       118
       118
       +
       	assert.Equal(t, "This is the alt text description", result.Description)

     

       119
       119
       +
       	assert.Contains(t, result.ThumbnailURL, "kagiproxy.com")

     

       120
       120
       +
       }

     

       121
       121
       +
       

     

       122
       122
       +
       func TestFetchKagiKite_HTTPError(t *testing.T) {

     

       123
       123
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       124
       124
       +
       		w.WriteHeader(http.StatusNotFound)

     

       125
       125
       +
       	}))

     

       126
       126
       +
       	defer server.Close()

     

       127
       127
       +
       

     

       128
       128
       +
       	ctx := context.Background()

     

       129
       129
       +
       

     

       130
       130
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       131
       131
       +
       

     

       132
       132
       +
       	assert.Error(t, err)

     

       133
       133
       +
       	assert.Nil(t, result)

     

       134
       134
       +
       	assert.Contains(t, err.Error(), "HTTP 404")

     

       135
       135
       +
       }

     

       136
       136
       +
       

     

       137
       137
       +
       func TestFetchKagiKite_Timeout(t *testing.T) {

     

       138
       138
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       139
       139
       +
       		time.Sleep(2 * time.Second)

     

       140
       140
       +
       		w.WriteHeader(http.StatusOK)

     

       141
       141
       +
       	}))

     

       142
       142
       +
       	defer server.Close()

     

       143
       143
       +
       

     

       144
       144
       +
       	ctx := context.Background()

     

       145
       145
       +
       

     

       146
       146
       +
       	result, err := fetchKagiKite(ctx, server.URL, 100*time.Millisecond, "TestBot/1.0")

     

       147
       147
       +
       

     

       148
       148
       +
       	assert.Error(t, err)

     

       149
       149
       +
       	assert.Nil(t, result)

     

       150
       150
       +
       }

     

       151
       151
       +
       

     

       152
       152
       +
       func TestFetchKagiKite_MultipleImages_PicksSecond(t *testing.T) {

     

       153
       153
       +
       	mockHTML := `<!DOCTYPE html>

     

       154
       154
       +
       <html>

     

       155
       155
       +
       <head><title>Story with multiple images</title></head>

     

       156
       156
       +
       <body>

     

       157
       157
       +
       	<img src="https://kagiproxy.com/img/first123" alt="First image (header/logo)" />

     

       158
       158
       +
       	<img src="https://kagiproxy.com/img/second456" alt="Second image" />

     

       159
       159
       +
       </body>

     

       160
       160
       +
       </html>`

     

       161
       161
       +
       

     

       162
       162
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       163
       163
       +
       		w.Header().Set("Content-Type", "text/html")

     

       164
       164
       +
       		w.WriteHeader(http.StatusOK)

     

       165
       165
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       166
       166
       +
       	}))

     

       167
       167
       +
       	defer server.Close()

     

       168
       168
       +
       

     

       169
       169
       +
       	ctx := context.Background()

     

       170
       170
       +
       

     

       171
       171
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       172
       172
       +
       

     

       173
       173
       +
       	require.NoError(t, err)

     

       174
       174
       +
       	// We skip the first image (often a header/logo) and use the second

     

       175
       175
       +
       	assert.Contains(t, result.ThumbnailURL, "second456")

     

       176
       176
       +
       	assert.Equal(t, "Second image", result.Description)

     

       177
       177
       +
       }

     

       178
       178
       +
       

     

       179
       179
       +
       func TestFetchKagiKite_OnlyNonKagiImages_NoMatch(t *testing.T) {

     

       180
       180
       +
       	mockHTML := `<!DOCTYPE html>

     

       181
       181
       +
       <html>

     

       182
       182
       +
       <head><title>Story with non-Kagi images</title></head>

     

       183
       183
       +
       <body>

     

       184
       184
       +
       	<img src="https://example.com/img/test.jpg" alt="External image" />

     

       185
       185
       +
       </body>

     

       186
       186
       +
       </html>`

     

       187
       187
       +
       

     

       188
       188
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       189
       189
       +
       		w.Header().Set("Content-Type", "text/html")

     

       190
       190
       +
       		w.WriteHeader(http.StatusOK)

     

       191
       191
       +
       		_, _ = w.Write([]byte(mockHTML))

     

       192
       192
       +
       	}))

     

       193
       193
       +
       	defer server.Close()

     

       194
       194
       +
       

     

       195
       195
       +
       	ctx := context.Background()

     

       196
       196
       +
       

     

       197
       197
       +
       	result, err := fetchKagiKite(ctx, server.URL, 5*time.Second, "TestBot/1.0")

     

       198
       198
       +
       

     

       199
       199
       +
       	assert.Error(t, err)

     

       200
       200
       +
       	assert.Nil(t, result)

     

       201
       201
       +
       	assert.Contains(t, err.Error(), "no image found")

     

       202
       202
       +
       }

+269

internal/core/unfurl/opengraph_test.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       func TestParseOpenGraph_ValidTags(t *testing.T) {

     

       15
       15
       +
       	html := `

     

       16
       16
       +
       <!DOCTYPE html>

     

       17
       17
       +
       <html>

     

       18
       18
       +
       <head>

     

       19
       19
       +
           <meta property="og:title" content="Test Article Title" />

     

       20
       20
       +
           <meta property="og:description" content="This is a test description" />

     

       21
       21
       +
           <meta property="og:image" content="https://example.com/image.jpg" />

     

       22
       22
       +
           <meta property="og:url" content="https://example.com/canonical" />

     

       23
       23
       +
       </head>

     

       24
       24
       +
       <body>

     

       25
       25
       +
           <p>Some content</p>

     

       26
       26
       +
       </body>

     

       27
       27
       +
       </html>

     

       28
       28
       +
       `

     

       29
       29
       +
       

     

       30
       30
       +
       	og, err := parseOpenGraph(html)

     

       31
       31
       +
       	require.NoError(t, err)

     

       32
       32
       +
       

     

       33
       33
       +
       	assert.Equal(t, "Test Article Title", og.Title)

     

       34
       34
       +
       	assert.Equal(t, "This is a test description", og.Description)

     

       35
       35
       +
       	assert.Equal(t, "https://example.com/image.jpg", og.Image)

     

       36
       36
       +
       	assert.Equal(t, "https://example.com/canonical", og.URL)

     

       37
       37
       +
       }

     

       38
       38
       +
       

     

       39
       39
       +
       func TestParseOpenGraph_MissingImage(t *testing.T) {

     

       40
       40
       +
       	html := `

     

       41
       41
       +
       <!DOCTYPE html>

     

       42
       42
       +
       <html>

     

       43
       43
       +
       <head>

     

       44
       44
       +
           <meta property="og:title" content="Article Without Image" />

     

       45
       45
       +
           <meta property="og:description" content="No image tag" />

     

       46
       46
       +
       </head>

     

       47
       47
       +
       <body></body>

     

       48
       48
       +
       </html>

     

       49
       49
       +
       `

     

       50
       50
       +
       

     

       51
       51
       +
       	og, err := parseOpenGraph(html)

     

       52
       52
       +
       	require.NoError(t, err)

     

       53
       53
       +
       

     

       54
       54
       +
       	assert.Equal(t, "Article Without Image", og.Title)

     

       55
       55
       +
       	assert.Equal(t, "No image tag", og.Description)

     

       56
       56
       +
       	assert.Empty(t, og.Image, "Image should be empty when not provided")

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       func TestParseOpenGraph_FallbackToTitle(t *testing.T) {

     

       60
       60
       +
       	html := `

     

       61
       61
       +
       <!DOCTYPE html>

     

       62
       62
       +
       <html>

     

       63
       63
       +
       <head>

     

       64
       64
       +
           <title>Page Title Fallback</title>

     

       65
       65
       +
           <meta name="description" content="Meta description fallback" />

     

       66
       66
       +
       </head>

     

       67
       67
       +
       <body></body>

     

       68
       68
       +
       </html>

     

       69
       69
       +
       `

     

       70
       70
       +
       

     

       71
       71
       +
       	og, err := parseOpenGraph(html)

     

       72
       72
       +
       	require.NoError(t, err)

     

       73
       73
       +
       

     

       74
       74
       +
       	assert.Equal(t, "Page Title Fallback", og.Title, "Should fall back to <title>")

     

       75
       75
       +
       	assert.Equal(t, "Meta description fallback", og.Description, "Should fall back to meta description")

     

       76
       76
       +
       }

     

       77
       77
       +
       

     

       78
       78
       +
       func TestParseOpenGraph_PreferOpenGraphOverFallback(t *testing.T) {

     

       79
       79
       +
       	html := `

     

       80
       80
       +
       <!DOCTYPE html>

     

       81
       81
       +
       <html>

     

       82
       82
       +
       <head>

     

       83
       83
       +
           <title>Page Title</title>

     

       84
       84
       +
           <meta name="description" content="Meta description" />

     

       85
       85
       +
           <meta property="og:title" content="OpenGraph Title" />

     

       86
       86
       +
           <meta property="og:description" content="OpenGraph Description" />

     

       87
       87
       +
       </head>

     

       88
       88
       +
       <body></body>

     

       89
       89
       +
       </html>

     

       90
       90
       +
       `

     

       91
       91
       +
       

     

       92
       92
       +
       	og, err := parseOpenGraph(html)

     

       93
       93
       +
       	require.NoError(t, err)

     

       94
       94
       +
       

     

       95
       95
       +
       	assert.Equal(t, "OpenGraph Title", og.Title, "Should prefer og:title")

     

       96
       96
       +
       	assert.Equal(t, "OpenGraph Description", og.Description, "Should prefer og:description")

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       func TestParseOpenGraph_MalformedHTML(t *testing.T) {

     

       100
       100
       +
       	html := `

     

       101
       101
       +
       <!DOCTYPE html>

     

       102
       102
       +
       <html>

     

       103
       103
       +
       <head>

     

       104
       104
       +
           <meta property="og:title" content="Still Works" />

     

       105
       105
       +
           <meta property="og:description" content="Even with broken tags

     

       106
       106
       +
       </head>

     

       107
       107
       +
       <body>

     

       108
       108
       +
           <p>Unclosed paragraph

     

       109
       109
       +
       </body>

     

       110
       110
       +
       `

     

       111
       111
       +
       

     

       112
       112
       +
       	og, err := parseOpenGraph(html)

     

       113
       113
       +
       	require.NoError(t, err)

     

       114
       114
       +
       

     

       115
       115
       +
       	// Best-effort parsing should still extract what it can

     

       116
       116
       +
       	assert.NotEmpty(t, og.Title, "Should extract title despite malformed HTML")

     

       117
       117
       +
       }

     

       118
       118
       +
       

     

       119
       119
       +
       func TestParseOpenGraph_Empty(t *testing.T) {

     

       120
       120
       +
       	html := `

     

       121
       121
       +
       <!DOCTYPE html>

     

       122
       122
       +
       <html>

     

       123
       123
       +
       <head></head>

     

       124
       124
       +
       <body></body>

     

       125
       125
       +
       </html>

     

       126
       126
       +
       `

     

       127
       127
       +
       

     

       128
       128
       +
       	og, err := parseOpenGraph(html)

     

       129
       129
       +
       	require.NoError(t, err)

     

       130
       130
       +
       

     

       131
       131
       +
       	assert.Empty(t, og.Title)

     

       132
       132
       +
       	assert.Empty(t, og.Description)

     

       133
       133
       +
       	assert.Empty(t, og.Image)

     

       134
       134
       +
       }

     

       135
       135
       +
       

     

       136
       136
       +
       func TestFetchOpenGraph_Success(t *testing.T) {

     

       137
       137
       +
       	// Create test server with OpenGraph metadata

     

       138
       138
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       139
       139
       +
       		assert.Contains(t, r.Header.Get("User-Agent"), "CovesBot")

     

       140
       140
       +
       

     

       141
       141
       +
       		html := `

     

       142
       142
       +
       <!DOCTYPE html>

     

       143
       143
       +
       <html>

     

       144
       144
       +
       <head>

     

       145
       145
       +
           <meta property="og:title" content="Test News Article" />

     

       146
       146
       +
           <meta property="og:description" content="Breaking news story" />

     

       147
       147
       +
           <meta property="og:image" content="https://example.com/news.jpg" />

     

       148
       148
       +
           <meta property="og:url" content="https://example.com/article/123" />

     

       149
       149
       +
       </head>

     

       150
       150
       +
       <body><p>Article content</p></body>

     

       151
       151
       +
       </html>

     

       152
       152
       +
       `

     

       153
       153
       +
       		w.Header().Set("Content-Type", "text/html")

     

       154
       154
       +
       		w.WriteHeader(http.StatusOK)

     

       155
       155
       +
       		_, _ = w.Write([]byte(html))

     

       156
       156
       +
       	}))

     

       157
       157
       +
       	defer server.Close()

     

       158
       158
       +
       

     

       159
       159
       +
       	ctx := context.Background()

     

       160
       160
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       161
       161
       +
       	require.NoError(t, err)

     

       162
       162
       +
       	require.NotNil(t, result)

     

       163
       163
       +
       

     

       164
       164
       +
       	assert.Equal(t, "Test News Article", result.Title)

     

       165
       165
       +
       	assert.Equal(t, "Breaking news story", result.Description)

     

       166
       166
       +
       	assert.Equal(t, "https://example.com/news.jpg", result.ThumbnailURL)

     

       167
       167
       +
       	assert.Equal(t, "article", result.Type)

     

       168
       168
       +
       	assert.Equal(t, "opengraph", result.Provider)

     

       169
       169
       +
       }

     

       170
       170
       +
       

     

       171
       171
       +
       func TestFetchOpenGraph_HTTPError(t *testing.T) {

     

       172
       172
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       173
       173
       +
       		w.WriteHeader(http.StatusNotFound)

     

       174
       174
       +
       	}))

     

       175
       175
       +
       	defer server.Close()

     

       176
       176
       +
       

     

       177
       177
       +
       	ctx := context.Background()

     

       178
       178
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       179
       179
       +
       	require.Error(t, err)

     

       180
       180
       +
       	assert.Nil(t, result)

     

       181
       181
       +
       	assert.Contains(t, err.Error(), "404")

     

       182
       182
       +
       }

     

       183
       183
       +
       

     

       184
       184
       +
       func TestFetchOpenGraph_Timeout(t *testing.T) {

     

       185
       185
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       186
       186
       +
       		time.Sleep(2 * time.Second)

     

       187
       187
       +
       		w.WriteHeader(http.StatusOK)

     

       188
       188
       +
       	}))

     

       189
       189
       +
       	defer server.Close()

     

       190
       190
       +
       

     

       191
       191
       +
       	ctx := context.Background()

     

       192
       192
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 100*time.Millisecond, "CovesBot/1.0")

     

       193
       193
       +
       	require.Error(t, err)

     

       194
       194
       +
       	assert.Nil(t, result)

     

       195
       195
       +
       }

     

       196
       196
       +
       

     

       197
       197
       +
       func TestFetchOpenGraph_NoMetadata(t *testing.T) {

     

       198
       198
       +
       	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       199
       199
       +
       		html := `<html><head></head><body><p>No metadata</p></body></html>`

     

       200
       200
       +
       		w.Header().Set("Content-Type", "text/html")

     

       201
       201
       +
       		w.WriteHeader(http.StatusOK)

     

       202
       202
       +
       		_, _ = w.Write([]byte(html))

     

       203
       203
       +
       	}))

     

       204
       204
       +
       	defer server.Close()

     

       205
       205
       +
       

     

       206
       206
       +
       	ctx := context.Background()

     

       207
       207
       +
       	result, err := fetchOpenGraph(ctx, server.URL, 10*time.Second, "CovesBot/1.0")

     

       208
       208
       +
       	require.NoError(t, err)

     

       209
       209
       +
       	require.NotNil(t, result)

     

       210
       210
       +
       

     

       211
       211
       +
       	// Should still return a result with domain

     

       212
       212
       +
       	assert.Equal(t, "article", result.Type)

     

       213
       213
       +
       	assert.Equal(t, "opengraph", result.Provider)

     

       214
       214
       +
       	assert.NotEmpty(t, result.Domain)

     

       215
       215
       +
       }

     

       216
       216
       +
       

     

       217
       217
       +
       func TestIsOEmbedProvider(t *testing.T) {

     

       218
       218
       +
       	tests := []struct {

     

       219
       219
       +
       		url      string

     

       220
       220
       +
       		expected bool

     

       221
       221
       +
       	}{

     

       222
       222
       +
       		{"https://streamable.com/abc123", true},

     

       223
       223
       +
       		{"https://www.youtube.com/watch?v=test", true},

     

       224
       224
       +
       		{"https://youtu.be/test", true},

     

       225
       225
       +
       		{"https://reddit.com/r/test/comments/123", true},

     

       226
       226
       +
       		{"https://www.reddit.com/r/test/comments/123", true},

     

       227
       227
       +
       		{"https://example.com/article", false},

     

       228
       228
       +
       		{"https://news.ycombinator.com/item?id=123", false},

     

       229
       229
       +
       		{"https://kite.kagi.com/search?q=test", false},

     

       230
       230
       +
       	}

     

       231
       231
       +
       

     

       232
       232
       +
       	for _, tt := range tests {

     

       233
       233
       +
       		t.Run(tt.url, func(t *testing.T) {

     

       234
       234
       +
       			result := isOEmbedProvider(tt.url)

     

       235
       235
       +
       			assert.Equal(t, tt.expected, result, "URL: %s", tt.url)

     

       236
       236
       +
       		})

     

       237
       237
       +
       	}

     

       238
       238
       +
       }

     

       239
       239
       +
       

     

       240
       240
       +
       func TestIsSupported(t *testing.T) {

     

       241
       241
       +
       	tests := []struct {

     

       242
       242
       +
       		url      string

     

       243
       243
       +
       		expected bool

     

       244
       244
       +
       	}{

     

       245
       245
       +
       		{"https://example.com", true},

     

       246
       246
       +
       		{"http://example.com", true},

     

       247
       247
       +
       		{"https://news.site.com/article", true},

     

       248
       248
       +
       		{"ftp://example.com", false},

     

       249
       249
       +
       		{"not-a-url", false},

     

       250
       250
       +
       		{"", false},

     

       251
       251
       +
       	}

     

       252
       252
       +
       

     

       253
       253
       +
       	for _, tt := range tests {

     

       254
       254
       +
       		t.Run(tt.url, func(t *testing.T) {

     

       255
       255
       +
       			result := isSupported(tt.url)

     

       256
       256
       +
       			assert.Equal(t, tt.expected, result, "URL: %s", tt.url)

     

       257
       257
       +
       		})

     

       258
       258
       +
       	}

     

       259
       259
       +
       }

     

       260
       260
       +
       

     

       261
       261
       +
       func TestGetAttr(t *testing.T) {

     

       262
       262
       +
       	html := `<meta property="og:title" content="Test Title" name="test" />`

     

       263
       263
       +
       	doc, err := parseOpenGraph(html)

     

       264
       264
       +
       	require.NoError(t, err)

     

       265
       265
       +
       

     

       266
       266
       +
       	// This is a simple test to verify the helper function works

     

       267
       267
       +
       	// The actual usage is tested in the parseOpenGraph tests

     

       268
       268
       +
       	assert.NotNil(t, doc)

     

       269
       269
       +
       }

+170

internal/core/unfurl/service.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"log"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // Service handles URL unfurling with caching

     

       11
       11
       +
       type Service interface {

     

       12
       12
       +
       	UnfurlURL(ctx context.Context, url string) (*UnfurlResult, error)

     

       13
       13
       +
       	IsSupported(url string) bool

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       type service struct {

     

       17
       17
       +
       	repo           Repository

     

       18
       18
       +
       	circuitBreaker *circuitBreaker

     

       19
       19
       +
       	userAgent      string

     

       20
       20
       +
       	timeout        time.Duration

     

       21
       21
       +
       	cacheTTL       time.Duration

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       // NewService creates a new unfurl service

     

       25
       25
       +
       func NewService(repo Repository, opts ...ServiceOption) Service {

     

       26
       26
       +
       	s := &service{

     

       27
       27
       +
       		repo:           repo,

     

       28
       28
       +
       		timeout:        10 * time.Second,

     

       29
       29
       +
       		userAgent:      "CovesBot/1.0 (+https://coves.social)",

     

       30
       30
       +
       		cacheTTL:       24 * time.Hour,

     

       31
       31
       +
       		circuitBreaker: newCircuitBreaker(),

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	for _, opt := range opts {

     

       35
       35
       +
       		opt(s)

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	return s

     

       39
       39
       +
       }

     

       40
       40
       +
       

     

       41
       41
       +
       // ServiceOption configures the service

     

       42
       42
       +
       type ServiceOption func(*service)

     

       43
       43
       +
       

     

       44
       44
       +
       // WithTimeout sets the HTTP timeout for oEmbed requests

     

       45
       45
       +
       func WithTimeout(timeout time.Duration) ServiceOption {

     

       46
       46
       +
       	return func(s *service) {

     

       47
       47
       +
       		s.timeout = timeout

     

       48
       48
       +
       	}

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       // WithUserAgent sets the User-Agent header for oEmbed requests

     

       52
       52
       +
       func WithUserAgent(userAgent string) ServiceOption {

     

       53
       53
       +
       	return func(s *service) {

     

       54
       54
       +
       		s.userAgent = userAgent

     

       55
       55
       +
       	}

     

       56
       56
       +
       }

     

       57
       57
       +
       

     

       58
       58
       +
       // WithCacheTTL sets the cache TTL

     

       59
       59
       +
       func WithCacheTTL(ttl time.Duration) ServiceOption {

     

       60
       60
       +
       	return func(s *service) {

     

       61
       61
       +
       		s.cacheTTL = ttl

     

       62
       62
       +
       	}

     

       63
       63
       +
       }

     

       64
       64
       +
       

     

       65
       65
       +
       // IsSupported returns true if we can unfurl this URL

     

       66
       66
       +
       func (s *service) IsSupported(url string) bool {

     

       67
       67
       +
       	return isSupported(url)

     

       68
       68
       +
       }

     

       69
       69
       +
       

     

       70
       70
       +
       // UnfurlURL fetches metadata for a URL (with caching)

     

       71
       71
       +
       func (s *service) UnfurlURL(ctx context.Context, urlStr string) (*UnfurlResult, error) {

     

       72
       72
       +
       	// 1. Check cache first

     

       73
       73
       +
       	cached, err := s.repo.Get(ctx, urlStr)

     

       74
       74
       +
       	if err == nil && cached != nil {

     

       75
       75
       +
       		log.Printf("[UNFURL] Cache hit for %s (provider: %s)", urlStr, cached.Provider)

     

       76
       76
       +
       		return cached, nil

     

       77
       77
       +
       	}

     

       78
       78
       +
       

     

       79
       79
       +
       	// 2. Check if we support this URL

     

       80
       80
       +
       	if !isSupported(urlStr) {

     

       81
       81
       +
       		return nil, fmt.Errorf("unsupported URL: %s", urlStr)

     

       82
       82
       +
       	}

     

       83
       83
       +
       

     

       84
       84
       +
       	var result *UnfurlResult

     

       85
       85
       +
       	domain := extractDomain(urlStr)

     

       86
       86
       +
       

     

       87
       87
       +
       	// 3. Smart routing: Special handling for Kagi Kite (client-side rendered, no og:image tags)

     

       88
       88
       +
       	if domain == "kite.kagi.com" {

     

       89
       89
       +
       		provider := "kagi"

     

       90
       90
       +
       

     

       91
       91
       +
       		// Check circuit breaker

     

       92
       92
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       93
       93
       +
       		if !canAttempt {

     

       94
       94
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       95
       95
       +
       			return nil, err

     

       96
       96
       +
       		}

     

       97
       97
       +
       

     

       98
       98
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching via Kagi parser...", urlStr)

     

       99
       99
       +
       		result, err = fetchKagiKite(ctx, urlStr, s.timeout, s.userAgent)

     

       100
       100
       +
       		if err != nil {

     

       101
       101
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       102
       102
       +
       			return nil, err

     

       103
       103
       +
       		}

     

       104
       104
       +
       

     

       105
       105
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       106
       106
       +
       

     

       107
       107
       +
       		// Cache result

     

       108
       108
       +
       		if cacheErr := s.repo.Set(ctx, urlStr, result, s.cacheTTL); cacheErr != nil {

     

       109
       109
       +
       			log.Printf("[UNFURL] Warning: failed to cache result: %v", cacheErr)

     

       110
       110
       +
       		}

     

       111
       111
       +
       		return result, nil

     

       112
       112
       +
       	}

     

       113
       113
       +
       

     

       114
       114
       +
       	// 4. Check if this is a known oEmbed provider

     

       115
       115
       +
       	if isOEmbedProvider(urlStr) {

     

       116
       116
       +
       		provider := domain // Use domain as provider name (e.g., "streamable.com", "youtube.com")

     

       117
       117
       +
       

     

       118
       118
       +
       		// Check circuit breaker

     

       119
       119
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       120
       120
       +
       		if !canAttempt {

     

       121
       121
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       122
       122
       +
       			return nil, err

     

       123
       123
       +
       		}

     

       124
       124
       +
       

     

       125
       125
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching from oEmbed...", urlStr)

     

       126
       126
       +
       

     

       127
       127
       +
       		// Fetch from oEmbed provider

     

       128
       128
       +
       		oembed, err := fetchOEmbed(ctx, urlStr, s.timeout, s.userAgent)

     

       129
       129
       +
       		if err != nil {

     

       130
       130
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       131
       131
       +
       			return nil, fmt.Errorf("failed to fetch oEmbed data: %w", err)

     

       132
       132
       +
       		}

     

       133
       133
       +
       

     

       134
       134
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       135
       135
       +
       

     

       136
       136
       +
       		// Convert to UnfurlResult

     

       137
       137
       +
       		result = mapOEmbedToResult(oembed, urlStr)

     

       138
       138
       +
       	} else {

     

       139
       139
       +
       		provider := "opengraph"

     

       140
       140
       +
       

     

       141
       141
       +
       		// Check circuit breaker

     

       142
       142
       +
       		canAttempt, err := s.circuitBreaker.canAttempt(provider)

     

       143
       143
       +
       		if !canAttempt {

     

       144
       144
       +
       			log.Printf("[UNFURL] Skipping %s due to circuit breaker: %v", urlStr, err)

     

       145
       145
       +
       			return nil, err

     

       146
       146
       +
       		}

     

       147
       147
       +
       

     

       148
       148
       +
       		log.Printf("[UNFURL] Cache miss for %s, fetching via OpenGraph...", urlStr)

     

       149
       149
       +
       

     

       150
       150
       +
       		// Fetch via OpenGraph

     

       151
       151
       +
       		result, err = fetchOpenGraph(ctx, urlStr, s.timeout, s.userAgent)

     

       152
       152
       +
       		if err != nil {

     

       153
       153
       +
       			s.circuitBreaker.recordFailure(provider, err)

     

       154
       154
       +
       			return nil, fmt.Errorf("failed to fetch OpenGraph data: %w", err)

     

       155
       155
       +
       		}

     

       156
       156
       +
       

     

       157
       157
       +
       		s.circuitBreaker.recordSuccess(provider)

     

       158
       158
       +
       	}

     

       159
       159
       +
       

     

       160
       160
       +
       	// 5. Store in cache

     

       161
       161
       +
       	if cacheErr := s.repo.Set(ctx, urlStr, result, s.cacheTTL); cacheErr != nil {

     

       162
       162
       +
       		// Log but don't fail - cache is best-effort

     

       163
       163
       +
       		log.Printf("[UNFURL] Warning: Failed to cache result for %s: %v", urlStr, cacheErr)

     

       164
       164
       +
       	}

     

       165
       165
       +
       

     

       166
       166
       +
       	log.Printf("[UNFURL] Successfully unfurled %s (provider: %s, type: %s)",

     

       167
       167
       +
       		urlStr, result.Provider, result.Type)

     

       168
       168
       +
       

     

       169
       169
       +
       	return result, nil

     

       170
       170
       +
       }

+27

internal/core/unfurl/types.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import "time"

     

       4
       4
       +
       

     

       5
       5
       +
       // UnfurlResult represents the result of unfurling a URL

     

       6
       6
       +
       type UnfurlResult struct {

     

       7
       7
       +
       	Type         string `json:"type"`         // "video", "article", "image", "website"

     

       8
       8
       +
       	URI          string `json:"uri"`          // Original URL

     

       9
       9
       +
       	Title        string `json:"title"`        // Page/video title

     

       10
       10
       +
       	Description  string `json:"description"`  // Page/video description

     

       11
       11
       +
       	ThumbnailURL string `json:"thumbnailUrl"` // Preview image URL

     

       12
       12
       +
       	Provider     string `json:"provider"`     // "streamable", "youtube", "reddit"

     

       13
       13
       +
       	Domain       string `json:"domain"`       // Domain of the URL

     

       14
       14
       +
       	Width        int    `json:"width"`        // Media width (if applicable)

     

       15
       15
       +
       	Height       int    `json:"height"`       // Media height (if applicable)

     

       16
       16
       +
       }

     

       17
       17
       +
       

     

       18
       18
       +
       // CacheEntry represents a cached unfurl result with metadata

     

       19
       19
       +
       type CacheEntry struct {

     

       20
       20
       +
       	FetchedAt    time.Time    `db:"fetched_at"`

     

       21
       21
       +
       	ExpiresAt    time.Time    `db:"expires_at"`

     

       22
       22
       +
       	CreatedAt    time.Time    `db:"created_at"`

     

       23
       23
       +
       	ThumbnailURL *string      `db:"thumbnail_url"`

     

       24
       24
       +
       	URL          string       `db:"url"`

     

       25
       25
       +
       	Provider     string       `db:"provider"`

     

       26
       26
       +
       	Metadata     UnfurlResult `db:"metadata"`

     

       27
       27
       +
       }

+14

internal/core/unfurl/errors.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import "errors"

     

       4
       4
       +
       

     

       5
       5
       +
       var (

     

       6
       6
       +
       	// ErrNotFound is returned when an unfurl cache entry is not found or has expired

     

       7
       7
       +
       	ErrNotFound = errors.New("unfurl cache entry not found or expired")

     

       8
       8
       +
       

     

       9
       9
       +
       	// ErrInvalidURL is returned when the provided URL is invalid

     

       10
       10
       +
       	ErrInvalidURL = errors.New("invalid URL")

     

       11
       11
       +
       

     

       12
       12
       +
       	// ErrInvalidTTL is returned when the provided TTL is invalid (e.g., negative or zero)

     

       13
       13
       +
       	ErrInvalidTTL = errors.New("invalid TTL: must be positive")

     

       14
       14
       +
       )

+19

internal/core/unfurl/interfaces.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       // Repository defines the interface for unfurl cache persistence

     

       9
       9
       +
       type Repository interface {

     

       10
       10
       +
       	// Get retrieves a cached unfurl result for the given URL.

     

       11
       11
       +
       	// Returns nil, nil if not found or expired (not an error condition).

     

       12
       12
       +
       	// Returns error only on database failures.

     

       13
       13
       +
       	Get(ctx context.Context, url string) (*UnfurlResult, error)

     

       14
       14
       +
       

     

       15
       15
       +
       	// Set stores an unfurl result in the cache with the specified TTL.

     

       16
       16
       +
       	// If an entry already exists for the URL, it will be updated.

     

       17
       17
       +
       	// The expires_at is calculated as NOW() + ttl.

     

       18
       18
       +
       	Set(ctx context.Context, url string, result *UnfurlResult, ttl time.Duration) error

     

       19
       19
       +
       }

+117

internal/core/unfurl/repository.go

···

       1
       1
       +
       package unfurl

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"fmt"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       type postgresUnfurlRepo struct {

     

       12
       12
       +
       	db *sql.DB

     

       13
       13
       +
       }

     

       14
       14
       +
       

     

       15
       15
       +
       // NewRepository creates a new PostgreSQL unfurl cache repository

     

       16
       16
       +
       func NewRepository(db *sql.DB) Repository {

     

       17
       17
       +
       	return &postgresUnfurlRepo{db: db}

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // Get retrieves a cached unfurl result for the given URL.

     

       21
       21
       +
       // Returns nil, nil if not found or expired (not an error condition).

     

       22
       22
       +
       // Returns error only on database failures.

     

       23
       23
       +
       func (r *postgresUnfurlRepo) Get(ctx context.Context, url string) (*UnfurlResult, error) {

     

       24
       24
       +
       	query := `

     

       25
       25
       +
       		SELECT metadata, thumbnail_url, provider

     

       26
       26
       +
       		FROM unfurl_cache

     

       27
       27
       +
       		WHERE url = $1 AND expires_at > NOW()

     

       28
       28
       +
       	`

     

       29
       29
       +
       

     

       30
       30
       +
       	var metadataJSON []byte

     

       31
       31
       +
       	var thumbnailURL sql.NullString

     

       32
       32
       +
       	var provider string

     

       33
       33
       +
       

     

       34
       34
       +
       	err := r.db.QueryRowContext(ctx, query, url).Scan(&metadataJSON, &thumbnailURL, &provider)

     

       35
       35
       +
       	if err == sql.ErrNoRows {

     

       36
       36
       +
       		// Not found or expired is not an error

     

       37
       37
       +
       		return nil, nil

     

       38
       38
       +
       	}

     

       39
       39
       +
       	if err != nil {

     

       40
       40
       +
       		return nil, fmt.Errorf("failed to get unfurl cache entry: %w", err)

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// Unmarshal metadata JSONB to UnfurlResult

     

       44
       44
       +
       	var result UnfurlResult

     

       45
       45
       +
       	if err := json.Unmarshal(metadataJSON, &result); err != nil {

     

       46
       46
       +
       		return nil, fmt.Errorf("failed to unmarshal metadata: %w", err)

     

       47
       47
       +
       	}

     

       48
       48
       +
       

     

       49
       49
       +
       	// Ensure provider and thumbnailURL are set (may not be in metadata JSON)

     

       50
       50
       +
       	result.Provider = provider

     

       51
       51
       +
       	if thumbnailURL.Valid {

     

       52
       52
       +
       		result.ThumbnailURL = thumbnailURL.String

     

       53
       53
       +
       	}

     

       54
       54
       +
       

     

       55
       55
       +
       	return &result, nil

     

       56
       56
       +
       }

     

       57
       57
       +
       

     

       58
       58
       +
       // Set stores an unfurl result in the cache with the specified TTL.

     

       59
       59
       +
       // If an entry already exists for the URL, it will be updated.

     

       60
       60
       +
       // The expires_at is calculated as NOW() + ttl.

     

       61
       61
       +
       func (r *postgresUnfurlRepo) Set(ctx context.Context, url string, result *UnfurlResult, ttl time.Duration) error {

     

       62
       62
       +
       	// Marshal UnfurlResult to JSON for metadata column

     

       63
       63
       +
       	metadataJSON, err := json.Marshal(result)

     

       64
       64
       +
       	if err != nil {

     

       65
       65
       +
       		return fmt.Errorf("failed to marshal metadata: %w", err)

     

       66
       66
       +
       	}

     

       67
       67
       +
       

     

       68
       68
       +
       	// Store thumbnail_url separately for potential queries

     

       69
       69
       +
       	var thumbnailURL sql.NullString

     

       70
       70
       +
       	if result.ThumbnailURL != "" {

     

       71
       71
       +
       		thumbnailURL.String = result.ThumbnailURL

     

       72
       72
       +
       		thumbnailURL.Valid = true

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Convert Go duration to PostgreSQL interval string

     

       76
       76
       +
       	// e.g., "1 hour", "24 hours", "7 days"

     

       77
       77
       +
       	intervalStr := formatInterval(ttl)

     

       78
       78
       +
       

     

       79
       79
       +
       	query := `

     

       80
       80
       +
       		INSERT INTO unfurl_cache (url, provider, metadata, thumbnail_url, expires_at)

     

       81
       81
       +
       		VALUES ($1, $2, $3, $4, NOW() + $5::interval)

     

       82
       82
       +
       		ON CONFLICT (url) DO UPDATE

     

       83
       83
       +
       		SET provider = EXCLUDED.provider,

     

       84
       84
       +
       		    metadata = EXCLUDED.metadata,

     

       85
       85
       +
       		    thumbnail_url = EXCLUDED.thumbnail_url,

     

       86
       86
       +
       		    expires_at = EXCLUDED.expires_at,

     

       87
       87
       +
       		    fetched_at = NOW()

     

       88
       88
       +
       	`

     

       89
       89
       +
       

     

       90
       90
       +
       	_, err = r.db.ExecContext(ctx, query, url, result.Provider, metadataJSON, thumbnailURL, intervalStr)

     

       91
       91
       +
       	if err != nil {

     

       92
       92
       +
       		return fmt.Errorf("failed to insert/update unfurl cache entry: %w", err)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	return nil

     

       96
       96
       +
       }

     

       97
       97
       +
       

     

       98
       98
       +
       // formatInterval converts a Go duration to a PostgreSQL interval string

     

       99
       99
       +
       // PostgreSQL accepts intervals like "1 hour", "24 hours", "7 days"

     

       100
       100
       +
       func formatInterval(d time.Duration) string {

     

       101
       101
       +
       	seconds := int64(d.Seconds())

     

       102
       102
       +
       

     

       103
       103
       +
       	// Convert to appropriate unit for readability

     

       104
       104
       +
       	switch {

     

       105
       105
       +
       	case seconds >= 86400: // >= 1 day

     

       106
       106
       +
       		days := seconds / 86400

     

       107
       107
       +
       		return fmt.Sprintf("%d days", days)

     

       108
       108
       +
       	case seconds >= 3600: // >= 1 hour

     

       109
       109
       +
       		hours := seconds / 3600

     

       110
       110
       +
       		return fmt.Sprintf("%d hours", hours)

     

       111
       111
       +
       	case seconds >= 60: // >= 1 minute

     

       112
       112
       +
       		minutes := seconds / 60

     

       113
       113
       +
       		return fmt.Sprintf("%d minutes", minutes)

     

       114
       114
       +
       	default:

     

       115
       115
       +
       		return fmt.Sprintf("%d seconds", seconds)

     

       116
       116
       +
       	}

     

       117
       117
       +
       }

+23

internal/db/migrations/017_create_unfurl_cache.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       CREATE TABLE unfurl_cache (

     

       3
       3
       +
           url TEXT PRIMARY KEY,

     

       4
       4
       +
           provider TEXT NOT NULL,

     

       5
       5
       +
           metadata JSONB NOT NULL,

     

       6
       6
       +
           thumbnail_url TEXT,

     

       7
       7
       +
           fetched_at TIMESTAMP NOT NULL DEFAULT NOW(),

     

       8
       8
       +
           expires_at TIMESTAMP NOT NULL,

     

       9
       9
       +
           created_at TIMESTAMP NOT NULL DEFAULT NOW()

     

       10
       10
       +
       );

     

       11
       11
       +
       

     

       12
       12
       +
       CREATE INDEX idx_unfurl_cache_expires ON unfurl_cache(expires_at);

     

       13
       13
       +
       

     

       14
       14
       +
       COMMENT ON TABLE unfurl_cache IS 'Cache for oEmbed/URL unfurl results to reduce external API calls';

     

       15
       15
       +
       COMMENT ON COLUMN unfurl_cache.url IS 'The URL that was unfurled (primary key)';

     

       16
       16
       +
       COMMENT ON COLUMN unfurl_cache.provider IS 'Provider name (streamable, youtube, reddit, etc.)';

     

       17
       17
       +
       COMMENT ON COLUMN unfurl_cache.metadata IS 'Full unfurl result as JSON (title, description, type, etc.)';

     

       18
       18
       +
       COMMENT ON COLUMN unfurl_cache.thumbnail_url IS 'URL of the thumbnail image';

     

       19
       19
       +
       COMMENT ON COLUMN unfurl_cache.expires_at IS 'When this cache entry should be refetched (TTL-based)';

     

       20
       20
       +
       

     

       21
       21
       +
       -- +goose Down

     

       22
       22
       +
       DROP INDEX IF EXISTS idx_unfurl_cache_expires;

     

       23
       23
       +
       DROP TABLE IF EXISTS unfurl_cache;

internal/core/blobs/types.go

···

       1
       1
       +
       package blobs

     

       2
       2
       +
       

     

       3
       3
       +
       // BlobRef represents a blob reference for atproto records

     

       4
       4
       +
       type BlobRef struct {

     

       5
       5
       +
       	Type     string            `json:"$type"`

     

       6
       6
       +
       	Ref      map[string]string `json:"ref"`

     

       7
       7
       +
       	MimeType string            `json:"mimeType"`

     

       8
       8
       +
       	Size     int               `json:"size"`

     

       9
       9
       +
       }

+7 -1

internal/core/posts/interfaces.go

···

       1
       1
        
       package posts

     

       2
       2
        
       

     

       3
       3
       -
       import "context"

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       )

     

       6
       6
       +
       

     

       7
       7
       +
       // Service constructor accepts optional blobs.Service and unfurl.Service for embed enhancement.

     

       8
       8
       +
       // When unfurlService is provided, external embeds will be automatically enriched with metadata.

     

       9
       9
       +
       // When blobService is provided, thumbnails from unfurled URLs will be uploaded as blobs.

     

       4
       10
        
       

     

       5
       11
        
       // Service defines the business logic interface for posts

     

       6
       12
        
       // Coordinates between Repository, community service, and PDS

+81

internal/core/posts/blob_transform.go

···

       1
       1
       +
       package posts

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       )

     

       6
       6
       +
       

     

       7
       7
       +
       // TransformBlobRefsToURLs transforms all blob references in a PostView to PDS URLs

     

       8
       8
       +
       // This modifies the Embed field in-place, converting blob refs to direct URLs

     

       9
       9
       +
       // The transformation only affects external embeds with thumbnail blobs

     

       10
       10
       +
       func TransformBlobRefsToURLs(postView *PostView) {

     

       11
       11
       +
       	if postView == nil || postView.Embed == nil {

     

       12
       12
       +
       		return

     

       13
       13
       +
       	}

     

       14
       14
       +
       

     

       15
       15
       +
       	// Get community PDS URL from post view

     

       16
       16
       +
       	if postView.Community == nil || postView.Community.PDSURL == "" {

     

       17
       17
       +
       		return // Cannot transform without PDS URL

     

       18
       18
       +
       	}

     

       19
       19
       +
       

     

       20
       20
       +
       	communityDID := postView.Community.DID

     

       21
       21
       +
       	pdsURL := postView.Community.PDSURL

     

       22
       22
       +
       

     

       23
       23
       +
       	// Check if embed is a map (should be for external embeds)

     

       24
       24
       +
       	embedMap, ok := postView.Embed.(map[string]interface{})

     

       25
       25
       +
       	if !ok {

     

       26
       26
       +
       		return

     

       27
       27
       +
       	}

     

       28
       28
       +
       

     

       29
       29
       +
       	// Check embed type

     

       30
       30
       +
       	embedType, ok := embedMap["$type"].(string)

     

       31
       31
       +
       	if !ok {

     

       32
       32
       +
       		return

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	// Only transform external embeds

     

       36
       36
       +
       	if embedType == "social.coves.embed.external" {

     

       37
       37
       +
       		if external, ok := embedMap["external"].(map[string]interface{}); ok {

     

       38
       38
       +
       			transformThumbToURL(external, communityDID, pdsURL)

     

       39
       39
       +
       		}

     

       40
       40
       +
       	}

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       // transformThumbToURL converts a thumb blob ref to a PDS URL

     

       44
       44
       +
       // This modifies the external map in-place

     

       45
       45
       +
       func transformThumbToURL(external map[string]interface{}, communityDID, pdsURL string) {

     

       46
       46
       +
       	// Check if thumb exists

     

       47
       47
       +
       	thumb, ok := external["thumb"]

     

       48
       48
       +
       	if !ok {

     

       49
       49
       +
       		return

     

       50
       50
       +
       	}

     

       51
       51
       +
       

     

       52
       52
       +
       	// If thumb is already a string (URL), don't transform

     

       53
       53
       +
       	if _, isString := thumb.(string); isString {

     

       54
       54
       +
       		return

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	// Try to parse as blob ref

     

       58
       58
       +
       	thumbMap, ok := thumb.(map[string]interface{})

     

       59
       59
       +
       	if !ok {

     

       60
       60
       +
       		return

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Extract CID from blob ref

     

       64
       64
       +
       	ref, ok := thumbMap["ref"].(map[string]interface{})

     

       65
       65
       +
       	if !ok {

     

       66
       66
       +
       		return

     

       67
       67
       +
       	}

     

       68
       68
       +
       

     

       69
       69
       +
       	cid, ok := ref["$link"].(string)

     

       70
       70
       +
       	if !ok || cid == "" {

     

       71
       71
       +
       		return

     

       72
       72
       +
       	}

     

       73
       73
       +
       

     

       74
       74
       +
       	// Transform to PDS blob endpoint URL

     

       75
       75
       +
       	// Format: {pds_url}/xrpc/com.atproto.sync.getBlob?did={community_did}&cid={cid}

     

       76
       76
       +
       	blobURL := fmt.Sprintf("%s/xrpc/com.atproto.sync.getBlob?did=%s&cid=%s",

     

       77
       77
       +
       		pdsURL, communityDID, cid)

     

       78
       78
       +
       

     

       79
       79
       +
       	// Replace blob ref with URL string

     

       80
       80
       +
       	external["thumb"] = blobURL

     

       81
       81
       +
       }

+312

internal/core/posts/blob_transform_test.go

···

       1
       1
       +
       package posts

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"testing"

     

       5
       5
       +
       

     

       6
       6
       +
       	"github.com/stretchr/testify/assert"

     

       7
       7
       +
       	"github.com/stretchr/testify/require"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       func TestTransformBlobRefsToURLs(t *testing.T) {

     

       11
       11
       +
       	t.Run("transforms external embed thumb from blob to URL", func(t *testing.T) {

     

       12
       12
       +
       		post := &PostView{

     

       13
       13
       +
       			Community: &CommunityRef{

     

       14
       14
       +
       				DID:    "did:plc:testcommunity",

     

       15
       15
       +
       				PDSURL: "http://localhost:3001",

     

       16
       16
       +
       			},

     

       17
       17
       +
       			Embed: map[string]interface{}{

     

       18
       18
       +
       				"$type": "social.coves.embed.external",

     

       19
       19
       +
       				"external": map[string]interface{}{

     

       20
       20
       +
       					"uri": "https://example.com",

     

       21
       21
       +
       					"thumb": map[string]interface{}{

     

       22
       22
       +
       						"$type": "blob",

     

       23
       23
       +
       						"ref": map[string]interface{}{

     

       24
       24
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       25
       25
       +
       						},

     

       26
       26
       +
       						"mimeType": "image/jpeg",

     

       27
       27
       +
       						"size":     52813,

     

       28
       28
       +
       					},

     

       29
       29
       +
       				},

     

       30
       30
       +
       			},

     

       31
       31
       +
       		}

     

       32
       32
       +
       

     

       33
       33
       +
       		TransformBlobRefsToURLs(post)

     

       34
       34
       +
       

     

       35
       35
       +
       		// Verify embed is still a map

     

       36
       36
       +
       		embedMap, ok := post.Embed.(map[string]interface{})

     

       37
       37
       +
       		require.True(t, ok, "embed should still be a map")

     

       38
       38
       +
       

     

       39
       39
       +
       		// Verify external is still a map

     

       40
       40
       +
       		external, ok := embedMap["external"].(map[string]interface{})

     

       41
       41
       +
       		require.True(t, ok, "external should be a map")

     

       42
       42
       +
       

     

       43
       43
       +
       		// Verify thumb is now a URL string

     

       44
       44
       +
       		thumbURL, ok := external["thumb"].(string)

     

       45
       45
       +
       		require.True(t, ok, "thumb should be a string URL")

     

       46
       46
       +
       		assert.Equal(t,

     

       47
       47
       +
       			"http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:testcommunity&cid=bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       48
       48
       +
       			thumbURL)

     

       49
       49
       +
       	})

     

       50
       50
       +
       

     

       51
       51
       +
       	t.Run("handles missing thumb gracefully", func(t *testing.T) {

     

       52
       52
       +
       		post := &PostView{

     

       53
       53
       +
       			Community: &CommunityRef{

     

       54
       54
       +
       				DID:    "did:plc:testcommunity",

     

       55
       55
       +
       				PDSURL: "http://localhost:3001",

     

       56
       56
       +
       			},

     

       57
       57
       +
       			Embed: map[string]interface{}{

     

       58
       58
       +
       				"$type": "social.coves.embed.external",

     

       59
       59
       +
       				"external": map[string]interface{}{

     

       60
       60
       +
       					"uri": "https://example.com",

     

       61
       61
       +
       					// No thumb field

     

       62
       62
       +
       				},

     

       63
       63
       +
       			},

     

       64
       64
       +
       		}

     

       65
       65
       +
       

     

       66
       66
       +
       		// Should not panic

     

       67
       67
       +
       		TransformBlobRefsToURLs(post)

     

       68
       68
       +
       

     

       69
       69
       +
       		// Verify external is unchanged

     

       70
       70
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       71
       71
       +
       		external := embedMap["external"].(map[string]interface{})

     

       72
       72
       +
       		_, hasThumb := external["thumb"]

     

       73
       73
       +
       		assert.False(t, hasThumb, "thumb should not be added")

     

       74
       74
       +
       	})

     

       75
       75
       +
       

     

       76
       76
       +
       	t.Run("handles already-transformed URL thumb", func(t *testing.T) {

     

       77
       77
       +
       		expectedURL := "http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafytest"

     

       78
       78
       +
       		post := &PostView{

     

       79
       79
       +
       			Community: &CommunityRef{

     

       80
       80
       +
       				DID:    "did:plc:testcommunity",

     

       81
       81
       +
       				PDSURL: "http://localhost:3001",

     

       82
       82
       +
       			},

     

       83
       83
       +
       			Embed: map[string]interface{}{

     

       84
       84
       +
       				"$type": "social.coves.embed.external",

     

       85
       85
       +
       				"external": map[string]interface{}{

     

       86
       86
       +
       					"uri":   "https://example.com",

     

       87
       87
       +
       					"thumb": expectedURL, // Already a URL string

     

       88
       88
       +
       				},

     

       89
       89
       +
       			},

     

       90
       90
       +
       		}

     

       91
       91
       +
       

     

       92
       92
       +
       		// Should not error or change the URL

     

       93
       93
       +
       		TransformBlobRefsToURLs(post)

     

       94
       94
       +
       

     

       95
       95
       +
       		// Verify thumb is unchanged

     

       96
       96
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       97
       97
       +
       		external := embedMap["external"].(map[string]interface{})

     

       98
       98
       +
       		thumbURL, ok := external["thumb"].(string)

     

       99
       99
       +
       		require.True(t, ok, "thumb should still be a string")

     

       100
       100
       +
       		assert.Equal(t, expectedURL, thumbURL, "thumb URL should be unchanged")

     

       101
       101
       +
       	})

     

       102
       102
       +
       

     

       103
       103
       +
       	t.Run("handles missing embed", func(t *testing.T) {

     

       104
       104
       +
       		post := &PostView{

     

       105
       105
       +
       			Community: &CommunityRef{

     

       106
       106
       +
       				DID:    "did:plc:testcommunity",

     

       107
       107
       +
       				PDSURL: "http://localhost:3001",

     

       108
       108
       +
       			},

     

       109
       109
       +
       			Embed: nil,

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       112
       112
       +
       		// Should not panic

     

       113
       113
       +
       		TransformBlobRefsToURLs(post)

     

       114
       114
       +
       

     

       115
       115
       +
       		// Verify embed is still nil

     

       116
       116
       +
       		assert.Nil(t, post.Embed, "embed should remain nil")

     

       117
       117
       +
       	})

     

       118
       118
       +
       

     

       119
       119
       +
       	t.Run("handles nil post", func(t *testing.T) {

     

       120
       120
       +
       		// Should not panic

     

       121
       121
       +
       		TransformBlobRefsToURLs(nil)

     

       122
       122
       +
       	})

     

       123
       123
       +
       

     

       124
       124
       +
       	t.Run("handles missing community", func(t *testing.T) {

     

       125
       125
       +
       		post := &PostView{

     

       126
       126
       +
       			Community: nil,

     

       127
       127
       +
       			Embed: map[string]interface{}{

     

       128
       128
       +
       				"$type": "social.coves.embed.external",

     

       129
       129
       +
       				"external": map[string]interface{}{

     

       130
       130
       +
       					"uri": "https://example.com",

     

       131
       131
       +
       					"thumb": map[string]interface{}{

     

       132
       132
       +
       						"$type": "blob",

     

       133
       133
       +
       						"ref": map[string]interface{}{

     

       134
       134
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       135
       135
       +
       						},

     

       136
       136
       +
       					},

     

       137
       137
       +
       				},

     

       138
       138
       +
       			},

     

       139
       139
       +
       		}

     

       140
       140
       +
       

     

       141
       141
       +
       		// Should not panic or transform

     

       142
       142
       +
       		TransformBlobRefsToURLs(post)

     

       143
       143
       +
       

     

       144
       144
       +
       		// Verify thumb is unchanged (still a blob)

     

       145
       145
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       146
       146
       +
       		external := embedMap["external"].(map[string]interface{})

     

       147
       147
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       148
       148
       +
       		require.True(t, ok, "thumb should still be a map (blob ref)")

     

       149
       149
       +
       		assert.Equal(t, "blob", thumb["$type"], "blob type should be unchanged")

     

       150
       150
       +
       	})

     

       151
       151
       +
       

     

       152
       152
       +
       	t.Run("handles missing PDS URL", func(t *testing.T) {

     

       153
       153
       +
       		post := &PostView{

     

       154
       154
       +
       			Community: &CommunityRef{

     

       155
       155
       +
       				DID:    "did:plc:testcommunity",

     

       156
       156
       +
       				PDSURL: "", // Empty PDS URL

     

       157
       157
       +
       			},

     

       158
       158
       +
       			Embed: map[string]interface{}{

     

       159
       159
       +
       				"$type": "social.coves.embed.external",

     

       160
       160
       +
       				"external": map[string]interface{}{

     

       161
       161
       +
       					"uri": "https://example.com",

     

       162
       162
       +
       					"thumb": map[string]interface{}{

     

       163
       163
       +
       						"$type": "blob",

     

       164
       164
       +
       						"ref": map[string]interface{}{

     

       165
       165
       +
       							"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       166
       166
       +
       						},

     

       167
       167
       +
       					},

     

       168
       168
       +
       				},

     

       169
       169
       +
       			},

     

       170
       170
       +
       		}

     

       171
       171
       +
       

     

       172
       172
       +
       		// Should not panic or transform

     

       173
       173
       +
       		TransformBlobRefsToURLs(post)

     

       174
       174
       +
       

     

       175
       175
       +
       		// Verify thumb is unchanged (still a blob)

     

       176
       176
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       177
       177
       +
       		external := embedMap["external"].(map[string]interface{})

     

       178
       178
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       179
       179
       +
       		require.True(t, ok, "thumb should still be a map (blob ref)")

     

       180
       180
       +
       		assert.Equal(t, "blob", thumb["$type"], "blob type should be unchanged")

     

       181
       181
       +
       	})

     

       182
       182
       +
       

     

       183
       183
       +
       	t.Run("handles malformed blob ref gracefully", func(t *testing.T) {

     

       184
       184
       +
       		post := &PostView{

     

       185
       185
       +
       			Community: &CommunityRef{

     

       186
       186
       +
       				DID:    "did:plc:testcommunity",

     

       187
       187
       +
       				PDSURL: "http://localhost:3001",

     

       188
       188
       +
       			},

     

       189
       189
       +
       			Embed: map[string]interface{}{

     

       190
       190
       +
       				"$type": "social.coves.embed.external",

     

       191
       191
       +
       				"external": map[string]interface{}{

     

       192
       192
       +
       					"uri": "https://example.com",

     

       193
       193
       +
       					"thumb": map[string]interface{}{

     

       194
       194
       +
       						"$type": "blob",

     

       195
       195
       +
       						"ref":   "invalid-ref-format", // Should be a map with $link

     

       196
       196
       +
       					},

     

       197
       197
       +
       				},

     

       198
       198
       +
       			},

     

       199
       199
       +
       		}

     

       200
       200
       +
       

     

       201
       201
       +
       		// Should not panic

     

       202
       202
       +
       		TransformBlobRefsToURLs(post)

     

       203
       203
       +
       

     

       204
       204
       +
       		// Verify thumb is unchanged (malformed blob)

     

       205
       205
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       206
       206
       +
       		external := embedMap["external"].(map[string]interface{})

     

       207
       207
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       208
       208
       +
       		require.True(t, ok, "thumb should still be a map")

     

       209
       209
       +
       		assert.Equal(t, "invalid-ref-format", thumb["ref"], "malformed ref should be unchanged")

     

       210
       210
       +
       	})

     

       211
       211
       +
       

     

       212
       212
       +
       	t.Run("ignores non-external embed types", func(t *testing.T) {

     

       213
       213
       +
       		post := &PostView{

     

       214
       214
       +
       			Community: &CommunityRef{

     

       215
       215
       +
       				DID:    "did:plc:testcommunity",

     

       216
       216
       +
       				PDSURL: "http://localhost:3001",

     

       217
       217
       +
       			},

     

       218
       218
       +
       			Embed: map[string]interface{}{

     

       219
       219
       +
       				"$type": "social.coves.embed.images",

     

       220
       220
       +
       				"images": []interface{}{

     

       221
       221
       +
       					map[string]interface{}{

     

       222
       222
       +
       						"image": map[string]interface{}{

     

       223
       223
       +
       							"$type": "blob",

     

       224
       224
       +
       							"ref": map[string]interface{}{

     

       225
       225
       +
       								"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       226
       226
       +
       							},

     

       227
       227
       +
       						},

     

       228
       228
       +
       					},

     

       229
       229
       +
       				},

     

       230
       230
       +
       			},

     

       231
       231
       +
       		}

     

       232
       232
       +
       

     

       233
       233
       +
       		// Should not transform non-external embeds

     

       234
       234
       +
       		TransformBlobRefsToURLs(post)

     

       235
       235
       +
       

     

       236
       236
       +
       		// Verify images embed is unchanged

     

       237
       237
       +
       		embedMap := post.Embed.(map[string]interface{})

     

       238
       238
       +
       		images := embedMap["images"].([]interface{})

     

       239
       239
       +
       		imageObj := images[0].(map[string]interface{})

     

       240
       240
       +
       		imageBlob := imageObj["image"].(map[string]interface{})

     

       241
       241
       +
       		assert.Equal(t, "blob", imageBlob["$type"], "image blob should be unchanged")

     

       242
       242
       +
       	})

     

       243
       243
       +
       }

     

       244
       244
       +
       

     

       245
       245
       +
       func TestTransformThumbToURL(t *testing.T) {

     

       246
       246
       +
       	t.Run("transforms valid blob ref to URL", func(t *testing.T) {

     

       247
       247
       +
       		external := map[string]interface{}{

     

       248
       248
       +
       			"uri": "https://example.com",

     

       249
       249
       +
       			"thumb": map[string]interface{}{

     

       250
       250
       +
       				"$type": "blob",

     

       251
       251
       +
       				"ref": map[string]interface{}{

     

       252
       252
       +
       					"$link": "bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       253
       253
       +
       				},

     

       254
       254
       +
       				"mimeType": "image/jpeg",

     

       255
       255
       +
       				"size":     52813,

     

       256
       256
       +
       			},

     

       257
       257
       +
       		}

     

       258
       258
       +
       

     

       259
       259
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       260
       260
       +
       

     

       261
       261
       +
       		thumbURL, ok := external["thumb"].(string)

     

       262
       262
       +
       		require.True(t, ok, "thumb should be a string URL")

     

       263
       263
       +
       		assert.Equal(t,

     

       264
       264
       +
       			"http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafyreib6tbnql2ux3whnfysbzabthaj2vvck53nimhbi5g5a7jgvgr5eqm",

     

       265
       265
       +
       			thumbURL)

     

       266
       266
       +
       	})

     

       267
       267
       +
       

     

       268
       268
       +
       	t.Run("does not transform if thumb is already string", func(t *testing.T) {

     

       269
       269
       +
       		expectedURL := "http://localhost:3001/xrpc/com.atproto.sync.getBlob?did=did:plc:test&cid=bafytest"

     

       270
       270
       +
       		external := map[string]interface{}{

     

       271
       271
       +
       			"uri":   "https://example.com",

     

       272
       272
       +
       			"thumb": expectedURL,

     

       273
       273
       +
       		}

     

       274
       274
       +
       

     

       275
       275
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       276
       276
       +
       

     

       277
       277
       +
       		thumbURL, ok := external["thumb"].(string)

     

       278
       278
       +
       		require.True(t, ok, "thumb should still be a string")

     

       279
       279
       +
       		assert.Equal(t, expectedURL, thumbURL, "thumb should be unchanged")

     

       280
       280
       +
       	})

     

       281
       281
       +
       

     

       282
       282
       +
       	t.Run("does not transform if thumb is missing", func(t *testing.T) {

     

       283
       283
       +
       		external := map[string]interface{}{

     

       284
       284
       +
       			"uri": "https://example.com",

     

       285
       285
       +
       		}

     

       286
       286
       +
       

     

       287
       287
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       288
       288
       +
       

     

       289
       289
       +
       		_, hasThumb := external["thumb"]

     

       290
       290
       +
       		assert.False(t, hasThumb, "thumb should not be added")

     

       291
       291
       +
       	})

     

       292
       292
       +
       

     

       293
       293
       +
       	t.Run("does not transform if CID is empty", func(t *testing.T) {

     

       294
       294
       +
       		external := map[string]interface{}{

     

       295
       295
       +
       			"uri": "https://example.com",

     

       296
       296
       +
       			"thumb": map[string]interface{}{

     

       297
       297
       +
       				"$type": "blob",

     

       298
       298
       +
       				"ref": map[string]interface{}{

     

       299
       299
       +
       					"$link": "", // Empty CID

     

       300
       300
       +
       				},

     

       301
       301
       +
       			},

     

       302
       302
       +
       		}

     

       303
       303
       +
       

     

       304
       304
       +
       		transformThumbToURL(external, "did:plc:test", "http://localhost:3001")

     

       305
       305
       +
       

     

       306
       306
       +
       		// Verify thumb is unchanged

     

       307
       307
       +
       		thumb, ok := external["thumb"].(map[string]interface{})

     

       308
       308
       +
       		require.True(t, ok, "thumb should still be a map")

     

       309
       309
       +
       		ref := thumb["ref"].(map[string]interface{})

     

       310
       310
       +
       		assert.Equal(t, "", ref["$link"], "empty CID should be unchanged")

     

       311
       311
       +
       	})

     

       312
       312
       +
       }

+13 -14

aggregators/kagi-news/src/coves_client.py

···

       72
       72
        
               content: str,

     

       73
       73
        
               facets: List[Dict],

     

       74
       74
        
               title: Optional[str] = None,

     

       75
       75
       -
               embed: Optional[Dict] = None

     

       75
       75
       +
               embed: Optional[Dict] = None,

     

       76
       76
       +
               thumbnail_url: Optional[str] = None

     

       76
       77
        
           ) -> str:

     

       77
       78
        
               """

     

       78
       79
        
               Create a post in a community.

     
···

       83
       84
        
                   facets: Rich text facets (formatting, links)

     

       84
       85
        
                   title: Optional post title

     

       85
       86
        
                   embed: Optional external embed

     

       87
       87
       +
                   thumbnail_url: Optional thumbnail URL (for trusted aggregators only)

     

       86
       88
        
       

     

       87
       89
        
               Returns:

     

       88
       90
        
                   AT Proto URI of created post (e.g., "at://did:plc:.../social.coves.post/...")

     
···

       109
       111
        
                   if embed:

     

       110
       112
        
                       post_data["embed"] = embed

     

       111
       113
        
       

     

       114
       114
       +
                   # Add thumbnail URL at top level if provided (for trusted aggregators)

     

       115
       115
       +
                   if thumbnail_url:

     

       116
       116
       +
                       post_data["thumbnailUrl"] = thumbnail_url

     

       117
       117
       +
       

     

       112
       118
        
                   # Use Coves-specific endpoint (not direct PDS write)

     

       113
       119
        
                   # This provides validation, authorization, and business logic

     

       114
       120
        
                   logger.info(f"Creating post in community: {community_handle}")

     
···

       141
       147
        
               self,

     

       142
       148
        
               uri: str,

     

       143
       149
        
               title: str,

     

       144
       144
       -
               description: str,

     

       145
       145
       -
               thumb: Optional[str] = None

     

       150
       150
       +
               description: str

     

       146
       151
        
           ) -> Dict:

     

       147
       152
        
               """

     

       148
       153
        
               Create external embed object for hot-linked content.

     

       149
       154
        
       

     

       150
       155
        
               Args:

     

       151
       151
       -
                   uri: External URL (story link)

     

       152
       152
       -
                   title: Story title

     

       153
       153
       -
                   description: Story description/summary

     

       154
       154
       -
                   thumb: Optional thumbnail image URL

     

       156
       156
       +
                   uri: URL of the external content

     

       157
       157
       +
                   title: Title of the content

     

       158
       158
       +
                   description: Description/summary

     

       155
       159
        
       

     

       156
       160
        
               Returns:

     

       157
       157
       -
                   External embed dictionary

     

       161
       161
       +
                   Embed dictionary ready for post creation

     

       158
       162
        
               """

     

       159
       159
       -
               embed = {

     

       163
       163
       +
               return {

     

       160
       164
        
                   "$type": "social.coves.embed.external",

     

       161
       165
        
                   "external": {

     

       162
       166
        
                       "uri": uri,

     
···

       165
       169
        
                   }

     

       166
       170
        
               }

     

       167
       171
        
       

     

       168
       168
       -
               if thumb:

     

       169
       169
       -
                   embed["external"]["thumb"] = thumb

     

       170
       170
       -
       

     

       171
       171
       -
               return embed

     

       172
       172
       -
       

     

       173
       172
        
           def _get_timestamp(self) -> str:

     

       174
       173
        
               """

     

       175
       174
        
               Get current timestamp in ISO 8601 format.

+4 -3

aggregators/kagi-news/src/main.py

···

       173
       173
        
                       embed = self.coves_client.create_external_embed(

     

       174
       174
        
                           uri=story.link,

     

       175
       175
        
                           title=story.title,

     

       176
       176
       -
                           description=story.summary[:200] if len(story.summary) > 200 else story.summary,

     

       177
       177
       -
                           thumb=story.image_url

     

       176
       176
       +
                           description=story.summary[:200] if len(story.summary) > 200 else story.summary

     

       178
       177
        
                       )

     

       179
       178
        
       

     

       180
       179
        
                       # Post to community

     

       180
       180
       +
                       # Pass thumbnail URL from RSS feed at top level for trusted aggregator upload

     

       181
       181
        
                       try:

     

       182
       182
        
                           post_uri = self.coves_client.create_post(

     

       183
       183
        
                               community_handle=feed_config.community_handle,

     

       184
       184
        
                               title=story.title,

     

       185
       185
        
                               content=rich_text["content"],

     

       186
       186
        
                               facets=rich_text["facets"],

     

       187
       187
       -
                               embed=embed

     

       187
       187
       +
                               embed=embed,

     

       188
       188
       +
                               thumbnail_url=story.image_url  # From RSS feed - server will validate and upload

     

       188
       189
        
                           )

     

       189
       190
        
       

     

       190
       191
        
                           # Mark as posted (only if successful)

+5 -14

aggregators/kagi-news/tests/test_e2e.py

···

       398
       398
        
           Verifies:

     

       399
       399
        
           - Embed structure matches social.coves.embed.external

     

       400
       400
        
           - All required fields are present

     

       401
       401
       -
           - Optional thumbnail is included when provided

     

       401
       401
       +
           - Thumbnails are handled by server's unfurl service (not included in client)

     

       402
       402
        
           """

     

       403
       403
        
           handle, password = aggregator_credentials

     

       404
       404
        
       

     
···

       408
       408
        
               password=password

     

       409
       409
        
           )

     

       410
       410
        
       

     

       411
       411
       -
           # Test with thumbnail

     

       411
       411
       +
           # Create external embed (server will handle thumbnail extraction)

     

       412
       412
        
           embed = client.create_external_embed(

     

       413
       413
        
               uri="https://example.com/story",

     

       414
       414
        
               title="Test Story",

     

       415
       415
       -
               description="Test description",

     

       416
       416
       -
               thumb="https://example.com/image.jpg"

     

       415
       415
       +
               description="Test description"

     

       417
       416
        
           )

     

       418
       417
        
       

     

       419
       418
        
           assert embed["$type"] == "social.coves.embed.external"

     

       420
       419
        
           assert embed["external"]["uri"] == "https://example.com/story"

     

       421
       420
        
           assert embed["external"]["title"] == "Test Story"

     

       422
       421
        
           assert embed["external"]["description"] == "Test description"

     

       423
       423
       -
           assert embed["external"]["thumb"] == "https://example.com/image.jpg"

     

       424
       424
       -
       

     

       425
       425
       -
           # Test without thumbnail

     

       426
       426
       -
           embed_no_thumb = client.create_external_embed(

     

       427
       427
       -
               uri="https://example.com/story2",

     

       428
       428
       -
               title="Test Story 2",

     

       429
       429
       -
               description="Test description 2"

     

       430
       430
       -
           )

     

       431
       431
       -
       

     

       432
       432
       -
           assert "thumb" not in embed_no_thumb["external"]

     

       422
       422
       +
           # Thumbnail is not included - server's unfurl service handles it

     

       423
       423
       +
           assert "thumb" not in embed["external"]

     

       433
       424
        
           print("\n✅ External embed format correct")

+4 -3

aggregators/kagi-news/tests/test_main.py

···

       404
       404
        
               mock_client.create_post.return_value = "at://did:plc:test/social.coves.post/abc123"

     

       405
       405
        
       

     

       406
       406
        
               # Mock create_external_embed to return proper embed structure

     

       407
       407
       +
               # Note: Thumbnails are handled by server's unfurl service, not client

     

       407
       408
        
               mock_client.create_external_embed.return_value = {

     

       408
       409
        
                   "$type": "social.coves.embed.external",

     

       409
       410
        
                   "external": {

     

       410
       411
        
                       "uri": sample_story.link,

     

       411
       412
        
                       "title": sample_story.title,

     

       412
       412
       -
                       "description": sample_story.summary,

     

       413
       413
       -
                       "thumb": sample_story.image_url

     

       413
       413
       +
                       "description": sample_story.summary

     

       414
       414
        
                   }

     

       415
       415
        
               }

     

       416
       416
        
       

     
···

       457
       457
        
                   assert call_kwargs["embed"]["$type"] == "social.coves.embed.external"

     

       458
       458
        
                   assert call_kwargs["embed"]["external"]["uri"] == sample_story.link

     

       459
       459
        
                   assert call_kwargs["embed"]["external"]["title"] == sample_story.title

     

       460
       460
       -
                   assert call_kwargs["embed"]["external"]["thumb"] == sample_story.image_url

     

       460
       460
       +
                   # Thumbnail is not included - server's unfurl service handles it

     

       461
       461
       +
                   assert "thumb" not in call_kwargs["embed"]["external"]

+134

scripts/post_streamable.py

···

       1
       1
       +
       #!/usr/bin/env python3

     

       2
       2
       +
       """

     

       3
       3
       +
       Quick script to post a Streamable video to test-usnews community.

     

       4
       4
       +
       Uses the kagi-news CovesClient infrastructure.

     

       5
       5
       +
       """

     

       6
       6
       +
       

     

       7
       7
       +
       import sys

     

       8
       8
       +
       import os

     

       9
       9
       +
       

     

       10
       10
       +
       # Add kagi-news src to path to use CovesClient

     

       11
       11
       +
       sys.path.insert(0, os.path.join(os.path.dirname(__file__), '../aggregators/kagi-news'))

     

       12
       12
       +
       

     

       13
       13
       +
       from src.coves_client import CovesClient

     

       14
       14
       +
       

     

       15
       15
       +
       def main():

     

       16
       16
       +
           # Configuration

     

       17
       17
       +
           COVES_API_URL = "http://localhost:8081"

     

       18
       18
       +
           PDS_URL = "http://localhost:3001"

     

       19
       19
       +
       

     

       20
       20
       +
           # Use PDS instance credentials (from .env.dev)

     

       21
       21
       +
           HANDLE = "testuser123.local.coves.dev"

     

       22
       22
       +
           PASSWORD = "test-password-123"

     

       23
       23
       +
       

     

       24
       24
       +
           # Post details

     

       25
       25
       +
           COMMUNITY_HANDLE = "test-usnews.community.coves.social"

     

       26
       26
       +
       

     

       27
       27
       +
           # Post 1: Streamable video

     

       28
       28
       +
           STREAMABLE_URL = "https://streamable.com/7kpdft"

     

       29
       29
       +
           STREAMABLE_TITLE = "NBACentral - \"Your son don't wanna be here, we know it's your last weekend. Enjoy ..."

     

       30
       30
       +
       

     

       31
       31
       +
           # Post 2: Reddit highlight

     

       32
       32
       +
           REDDIT_URL = "https://www.reddit.com/r/nba/comments/1orfsgm/highlight_giannis_antetokounmpo_41_pts_15_reb_9/"

     

       33
       33
       +
           REDDIT_TITLE = "[Highlight] Giannis Antetokounmpo (41 PTS, 15 REB, 9 AST) tallies his 56th career regular season game of 40+ points, passing Kareem Abdul-Jabbar for the most such games in franchise history. Milwaukee defeats Chicago 126-110 to win their NBA Cup opener."

     

       34
       34
       +
       

     

       35
       35
       +
           # Initialize client

     

       36
       36
       +
           print(f"Initializing Coves client...")

     

       37
       37
       +
           print(f"  API URL: {COVES_API_URL}")

     

       38
       38
       +
           print(f"  PDS URL: {PDS_URL}")

     

       39
       39
       +
           print(f"  Handle: {HANDLE}")

     

       40
       40
       +
       

     

       41
       41
       +
           client = CovesClient(

     

       42
       42
       +
               api_url=COVES_API_URL,

     

       43
       43
       +
               handle=HANDLE,

     

       44
       44
       +
               password=PASSWORD,

     

       45
       45
       +
               pds_url=PDS_URL

     

       46
       46
       +
           )

     

       47
       47
       +
       

     

       48
       48
       +
           # Authenticate

     

       49
       49
       +
           print("\nAuthenticating...")

     

       50
       50
       +
           try:

     

       51
       51
       +
               client.authenticate()

     

       52
       52
       +
               print(f"✓ Authenticated as {client.did}")

     

       53
       53
       +
           except Exception as e:

     

       54
       54
       +
               print(f"✗ Authentication failed: {e}")

     

       55
       55
       +
               return 1

     

       56
       56
       +
       

     

       57
       57
       +
           # Post 1: Streamable video

     

       58
       58
       +
           print("\n" + "="*60)

     

       59
       59
       +
           print("POST 1: STREAMABLE VIDEO")

     

       60
       60
       +
           print("="*60)

     

       61
       61
       +
       

     

       62
       62
       +
           print("\nCreating minimal external embed (URI only)...")

     

       63
       63
       +
           streamable_embed = {

     

       64
       64
       +
               "$type": "social.coves.embed.external",

     

       65
       65
       +
               "external": {

     

       66
       66
       +
                   "uri": STREAMABLE_URL

     

       67
       67
       +
               }

     

       68
       68
       +
           }

     

       69
       69
       +
           print(f"✓ Embed created with URI only (unfurl service should enrich)")

     

       70
       70
       +
       

     

       71
       71
       +
           print(f"\nPosting to {COMMUNITY_HANDLE}...")

     

       72
       72
       +
           print(f"  Title: {STREAMABLE_TITLE}")

     

       73
       73
       +
           print(f"  Video: {STREAMABLE_URL}")

     

       74
       74
       +
       

     

       75
       75
       +
           try:

     

       76
       76
       +
               post_uri = client.create_post(

     

       77
       77
       +
                   community_handle=COMMUNITY_HANDLE,

     

       78
       78
       +
                   title=STREAMABLE_TITLE,

     

       79
       79
       +
                   content="",

     

       80
       80
       +
                   facets=[],

     

       81
       81
       +
                   embed=streamable_embed

     

       82
       82
       +
               )

     

       83
       83
       +
       

     

       84
       84
       +
               print(f"\n✓ Streamable post created successfully!")

     

       85
       85
       +
               print(f"  URI: {post_uri}")

     

       86
       86
       +
       

     

       87
       87
       +
           except Exception as e:

     

       88
       88
       +
               print(f"\n✗ Streamable post creation failed: {e}")

     

       89
       89
       +
               import traceback

     

       90
       90
       +
               traceback.print_exc()

     

       91
       91
       +
               return 1

     

       92
       92
       +
       

     

       93
       93
       +
           # Post 2: Reddit highlight

     

       94
       94
       +
           print("\n" + "="*60)

     

       95
       95
       +
           print("POST 2: REDDIT HIGHLIGHT")

     

       96
       96
       +
           print("="*60)

     

       97
       97
       +
       

     

       98
       98
       +
           print("\nCreating minimal external embed (URI only)...")

     

       99
       99
       +
           reddit_embed = {

     

       100
       100
       +
               "$type": "social.coves.embed.external",

     

       101
       101
       +
               "external": {

     

       102
       102
       +
                   "uri": REDDIT_URL

     

       103
       103
       +
               }

     

       104
       104
       +
           }

     

       105
       105
       +
           print(f"✓ Embed created with URI only (unfurl service should enrich)")

     

       106
       106
       +
       

     

       107
       107
       +
           print(f"\nPosting to {COMMUNITY_HANDLE}...")

     

       108
       108
       +
           print(f"  Title: {REDDIT_TITLE}")

     

       109
       109
       +
           print(f"  URL: {REDDIT_URL}")

     

       110
       110
       +
       

     

       111
       111
       +
           try:

     

       112
       112
       +
               post_uri = client.create_post(

     

       113
       113
       +
                   community_handle=COMMUNITY_HANDLE,

     

       114
       114
       +
                   title=REDDIT_TITLE,

     

       115
       115
       +
                   content="",

     

       116
       116
       +
                   facets=[],

     

       117
       117
       +
                   embed=reddit_embed

     

       118
       118
       +
               )

     

       119
       119
       +
       

     

       120
       120
       +
               print(f"\n✓ Reddit post created successfully!")

     

       121
       121
       +
               print(f"  URI: {post_uri}")

     

       122
       122
       +
               print(f"\n" + "="*60)

     

       123
       123
       +
               print("Both posts created! Check them out at !test-usnews")

     

       124
       124
       +
               print("="*60)

     

       125
       125
       +
               return 0

     

       126
       126
       +
       

     

       127
       127
       +
           except Exception as e:

     

       128
       128
       +
               print(f"\n✗ Reddit post creation failed: {e}")

     

       129
       129
       +
               import traceback

     

       130
       130
       +
               traceback.print_exc()

     

       131
       131
       +
               return 1

     

       132
       132
       +
       

     

       133
       133
       +
       if __name__ == "__main__":

     

       134
       134
       +
           sys.exit(main())

+6 -3

aggregators/kagi-news/src/html_parser.py

···

       78
       78
        
                   Perspective(

     

       79
       79
        
                       actor=p['actor'],

     

       80
       80
        
                       description=p['description'],

     

       81
       81
       -
                       source_url=p['source_url']

     

       81
       81
       +
                       source_url=p['source_url'],

     

       82
       82
       +
                       source_name=p.get('source_name', '')

     

       82
       83
        
                   )

     

       83
       84
        
                   for p in parsed['perspectives']

     

       84
       85
        
               ]

     
···

       230
       231
        
               actor, rest = full_text.split(':', 1)

     

       231
       232
        
               actor = actor.strip()

     

       232
       233
        
       

     

       233
       233
       -
               # Find the <a> tag for source URL

     

       234
       234
       +
               # Find the <a> tag for source URL and name

     

       234
       235
        
               a_tag = li.find('a')

     

       235
       236
        
               source_url = a_tag['href'] if a_tag and a_tag.get('href') else ""

     

       237
       237
       +
               source_name = a_tag.get_text(strip=True) if a_tag else ""

     

       236
       238
        
       

     

       237
       239
        
               # Extract description (between colon and source link)

     

       238
       240
        
               # Remove the source citation part in parentheses

     
···

       250
       252
        
               return {

     

       251
       253
        
                   'actor': actor,

     

       252
       254
        
                   'description': description,

     

       253
       253
       -
                   'source_url': source_url

     

       255
       255
       +
                   'source_url': source_url,

     

       256
       256
       +
                   'source_name': source_name

     

       254
       257
        
               }

     

       255
       258
        
       

     

       256
       259
        
           def _extract_sources(self, soup: BeautifulSoup) -> List[Dict]:

aggregators/kagi-news/src/models.py

···

       20
       20
        
           actor: str

     

       21
       21
        
           description: str

     

       22
       22
        
           source_url: str

     

       23
       23
       +
           source_name: str = ""  # Name of the source (e.g., "The Straits Times")

     

       23
       24
        
       

     

       24
       25
        
       

     

       25
       26
        
       @dataclass

+11 -7

aggregators/kagi-news/src/richtext_formatter.py

···

       42
       42
        
                   builder.add_bold("Highlights:")

     

       43
       43
        
                   builder.add_text("\n")

     

       44
       44
        
                   for highlight in story.highlights:

     

       45
       45
       -
                       builder.add_text(f"• {highlight}\n")

     

       45
       45
       +
                       builder.add_text(f"• {highlight}\n\n")

     

       46
       46
        
                   builder.add_text("\n")

     

       47
       47
        
       

     

       48
       48
        
               # Perspectives (if present)

     
···

       53
       53
        
                       # Bold the actor name

     

       54
       54
        
                       actor_with_colon = f"{perspective.actor}:"

     

       55
       55
        
                       builder.add_bold(actor_with_colon)

     

       56
       56
       -
                       builder.add_text(f" {perspective.description} (")

     

       56
       56
       +
                       builder.add_text(f" {perspective.description}")

     

       57
       57
        
       

     

       58
       58
       -
                       # Add link to source

     

       59
       59
       -
                       source_link_text = "Source"

     

       60
       60
       -
                       builder.add_link(source_link_text, perspective.source_url)

     

       61
       61
       -
                       builder.add_text(")\n")

     

       58
       58
       +
                       # Add link to source if available

     

       59
       59
       +
                       if perspective.source_url:

     

       60
       60
       +
                           builder.add_text(" (")

     

       61
       61
       +
                           source_link_text = perspective.source_name if perspective.source_name else "Source"

     

       62
       62
       +
                           builder.add_link(source_link_text, perspective.source_url)

     

       63
       63
       +
                           builder.add_text(")")

     

       64
       64
       +
       

     

       65
       65
       +
                       builder.add_text("\n\n")

     

       62
       66
        
                   builder.add_text("\n")

     

       63
       67
        
       

     

       64
       68
        
               # Quote (if present)

     
···

       74
       78
        
                   for source in story.sources:

     

       75
       79
        
                       builder.add_text("• ")

     

       76
       80
        
                       builder.add_link(source.title, source.url)

     

       77
       77
       -
                       builder.add_text(f" - {source.domain}\n")

     

       81
       81
       +
                       builder.add_text(f" - {source.domain}\n\n")

     

       78
       82
        
                   builder.add_text("\n")

     

       79
       83
        
       

     

       80
       84
        
               # Kagi News attribution

-2

docker-compose.dev.yml

···

       1
       1
       -
       version: '3.8'

     

       2
       2
       -
       

     

       3
       1
        
       # Coves Local Development Stack

     

       4
       2
        
       # All-in-one setup: PDS + PostgreSQL + optional Relay

     

       5
       3
        
       #

+1 -1

tests/lexicon-test-data/interaction/comment-invalid-content.json

···

       1
       1
        
       {

     

       2
       2
       -
         "$type": "social.coves.feed.comment",

     

       2
       2
       +
         "$type": "social.coves.community.comment",

     

       3
       3
        
         "reply": {

     

       4
       4
        
           "root": {

     

       5
       5
        
             "uri": "at://did:plc:test123/social.coves.community.post/3k7a3dmb5bk2c",

+1 -1

tests/lexicon-test-data/interaction/comment-valid-sticker.json

···

       1
       1
        
       {

     

       2
       2
       -
         "$type": "social.coves.feed.comment",

     

       2
       2
       +
         "$type": "social.coves.community.comment",

     

       3
       3
        
         "reply": {

     

       4
       4
        
           "root": {

     

       5
       5
        
             "uri": "at://did:plc:test123/social.coves.community.post/3k7a3dmb5bk2c",

+1 -1

tests/lexicon-test-data/interaction/comment-valid-text.json

···

       1
       1
        
       {

     

       2
       2
       -
         "$type": "social.coves.feed.comment",

     

       2
       2
       +
         "$type": "social.coves.community.comment",

     

       3
       3
        
         "reply": {

     

       4
       4
        
           "root": {

     

       5
       5
        
             "uri": "at://did:plc:test123/social.coves.community.post/3k7a3dmb5bk2c",

+34

internal/db/migrations/018_migrate_comment_namespace.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Migration: Update comment URIs from social.coves.feed.comment to social.coves.community.comment

     

       3
       3
       +
       -- This updates the namespace for all comment records in the database.

     

       4
       4
       +
       -- Since we're pre-production, we're only updating the comments table (not votes).

     

       5
       5
       +
       

     

       6
       6
       +
       -- Update main comment URIs

     

       7
       7
       +
       UPDATE comments

     

       8
       8
       +
       SET uri = REPLACE(uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       9
       9
       +
       WHERE uri LIKE '%/social.coves.feed.comment/%';

     

       10
       10
       +
       

     

       11
       11
       +
       -- Update root references (when root is a comment, not a post)

     

       12
       12
       +
       UPDATE comments

     

       13
       13
       +
       SET root_uri = REPLACE(root_uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       14
       14
       +
       WHERE root_uri LIKE '%/social.coves.feed.comment/%';

     

       15
       15
       +
       

     

       16
       16
       +
       -- Update parent references (when parent is a comment)

     

       17
       17
       +
       UPDATE comments

     

       18
       18
       +
       SET parent_uri = REPLACE(parent_uri, '/social.coves.feed.comment/', '/social.coves.community.comment/')

     

       19
       19
       +
       WHERE parent_uri LIKE '%/social.coves.feed.comment/%';

     

       20
       20
       +
       

     

       21
       21
       +
       -- +goose Down

     

       22
       22
       +
       -- Rollback: Revert comment URIs from social.coves.community.comment to social.coves.feed.comment

     

       23
       23
       +
       

     

       24
       24
       +
       UPDATE comments

     

       25
       25
       +
       SET uri = REPLACE(uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       26
       26
       +
       WHERE uri LIKE '%/social.coves.community.comment/%';

     

       27
       27
       +
       

     

       28
       28
       +
       UPDATE comments

     

       29
       29
       +
       SET root_uri = REPLACE(root_uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       30
       30
       +
       WHERE root_uri LIKE '%/social.coves.community.comment/%';

     

       31
       31
       +
       

     

       32
       32
       +
       UPDATE comments

     

       33
       33
       +
       SET parent_uri = REPLACE(parent_uri, '/social.coves.community.comment/', '/social.coves.feed.comment/')

     

       34
       34
       +
       WHERE parent_uri LIKE '%/social.coves.community.comment/%';

+1 -1

internal/core/comments/comment.go

···

       33
       33
        
       

     

       34
       34
        
       // CommentRecord represents the atProto record structure indexed from Jetstream

     

       35
       35
        
       // This is the data structure that gets stored in the user's repository

     

       36
       36
       -
       // Matches social.coves.feed.comment lexicon

     

       36
       36
       +
       // Matches social.coves.community.comment lexicon

     

       37
       37
        
       type CommentRecord struct {

     

       38
       38
        
       	Embed     map[string]interface{} `json:"embed,omitempty"`

     

       39
       39
        
       	Labels    *SelfLabels            `json:"labels,omitempty"`

+2 -2

internal/core/comments/view_models.go

···

       5
       5
        
       )

     

       6
       6
        
       

     

       7
       7
        
       // CommentView represents the full view of a comment with all metadata

     

       8
       8
       -
       // Matches social.coves.feed.getComments#commentView lexicon

     

       8
       8
       +
       // Matches social.coves.community.comment.getComments#commentView lexicon

     

       9
       9
        
       // Used in thread views and get endpoints

     

       10
       10
        
       type CommentView struct {

     

       11
       11
        
       	Embed         interface{}         `json:"embed,omitempty"`

     
···

       24
       24
        
       }

     

       25
       25
        
       

     

       26
       26
        
       // ThreadViewComment represents a comment with its nested replies

     

       27
       27
       -
       // Matches social.coves.feed.getComments#threadViewComment lexicon

     

       27
       27
       +
       // Matches social.coves.community.comment.getComments#threadViewComment lexicon

     

       28
       28
        
       // Supports recursive threading for comment trees

     

       29
       29
        
       type ThreadViewComment struct {

     

       30
       30
        
       	Comment *CommentView         `json:"comment"`

+1 -1

internal/validation/lexicon.go

···

       86
       86
        
       

     

       87
       87
        
       // ValidateComment validates a comment record

     

       88
       88
        
       func (v *LexiconValidator) ValidateComment(comment map[string]interface{}) error {

     

       89
       89
       -
       	return v.ValidateRecord(comment, "social.coves.feed.comment")

     

       89
       89
       +
       	return v.ValidateRecord(comment, "social.coves.community.comment")

     

       90
       90
        
       }

     

       91
       91
        
       

     

       92
       92
        
       // ValidateVote validates a vote record

+3 -2

internal/core/unfurl/providers.go

···

       108
       108
        
       

     

       109
       109
        
       // normalizeURL converts protocol-relative URLs to HTTPS

     

       110
       110
        
       // Examples:

     

       111
       111
       -
       //   "//example.com/image.jpg" -> "https://example.com/image.jpg"

     

       112
       112
       -
       //   "https://example.com/image.jpg" -> "https://example.com/image.jpg" (unchanged)

     

       111
       111
       +
       //

     

       112
       112
       +
       //	"//example.com/image.jpg" -> "https://example.com/image.jpg"

     

       113
       113
       +
       //	"https://example.com/image.jpg" -> "https://example.com/image.jpg" (unchanged)

     

       113
       114
        
       func normalizeURL(urlStr string) string {

     

       114
       115
        
       	if strings.HasPrefix(urlStr, "//") {

     

       115
       116
        
       		return "https:" + urlStr

+130 -28

docs/PRD_ALPHA_GO_LIVE.md

···

       7
       7
        
       ## 🎯 Major Progress Update

     

       8
       8
        
       

     

       9
       9
        
       **✅ ALL E2E TESTS COMPLETE!** (Completed 2025-11-16)

     

       10
       10
       +
       **✅ BIDIRECTIONAL DID VERIFICATION COMPLETE!** (Completed 2025-11-16)

     

       10
       11
        
       

     

       11
       12
        
       All 6 critical E2E test suites have been implemented and are passing:

     

       12
       13
        
       - ✅ Full User Journey (signup → community → post → comment → vote)

     
···

       19
       20
        
       **Time Saved**: ~7-12 hours through parallel agent implementation

     

       20
       21
        
       **Test Quality**: Enhanced with comprehensive database record verification to catch race conditions

     

       21
       22
        
       

     

       23
       23
       +
       ### Production Deployment Requirements

     

       24
       24
       +
       

     

       25
       25
       +
       **Architecture**:

     

       26
       26
       +
       - **AppView Domain**: coves.social (instance identity, API, frontend)

     

       27
       27
       +
       - **PDS Domain**: coves.me (separate domain required - cannot be same as AppView)

     

       28
       28
       +
       - **Community Handles**: Use @coves.social (AppView domain)

     

       29
       29
       +
       - **Jetstream**: Connects to Bluesky's production firehose (wss://jetstream2.us-east.bsky.network)

     

       30
       30
       +
       

     

       31
       31
       +
       **Required: .well-known/did.json at coves.social**:

     

       32
       32
       +
       ```json

     

       33
       33
       +
       {

     

       34
       34
       +
         "id": "did:web:coves.social",

     

       35
       35
       +
         "alsoKnownAs": ["at://coves.social"],

     

       36
       36
       +
         "verificationMethod": [

     

       37
       37
       +
           {

     

       38
       38
       +
             "id": "did:web:coves.social#atproto",

     

       39
       39
       +
             "type": "Multikey",

     

       40
       40
       +
             "controller": "did:web:coves.social",

     

       41
       41
       +
             "publicKeyMultibase": "z..."

     

       42
       42
       +
           }

     

       43
       43
       +
         ],

     

       44
       44
       +
         "service": [

     

       45
       45
       +
           {

     

       46
       46
       +
             "id": "#atproto_pds",

     

       47
       47
       +
             "type": "AtprotoPersonalDataServer",

     

       48
       48
       +
             "serviceEndpoint": "https://coves.me"

     

       49
       49
       +
           }

     

       50
       50
       +
         ]

     

       51
       51
       +
       }

     

       52
       52
       +
       ```

     

       53
       53
       +
       

     

       54
       54
       +
       **Environment Variables**:

     

       55
       55
       +
       - AppView:

     

       56
       56
       +
         - `INSTANCE_DID=did:web:coves.social`

     

       57
       57
       +
         - `INSTANCE_DOMAIN=coves.social`

     

       58
       58
       +
         - `PDS_URL=https://coves.me` (separate domain)

     

       59
       59
       +
         - `SKIP_DID_WEB_VERIFICATION=false` (production)

     

       60
       60
       +
         - `JETSTREAM_URL=wss://jetstream2.us-east.bsky.network/subscribe`

     

       61
       61
       +
       

     

       62
       62
       +
       **Verification**:

     

       63
       63
       +
       - `curl https://coves.social/.well-known/did.json` (should return DID document)

     

       64
       64
       +
       - `curl https://coves.me/xrpc/_health` (PDS health check)

     

       65
       65
       +
       

     

       22
       66
        
       ## Overview

     

       23
       67
        
       

     

       24
       68
        
       This document tracks the remaining work required to launch Coves alpha with real users. Focus is on critical functionality, security, and operational readiness.

     
···

       29
       73
        
       

     

       30
       74
        
       ### 1. Authentication & Security

     

       31
       75
        
       

     

       76
       76
       +
       #### Production PDS Deployment

     

       77
       77
       +
       **CRITICAL**: PDS must be on separate domain from AppView (coves.me, not coves.social)

     

       78
       78
       +
       

     

       79
       79
       +
       - [ ] Deploy PDS to coves.me domain

     

       80
       80
       +
         - [ ] Set up DNS: A record for coves.me → server IP

     

       81
       81
       +
         - [ ] Configure SSL certificate for coves.me

     

       82
       82
       +
         - [ ] Deploy PDS container/service on port 2583

     

       83
       83
       +
         - [ ] Configure nginx/Caddy reverse proxy for coves.me → localhost:2583

     

       84
       84
       +
         - [ ] Set PDS_HOSTNAME=coves.me in PDS environment

     

       85
       85
       +
         - [ ] Mount persistent volume for PDS data (/pds/data)

     

       86
       86
       +
       - [ ] Verify PDS connectivity

     

       87
       87
       +
         - [ ] Test: `curl https://coves.me/xrpc/_health`

     

       88
       88
       +
         - [ ] Create test community account on PDS

     

       89
       89
       +
         - [ ] Verify JWKS endpoint: `curl https://coves.me/.well-known/jwks.json`

     

       90
       90
       +
         - [ ] Test community account token provisioning

     

       91
       91
       +
       - [ ] Configure AppView to use production PDS

     

       92
       92
       +
         - [ ] Set `PDS_URL=https://coves.me` in AppView .env

     

       93
       93
       +
         - [ ] Test community creation flow (provisions account on coves.me)

     

       94
       94
       +
         - [ ] Verify account provisioning works end-to-end

     

       95
       95
       +
       

     

       96
       96
       +
       **Important**: Jetstream connects to Bluesky's production firehose, which automatically includes events from all production PDS instances (including coves.me once it's live)

     

       97
       97
       +
       

     

       98
       98
       +
       **Estimated Effort**: 4-6 hours

     

       99
       99
       +
       **Risk**: Medium (infrastructure setup, DNS propagation)

     

       100
       100
       +
       

     

       32
       101
        
       #### JWT Signature Verification (Production Mode)

     

       33
       33
       -
       - [ ] Test with production PDS at `pds.bretton.dev`

     

       34
       34
       -
         - [ ] Create test account on production PDS

     

       35
       35
       -
         - [ ] Verify JWKS endpoint is accessible

     

       102
       102
       +
       - [ ] Test with production PDS at coves.me

     

       103
       103
       +
         - [ ] Verify JWKS endpoint is accessible: `https://coves.me/.well-known/jwks.json`

     

       36
       104
        
         - [ ] Run `TestJWTSignatureVerification` against production PDS

     

       37
       105
        
         - [ ] Confirm signature verification succeeds

     

       38
       38
       -
         - [ ] Test token refresh flow

     

       106
       106
       +
         - [ ] Test token refresh flow for community accounts

     

       39
       107
        
       - [ ] Set `AUTH_SKIP_VERIFY=false` in production environment

     

       40
       108
        
       - [ ] Verify all auth middleware tests pass with verification enabled

     

       41
       41
       -
       - [ ] Document production PDS requirements for communities

     

       42
       42
       -
       

     

       43
       43
       -
       **Estimated Effort**: 2-3 hours

     

       44
       44
       -
       **Risk**: Medium (code implemented, needs validation)

     

       45
       45
       -
       

     

       46
       46
       -
       #### did:web Verification

     

       47
       47
       -
       - [ ] Complete did:web domain verification implementation

     

       48
       48
       -
       - [ ] Test with real did:web identities

     

       49
       49
       -
       - [ ] Add security logging for verification failures

     

       50
       50
       -
       - [ ] Set `SKIP_DID_WEB_VERIFICATION=false` for production

     

       51
       109
        
       

     

       52
       110
        
       **Estimated Effort**: 2-3 hours

     

       53
       53
       -
       **Risk**: Medium

     

       111
       111
       +
       **Risk**: Low (depends on PDS deployment)

     

       112
       112
       +
       

     

       113
       113
       +
       #### did:web Verification ✅ COMPLETE

     

       114
       114
       +
       - [x] Complete did:web domain verification implementation (2025-11-16)

     

       115
       115
       +
       - [x] Implement Bluesky-compatible bidirectional verification

     

       116
       116
       +
       - [x] Add alsoKnownAs field verification in DID documents

     

       117
       117
       +
       - [x] Add security logging for verification failures

     

       118
       118
       +
       - [x] Update cache TTL to 24h (matches Bluesky recommendations)

     

       119
       119
       +
       - [x] Comprehensive test coverage with mock HTTP servers

     

       120
       120
       +
       - [ ] Set `SKIP_DID_WEB_VERIFICATION=false` for production (dev default: true)

     

       121
       121
       +
       - [ ] Deploy `.well-known/did.json` to production domain

     

       122
       122
       +
       

     

       123
       123
       +
       **Implementation Details**:

     

       124
       124
       +
       - **Location**: [internal/atproto/jetstream/community_consumer.go](../internal/atproto/jetstream/community_consumer.go)

     

       125
       125
       +
       - **Verification Flow**: Domain matching + DID document fetch + alsoKnownAs validation

     

       126
       126
       +
       - **Security Model**: Matches Bluesky (DNS/HTTPS authority + bidirectional binding)

     

       127
       127
       +
       - **Performance**: Bounded LRU cache (1000 entries), rate limiting (10 req/s), 24h TTL

     

       128
       128
       +
       - **Impact**: AppView indexing and federation trust (not community creation API)

     

       129
       129
       +
       - **Tests**: `tests/integration/community_hostedby_security_test.go`

     

       130
       130
       +
       

     

       131
       131
       +
       **Actual Effort**: 3 hours (implementation + testing)

     

       132
       132
       +
       **Risk**: ✅ Low (complete and tested)

     

       54
       133
        
       

     

       55
       134
        
       ### 2. DPoP Token Architecture Fix

     

       56
       135
        
       

     
···

       172
       251
        
         - [ ] Common issues and fixes

     

       173
       252
        
         - [ ] Emergency procedures (PDS down, database down, etc.)

     

       174
       253
        
       - [ ] Create production environment checklist

     

       175
       175
       -
         - [ ] All environment variables set

     

       176
       176
       -
         - [ ] `AUTH_SKIP_VERIFY=false`

     

       177
       177
       -
         - [ ] `SKIP_DID_WEB_VERIFICATION=false`

     

       178
       178
       -
         - [ ] Database migrations applied

     

       179
       179
       -
         - [ ] PDS connectivity verified

     

       180
       180
       -
         - [ ] JWKS caching working

     

       181
       181
       -
         - [ ] Jetstream consumers running

     

       254
       254
       +
         - [ ] **Domain Setup**

     

       255
       255
       +
           - [ ] AppView domain (coves.social) DNS configured

     

       256
       256
       +
           - [ ] PDS domain (coves.me) DNS configured - MUST be separate domain

     

       257
       257
       +
           - [ ] SSL certificates for both domains

     

       258
       258
       +
           - [ ] Nginx/Caddy reverse proxy configured for both domains

     

       259
       259
       +
         - [ ] **AppView Environment Variables**

     

       260
       260
       +
           - [ ] `INSTANCE_DID=did:web:coves.social`

     

       261
       261
       +
           - [ ] `INSTANCE_DOMAIN=coves.social`

     

       262
       262
       +
           - [ ] `PDS_URL=https://coves.me` (separate domain)

     

       263
       263
       +
           - [ ] `AUTH_SKIP_VERIFY=false`

     

       264
       264
       +
           - [ ] `SKIP_DID_WEB_VERIFICATION=false`

     

       265
       265
       +
           - [ ] `JETSTREAM_URL=wss://jetstream2.us-east.bsky.network/subscribe`

     

       266
       266
       +
         - [ ] **PDS Environment Variables**

     

       267
       267
       +
           - [ ] `PDS_HOSTNAME=coves.me`

     

       268
       268
       +
           - [ ] `PDS_PORT=2583`

     

       269
       269
       +
           - [ ] Persistent storage mounted

     

       270
       270
       +
         - [ ] **Deployment Verification**

     

       271
       271
       +
           - [ ] Deploy `.well-known/did.json` to coves.social with `serviceEndpoint: https://coves.me`

     

       272
       272
       +
           - [ ] Verify: `curl https://coves.social/.well-known/did.json`

     

       273
       273
       +
           - [ ] Verify: `curl https://coves.me/xrpc/_health`

     

       274
       274
       +
           - [ ] Database migrations applied

     

       275
       275
       +
           - [ ] PDS connectivity verified from AppView

     

       276
       276
       +
           - [ ] JWKS caching working

     

       277
       277
       +
           - [ ] Jetstream consumer connected to Bluesky production firehose

     

       278
       278
       +
           - [ ] Test community creation end-to-end

     

       182
       279
        
         - [ ] Monitoring and alerting active

     

       183
       280
        
       

     

       184
       281
        
       **Estimated Effort**: 6-8 hours

     
···

       342
       439
        
       ## Timeline Estimate

     

       343
       440
        
       

     

       344
       441
        
       ### Week 1: Critical Blockers (P0)

     

       345
       345
       -
       - **Days 1-2**: Authentication (JWT + did:web verification)

     

       442
       442
       +
       - ~~**Days 1-2**: Authentication (JWT + did:web verification)~~ ✅ **did:web COMPLETED**

     

       443
       443
       +
       - **Day 1**: Production PDS deployment (coves.me domain setup)

     

       444
       444
       +
       - **Day 2**: JWT signature verification with production PDS

     

       346
       445
        
       - **Day 3**: DPoP token architecture fix

     

       347
       446
        
       - ~~**Day 4**: Handle resolution + comment count reconciliation~~ ✅ **COMPLETED**

     

       348
       447
        
       - **Day 4-5**: Testing and bug fixes

     

       349
       448
        
       

     

       350
       350
       -
       **Total**: 15-20 hours (reduced from 20-25 due to completed items)

     

       449
       449
       +
       **Total**: 16-23 hours (added 4-6 hours for PDS deployment, reduced from original due to did:web completion)

     

       351
       450
        
       

     

       352
       451
        
       ### Week 2: Production Infrastructure (P1)

     

       353
       452
        
       - **Days 6-7**: Monitoring + structured logging

     
···

       363
       462
        
       

     

       364
       463
        
       **Total**: ~~20-25 hours~~ → **13 hours actual** (E2E tests) + 7-12 hours remaining (load testing, polish)

     

       365
       464
        
       

     

       366
       366
       -
       **Grand Total: ~~65-80 hours~~ → 50-65 hours remaining (approximately 1.5-2 weeks full-time)**

     

       367
       367
       -
       *(Originally 70-85 hours. Reduced by completed items: handle resolution, comment count reconciliation, and ALL E2E tests)*

     

       465
       465
       +
       **Grand Total: ~~65-80 hours~~ → 51-68 hours remaining (approximately 1.5-2 weeks full-time)**

     

       466
       466
       +
       *(Originally 70-85 hours. Adjusted for: +4-6 hours PDS deployment, -3 hours did:web completion, -13 hours E2E tests completion, -4 hours handle resolution and comment reconciliation)*

     

       368
       467
        
       

     

       369
       468
        
       **✅ Progress Update**: E2E testing section COMPLETE ahead of schedule - saved ~7-12 hours through parallel agent implementation

     

       370
       469
        
       

     
···

       377
       476
        
       - [ ] All P0 blockers resolved

     

       378
       477
        
         - ✅ Handle resolution (COMPLETE)

     

       379
       478
        
         - ✅ Comment count reconciliation (COMPLETE)

     

       479
       479
       +
         - ✅ did:web verification (COMPLETE - needs production deployment)

     

       480
       480
       +
         - [ ] Production PDS deployed to coves.me (separate domain)

     

       380
       481
        
         - [ ] JWT signature verification working with production PDS

     

       381
       482
        
         - [ ] DPoP architecture fix implemented

     

       382
       382
       -
         - [ ] did:web verification complete

     

       383
       483
        
       - [ ] Subscriptions/blocking work via client-write pattern

     

       384
       484
        
       - [x] **All integration tests passing** ✅

     

       385
       485
        
       - [x] **E2E user journey test passing** ✅

     
···

       461
       561
        
       11. [ ] Go/no-go decision

     

       462
       562
        
       12. [ ] Launch! 🚀

     

       463
       563
        
       

     

       464
       464
       -
       **🎉 Major Milestone**: All E2E tests complete! Test coverage now includes full user journey, blob uploads, concurrent operations, rate limiting, and error recovery.

     

       564
       564
       +
       **🎉 Major Milestones**:

     

       565
       565
       +
       - All E2E tests complete! Test coverage now includes full user journey, blob uploads, concurrent operations, rate limiting, and error recovery.

     

       566
       566
       +
       - Bidirectional DID verification complete! Bluesky-compatible security model with alsoKnownAs validation, 24h cache TTL, and comprehensive test coverage.

+19 -16

docs/PRD_BACKLOG.md

···

       295
       295
        
       

     

       296
       296
        
       ---

     

       297
       297
        
       

     

       298
       298
       -
       ### did:web Domain Verification & hostedByDID Auto-Population

     

       299
       299
       -
       **Added:** 2025-10-11 | **Updated:** 2025-10-16 | **Effort:** 2-3 days | **Priority:** ALPHA BLOCKER

     

       298
       298
       +
       ### ✅ did:web Domain Verification & hostedByDID Auto-Population - COMPLETE

     

       299
       299
       +
       **Added:** 2025-10-11 | **Updated:** 2025-11-16 | **Completed:** 2025-11-16 | **Status:** ✅ DONE

     

       300
       300
        
       

     

       301
       301
        
       **Problem:**

     

       302
       302
        
       1. **Domain Impersonation**: Self-hosters can set `INSTANCE_DID=did:web:nintendo.com` without owning the domain, enabling attacks where communities appear hosted by trusted domains

     
···

       307
       307
        
       - Federation partners can't verify instance authenticity

     

       308
       308
        
       - AppView pollution with fake hosting claims

     

       309
       309
        
       

     

       310
       310
       -
       **Solution:**

     

       311
       311
       -
       1. **Basic Validation (Phase 1)**: Verify `did:web:` domain matches configured `instanceDomain`

     

       312
       312
       -
       2. **Cryptographic Verification (Phase 2)**: Fetch `https://domain/.well-known/did.json` and verify:

     

       310
       310
       +
       **Solution Implemented (Bluesky-Compatible):**

     

       311
       311
       +
       1. ✅ **Domain Matching**: Verify `did:web:` domain matches configured `instanceDomain`

     

       312
       312
       +
       2. ✅ **Bidirectional Verification**: Fetch `https://domain/.well-known/did.json` and verify:

     

       313
       313
        
          - DID document exists and is valid

     

       314
       314
       -
          - Domain ownership proven via HTTPS hosting

     

       315
       315
       -
          - DID document matches claimed `instanceDID`

     

       316
       316
       -
       3. **Auto-populate hostedByDID**: Remove from client API, derive from instance configuration in service layer

     

       314
       314
       +
          - DID document ID matches claimed `instanceDID`

     

       315
       315
       +
          - DID document claims handle domain in `alsoKnownAs` field (bidirectional binding)

     

       316
       316
       +
          - Domain ownership proven via HTTPS hosting (matches Bluesky's trust model)

     

       317
       317
       +
       3. ✅ **Auto-populate hostedByDID**: Removed from client API, derived from instance configuration in service layer

     

       317
       318
        
       

     

       318
       319
        
       **Current Status:**

     

       319
       320
        
       - ✅ Default changed from `coves.local` → `coves.social` (fixes `.local` TLD bug)

     

       320
       320
       -
       - ✅ TODO comment in [cmd/server/main.go:126-131](../cmd/server/main.go#L126-L131)

     

       321
       321
        
       - ✅ hostedByDID removed from client requests (2025-10-16)

     

       322
       322
        
       - ✅ Service layer auto-populates `hostedByDID` from `instanceDID` (2025-10-16)

     

       323
       323
        
       - ✅ Handler rejects client-provided `hostedByDID` (2025-10-16)

     

       324
       324
        
       - ✅ Basic validation: Logs warning if `did:web:` domain ≠ `instanceDomain` (2025-10-16)

     

       325
       325
       -
       - ⚠️ **REMAINING**: Full DID document verification (cryptographic proof of ownership)

     

       326
       326
       -
       

     

       327
       327
       -
       **Implementation Notes:**

     

       328
       328
       -
       - Phase 1 complete: Basic validation catches config errors, logs warnings

     

       329
       329
       -
       - Phase 2 needed: Fetch `https://domain/.well-known/did.json` and verify ownership

     

       330
       330
       -
       - Add `SKIP_DID_WEB_VERIFICATION=true` for dev mode

     

       331
       331
       -
       - Full verification blocks startup if domain ownership cannot be proven

     

       325
       325
       +
       - ✅ **MANDATORY bidirectional DID verification** (2025-11-16)

     

       326
       326
       +
       - ✅ Cache TTL updated to 24h (matches Bluesky recommendations) (2025-11-16)

     

       327
       327
       +
       

     

       328
       328
       +
       **Implementation Details:**

     

       329
       329
       +
       - **Security Model**: Matches Bluesky's approach - relies on DNS/HTTPS authority, not cryptographic proof

     

       330
       330
       +
       - **Enforcement**: MANDATORY hard-fail in production (rejects communities with verification failures)

     

       331
       331
       +
       - **Dev Mode**: Set `SKIP_DID_WEB_VERIFICATION=true` to bypass verification for local development

     

       332
       332
       +
       - **Performance**: Bounded LRU cache (1000 entries), rate limiting (10 req/s), 24h cache TTL

     

       333
       333
       +
       - **Bidirectional Check**: Prevents impersonation by requiring DID document to claim the handle

     

       334
       334
       +
       - **Location**: [internal/atproto/jetstream/community_consumer.go](../internal/atproto/jetstream/community_consumer.go)

     

       332
       335
        
       

     

       333
       336
        
       ---

     

       334
       337

+18

internal/api/routes/aggregator.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"Coves/internal/api/handlers/aggregator"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/atproto/identity"

     

       5
       7
        
       	"Coves/internal/core/aggregators"

     

       8
       8
       +
       	"Coves/internal/core/users"

     

       9
       9
       +
       	"net/http"

     

       10
       10
       +
       	"time"

     

       6
       11
        
       

     

       7
       12
        
       	"github.com/go-chi/chi/v5"

     

       8
       13
        
       )

     
···

       12
       17
        
       func RegisterAggregatorRoutes(

     

       13
       18
        
       	r chi.Router,

     

       14
       19
        
       	aggregatorService aggregators.Service,

     

       20
       20
       +
       	userService users.UserService,

     

       21
       21
       +
       	identityResolver identity.Resolver,

     

       15
       22
        
       ) {

     

       16
       23
        
       	// Create query handlers

     

       17
       24
        
       	getServicesHandler := aggregator.NewGetServicesHandler(aggregatorService)

     

       18
       25
        
       	getAuthorizationsHandler := aggregator.NewGetAuthorizationsHandler(aggregatorService)

     

       19
       26
        
       	listForCommunityHandler := aggregator.NewListForCommunityHandler(aggregatorService)

     

       20
       27
        
       

     

       28
       28
       +
       	// Create registration handler

     

       29
       29
       +
       	registerHandler := aggregator.NewRegisterHandler(userService, identityResolver)

     

       30
       30
       +
       

     

       21
       31
        
       	// Query endpoints (public - no auth required)

     

       22
       32
        
       	// GET /xrpc/social.coves.aggregator.getServices?dids=did:plc:abc,did:plc:def

     

       23
       33
        
       	// Following app.bsky.feed.getFeedGenerators pattern

     
···

       31
       41
        
       	// Lists aggregators authorized by a community

     

       32
       42
        
       	r.Get("/xrpc/social.coves.aggregator.listForCommunity", listForCommunityHandler.HandleListForCommunity)

     

       33
       43
        
       

     

       44
       44
       +
       	// Registration endpoint (public - no auth required)

     

       45
       45
       +
       	// Aggregators register themselves after creating their own PDS accounts

     

       46
       46
       +
       	// POST /xrpc/social.coves.aggregator.register

     

       47
       47
       +
       	// Rate limited to 10 requests per 10 minutes per IP to prevent abuse

     

       48
       48
       +
       	registrationRateLimiter := middleware.NewRateLimiter(10, 10*time.Minute)

     

       49
       49
       +
       	r.Post("/xrpc/social.coves.aggregator.register",

     

       50
       50
       +
       		registrationRateLimiter.Middleware(http.HandlerFunc(registerHandler.HandleRegister)).ServeHTTP)

     

       51
       51
       +
       

     

       34
       52
        
       	// Write endpoints (Phase 2 - require authentication and moderator permissions)

     

       35
       53
        
       	// TODO: Implement after Jetstream consumer is ready

     

       36
       54
        
       	// POST /xrpc/social.coves.aggregator.enable (requires auth + moderator)

+95

scripts/aggregator-setup/1-create-pds-account.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 1-create-pds-account.sh

     

       4
       4
       +
       # Purpose: Create a PDS account for your aggregator

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script helps you create an account on a PDS (Personal Data Server).

     

       7
       7
       +
       # The PDS will automatically create a DID:PLC for you.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 1: Create PDS Account for Your Aggregator"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Get PDS URL

     

       17
       17
       +
       read -p "Enter PDS URL (default: https://bsky.social): " PDS_URL

     

       18
       18
       +
       PDS_URL=${PDS_URL:-https://bsky.social}

     

       19
       19
       +
       

     

       20
       20
       +
       # Get credentials

     

       21
       21
       +
       read -p "Enter desired handle (e.g., mynewsbot.bsky.social): " HANDLE

     

       22
       22
       +
       read -p "Enter email: " EMAIL

     

       23
       23
       +
       read -sp "Enter password: " PASSWORD

     

       24
       24
       +
       echo ""

     

       25
       25
       +
       

     

       26
       26
       +
       # Validate inputs

     

       27
       27
       +
       if [ -z "$HANDLE" ] || [ -z "$EMAIL" ] || [ -z "$PASSWORD" ]; then

     

       28
       28
       +
           echo "Error: All fields are required"

     

       29
       29
       +
           exit 1

     

       30
       30
       +
       fi

     

       31
       31
       +
       

     

       32
       32
       +
       echo ""

     

       33
       33
       +
       echo "Creating account on $PDS_URL..."

     

       34
       34
       +
       

     

       35
       35
       +
       # Create account via com.atproto.server.createAccount

     

       36
       36
       +
       RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.server.createAccount" \

     

       37
       37
       +
           -H "Content-Type: application/json" \

     

       38
       38
       +
           -d "{

     

       39
       39
       +
               \"handle\": \"$HANDLE\",

     

       40
       40
       +
               \"email\": \"$EMAIL\",

     

       41
       41
       +
               \"password\": \"$PASSWORD\"

     

       42
       42
       +
           }")

     

       43
       43
       +
       

     

       44
       44
       +
       # Check if successful

     

       45
       45
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       46
       46
       +
           echo "Error creating account:"

     

       47
       47
       +
           echo "$RESPONSE" | jq '.'

     

       48
       48
       +
           exit 1

     

       49
       49
       +
       fi

     

       50
       50
       +
       

     

       51
       51
       +
       # Extract DID and access token

     

       52
       52
       +
       DID=$(echo "$RESPONSE" | jq -r '.did')

     

       53
       53
       +
       ACCESS_JWT=$(echo "$RESPONSE" | jq -r '.accessJwt')

     

       54
       54
       +
       REFRESH_JWT=$(echo "$RESPONSE" | jq -r '.refreshJwt')

     

       55
       55
       +
       

     

       56
       56
       +
       if [ -z "$DID" ] || [ "$DID" = "null" ]; then

     

       57
       57
       +
           echo "Error: Failed to extract DID from response"

     

       58
       58
       +
           echo "$RESPONSE" | jq '.'

     

       59
       59
       +
           exit 1

     

       60
       60
       +
       fi

     

       61
       61
       +
       

     

       62
       62
       +
       echo ""

     

       63
       63
       +
       echo "✓ Account created successfully!"

     

       64
       64
       +
       echo ""

     

       65
       65
       +
       echo "=== Save these credentials ===="

     

       66
       66
       +
       echo "DID:          $DID"

     

       67
       67
       +
       echo "Handle:       $HANDLE"

     

       68
       68
       +
       echo "PDS URL:      $PDS_URL"

     

       69
       69
       +
       echo "Email:        $EMAIL"

     

       70
       70
       +
       echo "Password:     [hidden]"

     

       71
       71
       +
       echo "Access JWT:   $ACCESS_JWT"

     

       72
       72
       +
       echo "Refresh JWT:  $REFRESH_JWT"

     

       73
       73
       +
       echo "==============================="

     

       74
       74
       +
       echo ""

     

       75
       75
       +
       

     

       76
       76
       +
       # Save to config file

     

       77
       77
       +
       CONFIG_FILE="aggregator-config.env"

     

       78
       78
       +
       cat > "$CONFIG_FILE" <<EOF

     

       79
       79
       +
       # Aggregator Account Configuration

     

       80
       80
       +
       # Generated: $(date)

     

       81
       81
       +
       

     

       82
       82
       +
       AGGREGATOR_DID="$DID"

     

       83
       83
       +
       AGGREGATOR_HANDLE="$HANDLE"

     

       84
       84
       +
       AGGREGATOR_PDS_URL="$PDS_URL"

     

       85
       85
       +
       AGGREGATOR_EMAIL="$EMAIL"

     

       86
       86
       +
       AGGREGATOR_PASSWORD="$PASSWORD"

     

       87
       87
       +
       AGGREGATOR_ACCESS_JWT="$ACCESS_JWT"

     

       88
       88
       +
       AGGREGATOR_REFRESH_JWT="$REFRESH_JWT"

     

       89
       89
       +
       EOF

     

       90
       90
       +
       

     

       91
       91
       +
       echo "✓ Configuration saved to $CONFIG_FILE"

     

       92
       92
       +
       echo ""

     

       93
       93
       +
       echo "IMPORTANT: Keep this file secure! It contains your credentials."

     

       94
       94
       +
       echo ""

     

       95
       95
       +
       echo "Next step: Run ./2-setup-wellknown.sh"

+93

scripts/aggregator-setup/2-setup-wellknown.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 2-setup-wellknown.sh

     

       4
       4
       +
       # Purpose: Generate .well-known/atproto-did file for domain verification

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script creates the .well-known/atproto-did file that proves you own your domain.

     

       7
       7
       +
       # You'll need to host this file at https://yourdomain.com/.well-known/atproto-did

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 2: Setup .well-known/atproto-did"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Load config if available

     

       17
       17
       +
       if [ -f "aggregator-config.env" ]; then

     

       18
       18
       +
           source aggregator-config.env

     

       19
       19
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       20
       20
       +
           echo "  DID: $AGGREGATOR_DID"

     

       21
       21
       +
           echo ""

     

       22
       22
       +
       else

     

       23
       23
       +
           echo "Configuration file not found. Please run 1-create-pds-account.sh first."

     

       24
       24
       +
           exit 1

     

       25
       25
       +
       fi

     

       26
       26
       +
       

     

       27
       27
       +
       # Get domain

     

       28
       28
       +
       read -p "Enter your aggregator's domain (e.g., rss-bot.example.com): " DOMAIN

     

       29
       29
       +
       

     

       30
       30
       +
       if [ -z "$DOMAIN" ]; then

     

       31
       31
       +
           echo "Error: Domain is required"

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       # Save domain to config

     

       36
       36
       +
       echo "" >> aggregator-config.env

     

       37
       37
       +
       echo "AGGREGATOR_DOMAIN=\"$DOMAIN\"" >> aggregator-config.env

     

       38
       38
       +
       

     

       39
       39
       +
       echo ""

     

       40
       40
       +
       echo "Creating .well-known directory..."

     

       41
       41
       +
       mkdir -p .well-known

     

       42
       42
       +
       

     

       43
       43
       +
       # Create the atproto-did file

     

       44
       44
       +
       echo "$AGGREGATOR_DID" > .well-known/atproto-did

     

       45
       45
       +
       

     

       46
       46
       +
       echo "✓ Created .well-known/atproto-did with content: $AGGREGATOR_DID"

     

       47
       47
       +
       echo ""

     

       48
       48
       +
       

     

       49
       49
       +
       echo "================================================"

     

       50
       50
       +
       echo "Next Steps:"

     

       51
       51
       +
       echo "================================================"

     

       52
       52
       +
       echo ""

     

       53
       53
       +
       echo "1. Upload the .well-known directory to your web server"

     

       54
       54
       +
       echo "   The file must be accessible at:"

     

       55
       55
       +
       echo "   https://$DOMAIN/.well-known/atproto-did"

     

       56
       56
       +
       echo ""

     

       57
       57
       +
       echo "2. Verify it's working by running:"

     

       58
       58
       +
       echo "   curl https://$DOMAIN/.well-known/atproto-did"

     

       59
       59
       +
       echo "   (Should return: $AGGREGATOR_DID)"

     

       60
       60
       +
       echo ""

     

       61
       61
       +
       echo "3. Once verified, run: ./3-register-with-coves.sh"

     

       62
       62
       +
       echo ""

     

       63
       63
       +
       

     

       64
       64
       +
       # Create nginx example

     

       65
       65
       +
       cat > nginx-example.conf <<EOF

     

       66
       66
       +
       # Example nginx configuration for serving .well-known

     

       67
       67
       +
       # Add this to your nginx server block:

     

       68
       68
       +
       

     

       69
       69
       +
       location /.well-known/atproto-did {

     

       70
       70
       +
           alias /path/to/your/.well-known/atproto-did;

     

       71
       71
       +
           default_type text/plain;

     

       72
       72
       +
           add_header Access-Control-Allow-Origin *;

     

       73
       73
       +
       }

     

       74
       74
       +
       EOF

     

       75
       75
       +
       

     

       76
       76
       +
       echo "✓ Created nginx-example.conf for reference"

     

       77
       77
       +
       echo ""

     

       78
       78
       +
       

     

       79
       79
       +
       # Create Apache example

     

       80
       80
       +
       cat > apache-example.conf <<EOF

     

       81
       81
       +
       # Example Apache configuration for serving .well-known

     

       82
       82
       +
       # Add this to your Apache virtual host:

     

       83
       83
       +
       

     

       84
       84
       +
       Alias /.well-known /path/to/your/.well-known

     

       85
       85
       +
       <Directory /path/to/your/.well-known>

     

       86
       86
       +
           Options None

     

       87
       87
       +
           AllowOverride None

     

       88
       88
       +
           Require all granted

     

       89
       89
       +
           Header set Access-Control-Allow-Origin "*"

     

       90
       90
       +
       </Directory>

     

       91
       91
       +
       EOF

     

       92
       92
       +
       

     

       93
       93
       +
       echo "✓ Created apache-example.conf for reference"

+103

scripts/aggregator-setup/3-register-with-coves.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 3-register-with-coves.sh

     

       4
       4
       +
       # Purpose: Register your aggregator with a Coves instance

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script calls the social.coves.aggregator.register XRPC endpoint

     

       7
       7
       +
       # to register your aggregator DID with the Coves instance.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Step 3: Register with Coves Instance"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Load config if available

     

       17
       17
       +
       if [ -f "aggregator-config.env" ]; then

     

       18
       18
       +
           source aggregator-config.env

     

       19
       19
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       20
       20
       +
           echo "  DID:    $AGGREGATOR_DID"

     

       21
       21
       +
           echo "  Domain: $AGGREGATOR_DOMAIN"

     

       22
       22
       +
           echo ""

     

       23
       23
       +
       else

     

       24
       24
       +
           echo "Configuration file not found. Please run previous scripts first."

     

       25
       25
       +
           exit 1

     

       26
       26
       +
       fi

     

       27
       27
       +
       

     

       28
       28
       +
       # Validate domain is set

     

       29
       29
       +
       if [ -z "$AGGREGATOR_DOMAIN" ]; then

     

       30
       30
       +
           echo "Error: AGGREGATOR_DOMAIN not set. Please run 2-setup-wellknown.sh first."

     

       31
       31
       +
           exit 1

     

       32
       32
       +
       fi

     

       33
       33
       +
       

     

       34
       34
       +
       # Get Coves instance URL

     

       35
       35
       +
       read -p "Enter Coves instance URL (default: https://api.coves.social): " COVES_URL

     

       36
       36
       +
       COVES_URL=${COVES_URL:-https://api.coves.social}

     

       37
       37
       +
       

     

       38
       38
       +
       echo ""

     

       39
       39
       +
       echo "Verifying .well-known/atproto-did is accessible..."

     

       40
       40
       +
       

     

       41
       41
       +
       # Verify .well-known is accessible

     

       42
       42
       +
       WELLKNOWN_URL="https://$AGGREGATOR_DOMAIN/.well-known/atproto-did"

     

       43
       43
       +
       WELLKNOWN_CONTENT=$(curl -s "$WELLKNOWN_URL" || echo "ERROR")

     

       44
       44
       +
       

     

       45
       45
       +
       if [ "$WELLKNOWN_CONTENT" = "ERROR" ]; then

     

       46
       46
       +
           echo "✗ Error: Could not access $WELLKNOWN_URL"

     

       47
       47
       +
           echo "  Please ensure the file is uploaded and accessible."

     

       48
       48
       +
           exit 1

     

       49
       49
       +
       elif [ "$WELLKNOWN_CONTENT" != "$AGGREGATOR_DID" ]; then

     

       50
       50
       +
           echo "✗ Error: .well-known/atproto-did contains wrong DID"

     

       51
       51
       +
           echo "  Expected: $AGGREGATOR_DID"

     

       52
       52
       +
           echo "  Got:      $WELLKNOWN_CONTENT"

     

       53
       53
       +
           exit 1

     

       54
       54
       +
       fi

     

       55
       55
       +
       

     

       56
       56
       +
       echo "✓ .well-known/atproto-did is correctly configured"

     

       57
       57
       +
       echo ""

     

       58
       58
       +
       

     

       59
       59
       +
       echo "Registering with $COVES_URL..."

     

       60
       60
       +
       

     

       61
       61
       +
       # Call registration endpoint

     

       62
       62
       +
       RESPONSE=$(curl -s -X POST "$COVES_URL/xrpc/social.coves.aggregator.register" \

     

       63
       63
       +
           -H "Content-Type: application/json" \

     

       64
       64
       +
           -d "{

     

       65
       65
       +
               \"did\": \"$AGGREGATOR_DID\",

     

       66
       66
       +
               \"domain\": \"$AGGREGATOR_DOMAIN\"

     

       67
       67
       +
           }")

     

       68
       68
       +
       

     

       69
       69
       +
       # Check if successful

     

       70
       70
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       71
       71
       +
           echo "✗ Registration failed:"

     

       72
       72
       +
           echo "$RESPONSE" | jq '.'

     

       73
       73
       +
           exit 1

     

       74
       74
       +
       fi

     

       75
       75
       +
       

     

       76
       76
       +
       # Extract response

     

       77
       77
       +
       REGISTERED_DID=$(echo "$RESPONSE" | jq -r '.did')

     

       78
       78
       +
       REGISTERED_HANDLE=$(echo "$RESPONSE" | jq -r '.handle')

     

       79
       79
       +
       MESSAGE=$(echo "$RESPONSE" | jq -r '.message')

     

       80
       80
       +
       

     

       81
       81
       +
       if [ -z "$REGISTERED_DID" ] || [ "$REGISTERED_DID" = "null" ]; then

     

       82
       82
       +
           echo "✗ Error: Unexpected response format"

     

       83
       83
       +
           echo "$RESPONSE" | jq '.'

     

       84
       84
       +
           exit 1

     

       85
       85
       +
       fi

     

       86
       86
       +
       

     

       87
       87
       +
       echo ""

     

       88
       88
       +
       echo "✓ Registration successful!"

     

       89
       89
       +
       echo ""

     

       90
       90
       +
       echo "=== Registration Details ===="

     

       91
       91
       +
       echo "DID:     $REGISTERED_DID"

     

       92
       92
       +
       echo "Handle:  $REGISTERED_HANDLE"

     

       93
       93
       +
       echo "Message: $MESSAGE"

     

       94
       94
       +
       echo "============================="

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       

     

       97
       97
       +
       # Save Coves URL to config

     

       98
       98
       +
       echo "" >> aggregator-config.env

     

       99
       99
       +
       echo "COVES_INSTANCE_URL=\"$COVES_URL\"" >> aggregator-config.env

     

       100
       100
       +
       

     

       101
       101
       +
       echo "✓ Updated aggregator-config.env with Coves instance URL"

     

       102
       102
       +
       echo ""

     

       103
       103
       +
       echo "Next step: Run ./4-create-service-declaration.sh"

+125

scripts/aggregator-setup/4-create-service-declaration.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: 4-create-service-declaration.sh

     

       4
       4
       +
       # Purpose: Create aggregator service declaration record

     

       5
       5
       +
       #

     

       6
       6
       +
       # This script writes a social.coves.aggregator.service record to your aggregator's repository.

     

       7
       7
       +
       # This record contains metadata about your aggregator (name, description, etc.) and will be

     

       8
       8
       +
       # indexed by Coves' Jetstream consumer into the aggregators table.

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       echo "================================================"

     

       13
       13
       +
       echo "Step 4: Create Service Declaration"

     

       14
       14
       +
       echo "================================================"

     

       15
       15
       +
       echo ""

     

       16
       16
       +
       

     

       17
       17
       +
       # Load config if available

     

       18
       18
       +
       if [ -f "aggregator-config.env" ]; then

     

       19
       19
       +
           source aggregator-config.env

     

       20
       20
       +
           echo "✓ Loaded configuration from aggregator-config.env"

     

       21
       21
       +
           echo "  DID:       $AGGREGATOR_DID"

     

       22
       22
       +
           echo "  PDS URL:   $AGGREGATOR_PDS_URL"

     

       23
       23
       +
           echo ""

     

       24
       24
       +
       else

     

       25
       25
       +
           echo "Configuration file not found. Please run previous scripts first."

     

       26
       26
       +
           exit 1

     

       27
       27
       +
       fi

     

       28
       28
       +
       

     

       29
       29
       +
       # Validate required fields

     

       30
       30
       +
       if [ -z "$AGGREGATOR_ACCESS_JWT" ]; then

     

       31
       31
       +
           echo "Error: AGGREGATOR_ACCESS_JWT not set. Please run 1-create-pds-account.sh first."

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       echo "Enter aggregator metadata:"

     

       36
       36
       +
       echo ""

     

       37
       37
       +
       

     

       38
       38
       +
       # Get metadata from user

     

       39
       39
       +
       read -p "Display Name (e.g., 'RSS News Aggregator'): " DISPLAY_NAME

     

       40
       40
       +
       read -p "Description: " DESCRIPTION

     

       41
       41
       +
       read -p "Source URL (e.g., 'https://github.com/yourname/aggregator'): " SOURCE_URL

     

       42
       42
       +
       read -p "Maintainer DID (your personal DID, optional): " MAINTAINER_DID

     

       43
       43
       +
       

     

       44
       44
       +
       if [ -z "$DISPLAY_NAME" ]; then

     

       45
       45
       +
           echo "Error: Display name is required"

     

       46
       46
       +
           exit 1

     

       47
       47
       +
       fi

     

       48
       48
       +
       

     

       49
       49
       +
       echo ""

     

       50
       50
       +
       echo "Creating service declaration record..."

     

       51
       51
       +
       

     

       52
       52
       +
       # Build the service record

     

       53
       53
       +
       SERVICE_RECORD=$(cat <<EOF

     

       54
       54
       +
       {

     

       55
       55
       +
           "\$type": "social.coves.aggregator.service",

     

       56
       56
       +
           "did": "$AGGREGATOR_DID",

     

       57
       57
       +
           "displayName": "$DISPLAY_NAME",

     

       58
       58
       +
           "description": "$DESCRIPTION",

     

       59
       59
       +
           "sourceUrl": "$SOURCE_URL",

     

       60
       60
       +
           "maintainer": "$MAINTAINER_DID",

     

       61
       61
       +
           "createdAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"

     

       62
       62
       +
       }

     

       63
       63
       +
       EOF

     

       64
       64
       +
       )

     

       65
       65
       +
       

     

       66
       66
       +
       # Call com.atproto.repo.createRecord

     

       67
       67
       +
       RESPONSE=$(curl -s -X POST "$AGGREGATOR_PDS_URL/xrpc/com.atproto.repo.createRecord" \

     

       68
       68
       +
           -H "Authorization: Bearer $AGGREGATOR_ACCESS_JWT" \

     

       69
       69
       +
           -H "Content-Type: application/json" \

     

       70
       70
       +
           -d "{

     

       71
       71
       +
               \"repo\": \"$AGGREGATOR_DID\",

     

       72
       72
       +
               \"collection\": \"social.coves.aggregator.service\",

     

       73
       73
       +
               \"rkey\": \"self\",

     

       74
       74
       +
               \"record\": $SERVICE_RECORD

     

       75
       75
       +
           }")

     

       76
       76
       +
       

     

       77
       77
       +
       # Check if successful

     

       78
       78
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       79
       79
       +
           echo "✗ Failed to create service declaration:"

     

       80
       80
       +
           echo "$RESPONSE" | jq '.'

     

       81
       81
       +
           exit 1

     

       82
       82
       +
       fi

     

       83
       83
       +
       

     

       84
       84
       +
       # Extract response

     

       85
       85
       +
       RECORD_URI=$(echo "$RESPONSE" | jq -r '.uri')

     

       86
       86
       +
       RECORD_CID=$(echo "$RESPONSE" | jq -r '.cid')

     

       87
       87
       +
       

     

       88
       88
       +
       if [ -z "$RECORD_URI" ] || [ "$RECORD_URI" = "null" ]; then

     

       89
       89
       +
           echo "✗ Error: Unexpected response format"

     

       90
       90
       +
           echo "$RESPONSE" | jq '.'

     

       91
       91
       +
           exit 1

     

       92
       92
       +
       fi

     

       93
       93
       +
       

     

       94
       94
       +
       echo ""

     

       95
       95
       +
       echo "✓ Service declaration created successfully!"

     

       96
       96
       +
       echo ""

     

       97
       97
       +
       echo "=== Record Details ===="

     

       98
       98
       +
       echo "URI: $RECORD_URI"

     

       99
       99
       +
       echo "CID: $RECORD_CID"

     

       100
       100
       +
       echo "======================="

     

       101
       101
       +
       echo ""

     

       102
       102
       +
       

     

       103
       103
       +
       # Save to config

     

       104
       104
       +
       echo "" >> aggregator-config.env

     

       105
       105
       +
       echo "SERVICE_DECLARATION_URI=\"$RECORD_URI\"" >> aggregator-config.env

     

       106
       106
       +
       echo "SERVICE_DECLARATION_CID=\"$RECORD_CID\"" >> aggregator-config.env

     

       107
       107
       +
       

     

       108
       108
       +
       echo "✓ Updated aggregator-config.env"

     

       109
       109
       +
       echo ""

     

       110
       110
       +
       echo "================================================"

     

       111
       111
       +
       echo "Setup Complete!"

     

       112
       112
       +
       echo "================================================"

     

       113
       113
       +
       echo ""

     

       114
       114
       +
       echo "Your aggregator is now registered with Coves!"

     

       115
       115
       +
       echo ""

     

       116
       116
       +
       echo "Next steps:"

     

       117
       117
       +
       echo "1. Wait a few seconds for Jetstream to index your service declaration"

     

       118
       118
       +
       echo "2. Verify your aggregator appears in the aggregators list"

     

       119
       119
       +
       echo "3. Community moderators can now authorize your aggregator"

     

       120
       120
       +
       echo "4. Once authorized, you can start posting to communities"

     

       121
       121
       +
       echo ""

     

       122
       122
       +
       echo "To test posting, use the Coves XRPC endpoint:"

     

       123
       123
       +
       echo "  POST $COVES_INSTANCE_URL/xrpc/social.coves.community.post.create"

     

       124
       124
       +
       echo ""

     

       125
       125
       +
       echo "See docs/aggregators/SETUP_GUIDE.md for more information"

+195

aggregators/kagi-news/scripts/setup.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       

     

       3
       3
       +
       # Script: setup-kagi-aggregator.sh

     

       4
       4
       +
       # Purpose: Complete setup script for Kagi News RSS aggregator

     

       5
       5
       +
       #

     

       6
       6
       +
       # This is a reference implementation showing automated setup for a specific aggregator.

     

       7
       7
       +
       # Other aggregator developers can use this as a template.

     

       8
       8
       +
       

     

       9
       9
       +
       set -e

     

       10
       10
       +
       

     

       11
       11
       +
       echo "================================================"

     

       12
       12
       +
       echo "Kagi News RSS Aggregator - Automated Setup"

     

       13
       13
       +
       echo "================================================"

     

       14
       14
       +
       echo ""

     

       15
       15
       +
       

     

       16
       16
       +
       # Configuration for Kagi aggregator

     

       17
       17
       +
       AGGREGATOR_NAME="kagi-news-bot"

     

       18
       18
       +
       DISPLAY_NAME="Kagi News RSS"

     

       19
       19
       +
       DESCRIPTION="Aggregates tech news from Kagi RSS feeds and posts to relevant communities"

     

       20
       20
       +
       SOURCE_URL="https://github.com/coves-social/kagi-aggregator"

     

       21
       21
       +
       

     

       22
       22
       +
       # Check if config already exists

     

       23
       23
       +
       if [ -f "kagi-aggregator-config.env" ]; then

     

       24
       24
       +
           echo "Configuration file already exists. Loading existing configuration..."

     

       25
       25
       +
           source kagi-aggregator-config.env

     

       26
       26
       +
           SKIP_ACCOUNT_CREATION=true

     

       27
       27
       +
       else

     

       28
       28
       +
           SKIP_ACCOUNT_CREATION=false

     

       29
       29
       +
       fi

     

       30
       30
       +
       

     

       31
       31
       +
       # Get runtime configuration

     

       32
       32
       +
       if [ "$SKIP_ACCOUNT_CREATION" = false ]; then

     

       33
       33
       +
           read -p "Enter PDS URL (default: https://bsky.social): " PDS_URL

     

       34
       34
       +
           PDS_URL=${PDS_URL:-https://bsky.social}

     

       35
       35
       +
       

     

       36
       36
       +
           read -p "Enter email for bot account: " EMAIL

     

       37
       37
       +
           read -sp "Enter password for bot account: " PASSWORD

     

       38
       38
       +
           echo ""

     

       39
       39
       +
       

     

       40
       40
       +
           # Generate handle

     

       41
       41
       +
           TIMESTAMP=$(date +%s)

     

       42
       42
       +
           HANDLE="$AGGREGATOR_NAME-$TIMESTAMP.bsky.social"

     

       43
       43
       +
       

     

       44
       44
       +
           echo ""

     

       45
       45
       +
           echo "Creating PDS account..."

     

       46
       46
       +
           echo "Handle: $HANDLE"

     

       47
       47
       +
       

     

       48
       48
       +
           # Create account

     

       49
       49
       +
           RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.server.createAccount" \

     

       50
       50
       +
               -H "Content-Type: application/json" \

     

       51
       51
       +
               -d "{

     

       52
       52
       +
                   \"handle\": \"$HANDLE\",

     

       53
       53
       +
                   \"email\": \"$EMAIL\",

     

       54
       54
       +
                   \"password\": \"$PASSWORD\"

     

       55
       55
       +
               }")

     

       56
       56
       +
       

     

       57
       57
       +
           if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       58
       58
       +
               echo "✗ Error creating account:"

     

       59
       59
       +
               echo "$RESPONSE" | jq '.'

     

       60
       60
       +
               exit 1

     

       61
       61
       +
           fi

     

       62
       62
       +
       

     

       63
       63
       +
           DID=$(echo "$RESPONSE" | jq -r '.did')

     

       64
       64
       +
           ACCESS_JWT=$(echo "$RESPONSE" | jq -r '.accessJwt')

     

       65
       65
       +
           REFRESH_JWT=$(echo "$RESPONSE" | jq -r '.refreshJwt')

     

       66
       66
       +
       

     

       67
       67
       +
           echo "✓ Account created: $DID"

     

       68
       68
       +
       

     

       69
       69
       +
           # Save configuration

     

       70
       70
       +
           cat > kagi-aggregator-config.env <<EOF

     

       71
       71
       +
       # Kagi Aggregator Configuration

     

       72
       72
       +
       AGGREGATOR_DID="$DID"

     

       73
       73
       +
       AGGREGATOR_HANDLE="$HANDLE"

     

       74
       74
       +
       AGGREGATOR_PDS_URL="$PDS_URL"

     

       75
       75
       +
       AGGREGATOR_EMAIL="$EMAIL"

     

       76
       76
       +
       AGGREGATOR_PASSWORD="$PASSWORD"

     

       77
       77
       +
       AGGREGATOR_ACCESS_JWT="$ACCESS_JWT"

     

       78
       78
       +
       AGGREGATOR_REFRESH_JWT="$REFRESH_JWT"

     

       79
       79
       +
       EOF

     

       80
       80
       +
       

     

       81
       81
       +
           echo "✓ Configuration saved to kagi-aggregator-config.env"

     

       82
       82
       +
       fi

     

       83
       83
       +
       

     

       84
       84
       +
       # Get domain and Coves instance

     

       85
       85
       +
       read -p "Enter aggregator domain (e.g., kagi-news.example.com): " DOMAIN

     

       86
       86
       +
       read -p "Enter Coves instance URL (default: https://api.coves.social): " COVES_URL

     

       87
       87
       +
       COVES_URL=${COVES_URL:-https://api.coves.social}

     

       88
       88
       +
       

     

       89
       89
       +
       # Setup .well-known

     

       90
       90
       +
       echo ""

     

       91
       91
       +
       echo "Setting up .well-known/atproto-did..."

     

       92
       92
       +
       mkdir -p .well-known

     

       93
       93
       +
       echo "$DID" > .well-known/atproto-did

     

       94
       94
       +
       echo "✓ Created .well-known/atproto-did"

     

       95
       95
       +
       

     

       96
       96
       +
       echo ""

     

       97
       97
       +
       echo "================================================"

     

       98
       98
       +
       echo "IMPORTANT: Manual Step Required"

     

       99
       99
       +
       echo "================================================"

     

       100
       100
       +
       echo ""

     

       101
       101
       +
       echo "Upload the .well-known directory to your web server at:"

     

       102
       102
       +
       echo "  https://$DOMAIN/.well-known/atproto-did"

     

       103
       103
       +
       echo ""

     

       104
       104
       +
       read -p "Press Enter when the file is uploaded and accessible..."

     

       105
       105
       +
       

     

       106
       106
       +
       # Verify .well-known

     

       107
       107
       +
       echo ""

     

       108
       108
       +
       echo "Verifying .well-known/atproto-did..."

     

       109
       109
       +
       WELLKNOWN_CONTENT=$(curl -s "https://$DOMAIN/.well-known/atproto-did" || echo "ERROR")

     

       110
       110
       +
       

     

       111
       111
       +
       if [ "$WELLKNOWN_CONTENT" != "$DID" ]; then

     

       112
       112
       +
           echo "✗ Error: .well-known/atproto-did not accessible or contains wrong DID"

     

       113
       113
       +
           echo "  Expected: $DID"

     

       114
       114
       +
           echo "  Got:      $WELLKNOWN_CONTENT"

     

       115
       115
       +
           exit 1

     

       116
       116
       +
       fi

     

       117
       117
       +
       

     

       118
       118
       +
       echo "✓ .well-known/atproto-did verified"

     

       119
       119
       +
       

     

       120
       120
       +
       # Register with Coves

     

       121
       121
       +
       echo ""

     

       122
       122
       +
       echo "Registering with Coves instance..."

     

       123
       123
       +
       RESPONSE=$(curl -s -X POST "$COVES_URL/xrpc/social.coves.aggregator.register" \

     

       124
       124
       +
           -H "Content-Type: application/json" \

     

       125
       125
       +
           -d "{

     

       126
       126
       +
               \"did\": \"$DID\",

     

       127
       127
       +
               \"domain\": \"$DOMAIN\"

     

       128
       128
       +
           }")

     

       129
       129
       +
       

     

       130
       130
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       131
       131
       +
           echo "✗ Registration failed:"

     

       132
       132
       +
           echo "$RESPONSE" | jq '.'

     

       133
       133
       +
           exit 1

     

       134
       134
       +
       fi

     

       135
       135
       +
       

     

       136
       136
       +
       echo "✓ Registered with Coves"

     

       137
       137
       +
       

     

       138
       138
       +
       # Create service declaration

     

       139
       139
       +
       echo ""

     

       140
       140
       +
       echo "Creating service declaration..."

     

       141
       141
       +
       SERVICE_RECORD=$(cat <<EOF

     

       142
       142
       +
       {

     

       143
       143
       +
           "\$type": "social.coves.aggregator.service",

     

       144
       144
       +
           "did": "$DID",

     

       145
       145
       +
           "displayName": "$DISPLAY_NAME",

     

       146
       146
       +
           "description": "$DESCRIPTION",

     

       147
       147
       +
           "sourceUrl": "$SOURCE_URL",

     

       148
       148
       +
           "createdAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"

     

       149
       149
       +
       }

     

       150
       150
       +
       EOF

     

       151
       151
       +
       )

     

       152
       152
       +
       

     

       153
       153
       +
       RESPONSE=$(curl -s -X POST "$PDS_URL/xrpc/com.atproto.repo.createRecord" \

     

       154
       154
       +
           -H "Authorization: Bearer $ACCESS_JWT" \

     

       155
       155
       +
           -H "Content-Type: application/json" \

     

       156
       156
       +
           -d "{

     

       157
       157
       +
               \"repo\": \"$DID\",

     

       158
       158
       +
               \"collection\": \"social.coves.aggregator.service\",

     

       159
       159
       +
               \"rkey\": \"self\",

     

       160
       160
       +
               \"record\": $SERVICE_RECORD

     

       161
       161
       +
           }")

     

       162
       162
       +
       

     

       163
       163
       +
       if echo "$RESPONSE" | jq -e '.error' > /dev/null 2>&1; then

     

       164
       164
       +
           echo "✗ Failed to create service declaration:"

     

       165
       165
       +
           echo "$RESPONSE" | jq '.'

     

       166
       166
       +
           exit 1

     

       167
       167
       +
       fi

     

       168
       168
       +
       

     

       169
       169
       +
       RECORD_URI=$(echo "$RESPONSE" | jq -r '.uri')

     

       170
       170
       +
       echo "✓ Service declaration created: $RECORD_URI"

     

       171
       171
       +
       

     

       172
       172
       +
       # Save final configuration

     

       173
       173
       +
       cat >> kagi-aggregator-config.env <<EOF

     

       174
       174
       +
       

     

       175
       175
       +
       # Setup completed on $(date)

     

       176
       176
       +
       AGGREGATOR_DOMAIN="$DOMAIN"

     

       177
       177
       +
       COVES_INSTANCE_URL="$COVES_URL"

     

       178
       178
       +
       SERVICE_DECLARATION_URI="$RECORD_URI"

     

       179
       179
       +
       EOF

     

       180
       180
       +
       

     

       181
       181
       +
       echo ""

     

       182
       182
       +
       echo "================================================"

     

       183
       183
       +
       echo "✓ Kagi Aggregator Setup Complete!"

     

       184
       184
       +
       echo "================================================"

     

       185
       185
       +
       echo ""

     

       186
       186
       +
       echo "Configuration saved to: kagi-aggregator-config.env"

     

       187
       187
       +
       echo ""

     

       188
       188
       +
       echo "Your aggregator is now registered and ready to use."

     

       189
       189
       +
       echo ""

     

       190
       190
       +
       echo "Next steps:"

     

       191
       191
       +
       echo "1. Start your aggregator bot: npm start (or appropriate command)"

     

       192
       192
       +
       echo "2. Community moderators can authorize your aggregator"

     

       193
       193
       +
       echo "3. Once authorized, your bot can start posting"

     

       194
       194
       +
       echo ""

     

       195
       195
       +
       echo "See docs/aggregators/SETUP_GUIDE.md for more information"

+55

aggregators/kagi-news/.dockerignore

···

       1
       1
       +
       # Git

     

       2
       2
       +
       .git

     

       3
       3
       +
       .gitignore

     

       4
       4
       +
       

     

       5
       5
       +
       # Python

     

       6
       6
       +
       __pycache__

     

       7
       7
       +
       *.py[cod]

     

       8
       8
       +
       *$py.class

     

       9
       9
       +
       *.so

     

       10
       10
       +
       .Python

     

       11
       11
       +
       venv/

     

       12
       12
       +
       *.egg-info

     

       13
       13
       +
       dist/

     

       14
       14
       +
       build/

     

       15
       15
       +
       

     

       16
       16
       +
       # Testing

     

       17
       17
       +
       .pytest_cache/

     

       18
       18
       +
       .coverage

     

       19
       19
       +
       htmlcov/

     

       20
       20
       +
       .tox/

     

       21
       21
       +
       .hypothesis/

     

       22
       22
       +
       

     

       23
       23
       +
       # IDE

     

       24
       24
       +
       .vscode/

     

       25
       25
       +
       .idea/

     

       26
       26
       +
       *.swp

     

       27
       27
       +
       *.swo

     

       28
       28
       +
       *~

     

       29
       29
       +
       

     

       30
       30
       +
       # Environment

     

       31
       31
       +
       .env.local

     

       32
       32
       +
       .env.*.local

     

       33
       33
       +
       

     

       34
       34
       +
       # Data and logs

     

       35
       35
       +
       data/

     

       36
       36
       +
       *.log

     

       37
       37
       +
       

     

       38
       38
       +
       # Documentation

     

       39
       39
       +
       README.md

     

       40
       40
       +
       docs/

     

       41
       41
       +
       

     

       42
       42
       +
       # Docker

     

       43
       43
       +
       Dockerfile

     

       44
       44
       +
       docker-compose.yml

     

       45
       45
       +
       .dockerignore

     

       46
       46
       +
       

     

       47
       47
       +
       # Development

     

       48
       48
       +
       tests/

     

       49
       49
       +
       pytest.ini

     

       50
       50
       +
       mypy.ini

     

       51
       51
       +
       .mypy_cache/

     

       52
       52
       +
       

     

       53
       53
       +
       # OS

     

       54
       54
       +
       .DS_Store

     

       55
       55
       +
       Thumbs.db

+53

aggregators/kagi-news/Dockerfile

···

       1
       1
       +
       # Kagi News RSS Aggregator

     

       2
       2
       +
       # Production-ready Docker image with cron scheduler

     

       3
       3
       +
       

     

       4
       4
       +
       FROM python:3.11-slim

     

       5
       5
       +
       

     

       6
       6
       +
       # Install cron and other utilities

     

       7
       7
       +
       RUN apt-get update && apt-get install -y \

     

       8
       8
       +
           cron \

     

       9
       9
       +
           curl \

     

       10
       10
       +
           procps \

     

       11
       11
       +
           && rm -rf /var/lib/apt/lists/*

     

       12
       12
       +
       

     

       13
       13
       +
       # Set working directory

     

       14
       14
       +
       WORKDIR /app

     

       15
       15
       +
       

     

       16
       16
       +
       # Copy requirements first for better caching

     

       17
       17
       +
       COPY requirements.txt .

     

       18
       18
       +
       

     

       19
       19
       +
       # Install Python dependencies (exclude dev/test deps in production)

     

       20
       20
       +
       RUN pip install --no-cache-dir \

     

       21
       21
       +
           feedparser==6.0.11 \

     

       22
       22
       +
           beautifulsoup4==4.12.3 \

     

       23
       23
       +
           requests==2.31.0 \

     

       24
       24
       +
           atproto==0.0.55 \

     

       25
       25
       +
           pyyaml==6.0.1

     

       26
       26
       +
       

     

       27
       27
       +
       # Copy application code

     

       28
       28
       +
       COPY src/ ./src/

     

       29
       29
       +
       COPY config.yaml ./

     

       30
       30
       +
       

     

       31
       31
       +
       # Copy crontab file

     

       32
       32
       +
       COPY crontab /etc/cron.d/kagi-aggregator

     

       33
       33
       +
       

     

       34
       34
       +
       # Give execution rights on the cron job and apply it

     

       35
       35
       +
       RUN chmod 0644 /etc/cron.d/kagi-aggregator && \

     

       36
       36
       +
           crontab /etc/cron.d/kagi-aggregator

     

       37
       37
       +
       

     

       38
       38
       +
       # Create log file to be able to run tail

     

       39
       39
       +
       RUN touch /var/log/cron.log

     

       40
       40
       +
       

     

       41
       41
       +
       # Copy entrypoint script

     

       42
       42
       +
       COPY docker-entrypoint.sh /usr/local/bin/

     

       43
       43
       +
       RUN chmod +x /usr/local/bin/docker-entrypoint.sh

     

       44
       44
       +
       

     

       45
       45
       +
       # Health check - verify cron is running

     

       46
       46
       +
       HEALTHCHECK --interval=60s --timeout=10s --start-period=10s --retries=3 \

     

       47
       47
       +
           CMD pgrep cron || exit 1

     

       48
       48
       +
       

     

       49
       49
       +
       # Run the entrypoint script

     

       50
       50
       +
       ENTRYPOINT ["docker-entrypoint.sh"]

     

       51
       51
       +
       

     

       52
       52
       +
       # Default command: tail the cron log

     

       53
       53
       +
       CMD ["tail", "-f", "/var/log/cron.log"]

+48

aggregators/kagi-news/docker-compose.yml

···

       1
       1
       +
       services:

     

       2
       2
       +
         kagi-aggregator:

     

       3
       3
       +
           build:

     

       4
       4
       +
             context: .

     

       5
       5
       +
             dockerfile: Dockerfile

     

       6
       6
       +
           container_name: kagi-news-aggregator

     

       7
       7
       +
           restart: unless-stopped

     

       8
       8
       +
       

     

       9
       9
       +
           # Environment variables - override in .env file or here

     

       10
       10
       +
           environment:

     

       11
       11
       +
             # Required: Aggregator credentials

     

       12
       12
       +
             - AGGREGATOR_HANDLE=${AGGREGATOR_HANDLE}

     

       13
       13
       +
             - AGGREGATOR_PASSWORD=${AGGREGATOR_PASSWORD}

     

       14
       14
       +
       

     

       15
       15
       +
             # Optional: Override Coves API URL

     

       16
       16
       +
             - COVES_API_URL=${COVES_API_URL:-https://api.coves.social}

     

       17
       17
       +
       

     

       18
       18
       +
             # Optional: Run immediately on startup (useful for testing)

     

       19
       19
       +
             - RUN_ON_STARTUP=${RUN_ON_STARTUP:-false}

     

       20
       20
       +
       

     

       21
       21
       +
           # Mount config file if you want to modify it without rebuilding

     

       22
       22
       +
           volumes:

     

       23
       23
       +
             - ./config.yaml:/app/config.yaml:ro

     

       24
       24
       +
             - ./data:/app/data  # For state persistence (if implemented)

     

       25
       25
       +
       

     

       26
       26
       +
           # Use env_file to load credentials from .env

     

       27
       27
       +
           env_file:

     

       28
       28
       +
             - .env

     

       29
       29
       +
       

     

       30
       30
       +
           # Logging configuration

     

       31
       31
       +
           logging:

     

       32
       32
       +
             driver: "json-file"

     

       33
       33
       +
             options:

     

       34
       34
       +
               max-size: "10m"

     

       35
       35
       +
               max-file: "3"

     

       36
       36
       +
       

     

       37
       37
       +
           # Health check

     

       38
       38
       +
           healthcheck:

     

       39
       39
       +
             test: ["CMD", "pgrep", "cron"]

     

       40
       40
       +
             interval: 60s

     

       41
       41
       +
             timeout: 10s

     

       42
       42
       +
             retries: 3

     

       43
       43
       +
             start_period: 10s

     

       44
       44
       +
       

     

       45
       45
       +
       # Optional: Networks for multi-container setups

     

       46
       46
       +
       # networks:

     

       47
       47
       +
       #   coves:

     

       48
       48
       +
       #     external: true

+41

aggregators/kagi-news/docker-entrypoint.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       set -e

     

       3
       3
       +
       

     

       4
       4
       +
       echo "Starting Kagi News RSS Aggregator..."

     

       5
       5
       +
       echo "========================================="

     

       6
       6
       +
       

     

       7
       7
       +
       # Load environment variables if .env file exists

     

       8
       8
       +
       if [ -f /app/.env ]; then

     

       9
       9
       +
           echo "Loading environment variables from .env"

     

       10
       10
       +
           export $(grep -v '^#' /app/.env | xargs)

     

       11
       11
       +
       fi

     

       12
       12
       +
       

     

       13
       13
       +
       # Validate required environment variables

     

       14
       14
       +
       if [ -z "$AGGREGATOR_HANDLE" ] || [ -z "$AGGREGATOR_PASSWORD" ]; then

     

       15
       15
       +
           echo "ERROR: Missing required environment variables!"

     

       16
       16
       +
           echo "Please set AGGREGATOR_HANDLE and AGGREGATOR_PASSWORD"

     

       17
       17
       +
           exit 1

     

       18
       18
       +
       fi

     

       19
       19
       +
       

     

       20
       20
       +
       echo "Aggregator Handle: $AGGREGATOR_HANDLE"

     

       21
       21
       +
       echo "Cron schedule loaded from /etc/cron.d/kagi-aggregator"

     

       22
       22
       +
       

     

       23
       23
       +
       # Start cron in the background

     

       24
       24
       +
       echo "Starting cron daemon..."

     

       25
       25
       +
       cron

     

       26
       26
       +
       

     

       27
       27
       +
       # Optional: Run aggregator immediately on startup (for testing)

     

       28
       28
       +
       if [ "$RUN_ON_STARTUP" = "true" ]; then

     

       29
       29
       +
           echo "Running aggregator immediately (RUN_ON_STARTUP=true)..."

     

       30
       30
       +
           cd /app && python -m src.main

     

       31
       31
       +
       fi

     

       32
       32
       +
       

     

       33
       33
       +
       echo "========================================="

     

       34
       34
       +
       echo "Kagi News Aggregator is running!"

     

       35
       35
       +
       echo "Cron schedule: Daily at 1 PM UTC"

     

       36
       36
       +
       echo "Logs will appear below:"

     

       37
       37
       +
       echo "========================================="

     

       38
       38
       +
       echo ""

     

       39
       39
       +
       

     

       40
       40
       +
       # Execute the command passed to docker run (defaults to tail -f /var/log/cron.log)

     

       41
       41
       +
       exec "$@"

+20

.beads/.gitignore

···

       1
       1
       +
       # SQLite databases

     

       2
       2
       +
       *.db

     

       3
       3
       +
       *.db-journal

     

       4
       4
       +
       *.db-wal

     

       5
       5
       +
       *.db-shm

     

       6
       6
       +
       

     

       7
       7
       +
       # Daemon runtime files

     

       8
       8
       +
       daemon.lock

     

       9
       9
       +
       daemon.log

     

       10
       10
       +
       daemon.pid

     

       11
       11
       +
       bd.sock

     

       12
       12
       +
       

     

       13
       13
       +
       # Legacy database files

     

       14
       14
       +
       db.sqlite

     

       15
       15
       +
       bd.db

     

       16
       16
       +
       

     

       17
       17
       +
       # Keep JSONL exports and config (source of truth for git)

     

       18
       18
       +
       !*.jsonl

     

       19
       19
       +
       !metadata.json

     

       20
       20
       +
       !config.json

+56

.beads/config.yaml

···

       1
       1
       +
       # Beads Configuration File

     

       2
       2
       +
       # This file configures default behavior for all bd commands in this repository

     

       3
       3
       +
       # All settings can also be set via environment variables (BD_* prefix)

     

       4
       4
       +
       # or overridden with command-line flags

     

       5
       5
       +
       

     

       6
       6
       +
       # Issue prefix for this repository (used by bd init)

     

       7
       7
       +
       # If not set, bd init will auto-detect from directory name

     

       8
       8
       +
       # Example: issue-prefix: "myproject" creates issues like "myproject-1", "myproject-2", etc.

     

       9
       9
       +
       # issue-prefix: ""

     

       10
       10
       +
       

     

       11
       11
       +
       # Use no-db mode: load from JSONL, no SQLite, write back after each command

     

       12
       12
       +
       # When true, bd will use .beads/issues.jsonl as the source of truth

     

       13
       13
       +
       # instead of SQLite database

     

       14
       14
       +
       # no-db: false

     

       15
       15
       +
       

     

       16
       16
       +
       # Disable daemon for RPC communication (forces direct database access)

     

       17
       17
       +
       # no-daemon: false

     

       18
       18
       +
       

     

       19
       19
       +
       # Disable auto-flush of database to JSONL after mutations

     

       20
       20
       +
       # no-auto-flush: false

     

       21
       21
       +
       

     

       22
       22
       +
       # Disable auto-import from JSONL when it's newer than database

     

       23
       23
       +
       # no-auto-import: false

     

       24
       24
       +
       

     

       25
       25
       +
       # Enable JSON output by default

     

       26
       26
       +
       # json: false

     

       27
       27
       +
       

     

       28
       28
       +
       # Default actor for audit trails (overridden by BD_ACTOR or --actor)

     

       29
       29
       +
       # actor: ""

     

       30
       30
       +
       

     

       31
       31
       +
       # Path to database (overridden by BEADS_DB or --db)

     

       32
       32
       +
       # db: ""

     

       33
       33
       +
       

     

       34
       34
       +
       # Auto-start daemon if not running (can also use BEADS_AUTO_START_DAEMON)

     

       35
       35
       +
       # auto-start-daemon: true

     

       36
       36
       +
       

     

       37
       37
       +
       # Debounce interval for auto-flush (can also use BEADS_FLUSH_DEBOUNCE)

     

       38
       38
       +
       # flush-debounce: "5s"

     

       39
       39
       +
       

     

       40
       40
       +
       # Multi-repo configuration (experimental - bd-307)

     

       41
       41
       +
       # Allows hydrating from multiple repositories and routing writes to the correct JSONL

     

       42
       42
       +
       # repos:

     

       43
       43
       +
       #   primary: "."  # Primary repo (where this database lives)

     

       44
       44
       +
       #   additional:   # Additional repos to hydrate from (read-only)

     

       45
       45
       +
       #     - ~/beads-planning  # Personal planning repo

     

       46
       46
       +
       #     - ~/work-planning   # Work planning repo

     

       47
       47
       +
       

     

       48
       48
       +
       # Integration settings (access with 'bd config get/set')

     

       49
       49
       +
       # These are stored in the database, not in this file:

     

       50
       50
       +
       # - jira.url

     

       51
       51
       +
       # - jira.project

     

       52
       52
       +
       # - linear.url

     

       53
       53
       +
       # - linear.api-key

     

       54
       54
       +
       # - github.org

     

       55
       55
       +
       # - github.repo

     

       56
       56
       +
       # - sync.branch - Git branch for beads commits (use BEADS_SYNC_BRANCH env var or bd config set)

.beads/metadata.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "database": "beads.db",

     

       3
       3
       +
         "jsonl_export": "beads.jsonl"

     

       4
       4
       +
       }

.gitattributes

···

       1
       1
       +
       

     

       2
       2
       +
       # Use bd merge for beads JSONL files

     

       3
       3
       +
       .beads/beads.jsonl merge=beads

+131

AGENTS.md

···

       1
       1
       +
       # AI Agent Guidelines for Coves

     

       2
       2
       +
       

     

       3
       3
       +
       ## Issue Tracking with bd (beads)

     

       4
       4
       +
       

     

       5
       5
       +
       **IMPORTANT**: This project uses **bd (beads)** for ALL issue tracking. Do NOT use markdown TODOs, task lists, or other tracking methods.

     

       6
       6
       +
       

     

       7
       7
       +
       ### Why bd?

     

       8
       8
       +
       

     

       9
       9
       +
       - Dependency-aware: Track blockers and relationships between issues

     

       10
       10
       +
       - Git-friendly: Auto-syncs to JSONL for version control

     

       11
       11
       +
       - Agent-optimized: JSON output, ready work detection, discovered-from links

     

       12
       12
       +
       - Prevents duplicate tracking systems and confusion

     

       13
       13
       +
       

     

       14
       14
       +
       ### Quick Start

     

       15
       15
       +
       

     

       16
       16
       +
       **Check for ready work:**

     

       17
       17
       +
       ```bash

     

       18
       18
       +
       bd ready --json

     

       19
       19
       +
       ```

     

       20
       20
       +
       

     

       21
       21
       +
       **Create new issues:**

     

       22
       22
       +
       ```bash

     

       23
       23
       +
       bd create "Issue title" -t bug|feature|task -p 0-4 --json

     

       24
       24
       +
       bd create "Issue title" -p 1 --deps discovered-from:bd-123 --json

     

       25
       25
       +
       ```

     

       26
       26
       +
       

     

       27
       27
       +
       **Claim and update:**

     

       28
       28
       +
       ```bash

     

       29
       29
       +
       bd update bd-42 --status in_progress --json

     

       30
       30
       +
       bd update bd-42 --priority 1 --json

     

       31
       31
       +
       ```

     

       32
       32
       +
       

     

       33
       33
       +
       **Complete work:**

     

       34
       34
       +
       ```bash

     

       35
       35
       +
       bd close bd-42 --reason "Completed" --json

     

       36
       36
       +
       ```

     

       37
       37
       +
       

     

       38
       38
       +
       ### Issue Types

     

       39
       39
       +
       

     

       40
       40
       +
       - `bug` - Something broken

     

       41
       41
       +
       - `feature` - New functionality

     

       42
       42
       +
       - `task` - Work item (tests, docs, refactoring)

     

       43
       43
       +
       - `epic` - Large feature with subtasks

     

       44
       44
       +
       - `chore` - Maintenance (dependencies, tooling)

     

       45
       45
       +
       

     

       46
       46
       +
       ### Priorities

     

       47
       47
       +
       

     

       48
       48
       +
       - `0` - Critical (security, data loss, broken builds)

     

       49
       49
       +
       - `1` - High (major features, important bugs)

     

       50
       50
       +
       - `2` - Medium (default, nice-to-have)

     

       51
       51
       +
       - `3` - Low (polish, optimization)

     

       52
       52
       +
       - `4` - Backlog (future ideas)

     

       53
       53
       +
       

     

       54
       54
       +
       ### Workflow for AI Agents

     

       55
       55
       +
       

     

       56
       56
       +
       1. **Check ready work**: `bd ready` shows unblocked issues

     

       57
       57
       +
       2. **Claim your task**: `bd update <id> --status in_progress`

     

       58
       58
       +
       3. **Work on it**: Implement, test, document

     

       59
       59
       +
       4. **Discover new work?** Create linked issue:

     

       60
       60
       +
          - `bd create "Found bug" -p 1 --deps discovered-from:<parent-id>`

     

       61
       61
       +
       5. **Complete**: `bd close <id> --reason "Done"`

     

       62
       62
       +
       6. **Commit together**: Always commit the `.beads/issues.jsonl` file together with the code changes so issue state stays in sync with code state

     

       63
       63
       +
       

     

       64
       64
       +
       ### Auto-Sync

     

       65
       65
       +
       

     

       66
       66
       +
       bd automatically syncs with git:

     

       67
       67
       +
       - Exports to `.beads/issues.jsonl` after changes (5s debounce)

     

       68
       68
       +
       - Imports from JSONL when newer (e.g., after `git pull`)

     

       69
       69
       +
       - No manual export/import needed!

     

       70
       70
       +
       

     

       71
       71
       +
       ### MCP Server (Recommended)

     

       72
       72
       +
       

     

       73
       73
       +
       If using Claude or MCP-compatible clients, install the beads MCP server:

     

       74
       74
       +
       

     

       75
       75
       +
       ```bash

     

       76
       76
       +
       pip install beads-mcp

     

       77
       77
       +
       ```

     

       78
       78
       +
       

     

       79
       79
       +
       Add to MCP config (e.g., `~/.config/claude/config.json`):

     

       80
       80
       +
       ```json

     

       81
       81
       +
       {

     

       82
       82
       +
         "beads": {

     

       83
       83
       +
           "command": "beads-mcp",

     

       84
       84
       +
           "args": []

     

       85
       85
       +
         }

     

       86
       86
       +
       }

     

       87
       87
       +
       ```

     

       88
       88
       +
       

     

       89
       89
       +
       Then use `mcp__beads__*` functions instead of CLI commands.

     

       90
       90
       +
       

     

       91
       91
       +
       ### Managing AI-Generated Planning Documents

     

       92
       92
       +
       

     

       93
       93
       +
       AI assistants often create planning and design documents during development:

     

       94
       94
       +
       - PLAN.md, IMPLEMENTATION.md, ARCHITECTURE.md

     

       95
       95
       +
       - DESIGN.md, CODEBASE_SUMMARY.md, INTEGRATION_PLAN.md

     

       96
       96
       +
       - TESTING_GUIDE.md, TECHNICAL_DESIGN.md, and similar files

     

       97
       97
       +
       

     

       98
       98
       +
       **Best Practice: Use a dedicated directory for these ephemeral files**

     

       99
       99
       +
       

     

       100
       100
       +
       **Recommended approach:**

     

       101
       101
       +
       - Create a `history/` directory in the project root

     

       102
       102
       +
       - Store ALL AI-generated planning/design docs in `history/`

     

       103
       103
       +
       - Keep the repository root clean and focused on permanent project files

     

       104
       104
       +
       - Only access `history/` when explicitly asked to review past planning

     

       105
       105
       +
       

     

       106
       106
       +
       **Example .gitignore entry (optional):**

     

       107
       107
       +
       ```

     

       108
       108
       +
       # AI planning documents (ephemeral)

     

       109
       109
       +
       history/

     

       110
       110
       +
       ```

     

       111
       111
       +
       

     

       112
       112
       +
       **Benefits:**

     

       113
       113
       +
       - ✅ Clean repository root

     

       114
       114
       +
       - ✅ Clear separation between ephemeral and permanent documentation

     

       115
       115
       +
       - ✅ Easy to exclude from version control if desired

     

       116
       116
       +
       - ✅ Preserves planning history for archeological research

     

       117
       117
       +
       - ✅ Reduces noise when browsing the project

     

       118
       118
       +
       

     

       119
       119
       +
       ### Important Rules

     

       120
       120
       +
       

     

       121
       121
       +
       - ✅ Use bd for ALL task tracking

     

       122
       122
       +
       - ✅ Always use `--json` flag for programmatic use

     

       123
       123
       +
       - ✅ Link discovered work with `discovered-from` dependencies

     

       124
       124
       +
       - ✅ Check `bd ready` before asking "what should I work on?"

     

       125
       125
       +
       - ✅ Store AI planning docs in `history/` directory

     

       126
       126
       +
       - ❌ Do NOT create markdown TODO lists

     

       127
       127
       +
       - ❌ Do NOT use external issue trackers

     

       128
       128
       +
       - ❌ Do NOT duplicate tracking systems

     

       129
       129
       +
       - ❌ Do NOT clutter repo root with planning documents

     

       130
       130
       +
       

     

       131
       131
       +
       For more details, see the [beads repository](https://github.com/steveyegge/beads).

+8 -8

internal/core/communities/community.go

···

       123
       123
        
       

     

       124
       124
        
       // ListCommunitiesRequest represents query parameters for listing communities

     

       125
       125
        
       type ListCommunitiesRequest struct {

     

       126
       126
       -
       	Visibility string `json:"visibility,omitempty"`

     

       127
       127
       -
       	HostedBy   string `json:"hostedBy,omitempty"`

     

       128
       128
       -
       	SortBy     string `json:"sortBy,omitempty"`

     

       129
       129
       -
       	SortOrder  string `json:"sortOrder,omitempty"`

     

       130
       130
       -
       	Limit      int    `json:"limit"`

     

       131
       131
       -
       	Offset     int    `json:"offset"`

     

       126
       126
       +
       	Sort       string `json:"sort,omitempty"`       // Enum: popular, active, new, alphabetical

     

       127
       127
       +
       	Visibility string `json:"visibility,omitempty"` // Filter: public, unlisted, private

     

       128
       128
       +
       	Category   string `json:"category,omitempty"`   // Optional: filter by category (future)

     

       129
       129
       +
       	Language   string `json:"language,omitempty"`   // Optional: filter by language (future)

     

       130
       130
       +
       	Limit      int    `json:"limit"`                // 1-100, default 50

     

       131
       131
       +
       	Offset     int    `json:"offset"`               // Pagination offset

     

       132
       132
        
       }

     

       133
       133
        
       

     

       134
       134
        
       // SearchCommunitiesRequest represents query parameters for searching communities

     
···

       159
       159
        
       	name := c.Handle[:communityIndex]

     

       160
       160
        
       

     

       161
       161
        
       	// Extract instance domain (everything after ".community.")

     

       162
       162
       -
       	// len(".community.") = 11

     

       163
       163
       -
       	instanceDomain := c.Handle[communityIndex+11:]

     

       162
       162
       +
       	communitySegment := ".community."

     

       163
       163
       +
       	instanceDomain := c.Handle[communityIndex+len(communitySegment):]

     

       164
       164
        
       

     

       165
       165
        
       	return fmt.Sprintf("!%s@%s", name, instanceDomain)

     

       166
       166
        
       }

+2 -2

internal/core/communities/interfaces.go

···

       16
       16
        
       	UpdateCredentials(ctx context.Context, did, accessToken, refreshToken string) error

     

       17
       17
        
       

     

       18
       18
        
       	// Listing & Search

     

       19
       19
       -
       	List(ctx context.Context, req ListCommunitiesRequest) ([]*Community, int, error) // Returns communities + total count

     

       19
       19
       +
       	List(ctx context.Context, req ListCommunitiesRequest) ([]*Community, error)

     

       20
       20
        
       	Search(ctx context.Context, req SearchCommunitiesRequest) ([]*Community, int, error)

     

       21
       21
        
       

     

       22
       22
        
       	// Subscriptions (lightweight feed follows)

     
···

       62
       62
        
       	CreateCommunity(ctx context.Context, req CreateCommunityRequest) (*Community, error)

     

       63
       63
        
       	GetCommunity(ctx context.Context, identifier string) (*Community, error) // identifier can be DID or handle

     

       64
       64
        
       	UpdateCommunity(ctx context.Context, req UpdateCommunityRequest) (*Community, error)

     

       65
       65
       -
       	ListCommunities(ctx context.Context, req ListCommunitiesRequest) ([]*Community, int, error)

     

       65
       65
       +
       	ListCommunities(ctx context.Context, req ListCommunitiesRequest) ([]*Community, error)

     

       66
       66
        
       	SearchCommunities(ctx context.Context, req SearchCommunitiesRequest) ([]*Community, int, error)

     

       67
       67
        
       

     

       68
       68
        
       	// Subscription operations (write-forward: creates record in user's PDS)

+57

scripts/backup.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Database Backup Script

     

       3
       3
       +
       # Usage: ./scripts/backup.sh

     

       4
       4
       +
       #

     

       5
       5
       +
       # Creates timestamped PostgreSQL backups in ./backups/

     

       6
       6
       +
       # Retention: Keeps last 30 days of backups

     

       7
       7
       +
       

     

       8
       8
       +
       set -e

     

       9
       9
       +
       

     

       10
       10
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       11
       11
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       12
       12
       +
       BACKUP_DIR="$PROJECT_DIR/backups"

     

       13
       13
       +
       COMPOSE_FILE="$PROJECT_DIR/docker-compose.prod.yml"

     

       14
       14
       +
       

     

       15
       15
       +
       # Load environment

     

       16
       16
       +
       set -a

     

       17
       17
       +
       source "$PROJECT_DIR/.env.prod"

     

       18
       18
       +
       set +a

     

       19
       19
       +
       

     

       20
       20
       +
       # Colors

     

       21
       21
       +
       GREEN='\033[0;32m'

     

       22
       22
       +
       YELLOW='\033[1;33m'

     

       23
       23
       +
       NC='\033[0m'

     

       24
       24
       +
       

     

       25
       25
       +
       log() { echo -e "${GREEN}[BACKUP]${NC} $1"; }

     

       26
       26
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       27
       27
       +
       

     

       28
       28
       +
       # Create backup directory

     

       29
       29
       +
       mkdir -p "$BACKUP_DIR"

     

       30
       30
       +
       

     

       31
       31
       +
       # Generate timestamp

     

       32
       32
       +
       TIMESTAMP=$(date +%Y%m%d_%H%M%S)

     

       33
       33
       +
       BACKUP_FILE="$BACKUP_DIR/coves_${TIMESTAMP}.sql.gz"

     

       34
       34
       +
       

     

       35
       35
       +
       log "Starting backup..."

     

       36
       36
       +
       

     

       37
       37
       +
       # Run pg_dump inside container

     

       38
       38
       +
       docker compose -f "$COMPOSE_FILE" exec -T postgres \

     

       39
       39
       +
           pg_dump -U "$POSTGRES_USER" -d "$POSTGRES_DB" --clean --if-exists \

     

       40
       40
       +
           | gzip > "$BACKUP_FILE"

     

       41
       41
       +
       

     

       42
       42
       +
       # Get file size

     

       43
       43
       +
       SIZE=$(du -h "$BACKUP_FILE" | cut -f1)

     

       44
       44
       +
       

     

       45
       45
       +
       log "✅ Backup complete: $BACKUP_FILE ($SIZE)"

     

       46
       46
       +
       

     

       47
       47
       +
       # Cleanup old backups (keep last 30 days)

     

       48
       48
       +
       log "Cleaning up backups older than 30 days..."

     

       49
       49
       +
       find "$BACKUP_DIR" -name "coves_*.sql.gz" -mtime +30 -delete

     

       50
       50
       +
       

     

       51
       51
       +
       # List recent backups

     

       52
       52
       +
       log ""

     

       53
       53
       +
       log "Recent backups:"

     

       54
       54
       +
       ls -lh "$BACKUP_DIR"/*.sql.gz 2>/dev/null | tail -5

     

       55
       55
       +
       

     

       56
       56
       +
       log ""

     

       57
       57
       +
       log "To restore: gunzip -c $BACKUP_FILE | docker compose -f docker-compose.prod.yml exec -T postgres psql -U $POSTGRES_USER -d $POSTGRES_DB"

+133

scripts/deploy.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Deployment Script

     

       3
       3
       +
       # Usage: ./scripts/deploy.sh [service]

     

       4
       4
       +
       #

     

       5
       5
       +
       # Examples:

     

       6
       6
       +
       #   ./scripts/deploy.sh           # Deploy all services

     

       7
       7
       +
       #   ./scripts/deploy.sh appview   # Deploy only AppView

     

       8
       8
       +
       #   ./scripts/deploy.sh --pull    # Pull from git first, then deploy

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       COMPOSE_FILE="$PROJECT_DIR/docker-compose.prod.yml"

     

       15
       15
       +
       

     

       16
       16
       +
       # Colors for output

     

       17
       17
       +
       RED='\033[0;31m'

     

       18
       18
       +
       GREEN='\033[0;32m'

     

       19
       19
       +
       YELLOW='\033[1;33m'

     

       20
       20
       +
       NC='\033[0m' # No Color

     

       21
       21
       +
       

     

       22
       22
       +
       log() {

     

       23
       23
       +
           echo -e "${GREEN}[DEPLOY]${NC} $1"

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       26
       26
       +
       warn() {

     

       27
       27
       +
           echo -e "${YELLOW}[WARN]${NC} $1"

     

       28
       28
       +
       }

     

       29
       29
       +
       

     

       30
       30
       +
       error() {

     

       31
       31
       +
           echo -e "${RED}[ERROR]${NC} $1"

     

       32
       32
       +
           exit 1

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       # Parse arguments

     

       36
       36
       +
       PULL_GIT=false

     

       37
       37
       +
       SERVICE=""

     

       38
       38
       +
       

     

       39
       39
       +
       for arg in "$@"; do

     

       40
       40
       +
           case $arg in

     

       41
       41
       +
               --pull)

     

       42
       42
       +
                   PULL_GIT=true

     

       43
       43
       +
                   ;;

     

       44
       44
       +
               *)

     

       45
       45
       +
                   SERVICE="$arg"

     

       46
       46
       +
                   ;;

     

       47
       47
       +
           esac

     

       48
       48
       +
       done

     

       49
       49
       +
       

     

       50
       50
       +
       cd "$PROJECT_DIR"

     

       51
       51
       +
       

     

       52
       52
       +
       # Load environment variables

     

       53
       53
       +
       if [ ! -f ".env.prod" ]; then

     

       54
       54
       +
           error ".env.prod not found! Copy from .env.prod.example and configure secrets."

     

       55
       55
       +
       fi

     

       56
       56
       +
       

     

       57
       57
       +
       log "Loading environment from .env.prod..."

     

       58
       58
       +
       set -a

     

       59
       59
       +
       source .env.prod

     

       60
       60
       +
       set +a

     

       61
       61
       +
       

     

       62
       62
       +
       # Optional: Pull from git

     

       63
       63
       +
       if [ "$PULL_GIT" = true ]; then

     

       64
       64
       +
           log "Pulling latest code from git..."

     

       65
       65
       +
           git fetch origin

     

       66
       66
       +
           git pull origin main

     

       67
       67
       +
       fi

     

       68
       68
       +
       

     

       69
       69
       +
       # Check database connectivity before deployment

     

       70
       70
       +
       log "Checking database connectivity..."

     

       71
       71
       +
       if docker compose -f "$COMPOSE_FILE" exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; then

     

       72
       72
       +
           log "Database is ready"

     

       73
       73
       +
       else

     

       74
       74
       +
           warn "Database not ready yet - it will start with the deployment"

     

       75
       75
       +
       fi

     

       76
       76
       +
       

     

       77
       77
       +
       # Build and deploy

     

       78
       78
       +
       if [ -n "$SERVICE" ]; then

     

       79
       79
       +
           log "Building $SERVICE..."

     

       80
       80
       +
           docker compose -f "$COMPOSE_FILE" build --no-cache "$SERVICE"

     

       81
       81
       +
       

     

       82
       82
       +
           log "Deploying $SERVICE..."

     

       83
       83
       +
           docker compose -f "$COMPOSE_FILE" up -d "$SERVICE"

     

       84
       84
       +
       else

     

       85
       85
       +
           log "Building all services..."

     

       86
       86
       +
           docker compose -f "$COMPOSE_FILE" build --no-cache

     

       87
       87
       +
       

     

       88
       88
       +
           log "Deploying all services..."

     

       89
       89
       +
           docker compose -f "$COMPOSE_FILE" up -d

     

       90
       90
       +
       fi

     

       91
       91
       +
       

     

       92
       92
       +
       # Health check

     

       93
       93
       +
       log "Waiting for services to be healthy..."

     

       94
       94
       +
       sleep 10

     

       95
       95
       +
       

     

       96
       96
       +
       # Wait for database to be ready before running migrations

     

       97
       97
       +
       log "Waiting for database..."

     

       98
       98
       +
       for i in {1..30}; do

     

       99
       99
       +
           if docker compose -f "$COMPOSE_FILE" exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; then

     

       100
       100
       +
               break

     

       101
       101
       +
           fi

     

       102
       102
       +
           sleep 1

     

       103
       103
       +
       done

     

       104
       104
       +
       

     

       105
       105
       +
       # Run database migrations

     

       106
       106
       +
       # The AppView runs migrations on startup, but we can also trigger them explicitly

     

       107
       107
       +
       log "Running database migrations..."

     

       108
       108
       +
       if docker compose -f "$COMPOSE_FILE" exec -T appview /app/coves-server migrate 2>/dev/null; then

     

       109
       109
       +
           log "✅ Migrations completed"

     

       110
       110
       +
       else

     

       111
       111
       +
           warn "⚠️  Migration command not available or failed - AppView will run migrations on startup"

     

       112
       112
       +
       fi

     

       113
       113
       +
       

     

       114
       114
       +
       # Check AppView health

     

       115
       115
       +
       if docker compose -f "$COMPOSE_FILE" exec -T appview wget --spider -q http://localhost:8080/xrpc/_health 2>/dev/null; then

     

       116
       116
       +
           log "✅ AppView is healthy"

     

       117
       117
       +
       else

     

       118
       118
       +
           warn "⚠️  AppView health check failed - check logs with: docker compose -f docker-compose.prod.yml logs appview"

     

       119
       119
       +
       fi

     

       120
       120
       +
       

     

       121
       121
       +
       # Check PDS health

     

       122
       122
       +
       if docker compose -f "$COMPOSE_FILE" exec -T pds wget --spider -q http://localhost:3000/xrpc/_health 2>/dev/null; then

     

       123
       123
       +
           log "✅ PDS is healthy"

     

       124
       124
       +
       else

     

       125
       125
       +
           warn "⚠️  PDS health check failed - check logs with: docker compose -f docker-compose.prod.yml logs pds"

     

       126
       126
       +
       fi

     

       127
       127
       +
       

     

       128
       128
       +
       log "Deployment complete!"

     

       129
       129
       +
       log ""

     

       130
       130
       +
       log "Useful commands:"

     

       131
       131
       +
       log "  View logs:     docker compose -f docker-compose.prod.yml logs -f"

     

       132
       132
       +
       log "  Check status:  docker compose -f docker-compose.prod.yml ps"

     

       133
       133
       +
       log "  Rollback:      docker compose -f docker-compose.prod.yml down && git checkout HEAD~1 && ./scripts/deploy.sh"

+149

scripts/generate-did-keys.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Generate cryptographic keys for Coves did:web DID document

     

       3
       3
       +
       #

     

       4
       4
       +
       # This script generates a secp256k1 (K-256) key pair as required by atproto.

     

       5
       5
       +
       # Reference: https://atproto.com/specs/cryptography

     

       6
       6
       +
       #

     

       7
       7
       +
       # Key format:

     

       8
       8
       +
       #   - Curve: secp256k1 (K-256) - same as Bitcoin/Ethereum

     

       9
       9
       +
       #   - Type: Multikey

     

       10
       10
       +
       #   - Encoding: publicKeyMultibase with base58btc ('z' prefix)

     

       11
       11
       +
       #   - Multicodec: 0xe7 for secp256k1 compressed public key

     

       12
       12
       +
       #

     

       13
       13
       +
       # Output:

     

       14
       14
       +
       #   - Private key (hex) for PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX

     

       15
       15
       +
       #   - Public key (multibase) for did.json publicKeyMultibase field

     

       16
       16
       +
       #   - Complete did.json file

     

       17
       17
       +
       

     

       18
       18
       +
       set -e

     

       19
       19
       +
       

     

       20
       20
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       21
       21
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       22
       22
       +
       OUTPUT_DIR="$PROJECT_DIR/static/.well-known"

     

       23
       23
       +
       

     

       24
       24
       +
       # Colors

     

       25
       25
       +
       GREEN='\033[0;32m'

     

       26
       26
       +
       YELLOW='\033[1;33m'

     

       27
       27
       +
       RED='\033[0;31m'

     

       28
       28
       +
       NC='\033[0m'

     

       29
       29
       +
       

     

       30
       30
       +
       log() { echo -e "${GREEN}[KEYGEN]${NC} $1"; }

     

       31
       31
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       32
       32
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       33
       33
       +
       

     

       34
       34
       +
       # Check for required tools

     

       35
       35
       +
       if ! command -v openssl &> /dev/null; then

     

       36
       36
       +
           error "openssl is required but not installed"

     

       37
       37
       +
       fi

     

       38
       38
       +
       

     

       39
       39
       +
       if ! command -v python3 &> /dev/null; then

     

       40
       40
       +
           error "python3 is required for base58 encoding"

     

       41
       41
       +
       fi

     

       42
       42
       +
       

     

       43
       43
       +
       # Check for base58 library

     

       44
       44
       +
       if ! python3 -c "import base58" 2>/dev/null; then

     

       45
       45
       +
           warn "Installing base58 Python library..."

     

       46
       46
       +
           pip3 install base58 || error "Failed to install base58. Run: pip3 install base58"

     

       47
       47
       +
       fi

     

       48
       48
       +
       

     

       49
       49
       +
       log "Generating secp256k1 key pair for did:web..."

     

       50
       50
       +
       

     

       51
       51
       +
       # Generate private key

     

       52
       52
       +
       PRIVATE_KEY_PEM=$(mktemp)

     

       53
       53
       +
       openssl ecparam -name secp256k1 -genkey -noout -out "$PRIVATE_KEY_PEM" 2>/dev/null

     

       54
       54
       +
       

     

       55
       55
       +
       # Extract private key as hex (for PDS config)

     

       56
       56
       +
       PRIVATE_KEY_HEX=$(openssl ec -in "$PRIVATE_KEY_PEM" -text -noout 2>/dev/null | \

     

       57
       57
       +
           grep -A 3 "priv:" | tail -n 3 | tr -d ' :\n' | tr -d '\r')

     

       58
       58
       +
       

     

       59
       59
       +
       # Extract public key as compressed format

     

       60
       60
       +
       # OpenSSL outputs the public key, we need to get the compressed form

     

       61
       61
       +
       PUBLIC_KEY_HEX=$(openssl ec -in "$PRIVATE_KEY_PEM" -pubout -conv_form compressed -outform DER 2>/dev/null | \

     

       62
       62
       +
           tail -c 33 | xxd -p | tr -d '\n')

     

       63
       63
       +
       

     

       64
       64
       +
       # Clean up temp file

     

       65
       65
       +
       rm -f "$PRIVATE_KEY_PEM"

     

       66
       66
       +
       

     

       67
       67
       +
       # Encode public key as multibase with multicodec

     

       68
       68
       +
       # Multicodec 0xe7 = secp256k1 compressed public key

     

       69
       69
       +
       # Then base58btc encode with 'z' prefix

     

       70
       70
       +
       PUBLIC_KEY_MULTIBASE=$(python3 << EOF

     

       71
       71
       +
       import base58

     

       72
       72
       +
       

     

       73
       73
       +
       # Compressed public key bytes

     

       74
       74
       +
       pub_hex = "$PUBLIC_KEY_HEX"

     

       75
       75
       +
       pub_bytes = bytes.fromhex(pub_hex)

     

       76
       76
       +
       

     

       77
       77
       +
       # Prepend multicodec 0xe7 for secp256k1-pub

     

       78
       78
       +
       # 0xe7 as varint is just 0xe7 (single byte, < 128)

     

       79
       79
       +
       multicodec = bytes([0xe7, 0x01])  # 0xe701 for secp256k1-pub compressed

     

       80
       80
       +
       key_with_codec = multicodec + pub_bytes

     

       81
       81
       +
       

     

       82
       82
       +
       # Base58btc encode

     

       83
       83
       +
       encoded = base58.b58encode(key_with_codec).decode('ascii')

     

       84
       84
       +
       

     

       85
       85
       +
       # Add 'z' prefix for multibase

     

       86
       86
       +
       print('z' + encoded)

     

       87
       87
       +
       EOF

     

       88
       88
       +
       )

     

       89
       89
       +
       

     

       90
       90
       +
       log "Keys generated successfully!"

     

       91
       91
       +
       echo ""

     

       92
       92
       +
       echo "============================================"

     

       93
       93
       +
       echo "  PRIVATE KEY (keep secret!)"

     

       94
       94
       +
       echo "============================================"

     

       95
       95
       +
       echo ""

     

       96
       96
       +
       echo "Add this to your .env.prod file:"

     

       97
       97
       +
       echo ""

     

       98
       98
       +
       echo "PDS_ROTATION_KEY=$PRIVATE_KEY_HEX"

     

       99
       99
       +
       echo ""

     

       100
       100
       +
       echo "============================================"

     

       101
       101
       +
       echo "  PUBLIC KEY (for did.json)"

     

       102
       102
       +
       echo "============================================"

     

       103
       103
       +
       echo ""

     

       104
       104
       +
       echo "publicKeyMultibase: $PUBLIC_KEY_MULTIBASE"

     

       105
       105
       +
       echo ""

     

       106
       106
       +
       

     

       107
       107
       +
       # Generate the did.json file

     

       108
       108
       +
       log "Generating did.json..."

     

       109
       109
       +
       

     

       110
       110
       +
       mkdir -p "$OUTPUT_DIR"

     

       111
       111
       +
       

     

       112
       112
       +
       cat > "$OUTPUT_DIR/did.json" << EOF

     

       113
       113
       +
       {

     

       114
       114
       +
         "id": "did:web:coves.social",

     

       115
       115
       +
         "alsoKnownAs": ["at://coves.social"],

     

       116
       116
       +
         "verificationMethod": [

     

       117
       117
       +
           {

     

       118
       118
       +
             "id": "did:web:coves.social#atproto",

     

       119
       119
       +
             "type": "Multikey",

     

       120
       120
       +
             "controller": "did:web:coves.social",

     

       121
       121
       +
             "publicKeyMultibase": "$PUBLIC_KEY_MULTIBASE"

     

       122
       122
       +
           }

     

       123
       123
       +
         ],

     

       124
       124
       +
         "service": [

     

       125
       125
       +
           {

     

       126
       126
       +
             "id": "#atproto_pds",

     

       127
       127
       +
             "type": "AtprotoPersonalDataServer",

     

       128
       128
       +
             "serviceEndpoint": "https://coves.me"

     

       129
       129
       +
           }

     

       130
       130
       +
         ]

     

       131
       131
       +
       }

     

       132
       132
       +
       EOF

     

       133
       133
       +
       

     

       134
       134
       +
       log "Created: $OUTPUT_DIR/did.json"

     

       135
       135
       +
       echo ""

     

       136
       136
       +
       echo "============================================"

     

       137
       137
       +
       echo "  NEXT STEPS"

     

       138
       138
       +
       echo "============================================"

     

       139
       139
       +
       echo ""

     

       140
       140
       +
       echo "1. Copy the PDS_ROTATION_KEY value to your .env.prod file"

     

       141
       141
       +
       echo ""

     

       142
       142
       +
       echo "2. Verify the did.json looks correct:"

     

       143
       143
       +
       echo "   cat $OUTPUT_DIR/did.json"

     

       144
       144
       +
       echo ""

     

       145
       145
       +
       echo "3. After deployment, verify it's accessible:"

     

       146
       146
       +
       echo "   curl https://coves.social/.well-known/did.json"

     

       147
       147
       +
       echo ""

     

       148
       148
       +
       warn "IMPORTANT: Keep the private key secret! Only share the public key."

     

       149
       149
       +
       warn "The did.json file with the public key IS safe to commit to git."

+106

scripts/setup-production.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Coves Production Setup Script

     

       3
       3
       +
       # Run this once on a fresh server to set up everything

     

       4
       4
       +
       #

     

       5
       5
       +
       # Prerequisites:

     

       6
       6
       +
       #   - Docker and docker-compose installed

     

       7
       7
       +
       #   - Git installed

     

       8
       8
       +
       #   - .env.prod file configured

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       

     

       15
       15
       +
       # Colors

     

       16
       16
       +
       GREEN='\033[0;32m'

     

       17
       17
       +
       YELLOW='\033[1;33m'

     

       18
       18
       +
       RED='\033[0;31m'

     

       19
       19
       +
       NC='\033[0m'

     

       20
       20
       +
       

     

       21
       21
       +
       log() { echo -e "${GREEN}[SETUP]${NC} $1"; }

     

       22
       22
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       23
       23
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       24
       24
       +
       

     

       25
       25
       +
       cd "$PROJECT_DIR"

     

       26
       26
       +
       

     

       27
       27
       +
       # Check prerequisites

     

       28
       28
       +
       log "Checking prerequisites..."

     

       29
       29
       +
       

     

       30
       30
       +
       if ! command -v docker &> /dev/null; then

     

       31
       31
       +
           error "Docker is not installed. Install with: curl -fsSL https://get.docker.com | sh"

     

       32
       32
       +
       fi

     

       33
       33
       +
       

     

       34
       34
       +
       if ! docker compose version &> /dev/null; then

     

       35
       35
       +
           error "docker compose is not available. Install with: apt install docker-compose-plugin"

     

       36
       36
       +
       fi

     

       37
       37
       +
       

     

       38
       38
       +
       # Check for .env.prod

     

       39
       39
       +
       if [ ! -f ".env.prod" ]; then

     

       40
       40
       +
           error ".env.prod not found! Copy from .env.prod.example and configure secrets."

     

       41
       41
       +
       fi

     

       42
       42
       +
       

     

       43
       43
       +
       # Load environment

     

       44
       44
       +
       set -a

     

       45
       45
       +
       source .env.prod

     

       46
       46
       +
       set +a

     

       47
       47
       +
       

     

       48
       48
       +
       # Create required directories

     

       49
       49
       +
       log "Creating directories..."

     

       50
       50
       +
       mkdir -p backups

     

       51
       51
       +
       mkdir -p static/.well-known

     

       52
       52
       +
       

     

       53
       53
       +
       # Check for did.json

     

       54
       54
       +
       if [ ! -f "static/.well-known/did.json" ]; then

     

       55
       55
       +
           warn "static/.well-known/did.json not found!"

     

       56
       56
       +
           warn "Run ./scripts/generate-did-keys.sh to create it."

     

       57
       57
       +
       fi

     

       58
       58
       +
       

     

       59
       59
       +
       # Note: Caddy logs are written to Docker volume (caddy-data)

     

       60
       60
       +
       # If you need host-accessible logs, uncomment and run as root:

     

       61
       61
       +
       # mkdir -p /var/log/caddy && chown 1000:1000 /var/log/caddy

     

       62
       62
       +
       

     

       63
       63
       +
       # Pull Docker images

     

       64
       64
       +
       log "Pulling Docker images..."

     

       65
       65
       +
       docker compose -f docker-compose.prod.yml pull postgres pds caddy

     

       66
       66
       +
       

     

       67
       67
       +
       # Build AppView

     

       68
       68
       +
       log "Building AppView..."

     

       69
       69
       +
       docker compose -f docker-compose.prod.yml build appview

     

       70
       70
       +
       

     

       71
       71
       +
       # Start services

     

       72
       72
       +
       log "Starting services..."

     

       73
       73
       +
       docker compose -f docker-compose.prod.yml up -d

     

       74
       74
       +
       

     

       75
       75
       +
       # Wait for PostgreSQL

     

       76
       76
       +
       log "Waiting for PostgreSQL to be ready..."

     

       77
       77
       +
       until docker compose -f docker-compose.prod.yml exec -T postgres pg_isready -U "$POSTGRES_USER" -d "$POSTGRES_DB" > /dev/null 2>&1; do

     

       78
       78
       +
           sleep 2

     

       79
       79
       +
       done

     

       80
       80
       +
       log "PostgreSQL is ready!"

     

       81
       81
       +
       

     

       82
       82
       +
       # Run migrations

     

       83
       83
       +
       log "Running database migrations..."

     

       84
       84
       +
       # The AppView runs migrations on startup, but you can also run them manually:

     

       85
       85
       +
       # docker compose -f docker-compose.prod.yml exec appview /app/coves-server migrate

     

       86
       86
       +
       

     

       87
       87
       +
       # Final status

     

       88
       88
       +
       log ""

     

       89
       89
       +
       log "============================================"

     

       90
       90
       +
       log "  Coves Production Setup Complete!"

     

       91
       91
       +
       log "============================================"

     

       92
       92
       +
       log ""

     

       93
       93
       +
       log "Services running:"

     

       94
       94
       +
       docker compose -f docker-compose.prod.yml ps

     

       95
       95
       +
       log ""

     

       96
       96
       +
       log "Next steps:"

     

       97
       97
       +
       log "  1. Configure DNS for coves.social and coves.me"

     

       98
       98
       +
       log "  2. Run ./scripts/generate-did-keys.sh to create DID keys"

     

       99
       99
       +
       log "  3. Test health endpoints:"

     

       100
       100
       +
       log "     curl https://coves.social/xrpc/_health"

     

       101
       101
       +
       log "     curl https://coves.me/xrpc/_health"

     

       102
       102
       +
       log ""

     

       103
       103
       +
       log "Useful commands:"

     

       104
       104
       +
       log "  View logs:     docker compose -f docker-compose.prod.yml logs -f"

     

       105
       105
       +
       log "  Deploy update: ./scripts/deploy.sh appview"

     

       106
       106
       +
       log "  Backup DB:     ./scripts/backup.sh"

+19

static/.well-known/did.json.template

···

       1
       1
       +
       {

     

       2
       2
       +
         "id": "did:web:coves.social",

     

       3
       3
       +
         "alsoKnownAs": ["at://coves.social"],

     

       4
       4
       +
         "verificationMethod": [

     

       5
       5
       +
           {

     

       6
       6
       +
             "id": "did:web:coves.social#atproto",

     

       7
       7
       +
             "type": "Multikey",

     

       8
       8
       +
             "controller": "did:web:coves.social",

     

       9
       9
       +
             "publicKeyMultibase": "REPLACE_WITH_YOUR_PUBLIC_KEY"

     

       10
       10
       +
           }

     

       11
       11
       +
         ],

     

       12
       12
       +
         "service": [

     

       13
       13
       +
           {

     

       14
       14
       +
             "id": "#atproto_pds",

     

       15
       15
       +
             "type": "AtprotoPersonalDataServer",

     

       16
       16
       +
             "serviceEndpoint": "https://coves.me"

     

       17
       17
       +
           }

     

       18
       18
       +
         ]

     

       19
       19
       +
       }

+18

static/client-metadata.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "client_id": "https://coves.social/client-metadata.json",

     

       3
       3
       +
         "client_name": "Coves",

     

       4
       4
       +
         "client_uri": "https://coves.social",

     

       5
       5
       +
         "logo_uri": "https://coves.social/logo.png",

     

       6
       6
       +
         "tos_uri": "https://coves.social/terms",

     

       7
       7
       +
         "policy_uri": "https://coves.social/privacy",

     

       8
       8
       +
         "redirect_uris": [

     

       9
       9
       +
           "https://coves.social/oauth/callback",

     

       10
       10
       +
           "social.coves:/oauth/callback"

     

       11
       11
       +
         ],

     

       12
       12
       +
         "scope": "atproto transition:generic",

     

       13
       13
       +
         "grant_types": ["authorization_code", "refresh_token"],

     

       14
       14
       +
         "response_types": ["code"],

     

       15
       15
       +
         "application_type": "native",

     

       16
       16
       +
         "token_endpoint_auth_method": "none",

     

       17
       17
       +
         "dpop_bound_access_tokens": true

     

       18
       18
       +
       }

+2 -1

Dockerfile

···

       42
       42
        
       COPY --from=builder /build/coves-server /app/coves-server

     

       43
       43
        
       

     

       44
       44
        
       # Copy migrations (needed for goose)

     

       45
       45
       -
       COPY --from=builder /build/internal/db/migrations /app/migrations

     

       45
       45
       +
       # Must maintain path structure as app looks for internal/db/migrations

     

       46
       46
       +
       COPY --from=builder /build/internal/db/migrations /app/internal/db/migrations

     

       46
       47
        
       

     

       47
       48
        
       # Set ownership

     

       48
       49
        
       RUN chown -R coves:coves /app

+187

scripts/derive-did-from-key.sh

···

       1
       1
       +
       #!/bin/bash

     

       2
       2
       +
       # Derive public key from existing PDS_ROTATION_KEY and create did.json

     

       3
       3
       +
       #

     

       4
       4
       +
       # This script takes your existing private key and derives the public key from it.

     

       5
       5
       +
       # Use this if you already have a PDS running with a rotation key but need to

     

       6
       6
       +
       # create/fix the did.json file.

     

       7
       7
       +
       #

     

       8
       8
       +
       # Usage: ./scripts/derive-did-from-key.sh

     

       9
       9
       +
       

     

       10
       10
       +
       set -e

     

       11
       11
       +
       

     

       12
       12
       +
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

     

       13
       13
       +
       PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

     

       14
       14
       +
       OUTPUT_DIR="$PROJECT_DIR/static/.well-known"

     

       15
       15
       +
       

     

       16
       16
       +
       # Colors

     

       17
       17
       +
       GREEN='\033[0;32m'

     

       18
       18
       +
       YELLOW='\033[1;33m'

     

       19
       19
       +
       RED='\033[0;31m'

     

       20
       20
       +
       NC='\033[0m'

     

       21
       21
       +
       

     

       22
       22
       +
       log() { echo -e "${GREEN}[DERIVE]${NC} $1"; }

     

       23
       23
       +
       warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

     

       24
       24
       +
       error() { echo -e "${RED}[ERROR]${NC} $1"; exit 1; }

     

       25
       25
       +
       

     

       26
       26
       +
       # Check for required tools

     

       27
       27
       +
       if ! command -v openssl &> /dev/null; then

     

       28
       28
       +
           error "openssl is required but not installed"

     

       29
       29
       +
       fi

     

       30
       30
       +
       

     

       31
       31
       +
       if ! command -v python3 &> /dev/null; then

     

       32
       32
       +
           error "python3 is required for base58 encoding"

     

       33
       33
       +
       fi

     

       34
       34
       +
       

     

       35
       35
       +
       # Check for base58 library

     

       36
       36
       +
       if ! python3 -c "import base58" 2>/dev/null; then

     

       37
       37
       +
           warn "Installing base58 Python library..."

     

       38
       38
       +
           pip3 install base58 || error "Failed to install base58. Run: pip3 install base58"

     

       39
       39
       +
       fi

     

       40
       40
       +
       

     

       41
       41
       +
       # Load environment to get the existing key

     

       42
       42
       +
       if [ -f "$PROJECT_DIR/.env.prod" ]; then

     

       43
       43
       +
           source "$PROJECT_DIR/.env.prod"

     

       44
       44
       +
       elif [ -f "$PROJECT_DIR/.env" ]; then

     

       45
       45
       +
           source "$PROJECT_DIR/.env"

     

       46
       46
       +
       else

     

       47
       47
       +
           error "No .env.prod or .env file found"

     

       48
       48
       +
       fi

     

       49
       49
       +
       

     

       50
       50
       +
       if [ -z "$PDS_ROTATION_KEY" ]; then

     

       51
       51
       +
           error "PDS_ROTATION_KEY not found in environment"

     

       52
       52
       +
       fi

     

       53
       53
       +
       

     

       54
       54
       +
       # Validate key format (should be 64 hex chars)

     

       55
       55
       +
       if [[ ! "$PDS_ROTATION_KEY" =~ ^[0-9a-fA-F]{64}$ ]]; then

     

       56
       56
       +
           error "PDS_ROTATION_KEY is not a valid 64-character hex string"

     

       57
       57
       +
       fi

     

       58
       58
       +
       

     

       59
       59
       +
       log "Deriving public key from existing PDS_ROTATION_KEY..."

     

       60
       60
       +
       

     

       61
       61
       +
       # Create a temporary PEM file from the hex private key

     

       62
       62
       +
       TEMP_DIR=$(mktemp -d)

     

       63
       63
       +
       PRIVATE_KEY_HEX="$PDS_ROTATION_KEY"

     

       64
       64
       +
       

     

       65
       65
       +
       # Convert hex private key to PEM format

     

       66
       66
       +
       # secp256k1 curve OID: 1.3.132.0.10

     

       67
       67
       +
       python3 > "$TEMP_DIR/private.pem" << EOF

     

       68
       68
       +
       import binascii

     

       69
       69
       +
       

     

       70
       70
       +
       # Private key in hex

     

       71
       71
       +
       priv_hex = "$PRIVATE_KEY_HEX"

     

       72
       72
       +
       priv_bytes = binascii.unhexlify(priv_hex)

     

       73
       73
       +
       

     

       74
       74
       +
       # secp256k1 OID

     

       75
       75
       +
       oid = bytes([0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a])

     

       76
       76
       +
       

     

       77
       77
       +
       # Build the EC private key structure

     

       78
       78
       +
       # SEQUENCE { version INTEGER, privateKey OCTET STRING, [0] OID, [1] publicKey }

     

       79
       79
       +
       # We'll use a simpler approach: just the private key with curve params

     

       80
       80
       +
       

     

       81
       81
       +
       # EC PARAMETERS for secp256k1

     

       82
       82
       +
       ec_params = bytes([

     

       83
       83
       +
           0x30, 0x07,  # SEQUENCE, 7 bytes

     

       84
       84
       +
           0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a  # OID for secp256k1

     

       85
       85
       +
       ])

     

       86
       86
       +
       

     

       87
       87
       +
       # EC PRIVATE KEY structure

     

       88
       88
       +
       # SEQUENCE { version, privateKey, [0] parameters }

     

       89
       89
       +
       inner = bytes([0x02, 0x01, 0x01])  # version = 1

     

       90
       90
       +
       inner += bytes([0x04, 0x20]) + priv_bytes  # OCTET STRING with 32-byte key

     

       91
       91
       +
       inner += bytes([0xa0, 0x07]) + bytes([0x06, 0x05, 0x2b, 0x81, 0x04, 0x00, 0x0a])  # [0] OID

     

       92
       92
       +
       

     

       93
       93
       +
       # Wrap in SEQUENCE

     

       94
       94
       +
       key_der = bytes([0x30, len(inner)]) + inner

     

       95
       95
       +
       

     

       96
       96
       +
       # Base64 encode

     

       97
       97
       +
       import base64

     

       98
       98
       +
       key_b64 = base64.b64encode(key_der).decode('ascii')

     

       99
       99
       +
       

     

       100
       100
       +
       # Format as PEM

     

       101
       101
       +
       print("-----BEGIN EC PRIVATE KEY-----")

     

       102
       102
       +
       for i in range(0, len(key_b64), 64):

     

       103
       103
       +
           print(key_b64[i:i+64])

     

       104
       104
       +
       print("-----END EC PRIVATE KEY-----")

     

       105
       105
       +
       EOF

     

       106
       106
       +
       

     

       107
       107
       +
       # Extract the compressed public key

     

       108
       108
       +
       PUBLIC_KEY_HEX=$(openssl ec -in "$TEMP_DIR/private.pem" -pubout -conv_form compressed -outform DER 2>/dev/null | \

     

       109
       109
       +
           tail -c 33 | xxd -p | tr -d '\n')

     

       110
       110
       +
       

     

       111
       111
       +
       # Clean up

     

       112
       112
       +
       rm -rf "$TEMP_DIR"

     

       113
       113
       +
       

     

       114
       114
       +
       if [ -z "$PUBLIC_KEY_HEX" ] || [ ${#PUBLIC_KEY_HEX} -ne 66 ]; then

     

       115
       115
       +
           error "Failed to derive public key. Got: $PUBLIC_KEY_HEX"

     

       116
       116
       +
       fi

     

       117
       117
       +
       

     

       118
       118
       +
       log "Derived public key: ${PUBLIC_KEY_HEX:0:8}...${PUBLIC_KEY_HEX: -8}"

     

       119
       119
       +
       

     

       120
       120
       +
       # Encode public key as multibase with multicodec

     

       121
       121
       +
       PUBLIC_KEY_MULTIBASE=$(python3 << EOF

     

       122
       122
       +
       import base58

     

       123
       123
       +
       

     

       124
       124
       +
       # Compressed public key bytes

     

       125
       125
       +
       pub_hex = "$PUBLIC_KEY_HEX"

     

       126
       126
       +
       pub_bytes = bytes.fromhex(pub_hex)

     

       127
       127
       +
       

     

       128
       128
       +
       # Prepend multicodec 0xe7 for secp256k1-pub

     

       129
       129
       +
       # 0xe7 as varint is just 0xe7 (single byte, < 128)

     

       130
       130
       +
       multicodec = bytes([0xe7, 0x01])  # 0xe701 for secp256k1-pub compressed

     

       131
       131
       +
       key_with_codec = multicodec + pub_bytes

     

       132
       132
       +
       

     

       133
       133
       +
       # Base58btc encode

     

       134
       134
       +
       encoded = base58.b58encode(key_with_codec).decode('ascii')

     

       135
       135
       +
       

     

       136
       136
       +
       # Add 'z' prefix for multibase

     

       137
       137
       +
       print('z' + encoded)

     

       138
       138
       +
       EOF

     

       139
       139
       +
       )

     

       140
       140
       +
       

     

       141
       141
       +
       log "Public key multibase: $PUBLIC_KEY_MULTIBASE"

     

       142
       142
       +
       

     

       143
       143
       +
       # Generate the did.json file

     

       144
       144
       +
       log "Generating did.json..."

     

       145
       145
       +
       

     

       146
       146
       +
       mkdir -p "$OUTPUT_DIR"

     

       147
       147
       +
       

     

       148
       148
       +
       cat > "$OUTPUT_DIR/did.json" << EOF

     

       149
       149
       +
       {

     

       150
       150
       +
         "id": "did:web:coves.social",

     

       151
       151
       +
         "alsoKnownAs": ["at://coves.social"],

     

       152
       152
       +
         "verificationMethod": [

     

       153
       153
       +
           {

     

       154
       154
       +
             "id": "did:web:coves.social#atproto",

     

       155
       155
       +
             "type": "Multikey",

     

       156
       156
       +
             "controller": "did:web:coves.social",

     

       157
       157
       +
             "publicKeyMultibase": "$PUBLIC_KEY_MULTIBASE"

     

       158
       158
       +
           }

     

       159
       159
       +
         ],

     

       160
       160
       +
         "service": [

     

       161
       161
       +
           {

     

       162
       162
       +
             "id": "#atproto_pds",

     

       163
       163
       +
             "type": "AtprotoPersonalDataServer",

     

       164
       164
       +
             "serviceEndpoint": "https://coves.me"

     

       165
       165
       +
           }

     

       166
       166
       +
         ]

     

       167
       167
       +
       }

     

       168
       168
       +
       EOF

     

       169
       169
       +
       

     

       170
       170
       +
       log "Created: $OUTPUT_DIR/did.json"

     

       171
       171
       +
       echo ""

     

       172
       172
       +
       echo "============================================"

     

       173
       173
       +
       echo "  DID Document Generated Successfully!"

     

       174
       174
       +
       echo "============================================"

     

       175
       175
       +
       echo ""

     

       176
       176
       +
       echo "Public key multibase: $PUBLIC_KEY_MULTIBASE"

     

       177
       177
       +
       echo ""

     

       178
       178
       +
       echo "Next steps:"

     

       179
       179
       +
       echo "  1. Copy this file to your production server:"

     

       180
       180
       +
       echo "     scp $OUTPUT_DIR/did.json user@server:/opt/coves/static/.well-known/"

     

       181
       181
       +
       echo ""

     

       182
       182
       +
       echo "  2. Or if running on production, restart Caddy:"

     

       183
       183
       +
       echo "     docker compose -f docker-compose.prod.yml restart caddy"

     

       184
       184
       +
       echo ""

     

       185
       185
       +
       echo "  3. Verify it's accessible:"

     

       186
       186
       +
       echo "     curl https://coves.social/.well-known/did.json"

     

       187
       187
       +
       echo ""

+2 -3

internal/api/handlers/community/block.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/communities"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/api/middleware"

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       // BlockHandler handles community blocking operations

+1 -2

internal/api/handlers/community/list.go

···

       1
       1
        
       package community

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"encoding/json"

     

       5
       6
        
       	"net/http"

     

       6
       7
        
       	"strconv"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/communities"

     

       9
       8
        
       )

     

       10
       9
        
       

     

       11
       10
        
       // ListHandler handles listing communities

+2 -3

internal/api/handlers/communityFeed/get_community.go

···

       1
       1
        
       package communityFeed

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communityFeeds"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       9
        
       	"strconv"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/communityFeeds"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // GetCommunityHandler handles community feed retrieval

+2 -3

internal/api/handlers/discover/get_discover.go

···

       1
       1
        
       package discover

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/discover"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       9
        
       	"strconv"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/discover"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       // GetDiscoverHandler handles discover feed retrieval

+2 -3

internal/api/handlers/post/errors.go

···

       1
       1
        
       package post

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/aggregators"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       4
       6
        
       	"encoding/json"

     

       5
       7
        
       	"log"

     

       6
       8
        
       	"net/http"

     

       7
       7
       -
       

     

       8
       8
       -
       	"Coves/internal/core/aggregators"

     

       9
       9
       -
       	"Coves/internal/core/posts"

     

       10
       9
        
       )

     

       11
       10
        
       

     

       12
       11
        
       type errorResponse struct {

+3 -4

internal/api/handlers/timeline/get_timeline.go

···

       1
       1
        
       package timeline

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/timeline"

     

       4
       7
        
       	"encoding/json"

     

       5
       8
        
       	"log"

     

       6
       9
        
       	"net/http"

     

       7
       10
        
       	"strconv"

     

       8
       11
        
       	"strings"

     

       9
       9
       -
       

     

       10
       10
       -
       	"Coves/internal/api/middleware"

     

       11
       11
       -
       	"Coves/internal/core/posts"

     

       12
       12
       -
       	"Coves/internal/core/timeline"

     

       13
       12
        
       )

     

       14
       13
        
       

     

       15
       14
        
       // GetTimelineHandler handles timeline feed retrieval

+2 -3

internal/atproto/jetstream/comment_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/utils"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"database/sql"

     

       6
       8
        
       	"encoding/json"

     
···

       9
       11
        
       	"strings"

     

       10
       12
        
       	"time"

     

       11
       13
        
       

     

       12
       12
       -
       	"Coves/internal/atproto/utils"

     

       13
       13
       -
       	"Coves/internal/core/comments"

     

       14
       14
       -
       

     

       15
       14
        
       	"github.com/lib/pq"

     

       16
       15
        
       )

     

       17
       16

+3 -4

internal/atproto/jetstream/community_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/atproto/utils"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"fmt"

     
···

       9
       12
        
       	"strings"

     

       10
       13
        
       	"time"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/atproto/identity"

     

       13
       13
       -
       	"Coves/internal/atproto/utils"

     

       14
       14
       -
       	"Coves/internal/core/communities"

     

       15
       15
       -
       

     

       16
       15
        
       	lru "github.com/hashicorp/golang-lru/v2"

     

       17
       16
        
       	"golang.org/x/net/publicsuffix"

     

       18
       17
        
       	"golang.org/x/time/rate"

+3 -4

internal/atproto/jetstream/post_consumer.go

···

       1
       1
        
       package jetstream

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"database/sql"

     

       6
       9
        
       	"encoding/json"

     
···

       8
       11
        
       	"log"

     

       9
       12
        
       	"strings"

     

       10
       13
        
       	"time"

     

       11
       11
       -
       

     

       12
       12
       -
       	"Coves/internal/core/communities"

     

       13
       13
       -
       	"Coves/internal/core/posts"

     

       14
       14
       -
       	"Coves/internal/core/users"

     

       15
       14
        
       )

     

       16
       15
        
       

     

       17
       16
        
       // PostEventConsumer consumes post-related events from Jetstream

+1 -2

internal/core/blobs/service.go

···

       1
       1
        
       package blobs

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"bytes"

     

       5
       6
        
       	"context"

     

       6
       7
        
       	"encoding/json"

     
···

       9
       10
        
       	"log"

     

       10
       11
        
       	"net/http"

     

       11
       12
        
       	"time"

     

       12
       12
       -
       

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       13
        
       )

     

       15
       14
        
       

     

       16
       15
        
       // Service defines the interface for blob operations

+5 -6

internal/core/comments/comment_service_test.go

···

       1
       1
        
       package comments

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/core/posts"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"errors"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       11
        
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       10
       -
       	"Coves/internal/core/posts"

     

       11
       11
       -
       	"Coves/internal/core/users"

     

       12
       12
       -
       

     

       13
       12
        
       	"github.com/stretchr/testify/assert"

     

       14
       13
        
       )

     

       15
       14
        
       

     
···

       232
       231
        
       	return nil

     

       233
       232
        
       }

     

       234
       233
        
       

     

       235
       235
       -
       func (m *mockCommunityRepo) List(ctx context.Context, req communities.ListCommunitiesRequest) ([]*communities.Community, int, error) {

     

       236
       236
       -
       	return nil, 0, nil

     

       234
       234
       +
       func (m *mockCommunityRepo) List(ctx context.Context, req communities.ListCommunitiesRequest) ([]*communities.Community, error) {

     

       235
       235
       +
       	return nil, nil

     

       237
       236
        
       }

     

       238
       237
        
       

     

       239
       238
        
       func (m *mockCommunityRepo) Search(ctx context.Context, req communities.SearchCommunitiesRequest) ([]*communities.Community, int, error) {

+1 -2

internal/core/communities/service.go

···

       1
       1
        
       package communities

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/utils"

     

       4
       5
        
       	"bytes"

     

       5
       6
        
       	"context"

     

       6
       7
        
       	"encoding/json"

     
···

       13
       14
        
       	"strings"

     

       14
       15
        
       	"sync"

     

       15
       16
        
       	"time"

     

       16
       16
       -
       

     

       17
       17
       -
       	"Coves/internal/atproto/utils"

     

       18
       17
        
       )

     

       19
       18
        
       

     

       20
       19
        
       // Community handle validation regex (DNS-valid handle: name.community.instance.com)

+5 -6

internal/core/posts/service.go

···

       1
       1
        
       package posts

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/aggregators"

     

       6
       6
       +
       	"Coves/internal/core/blobs"

     

       7
       7
       +
       	"Coves/internal/core/communities"

     

       8
       8
       +
       	"Coves/internal/core/unfurl"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"context"

     

       6
       11
        
       	"encoding/json"

     
···

       10
       15
        
       	"net/http"

     

       11
       16
        
       	"os"

     

       12
       17
        
       	"time"

     

       13
       13
       -
       

     

       14
       14
       -
       	"Coves/internal/api/middleware"

     

       15
       15
       -
       	"Coves/internal/core/aggregators"

     

       16
       16
       -
       	"Coves/internal/core/blobs"

     

       17
       17
       -
       	"Coves/internal/core/communities"

     

       18
       18
       -
       	"Coves/internal/core/unfurl"

     

       19
       18
        
       )

     

       20
       19
        
       

     

       21
       20
        
       type postService struct {

+1 -2

internal/db/postgres/comment_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/comments"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"encoding/base64"

     
···

       8
       9
        
       	"log"

     

       9
       10
        
       	"strings"

     

       10
       11
        
       

     

       11
       11
       -
       	"Coves/internal/core/comments"

     

       12
       12
       -
       

     

       13
       12
        
       	"github.com/lib/pq"

     

       14
       13
        
       )

     

       15
       14

+2 -4

internal/db/postgres/community_repo.go

···

       1
       1
        
       package postgres

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       4
       5
        
       	"context"

     

       5
       6
        
       	"database/sql"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"log"

     

       8
       9
        
       	"strings"

     

       9
       10
        
       

     

       10
       10
       -
       	"Coves/internal/core/communities"

     

       11
       11
       -
       

     

       12
       11
        
       	"github.com/lib/pq"

     

       13
       12
        
       )

     

       14
       13
        
       

     
···

       369
       368
        
       	}

     

       370
       369
        
       

     

       371
       370
        
       	// Build sort clause - map sort enum to DB columns

     

       372
       372
       -
       	sortColumn := "subscriber_count" // default: popular

     

       373
       373
       -
       	sortOrder := "DESC"

     

       371
       371
       +
       	var sortColumn, sortOrder string

     

       374
       372
        
       

     

       375
       373
        
       	switch req.Sort {

     

       376
       374
        
       	case "popular":

+7 -8

tests/e2e/error_recovery_test.go

···

       1
       1
        
       package e2e

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/identity"

     

       5
       5
       +
       	"Coves/internal/atproto/jetstream"

     

       6
       6
       +
       	"Coves/internal/core/users"

     

       7
       7
       +
       	"Coves/internal/db/postgres"

     

       4
       8
        
       	"context"

     

       5
       9
        
       	"database/sql"

     

       6
       10
        
       	"fmt"

     
···

       12
       16
        
       	"testing"

     

       13
       17
        
       	"time"

     

       14
       18
        
       

     

       15
       15
       -
       	"Coves/internal/atproto/identity"

     

       16
       16
       -
       	"Coves/internal/atproto/jetstream"

     

       17
       17
       -
       	"Coves/internal/core/users"

     

       18
       18
       -
       	"Coves/internal/db/postgres"

     

       19
       19
       -
       

     

       20
       19
        
       	_ "github.com/lib/pq"

     

       21
       20
        
       	"github.com/pressly/goose/v3"

     

       22
       21
        
       )

     
···

       138
       137
        
       

     

       139
       138
        
       	testCases := []struct {

     

       140
       139
        
       		name      string

     

       141
       141
       -
       		event     jetstream.JetstreamEvent

     

       142
       140
        
       		shouldLog string

     

       141
       141
       +
       		event     jetstream.JetstreamEvent

     

       143
       142
        
       	}{

     

       144
       143
        
       		{

     

       145
       144
        
       			name: "Nil identity data",

     
···

       348
       347
        
       		if shouldFail.Load() {

     

       349
       348
        
       			t.Logf("Mock PDS: Simulating unavailability (request #%d)", requestCount.Load())

     

       350
       349
        
       			w.WriteHeader(http.StatusServiceUnavailable)

     

       351
       351
       -
       			w.Write([]byte(`{"error":"ServiceUnavailable","message":"PDS temporarily unavailable"}`))

     

       350
       350
       +
       			_, _ = w.Write([]byte(`{"error":"ServiceUnavailable","message":"PDS temporarily unavailable"}`))

     

       352
       351
        
       			return

     

       353
       352
        
       		}

     

       354
       353
        
       

     

       355
       354
        
       		t.Logf("Mock PDS: Serving request successfully (request #%d)", requestCount.Load())

     

       356
       355
        
       		// Simulate successful PDS response

     

       357
       356
        
       		w.WriteHeader(http.StatusOK)

     

       358
       358
       -
       		w.Write([]byte(`{"did":"did:plc:pdstest123","handle":"pds.test"}`))

     

       357
       357
       +
       		_, _ = w.Write([]byte(`{"did":"did:plc:pdstest123","handle":"pds.test"}`))

     

       359
       358
        
       	}))

     

       360
       359
        
       	defer mockPDS.Close()

     

       361
       360

+14 -14

tests/integration/block_handle_resolution_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/community"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       4
       7
        
       	"bytes"

     

       5
       8
        
       	"context"

     

       6
       9
        
       	"encoding/json"

     
···

       9
       12
        
       	"net/http/httptest"

     

       10
       13
        
       	"testing"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/community"

     

       13
       13
       -
       	"Coves/internal/api/middleware"

     

       14
       14
       -
       	"Coves/internal/core/communities"

     

       15
       15
        
       	postgresRepo "Coves/internal/db/postgres"

     

       16
       16
        
       )

     

       17
       17
        
       

     
···

       73
       73
        
       		// We expect 401 (no auth) but verify the error is NOT "Community not found"

     

       74
       74
        
       		// If handle resolution worked, we'd get past that validation

     

       75
       75
        
       		resp := w.Result()

     

       76
       76
       -
       		defer resp.Body.Close()

     

       76
       76
       +
       		defer func() { _ = resp.Body.Close() }()

     

       77
       77
        
       

     

       78
       78
        
       		if resp.StatusCode == http.StatusNotFound {

     

       79
       79
        
       			t.Errorf("Handle resolution failed - got 404 CommunityNotFound")

     
···

       82
       82
        
       		// Expected: 401 Unauthorized (because we didn't add auth context)

     

       83
       83
        
       		if resp.StatusCode != http.StatusUnauthorized {

     

       84
       84
        
       			var errorResp map[string]interface{}

     

       85
       85
       -
       			json.NewDecoder(resp.Body).Decode(&errorResp)

     

       85
       85
       +
       			_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       86
       86
        
       			t.Logf("Response status: %d, body: %+v", resp.StatusCode, errorResp)

     

       87
       87
        
       		}

     

       88
       88
        
       	})

     
···

       100
       100
        
       		blockHandler.HandleBlock(w, req)

     

       101
       101
        
       

     

       102
       102
        
       		resp := w.Result()

     

       103
       103
       -
       		defer resp.Body.Close()

     

       103
       103
       +
       		defer func() { _ = resp.Body.Close() }()

     

       104
       104
        
       

     

       105
       105
        
       		if resp.StatusCode == http.StatusNotFound {

     

       106
       106
        
       			t.Errorf("@-prefixed handle resolution failed - got 404 CommunityNotFound")

     
···

       121
       121
        
       		blockHandler.HandleBlock(w, req)

     

       122
       122
        
       

     

       123
       123
        
       		resp := w.Result()

     

       124
       124
       -
       		defer resp.Body.Close()

     

       124
       124
       +
       		defer func() { _ = resp.Body.Close() }()

     

       125
       125
        
       

     

       126
       126
        
       		if resp.StatusCode == http.StatusNotFound {

     

       127
       127
        
       			t.Errorf("Scoped format resolution failed - got 404 CommunityNotFound")

     
···

       141
       141
        
       		blockHandler.HandleBlock(w, req)

     

       142
       142
        
       

     

       143
       143
        
       		resp := w.Result()

     

       144
       144
       -
       		defer resp.Body.Close()

     

       144
       144
       +
       		defer func() { _ = resp.Body.Close() }()

     

       145
       145
        
       

     

       146
       146
        
       		if resp.StatusCode == http.StatusNotFound {

     

       147
       147
        
       			t.Errorf("DID resolution failed - got 404 CommunityNotFound")

     
···

       202
       202
        
       				blockHandler.HandleBlock(w, req)

     

       203
       203
        
       

     

       204
       204
        
       				resp := w.Result()

     

       205
       205
       -
       				defer resp.Body.Close()

     

       205
       205
       +
       				defer func() { _ = resp.Body.Close() }()

     

       206
       206
        
       

     

       207
       207
        
       				// Should return 400 Bad Request for validation errors

     

       208
       208
        
       				if resp.StatusCode != http.StatusBadRequest {

     
···

       210
       210
        
       				}

     

       211
       211
        
       

     

       212
       212
        
       				var errorResp map[string]interface{}

     

       213
       213
       -
       				json.NewDecoder(resp.Body).Decode(&errorResp)

     

       213
       213
       +
       				_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       214
       214
        
       

     

       215
       215
        
       				if errorCode, ok := errorResp["error"].(string); !ok || errorCode != "InvalidRequest" {

     

       216
       216
        
       					t.Errorf("Expected error code 'InvalidRequest', got %v", errorResp["error"])

     
···

       242
       242
        
       		blockHandler.HandleBlock(w, req)

     

       243
       243
        
       

     

       244
       244
        
       		resp := w.Result()

     

       245
       245
       -
       		defer resp.Body.Close()

     

       245
       245
       +
       		defer func() { _ = resp.Body.Close() }()

     

       246
       246
        
       

     

       247
       247
        
       		// Expected: 401 (auth check happens before resolution)

     

       248
       248
        
       		// In a real scenario with auth, invalid handle would return 404

     
···

       299
       299
        
       		blockHandler.HandleUnblock(w, req)

     

       300
       300
        
       

     

       301
       301
        
       		resp := w.Result()

     

       302
       302
       -
       		defer resp.Body.Close()

     

       302
       302
       +
       		defer func() { _ = resp.Body.Close() }()

     

       303
       303
        
       

     

       304
       304
        
       		// Should NOT be 404 (handle resolution should work)

     

       305
       305
        
       		if resp.StatusCode == http.StatusNotFound {

     
···

       309
       309
        
       		// Expected: 401 (no auth context)

     

       310
       310
        
       		if resp.StatusCode != http.StatusUnauthorized {

     

       311
       311
        
       			var errorResp map[string]interface{}

     

       312
       312
       -
       			json.NewDecoder(resp.Body).Decode(&errorResp)

     

       312
       312
       +
       			_ = json.NewDecoder(resp.Body).Decode(&errorResp)

     

       313
       313
        
       			t.Logf("Response: status=%d, body=%+v", resp.StatusCode, errorResp)

     

       314
       314
        
       		}

     

       315
       315
        
       	})

     
···

       328
       328
        
       		blockHandler.HandleUnblock(w, req)

     

       329
       329
        
       

     

       330
       330
        
       		resp := w.Result()

     

       331
       331
       -
       		defer resp.Body.Close()

     

       331
       331
       +
       		defer func() { _ = resp.Body.Close() }()

     

       332
       332
        
       

     

       333
       333
        
       		// Expected: 401 (auth check happens before resolution)

     

       334
       334
        
       		if resp.StatusCode != http.StatusUnauthorized && resp.StatusCode != http.StatusNotFound {

+3 -4

tests/integration/comment_consumer_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/comments"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/comments"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       func TestCommentConsumer_CreateComment(t *testing.T) {

+4 -5

tests/integration/comment_vote_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"testing"

     

       7
       7
       -
       	"time"

     

       8
       8
       -
       

     

       9
       4
        
       	"Coves/internal/atproto/jetstream"

     

       10
       5
        
       	"Coves/internal/core/comments"

     

       11
       6
        
       	"Coves/internal/core/users"

     

       12
       7
        
       	"Coves/internal/db/postgres"

     

       8
       8
       +
       	"context"

     

       9
       9
       +
       	"fmt"

     

       10
       10
       +
       	"testing"

     

       11
       11
       +
       	"time"

     

       13
       12
        
       )

     

       14
       13
        
       

     

       15
       14
        
       // TestCommentVote_CreateAndUpdate tests voting on comments and vote count updates

+4 -5

tests/integration/community_hostedby_security_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"fmt"

     

       6
       8
        
       	"net/http"

     
···

       8
       10
        
       	"strings"

     

       9
       11
        
       	"testing"

     

       10
       12
        
       	"time"

     

       11
       11
       -
       

     

       12
       12
       -
       	"Coves/internal/atproto/jetstream"

     

       13
       13
       -
       	"Coves/internal/db/postgres"

     

       14
       13
        
       )

     

       15
       14
        
       

     

       16
       15
        
       // TestHostedByVerification_DomainMatching tests that hostedBy domain must match handle domain

     
···

       257
       256
        
       				// Return a DID document with matching alsoKnownAs

     

       258
       257
        
       				w.Header().Set("Content-Type", "application/json")

     

       259
       258
        
       				w.WriteHeader(http.StatusOK)

     

       260
       260
       -
       				fmt.Fprintf(w, `{

     

       259
       259
       +
       				_, _ = fmt.Fprintf(w, `{

     

       261
       260
        
       					"id": "did:web:example.com",

     

       262
       261
        
       					"alsoKnownAs": ["at://example.com"],

     

       263
       262
        
       					"verificationMethod": [],

     
···

       332
       331
        
       				// Return a DID document WITHOUT alsoKnownAs field

     

       333
       332
        
       				w.Header().Set("Content-Type", "application/json")

     

       334
       333
        
       				w.WriteHeader(http.StatusOK)

     

       335
       335
       -
       				fmt.Fprintf(w, `{

     

       334
       334
       +
       				_, _ = fmt.Fprintf(w, `{

     

       336
       335
        
       					"id": "did:web:example.com",

     

       337
       336
        
       					"verificationMethod": [],

     

       338
       337
        
       					"service": []

+2 -3

tests/integration/community_repo_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/core/communities"

     

       5
       5
       +
       	"Coves/internal/db/postgres"

     

       4
       6
        
       	"context"

     

       5
       7
        
       	"fmt"

     

       6
       8
        
       	"testing"

     

       7
       9
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/core/communities"

     

       10
       10
       -
       	"Coves/internal/db/postgres"

     

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       func TestCommunityRepository_Create(t *testing.T) {

+6 -7

tests/integration/concurrent_scenarios_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"sync"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       	"time"

     

       9
       9
       -
       

     

       10
       4
        
       	"Coves/internal/atproto/jetstream"

     

       11
       5
        
       	"Coves/internal/core/comments"

     

       12
       6
        
       	"Coves/internal/core/communities"

     

       13
       7
        
       	"Coves/internal/core/users"

     

       14
       8
        
       	"Coves/internal/db/postgres"

     

       9
       9
       +
       	"context"

     

       10
       10
       +
       	"fmt"

     

       11
       11
       +
       	"sync"

     

       12
       12
       +
       	"testing"

     

       13
       13
       +
       	"time"

     

       15
       14
        
       )

     

       16
       15
        
       

     

       17
       16
        
       // TestConcurrentVoting_MultipleUsersOnSamePost tests race conditions when multiple users

     
···

       611
       610
        
       		wg.Add(numAttempts)

     

       612
       611
        
       

     

       613
       612
        
       		type result struct {

     

       614
       614
       -
       			success bool

     

       615
       613
        
       			err     error

     

       614
       614
       +
       			success bool

     

       616
       615
        
       		}

     

       617
       616
        
       		results := make(chan result, numAttempts)

     

       618
       617

+3 -4

tests/integration/post_consumer_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/jetstream"

     

       5
       5
       +
       	"Coves/internal/core/users"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"fmt"

     

       6
       9
        
       	"testing"

     

       7
       10
        
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"Coves/internal/atproto/jetstream"

     

       10
       10
       -
       	"Coves/internal/core/users"

     

       11
       11
       -
       	"Coves/internal/db/postgres"

     

       12
       11
        
       )

     

       13
       12
        
       

     

       14
       13
        
       // TestPostConsumer_CommentCountReconciliation tests that post comment_count

+4 -5

tests/integration/post_creation_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"strings"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       

     

       9
       4
        
       	"Coves/internal/api/middleware"

     

       10
       5
        
       	"Coves/internal/atproto/identity"

     

       11
       6
        
       	"Coves/internal/core/communities"

     

       12
       7
        
       	"Coves/internal/core/posts"

     

       13
       8
        
       	"Coves/internal/core/users"

     

       14
       9
        
       	"Coves/internal/db/postgres"

     

       10
       10
       +
       	"context"

     

       11
       11
       +
       	"fmt"

     

       12
       12
       +
       	"strings"

     

       13
       13
       +
       	"testing"

     

       15
       14
        
       

     

       16
       15
        
       	"github.com/stretchr/testify/assert"

     

       17
       16
        
       	"github.com/stretchr/testify/require"

+5 -6

tests/integration/post_handler_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/post"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       7
       7
       +
       	"Coves/internal/core/posts"

     

       8
       8
       +
       	"Coves/internal/db/postgres"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"encoding/json"

     

       6
       11
        
       	"net/http"

     
···

       8
       13
        
       	"strings"

     

       9
       14
        
       	"testing"

     

       10
       15
        
       

     

       11
       11
       -
       	"Coves/internal/api/handlers/post"

     

       12
       12
       -
       	"Coves/internal/api/middleware"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+5 -6

tests/integration/post_thumb_validation_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/post"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/communities"

     

       7
       7
       +
       	"Coves/internal/core/posts"

     

       8
       8
       +
       	"Coves/internal/db/postgres"

     

       4
       9
        
       	"bytes"

     

       5
       10
        
       	"context"

     

       6
       11
        
       	"encoding/json"

     
···

       8
       13
        
       	"net/http/httptest"

     

       9
       14
        
       	"testing"

     

       10
       15
        
       

     

       11
       11
       -
       	"Coves/internal/api/handlers/post"

     

       12
       12
       -
       	"Coves/internal/api/middleware"

     

       13
       13
       -
       	"Coves/internal/core/communities"

     

       14
       14
       -
       	"Coves/internal/core/posts"

     

       15
       15
       -
       	"Coves/internal/db/postgres"

     

       16
       16
       -
       

     

       17
       16
        
       	"github.com/stretchr/testify/assert"

     

       18
       17
        
       	"github.com/stretchr/testify/require"

     

       19
       18
        
       )

+5 -6

tests/integration/post_unfurl_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"encoding/json"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"testing"

     

       8
       8
       -
       	"time"

     

       9
       9
       -
       

     

       10
       4
        
       	"Coves/internal/api/middleware"

     

       11
       5
        
       	"Coves/internal/atproto/identity"

     

       12
       6
        
       	"Coves/internal/atproto/jetstream"

     
···

       15
       9
        
       	"Coves/internal/core/unfurl"

     

       16
       10
        
       	"Coves/internal/core/users"

     

       17
       11
        
       	"Coves/internal/db/postgres"

     

       12
       12
       +
       	"context"

     

       13
       13
       +
       	"encoding/json"

     

       14
       14
       +
       	"fmt"

     

       15
       15
       +
       	"testing"

     

       16
       16
       +
       	"time"

     

       18
       17
        
       

     

       19
       18
        
       	"github.com/stretchr/testify/assert"

     

       20
       19
        
       	"github.com/stretchr/testify/require"

+3 -4

tests/integration/timeline_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/timeline"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/db/postgres"

     

       4
       7
        
       	"context"

     

       5
       8
        
       	"encoding/json"

     

       6
       9
        
       	"fmt"

     
···

       9
       12
        
       	"testing"

     

       10
       13
        
       	"time"

     

       11
       14
        
       

     

       12
       12
       -
       	"Coves/internal/api/handlers/timeline"

     

       13
       13
       -
       	"Coves/internal/api/middleware"

     

       14
       14
       -
       	"Coves/internal/db/postgres"

     

       15
       15
       -
       

     

       16
       15
        
       	timelineCore "Coves/internal/core/timeline"

     

       17
       16
        
       

     

       18
       17
        
       	"github.com/stretchr/testify/assert"

+23

static/.well-known/did.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "@context": [

     

       3
       3
       +
           "https://www.w3.org/ns/did/v1",

     

       4
       4
       +
           "https://w3id.org/security/multikey/v1"

     

       5
       5
       +
         ],

     

       6
       6
       +
         "id": "did:web:coves.social",

     

       7
       7
       +
         "alsoKnownAs": ["at://coves.social"],

     

       8
       8
       +
         "verificationMethod": [

     

       9
       9
       +
           {

     

       10
       10
       +
             "id": "did:web:coves.social#atproto",

     

       11
       11
       +
             "type": "Multikey",

     

       12
       12
       +
             "controller": "did:web:coves.social",

     

       13
       13
       +
             "publicKeyMultibase": "zQ3shu1T3Y3MYoC1n7fCqkZqyrk8FiY3PV3BYM2JwyqcXFY6s"

     

       14
       14
       +
           }

     

       15
       15
       +
         ],

     

       16
       16
       +
         "service": [

     

       17
       17
       +
           {

     

       18
       18
       +
             "id": "#atproto_pds",

     

       19
       19
       +
             "type": "AtprotoPersonalDataServer",

     

       20
       20
       +
             "serviceEndpoint": "https://pds.coves.me"

     

       21
       21
       +
           }

     

       22
       22
       +
         ]

     

       23
       23
       +
       }

+1 -1

docs/E2E_TESTING.md

···

       93
       93
        
       

     

       94
       94
        
       Query via API:

     

       95
       95
        
       ```bash

     

       96
       96
       -
       curl "http://localhost:8081/xrpc/social.coves.actor.getProfile?actor=alice.local.coves.dev"

     

       96
       96
       +
       curl "http://localhost:8081/xrpc/social.coves.actor.getprofile?actor=alice.local.coves.dev"

     

       97
       97
        
       ```

     

       98
       98
        
       

     

       99
       99
        
       Expected response:

+3 -3

internal/api/routes/user.go

···

       28
       28
        
       func RegisterUserRoutes(r chi.Router, service users.UserService) {

     

       29
       29
        
       	h := NewUserHandler(service)

     

       30
       30
        
       

     

       31
       31
       -
       	// social.coves.actor.getProfile - query endpoint

     

       32
       32
       -
       	r.Get("/xrpc/social.coves.actor.getProfile", h.GetProfile)

     

       31
       31
       +
       	// social.coves.actor.getprofile - query endpoint

     

       32
       32
       +
       	r.Get("/xrpc/social.coves.actor.getprofile", h.GetProfile)

     

       33
       33
        
       

     

       34
       34
        
       	// social.coves.actor.signup - procedure endpoint

     

       35
       35
        
       	r.Post("/xrpc/social.coves.actor.signup", h.Signup)

     

       36
       36
        
       }

     

       37
       37
        
       

     

       38
       38
       -
       // GetProfile handles social.coves.actor.getProfile

     

       38
       38
       +
       // GetProfile handles social.coves.actor.getprofile

     

       39
       39
        
       // Query endpoint that retrieves a user profile by DID or handle

     

       40
       40
        
       func (h *UserHandler) GetProfile(w http.ResponseWriter, r *http.Request) {

     

       41
       41
        
       	ctx := r.Context()

+7 -4

docs/FEED_SYSTEM_IMPLEMENTATION.md

···

       203
       203
        
       # Get personalized timeline (hot posts from subscriptions)

     

       204
       204
        
       curl -X GET \

     

       205
       205
        
         'http://localhost:8081/xrpc/social.coves.feed.getTimeline?sort=hot&limit=15' \

     

       206
       206
       -
         -H 'Authorization: Bearer eyJhbGc...'

     

       206
       206
       +
         -H 'Authorization: DPoP eyJhbGc...' \

     

       207
       207
       +
         -H 'DPoP: eyJhbGc...'

     

       207
       208
        
       

     

       208
       209
        
       # Get top posts from last week

     

       209
       210
        
       curl -X GET \

     

       210
       211
        
         'http://localhost:8081/xrpc/social.coves.feed.getTimeline?sort=top&timeframe=week&limit=20' \

     

       211
       211
       -
         -H 'Authorization: Bearer eyJhbGc...'

     

       212
       212
       +
         -H 'Authorization: DPoP eyJhbGc...' \

     

       213
       213
       +
         -H 'DPoP: eyJhbGc...'

     

       212
       214
        
       

     

       213
       215
        
       # Get newest posts with pagination

     

       214
       216
        
       curl -X GET \

     

       215
       217
        
         'http://localhost:8081/xrpc/social.coves.feed.getTimeline?sort=new&limit=10&cursor=<cursor>' \

     

       216
       216
       -
         -H 'Authorization: Bearer eyJhbGc...'

     

       218
       218
       +
         -H 'Authorization: DPoP eyJhbGc...' \

     

       219
       219
       +
         -H 'DPoP: eyJhbGc...'

     

       217
       220
        
       ```

     

       218
       221
        
       

     

       219
       222
        
       **Response:**

     
···

       313
       316
        
       - ✅ Context timeout support

     

       314
       317
        
       

     

       315
       318
        
       ### Authentication (Timeline)

     

       316
       316
       -
       - ✅ JWT Bearer token required

     

       319
       319
       +
       - ✅ DPoP-bound access token required

     

       317
       320
        
       - ✅ DID extracted from auth context

     

       318
       321
        
       - ✅ Validates token signature (when AUTH_SKIP_VERIFY=false)

     

       319
       322
        
       - ✅ Returns 401 on auth failure

+3 -3

docs/PRD_OAUTH.md

···

       10
       10
        
       - ✅ Auth middleware protecting community endpoints

     

       11
       11
        
       - ✅ Handlers updated to use `GetUserDID(r)`

     

       12
       12
        
       - ✅ Comprehensive middleware auth tests (11 test cases)

     

       13
       13
       -
       - ✅ E2E tests updated to use Bearer tokens

     

       13
       13
       +
       - ✅ E2E tests updated to use DPoP-bound tokens

     

       14
       14
        
       - ✅ Security logging with IP, method, path, issuer

     

       15
       15
        
       - ✅ Scope validation (atproto required)

     

       16
       16
        
       - ✅ Issuer HTTPS validation

     
···

       163
       163
        
       Authorization: DPoP eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCIsImtpZCI6ImRpZDpwbGM6YWxpY2UjYXRwcm90by1wZHMifQ...

     

       164
       164
        
       ```

     

       165
       165
        
       

     

       166
       166
       -
       Format: `DPoP <access_token>`

     

       166
       166
       +
       Format: `DPoP <access_token>` (note: uses "DPoP" scheme, not "Bearer")

     

       167
       167
        
       

     

       168
       168
        
       The access token is a JWT containing:

     

       169
       169
        
       ```json

     
···

       753
       753
        
       - [x] All community endpoints reject requests without valid JWT structure

     

       754
       754
        
       - [x] Integration tests pass with mock tokens (11/11 middleware tests passing)

     

       755
       755
        
       - [x] Zero security regressions from X-User-DID (JWT validation is strictly better)

     

       756
       756
       -
       - [x] E2E tests updated to use proper Bearer token authentication

     

       756
       756
       +
       - [x] E2E tests updated to use proper DPoP token authentication

     

       757
       757
        
       - [x] Build succeeds without compilation errors

     

       758
       758
        
       

     

       759
       759
        
       ### Phase 2 (Beta) - ✅ READY FOR TESTING

+477

internal/atproto/oauth/handlers_security_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"net/http"

     

       5
       5
       +
       	"net/http/httptest"

     

       6
       6
       +
       	"testing"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/stretchr/testify/assert"

     

       9
       9
       +
       	"github.com/stretchr/testify/require"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       // TestIsAllowedMobileRedirectURI tests the mobile redirect URI allowlist with EXACT URI matching

     

       13
       13
       +
       // Only Universal Links (HTTPS) are allowed - custom schemes are blocked for security

     

       14
       14
       +
       func TestIsAllowedMobileRedirectURI(t *testing.T) {

     

       15
       15
       +
       	tests := []struct {

     

       16
       16
       +
       		name     string

     

       17
       17
       +
       		uri      string

     

       18
       18
       +
       		expected bool

     

       19
       19
       +
       	}{

     

       20
       20
       +
       		{

     

       21
       21
       +
       			name:     "allowed - Universal Link",

     

       22
       22
       +
       			uri:      "https://coves.social/app/oauth/callback",

     

       23
       23
       +
       			expected: true,

     

       24
       24
       +
       		},

     

       25
       25
       +
       		{

     

       26
       26
       +
       			name:     "rejected - custom scheme coves-app (vulnerable to interception)",

     

       27
       27
       +
       			uri:      "coves-app://oauth/callback",

     

       28
       28
       +
       			expected: false,

     

       29
       29
       +
       		},

     

       30
       30
       +
       		{

     

       31
       31
       +
       			name:     "rejected - custom scheme coves (vulnerable to interception)",

     

       32
       32
       +
       			uri:      "coves://oauth/callback",

     

       33
       33
       +
       			expected: false,

     

       34
       34
       +
       		},

     

       35
       35
       +
       		{

     

       36
       36
       +
       			name:     "rejected - evil scheme",

     

       37
       37
       +
       			uri:      "evil://callback",

     

       38
       38
       +
       			expected: false,

     

       39
       39
       +
       		},

     

       40
       40
       +
       		{

     

       41
       41
       +
       			name:     "rejected - http (not secure)",

     

       42
       42
       +
       			uri:      "http://example.com/callback",

     

       43
       43
       +
       			expected: false,

     

       44
       44
       +
       		},

     

       45
       45
       +
       		{

     

       46
       46
       +
       			name:     "rejected - https different domain",

     

       47
       47
       +
       			uri:      "https://example.com/callback",

     

       48
       48
       +
       			expected: false,

     

       49
       49
       +
       		},

     

       50
       50
       +
       		{

     

       51
       51
       +
       			name:     "rejected - https coves.social wrong path",

     

       52
       52
       +
       			uri:      "https://coves.social/wrong/path",

     

       53
       53
       +
       			expected: false,

     

       54
       54
       +
       		},

     

       55
       55
       +
       		{

     

       56
       56
       +
       			name:     "rejected - invalid URI",

     

       57
       57
       +
       			uri:      "not a uri",

     

       58
       58
       +
       			expected: false,

     

       59
       59
       +
       		},

     

       60
       60
       +
       		{

     

       61
       61
       +
       			name:     "rejected - empty string",

     

       62
       62
       +
       			uri:      "",

     

       63
       63
       +
       			expected: false,

     

       64
       64
       +
       		},

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	for _, tt := range tests {

     

       68
       68
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       69
       69
       +
       			result := isAllowedMobileRedirectURI(tt.uri)

     

       70
       70
       +
       			assert.Equal(t, tt.expected, result,

     

       71
       71
       +
       				"isAllowedMobileRedirectURI(%q) = %v, want %v", tt.uri, result, tt.expected)

     

       72
       72
       +
       		})

     

       73
       73
       +
       	}

     

       74
       74
       +
       }

     

       75
       75
       +
       

     

       76
       76
       +
       // TestExtractScheme tests the scheme extraction function

     

       77
       77
       +
       func TestExtractScheme(t *testing.T) {

     

       78
       78
       +
       	tests := []struct {

     

       79
       79
       +
       		name     string

     

       80
       80
       +
       		uri      string

     

       81
       81
       +
       		expected string

     

       82
       82
       +
       	}{

     

       83
       83
       +
       		{

     

       84
       84
       +
       			name:     "https scheme",

     

       85
       85
       +
       			uri:      "https://coves.social/app/oauth/callback",

     

       86
       86
       +
       			expected: "https",

     

       87
       87
       +
       		},

     

       88
       88
       +
       		{

     

       89
       89
       +
       			name:     "custom scheme",

     

       90
       90
       +
       			uri:      "coves-app://callback",

     

       91
       91
       +
       			expected: "coves-app",

     

       92
       92
       +
       		},

     

       93
       93
       +
       		{

     

       94
       94
       +
       			name:     "invalid URI",

     

       95
       95
       +
       			uri:      "not a uri",

     

       96
       96
       +
       			expected: "invalid",

     

       97
       97
       +
       		},

     

       98
       98
       +
       	}

     

       99
       99
       +
       

     

       100
       100
       +
       	for _, tt := range tests {

     

       101
       101
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       102
       102
       +
       			result := extractScheme(tt.uri)

     

       103
       103
       +
       			assert.Equal(t, tt.expected, result)

     

       104
       104
       +
       		})

     

       105
       105
       +
       	}

     

       106
       106
       +
       }

     

       107
       107
       +
       

     

       108
       108
       +
       // TestGenerateCSRFToken tests CSRF token generation

     

       109
       109
       +
       func TestGenerateCSRFToken(t *testing.T) {

     

       110
       110
       +
       	// Generate two tokens and verify they are different (randomness check)

     

       111
       111
       +
       	token1, err1 := generateCSRFToken()

     

       112
       112
       +
       	require.NoError(t, err1)

     

       113
       113
       +
       	require.NotEmpty(t, token1)

     

       114
       114
       +
       

     

       115
       115
       +
       	token2, err2 := generateCSRFToken()

     

       116
       116
       +
       	require.NoError(t, err2)

     

       117
       117
       +
       	require.NotEmpty(t, token2)

     

       118
       118
       +
       

     

       119
       119
       +
       	assert.NotEqual(t, token1, token2, "CSRF tokens should be unique")

     

       120
       120
       +
       

     

       121
       121
       +
       	// Verify token is base64 encoded (should decode without error)

     

       122
       122
       +
       	assert.Greater(t, len(token1), 40, "CSRF token should be reasonably long (32 bytes base64 encoded)")

     

       123
       123
       +
       }

     

       124
       124
       +
       

     

       125
       125
       +
       // TestHandleMobileLogin_RedirectURIValidation tests that HandleMobileLogin validates redirect URIs

     

       126
       126
       +
       func TestHandleMobileLogin_RedirectURIValidation(t *testing.T) {

     

       127
       127
       +
       	// Note: This is a unit test for the validation logic only.

     

       128
       128
       +
       	// Full integration tests with OAuth flow are in tests/integration/oauth_e2e_test.go

     

       129
       129
       +
       

     

       130
       130
       +
       	tests := []struct {

     

       131
       131
       +
       		name           string

     

       132
       132
       +
       		redirectURI    string

     

       133
       133
       +
       		expectedLog    string

     

       134
       134
       +
       		expectedStatus int

     

       135
       135
       +
       	}{

     

       136
       136
       +
       		{

     

       137
       137
       +
       			name:           "allowed - Universal Link",

     

       138
       138
       +
       			redirectURI:    "https://coves.social/app/oauth/callback",

     

       139
       139
       +
       			expectedStatus: http.StatusBadRequest, // Will fail at StartAuthFlow (no OAuth client setup)

     

       140
       140
       +
       		},

     

       141
       141
       +
       		{

     

       142
       142
       +
       			name:           "rejected - custom scheme coves-app (insecure)",

     

       143
       143
       +
       			redirectURI:    "coves-app://oauth/callback",

     

       144
       144
       +
       			expectedStatus: http.StatusBadRequest,

     

       145
       145
       +
       			expectedLog:    "rejected unauthorized mobile redirect URI",

     

       146
       146
       +
       		},

     

       147
       147
       +
       		{

     

       148
       148
       +
       			name:           "rejected evil scheme",

     

       149
       149
       +
       			redirectURI:    "evil://callback",

     

       150
       150
       +
       			expectedStatus: http.StatusBadRequest,

     

       151
       151
       +
       			expectedLog:    "rejected unauthorized mobile redirect URI",

     

       152
       152
       +
       		},

     

       153
       153
       +
       		{

     

       154
       154
       +
       			name:           "rejected http",

     

       155
       155
       +
       			redirectURI:    "http://evil.com/callback",

     

       156
       156
       +
       			expectedStatus: http.StatusBadRequest,

     

       157
       157
       +
       			expectedLog:    "scheme not allowed",

     

       158
       158
       +
       		},

     

       159
       159
       +
       	}

     

       160
       160
       +
       

     

       161
       161
       +
       	for _, tt := range tests {

     

       162
       162
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       163
       163
       +
       			// Test the validation function directly

     

       164
       164
       +
       			result := isAllowedMobileRedirectURI(tt.redirectURI)

     

       165
       165
       +
       			if tt.expectedLog != "" {

     

       166
       166
       +
       				assert.False(t, result, "Should reject %s", tt.redirectURI)

     

       167
       167
       +
       			}

     

       168
       168
       +
       		})

     

       169
       169
       +
       	}

     

       170
       170
       +
       }

     

       171
       171
       +
       

     

       172
       172
       +
       // TestHandleCallback_CSRFValidation tests that HandleCallback validates CSRF tokens for mobile flow

     

       173
       173
       +
       func TestHandleCallback_CSRFValidation(t *testing.T) {

     

       174
       174
       +
       	// This is a conceptual test structure. Full implementation would require:

     

       175
       175
       +
       	// 1. Mock OAuthClient

     

       176
       176
       +
       	// 2. Mock OAuth store

     

       177
       177
       +
       	// 3. Simulated OAuth callback with cookies

     

       178
       178
       +
       

     

       179
       179
       +
       	t.Run("mobile callback requires CSRF token", func(t *testing.T) {

     

       180
       180
       +
       		// Setup: Create request with mobile_redirect_uri cookie but NO oauth_csrf cookie

     

       181
       181
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test", nil)

     

       182
       182
       +
       		req.AddCookie(&http.Cookie{

     

       183
       183
       +
       			Name:  "mobile_redirect_uri",

     

       184
       184
       +
       			Value: "https%3A%2F%2Fcoves.social%2Fapp%2Foauth%2Fcallback",

     

       185
       185
       +
       		})

     

       186
       186
       +
       		// Missing: oauth_csrf cookie

     

       187
       187
       +
       

     

       188
       188
       +
       		// This would be rejected with 403 Forbidden in the actual handler

     

       189
       189
       +
       		// (Full test in integration tests with real OAuth flow)

     

       190
       190
       +
       

     

       191
       191
       +
       		assert.NotNil(t, req) // Placeholder assertion

     

       192
       192
       +
       	})

     

       193
       193
       +
       

     

       194
       194
       +
       	t.Run("mobile callback with valid CSRF token", func(t *testing.T) {

     

       195
       195
       +
       		// Setup: Create request with both cookies

     

       196
       196
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test", nil)

     

       197
       197
       +
       		req.AddCookie(&http.Cookie{

     

       198
       198
       +
       			Name:  "mobile_redirect_uri",

     

       199
       199
       +
       			Value: "https%3A%2F%2Fcoves.social%2Fapp%2Foauth%2Fcallback",

     

       200
       200
       +
       		})

     

       201
       201
       +
       		req.AddCookie(&http.Cookie{

     

       202
       202
       +
       			Name:  "oauth_csrf",

     

       203
       203
       +
       			Value: "valid-csrf-token",

     

       204
       204
       +
       		})

     

       205
       205
       +
       

     

       206
       206
       +
       		// This would be accepted (assuming valid OAuth code/state)

     

       207
       207
       +
       		// (Full test in integration tests with real OAuth flow)

     

       208
       208
       +
       

     

       209
       209
       +
       		assert.NotNil(t, req) // Placeholder assertion

     

       210
       210
       +
       	})

     

       211
       211
       +
       }

     

       212
       212
       +
       

     

       213
       213
       +
       // TestHandleMobileCallback_RevalidatesRedirectURI tests that handleMobileCallback re-validates the redirect URI

     

       214
       214
       +
       func TestHandleMobileCallback_RevalidatesRedirectURI(t *testing.T) {

     

       215
       215
       +
       	// This is a critical security test: even if an attacker somehow bypasses the initial check,

     

       216
       216
       +
       	// the callback handler should re-validate the redirect URI before redirecting.

     

       217
       217
       +
       

     

       218
       218
       +
       	tests := []struct {

     

       219
       219
       +
       		name        string

     

       220
       220
       +
       		redirectURI string

     

       221
       221
       +
       		shouldPass  bool

     

       222
       222
       +
       	}{

     

       223
       223
       +
       		{

     

       224
       224
       +
       			name:        "allowed - Universal Link",

     

       225
       225
       +
       			redirectURI: "https://coves.social/app/oauth/callback",

     

       226
       226
       +
       			shouldPass:  true,

     

       227
       227
       +
       		},

     

       228
       228
       +
       		{

     

       229
       229
       +
       			name:        "blocked - custom scheme (insecure)",

     

       230
       230
       +
       			redirectURI: "coves-app://oauth/callback",

     

       231
       231
       +
       			shouldPass:  false,

     

       232
       232
       +
       		},

     

       233
       233
       +
       		{

     

       234
       234
       +
       			name:        "blocked - evil scheme",

     

       235
       235
       +
       			redirectURI: "evil://callback",

     

       236
       236
       +
       			shouldPass:  false,

     

       237
       237
       +
       		},

     

       238
       238
       +
       	}

     

       239
       239
       +
       

     

       240
       240
       +
       	for _, tt := range tests {

     

       241
       241
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       242
       242
       +
       			result := isAllowedMobileRedirectURI(tt.redirectURI)

     

       243
       243
       +
       			assert.Equal(t, tt.shouldPass, result)

     

       244
       244
       +
       		})

     

       245
       245
       +
       	}

     

       246
       246
       +
       }

     

       247
       247
       +
       

     

       248
       248
       +
       // TestGenerateMobileRedirectBinding tests the binding token generation

     

       249
       249
       +
       // The binding now includes the CSRF token for proper double-submit validation

     

       250
       250
       +
       func TestGenerateMobileRedirectBinding(t *testing.T) {

     

       251
       251
       +
       	csrfToken := "test-csrf-token-12345"

     

       252
       252
       +
       	tests := []struct {

     

       253
       253
       +
       		name        string

     

       254
       254
       +
       		redirectURI string

     

       255
       255
       +
       	}{

     

       256
       256
       +
       		{

     

       257
       257
       +
       			name:        "Universal Link",

     

       258
       258
       +
       			redirectURI: "https://coves.social/app/oauth/callback",

     

       259
       259
       +
       		},

     

       260
       260
       +
       		{

     

       261
       261
       +
       			name:        "different path",

     

       262
       262
       +
       			redirectURI: "https://coves.social/different/path",

     

       263
       263
       +
       		},

     

       264
       264
       +
       	}

     

       265
       265
       +
       

     

       266
       266
       +
       	for _, tt := range tests {

     

       267
       267
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       268
       268
       +
       			binding1 := generateMobileRedirectBinding(csrfToken, tt.redirectURI)

     

       269
       269
       +
       			binding2 := generateMobileRedirectBinding(csrfToken, tt.redirectURI)

     

       270
       270
       +
       

     

       271
       271
       +
       			// Same CSRF token + URI should produce same binding (deterministic)

     

       272
       272
       +
       			assert.Equal(t, binding1, binding2, "binding should be deterministic for same inputs")

     

       273
       273
       +
       

     

       274
       274
       +
       			// Binding should not be empty

     

       275
       275
       +
       			assert.NotEmpty(t, binding1, "binding should not be empty")

     

       276
       276
       +
       

     

       277
       277
       +
       			// Binding should be base64 encoded (should decode without error)

     

       278
       278
       +
       			assert.Greater(t, len(binding1), 20, "binding should be reasonably long")

     

       279
       279
       +
       		})

     

       280
       280
       +
       	}

     

       281
       281
       +
       

     

       282
       282
       +
       	// Different URIs should produce different bindings

     

       283
       283
       +
       	binding1 := generateMobileRedirectBinding(csrfToken, "https://coves.social/app/oauth/callback")

     

       284
       284
       +
       	binding2 := generateMobileRedirectBinding(csrfToken, "https://coves.social/different/path")

     

       285
       285
       +
       	assert.NotEqual(t, binding1, binding2, "different URIs should produce different bindings")

     

       286
       286
       +
       

     

       287
       287
       +
       	// Different CSRF tokens should produce different bindings

     

       288
       288
       +
       	binding3 := generateMobileRedirectBinding("different-csrf-token", "https://coves.social/app/oauth/callback")

     

       289
       289
       +
       	assert.NotEqual(t, binding1, binding3, "different CSRF tokens should produce different bindings")

     

       290
       290
       +
       }

     

       291
       291
       +
       

     

       292
       292
       +
       // TestValidateMobileRedirectBinding tests the binding validation

     

       293
       293
       +
       // Now validates both CSRF token and redirect URI together (double-submit pattern)

     

       294
       294
       +
       func TestValidateMobileRedirectBinding(t *testing.T) {

     

       295
       295
       +
       	csrfToken := "test-csrf-token-for-validation"

     

       296
       296
       +
       	redirectURI := "https://coves.social/app/oauth/callback"

     

       297
       297
       +
       	validBinding := generateMobileRedirectBinding(csrfToken, redirectURI)

     

       298
       298
       +
       

     

       299
       299
       +
       	tests := []struct {

     

       300
       300
       +
       		name        string

     

       301
       301
       +
       		csrfToken   string

     

       302
       302
       +
       		redirectURI string

     

       303
       303
       +
       		binding     string

     

       304
       304
       +
       		shouldPass  bool

     

       305
       305
       +
       	}{

     

       306
       306
       +
       		{

     

       307
       307
       +
       			name:        "valid - correct CSRF token and redirect URI",

     

       308
       308
       +
       			csrfToken:   csrfToken,

     

       309
       309
       +
       			redirectURI: redirectURI,

     

       310
       310
       +
       			binding:     validBinding,

     

       311
       311
       +
       			shouldPass:  true,

     

       312
       312
       +
       		},

     

       313
       313
       +
       		{

     

       314
       314
       +
       			name:        "invalid - wrong redirect URI",

     

       315
       315
       +
       			csrfToken:   csrfToken,

     

       316
       316
       +
       			redirectURI: "https://coves.social/different/path",

     

       317
       317
       +
       			binding:     validBinding,

     

       318
       318
       +
       			shouldPass:  false,

     

       319
       319
       +
       		},

     

       320
       320
       +
       		{

     

       321
       321
       +
       			name:        "invalid - wrong CSRF token",

     

       322
       322
       +
       			csrfToken:   "wrong-csrf-token",

     

       323
       323
       +
       			redirectURI: redirectURI,

     

       324
       324
       +
       			binding:     validBinding,

     

       325
       325
       +
       			shouldPass:  false,

     

       326
       326
       +
       		},

     

       327
       327
       +
       		{

     

       328
       328
       +
       			name:        "invalid - random binding",

     

       329
       329
       +
       			csrfToken:   csrfToken,

     

       330
       330
       +
       			redirectURI: redirectURI,

     

       331
       331
       +
       			binding:     "random-invalid-binding",

     

       332
       332
       +
       			shouldPass:  false,

     

       333
       333
       +
       		},

     

       334
       334
       +
       		{

     

       335
       335
       +
       			name:        "invalid - empty binding",

     

       336
       336
       +
       			csrfToken:   csrfToken,

     

       337
       337
       +
       			redirectURI: redirectURI,

     

       338
       338
       +
       			binding:     "",

     

       339
       339
       +
       			shouldPass:  false,

     

       340
       340
       +
       		},

     

       341
       341
       +
       		{

     

       342
       342
       +
       			name:        "invalid - empty CSRF token",

     

       343
       343
       +
       			csrfToken:   "",

     

       344
       344
       +
       			redirectURI: redirectURI,

     

       345
       345
       +
       			binding:     validBinding,

     

       346
       346
       +
       			shouldPass:  false,

     

       347
       347
       +
       		},

     

       348
       348
       +
       	}

     

       349
       349
       +
       

     

       350
       350
       +
       	for _, tt := range tests {

     

       351
       351
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       352
       352
       +
       			result := validateMobileRedirectBinding(tt.csrfToken, tt.redirectURI, tt.binding)

     

       353
       353
       +
       			assert.Equal(t, tt.shouldPass, result)

     

       354
       354
       +
       		})

     

       355
       355
       +
       	}

     

       356
       356
       +
       }

     

       357
       357
       +
       

     

       358
       358
       +
       // TestSessionFixationAttackPrevention tests that the binding prevents session fixation

     

       359
       359
       +
       func TestSessionFixationAttackPrevention(t *testing.T) {

     

       360
       360
       +
       	// Simulate attack scenario:

     

       361
       361
       +
       	// 1. Attacker plants a cookie for evil://steal with binding for evil://steal

     

       362
       362
       +
       	// 2. User does a web login (no mobile_redirect_binding cookie)

     

       363
       363
       +
       	// 3. Callback should NOT redirect to evil://steal

     

       364
       364
       +
       

     

       365
       365
       +
       	attackerCSRF := "attacker-csrf-token"

     

       366
       366
       +
       	attackerRedirectURI := "evil://steal"

     

       367
       367
       +
       	attackerBinding := generateMobileRedirectBinding(attackerCSRF, attackerRedirectURI)

     

       368
       368
       +
       

     

       369
       369
       +
       	// Later, user's legitimate mobile login

     

       370
       370
       +
       	userCSRF := "user-csrf-token"

     

       371
       371
       +
       	userRedirectURI := "https://coves.social/app/oauth/callback"

     

       372
       372
       +
       	userBinding := generateMobileRedirectBinding(userCSRF, userRedirectURI)

     

       373
       373
       +
       

     

       374
       374
       +
       	// The attacker's binding should NOT validate for the user's redirect URI

     

       375
       375
       +
       	assert.False(t, validateMobileRedirectBinding(userCSRF, userRedirectURI, attackerBinding),

     

       376
       376
       +
       		"attacker's binding should not validate for user's CSRF token and redirect URI")

     

       377
       377
       +
       

     

       378
       378
       +
       	// The user's binding should validate for the user's CSRF token and redirect URI

     

       379
       379
       +
       	assert.True(t, validateMobileRedirectBinding(userCSRF, userRedirectURI, userBinding),

     

       380
       380
       +
       		"user's binding should validate for user's CSRF token and redirect URI")

     

       381
       381
       +
       

     

       382
       382
       +
       	// Cross-validation should fail

     

       383
       383
       +
       	assert.False(t, validateMobileRedirectBinding(attackerCSRF, attackerRedirectURI, userBinding),

     

       384
       384
       +
       		"user's binding should not validate for attacker's CSRF token and redirect URI")

     

       385
       385
       +
       }

     

       386
       386
       +
       

     

       387
       387
       +
       // TestCSRFTokenValidation tests that CSRF token VALUE is validated, not just presence

     

       388
       388
       +
       func TestCSRFTokenValidation(t *testing.T) {

     

       389
       389
       +
       	// This test verifies the fix for the P1 security issue:

     

       390
       390
       +
       	// "The callback never validates the token... the csrfToken argument is ignored entirely"

     

       391
       391
       +
       	//

     

       392
       392
       +
       	// The fix ensures that the CSRF token VALUE is cryptographically bound to the

     

       393
       393
       +
       	// binding token, so changing the CSRF token will invalidate the binding.

     

       394
       394
       +
       

     

       395
       395
       +
       	t.Run("CSRF token value must match", func(t *testing.T) {

     

       396
       396
       +
       		originalCSRF := "original-csrf-token-from-login"

     

       397
       397
       +
       		redirectURI := "https://coves.social/app/oauth/callback"

     

       398
       398
       +
       		binding := generateMobileRedirectBinding(originalCSRF, redirectURI)

     

       399
       399
       +
       

     

       400
       400
       +
       		// Original CSRF token should validate

     

       401
       401
       +
       		assert.True(t, validateMobileRedirectBinding(originalCSRF, redirectURI, binding),

     

       402
       402
       +
       			"original CSRF token should validate")

     

       403
       403
       +
       

     

       404
       404
       +
       		// Different CSRF token should NOT validate (this is the key security fix)

     

       405
       405
       +
       		differentCSRF := "attacker-forged-csrf-token"

     

       406
       406
       +
       		assert.False(t, validateMobileRedirectBinding(differentCSRF, redirectURI, binding),

     

       407
       407
       +
       			"different CSRF token should NOT validate - this is the security fix")

     

       408
       408
       +
       	})

     

       409
       409
       +
       

     

       410
       410
       +
       	t.Run("attacker cannot forge binding without CSRF token", func(t *testing.T) {

     

       411
       411
       +
       		// Attacker knows the redirect URI but not the CSRF token

     

       412
       412
       +
       		redirectURI := "https://coves.social/app/oauth/callback"

     

       413
       413
       +
       		victimCSRF := "victim-secret-csrf-token"

     

       414
       414
       +
       		victimBinding := generateMobileRedirectBinding(victimCSRF, redirectURI)

     

       415
       415
       +
       

     

       416
       416
       +
       		// Attacker tries various CSRF tokens to forge the binding

     

       417
       417
       +
       		attackerGuesses := []string{

     

       418
       418
       +
       			"",

     

       419
       419
       +
       			"guess1",

     

       420
       420
       +
       			"attacker-csrf",

     

       421
       421
       +
       			redirectURI, // trying the redirect URI as CSRF

     

       422
       422
       +
       		}

     

       423
       423
       +
       

     

       424
       424
       +
       		for _, guess := range attackerGuesses {

     

       425
       425
       +
       			assert.False(t, validateMobileRedirectBinding(guess, redirectURI, victimBinding),

     

       426
       426
       +
       				"attacker's CSRF guess %q should not validate", guess)

     

       427
       427
       +
       		}

     

       428
       428
       +
       	})

     

       429
       429
       +
       }

     

       430
       430
       +
       

     

       431
       431
       +
       // TestConstantTimeCompare tests the timing-safe comparison function

     

       432
       432
       +
       func TestConstantTimeCompare(t *testing.T) {

     

       433
       433
       +
       	tests := []struct {

     

       434
       434
       +
       		name     string

     

       435
       435
       +
       		a        string

     

       436
       436
       +
       		b        string

     

       437
       437
       +
       		expected bool

     

       438
       438
       +
       	}{

     

       439
       439
       +
       		{

     

       440
       440
       +
       			name:     "equal strings",

     

       441
       441
       +
       			a:        "abc123",

     

       442
       442
       +
       			b:        "abc123",

     

       443
       443
       +
       			expected: true,

     

       444
       444
       +
       		},

     

       445
       445
       +
       		{

     

       446
       446
       +
       			name:     "different strings same length",

     

       447
       447
       +
       			a:        "abc123",

     

       448
       448
       +
       			b:        "xyz789",

     

       449
       449
       +
       			expected: false,

     

       450
       450
       +
       		},

     

       451
       451
       +
       		{

     

       452
       452
       +
       			name:     "different lengths",

     

       453
       453
       +
       			a:        "short",

     

       454
       454
       +
       			b:        "longer",

     

       455
       455
       +
       			expected: false,

     

       456
       456
       +
       		},

     

       457
       457
       +
       		{

     

       458
       458
       +
       			name:     "empty strings",

     

       459
       459
       +
       			a:        "",

     

       460
       460
       +
       			b:        "",

     

       461
       461
       +
       			expected: true,

     

       462
       462
       +
       		},

     

       463
       463
       +
       		{

     

       464
       464
       +
       			name:     "one empty",

     

       465
       465
       +
       			a:        "abc",

     

       466
       466
       +
       			b:        "",

     

       467
       467
       +
       			expected: false,

     

       468
       468
       +
       		},

     

       469
       469
       +
       	}

     

       470
       470
       +
       

     

       471
       471
       +
       	for _, tt := range tests {

     

       472
       472
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       473
       473
       +
       			result := constantTimeCompare(tt.a, tt.b)

     

       474
       474
       +
       			assert.Equal(t, tt.expected, result)

     

       475
       475
       +
       		})

     

       476
       476
       +
       	}

     

       477
       477
       +
       }

+152

internal/atproto/oauth/seal.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"crypto/aes"

     

       5
       5
       +
       	"crypto/cipher"

     

       6
       6
       +
       	"crypto/rand"

     

       7
       7
       +
       	"encoding/base64"

     

       8
       8
       +
       	"encoding/json"

     

       9
       9
       +
       	"fmt"

     

       10
       10
       +
       	"time"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // SealedSession represents the data sealed in a mobile session token

     

       14
       14
       +
       type SealedSession struct {

     

       15
       15
       +
       	DID       string `json:"did"` // User's DID

     

       16
       16
       +
       	SessionID string `json:"sid"` // Session identifier

     

       17
       17
       +
       	ExpiresAt int64  `json:"exp"` // Unix timestamp when token expires

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       // SealSession creates an encrypted token containing session information.

     

       21
       21
       +
       // The token is encrypted using AES-256-GCM and encoded as base64url.

     

       22
       22
       +
       //

     

       23
       23
       +
       // Token format: base64url(nonce || ciphertext || tag)

     

       24
       24
       +
       // - nonce: 12 bytes (GCM standard nonce size)

     

       25
       25
       +
       // - ciphertext: encrypted JSON payload

     

       26
       26
       +
       // - tag: 16 bytes (GCM authentication tag)

     

       27
       27
       +
       //

     

       28
       28
       +
       // The sealed token can be safely given to mobile clients and used as

     

       29
       29
       +
       // a reference to the server-side session without exposing sensitive data.

     

       30
       30
       +
       func (c *OAuthClient) SealSession(did, sessionID string, ttl time.Duration) (string, error) {

     

       31
       31
       +
       	if len(c.SealSecret) == 0 {

     

       32
       32
       +
       		return "", fmt.Errorf("seal secret not configured")

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	if did == "" {

     

       36
       36
       +
       		return "", fmt.Errorf("DID is required")

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	if sessionID == "" {

     

       40
       40
       +
       		return "", fmt.Errorf("session ID is required")

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	// Create the session data

     

       44
       44
       +
       	expiresAt := time.Now().Add(ttl).Unix()

     

       45
       45
       +
       	session := SealedSession{

     

       46
       46
       +
       		DID:       did,

     

       47
       47
       +
       		SessionID: sessionID,

     

       48
       48
       +
       		ExpiresAt: expiresAt,

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	// Marshal to JSON

     

       52
       52
       +
       	plaintext, err := json.Marshal(session)

     

       53
       53
       +
       	if err != nil {

     

       54
       54
       +
       		return "", fmt.Errorf("failed to marshal session: %w", err)

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	// Create AES cipher

     

       58
       58
       +
       	block, err := aes.NewCipher(c.SealSecret)

     

       59
       59
       +
       	if err != nil {

     

       60
       60
       +
       		return "", fmt.Errorf("failed to create cipher: %w", err)

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Create GCM mode

     

       64
       64
       +
       	gcm, err := cipher.NewGCM(block)

     

       65
       65
       +
       	if err != nil {

     

       66
       66
       +
       		return "", fmt.Errorf("failed to create GCM: %w", err)

     

       67
       67
       +
       	}

     

       68
       68
       +
       

     

       69
       69
       +
       	// Generate random nonce

     

       70
       70
       +
       	nonce := make([]byte, gcm.NonceSize())

     

       71
       71
       +
       	if _, err := rand.Read(nonce); err != nil {

     

       72
       72
       +
       		return "", fmt.Errorf("failed to generate nonce: %w", err)

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Encrypt and authenticate

     

       76
       76
       +
       	// GCM.Seal appends the ciphertext and tag to the nonce

     

       77
       77
       +
       	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)

     

       78
       78
       +
       

     

       79
       79
       +
       	// Encode as base64url (no padding)

     

       80
       80
       +
       	token := base64.RawURLEncoding.EncodeToString(ciphertext)

     

       81
       81
       +
       

     

       82
       82
       +
       	return token, nil

     

       83
       83
       +
       }

     

       84
       84
       +
       

     

       85
       85
       +
       // UnsealSession decrypts and validates a sealed session token.

     

       86
       86
       +
       // Returns the session information if the token is valid and not expired.

     

       87
       87
       +
       func (c *OAuthClient) UnsealSession(token string) (*SealedSession, error) {

     

       88
       88
       +
       	if len(c.SealSecret) == 0 {

     

       89
       89
       +
       		return nil, fmt.Errorf("seal secret not configured")

     

       90
       90
       +
       	}

     

       91
       91
       +
       

     

       92
       92
       +
       	if token == "" {

     

       93
       93
       +
       		return nil, fmt.Errorf("token is required")

     

       94
       94
       +
       	}

     

       95
       95
       +
       

     

       96
       96
       +
       	// Decode from base64url

     

       97
       97
       +
       	ciphertext, err := base64.RawURLEncoding.DecodeString(token)

     

       98
       98
       +
       	if err != nil {

     

       99
       99
       +
       		return nil, fmt.Errorf("invalid token encoding: %w", err)

     

       100
       100
       +
       	}

     

       101
       101
       +
       

     

       102
       102
       +
       	// Create AES cipher

     

       103
       103
       +
       	block, err := aes.NewCipher(c.SealSecret)

     

       104
       104
       +
       	if err != nil {

     

       105
       105
       +
       		return nil, fmt.Errorf("failed to create cipher: %w", err)

     

       106
       106
       +
       	}

     

       107
       107
       +
       

     

       108
       108
       +
       	// Create GCM mode

     

       109
       109
       +
       	gcm, err := cipher.NewGCM(block)

     

       110
       110
       +
       	if err != nil {

     

       111
       111
       +
       		return nil, fmt.Errorf("failed to create GCM: %w", err)

     

       112
       112
       +
       	}

     

       113
       113
       +
       

     

       114
       114
       +
       	// Verify minimum size (nonce + tag)

     

       115
       115
       +
       	nonceSize := gcm.NonceSize()

     

       116
       116
       +
       	if len(ciphertext) < nonceSize {

     

       117
       117
       +
       		return nil, fmt.Errorf("invalid token: too short")

     

       118
       118
       +
       	}

     

       119
       119
       +
       

     

       120
       120
       +
       	// Extract nonce and ciphertext

     

       121
       121
       +
       	nonce := ciphertext[:nonceSize]

     

       122
       122
       +
       	ciphertextData := ciphertext[nonceSize:]

     

       123
       123
       +
       

     

       124
       124
       +
       	// Decrypt and authenticate

     

       125
       125
       +
       	plaintext, err := gcm.Open(nil, nonce, ciphertextData, nil)

     

       126
       126
       +
       	if err != nil {

     

       127
       127
       +
       		return nil, fmt.Errorf("failed to decrypt token: %w", err)

     

       128
       128
       +
       	}

     

       129
       129
       +
       

     

       130
       130
       +
       	// Unmarshal JSON

     

       131
       131
       +
       	var session SealedSession

     

       132
       132
       +
       	if err := json.Unmarshal(plaintext, &session); err != nil {

     

       133
       133
       +
       		return nil, fmt.Errorf("failed to unmarshal session: %w", err)

     

       134
       134
       +
       	}

     

       135
       135
       +
       

     

       136
       136
       +
       	// Validate required fields

     

       137
       137
       +
       	if session.DID == "" {

     

       138
       138
       +
       		return nil, fmt.Errorf("invalid session: missing DID")

     

       139
       139
       +
       	}

     

       140
       140
       +
       

     

       141
       141
       +
       	if session.SessionID == "" {

     

       142
       142
       +
       		return nil, fmt.Errorf("invalid session: missing session ID")

     

       143
       143
       +
       	}

     

       144
       144
       +
       

     

       145
       145
       +
       	// Check expiration

     

       146
       146
       +
       	now := time.Now().Unix()

     

       147
       147
       +
       	if session.ExpiresAt <= now {

     

       148
       148
       +
       		return nil, fmt.Errorf("token expired at %v", time.Unix(session.ExpiresAt, 0))

     

       149
       149
       +
       	}

     

       150
       150
       +
       

     

       151
       151
       +
       	return &session, nil

     

       152
       152
       +
       }

+331

internal/atproto/oauth/seal_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"crypto/rand"

     

       5
       5
       +
       	"encoding/base64"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       	"github.com/stretchr/testify/require"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       // generateSealSecret generates a random 32-byte seal secret for testing

     

       15
       15
       +
       func generateSealSecret() []byte {

     

       16
       16
       +
       	secret := make([]byte, 32)

     

       17
       17
       +
       	if _, err := rand.Read(secret); err != nil {

     

       18
       18
       +
       		panic(err)

     

       19
       19
       +
       	}

     

       20
       20
       +
       	return secret

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func TestSealSession_RoundTrip(t *testing.T) {

     

       24
       24
       +
       	// Create client with seal secret

     

       25
       25
       +
       	client := &OAuthClient{

     

       26
       26
       +
       		SealSecret: generateSealSecret(),

     

       27
       27
       +
       	}

     

       28
       28
       +
       

     

       29
       29
       +
       	did := "did:plc:abc123"

     

       30
       30
       +
       	sessionID := "session-xyz"

     

       31
       31
       +
       	ttl := 1 * time.Hour

     

       32
       32
       +
       

     

       33
       33
       +
       	// Seal the session

     

       34
       34
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       35
       35
       +
       	require.NoError(t, err)

     

       36
       36
       +
       	require.NotEmpty(t, token)

     

       37
       37
       +
       

     

       38
       38
       +
       	// Token should be base64url encoded

     

       39
       39
       +
       	_, err = base64.RawURLEncoding.DecodeString(token)

     

       40
       40
       +
       	require.NoError(t, err, "token should be valid base64url")

     

       41
       41
       +
       

     

       42
       42
       +
       	// Unseal the session

     

       43
       43
       +
       	session, err := client.UnsealSession(token)

     

       44
       44
       +
       	require.NoError(t, err)

     

       45
       45
       +
       	require.NotNil(t, session)

     

       46
       46
       +
       

     

       47
       47
       +
       	// Verify data

     

       48
       48
       +
       	assert.Equal(t, did, session.DID)

     

       49
       49
       +
       	assert.Equal(t, sessionID, session.SessionID)

     

       50
       50
       +
       

     

       51
       51
       +
       	// Verify expiration is approximately correct (within 1 second)

     

       52
       52
       +
       	expectedExpiry := time.Now().Add(ttl).Unix()

     

       53
       53
       +
       	assert.InDelta(t, expectedExpiry, session.ExpiresAt, 1.0)

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       func TestSealSession_ExpirationValidation(t *testing.T) {

     

       57
       57
       +
       	client := &OAuthClient{

     

       58
       58
       +
       		SealSecret: generateSealSecret(),

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	did := "did:plc:abc123"

     

       62
       62
       +
       	sessionID := "session-xyz"

     

       63
       63
       +
       	ttl := 2 * time.Second // Short TTL (must be >= 1 second due to Unix timestamp granularity)

     

       64
       64
       +
       

     

       65
       65
       +
       	// Seal the session

     

       66
       66
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       67
       67
       +
       	require.NoError(t, err)

     

       68
       68
       +
       

     

       69
       69
       +
       	// Should work immediately

     

       70
       70
       +
       	session, err := client.UnsealSession(token)

     

       71
       71
       +
       	require.NoError(t, err)

     

       72
       72
       +
       	assert.Equal(t, did, session.DID)

     

       73
       73
       +
       

     

       74
       74
       +
       	// Wait well past expiration

     

       75
       75
       +
       	time.Sleep(2500 * time.Millisecond)

     

       76
       76
       +
       

     

       77
       77
       +
       	// Should fail after expiration

     

       78
       78
       +
       	session, err = client.UnsealSession(token)

     

       79
       79
       +
       	assert.Error(t, err)

     

       80
       80
       +
       	assert.Nil(t, session)

     

       81
       81
       +
       	assert.Contains(t, err.Error(), "token expired")

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       func TestSealSession_TamperedTokenDetection(t *testing.T) {

     

       85
       85
       +
       	client := &OAuthClient{

     

       86
       86
       +
       		SealSecret: generateSealSecret(),

     

       87
       87
       +
       	}

     

       88
       88
       +
       

     

       89
       89
       +
       	did := "did:plc:abc123"

     

       90
       90
       +
       	sessionID := "session-xyz"

     

       91
       91
       +
       	ttl := 1 * time.Hour

     

       92
       92
       +
       

     

       93
       93
       +
       	// Seal the session

     

       94
       94
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       95
       95
       +
       	require.NoError(t, err)

     

       96
       96
       +
       

     

       97
       97
       +
       	// Tamper with the token by modifying one character

     

       98
       98
       +
       	tampered := token[:len(token)-5] + "XXXX" + token[len(token)-1:]

     

       99
       99
       +
       

     

       100
       100
       +
       	// Should fail to unseal tampered token

     

       101
       101
       +
       	session, err := client.UnsealSession(tampered)

     

       102
       102
       +
       	assert.Error(t, err)

     

       103
       103
       +
       	assert.Nil(t, session)

     

       104
       104
       +
       	assert.Contains(t, err.Error(), "failed to decrypt token")

     

       105
       105
       +
       }

     

       106
       106
       +
       

     

       107
       107
       +
       func TestSealSession_InvalidTokenFormats(t *testing.T) {

     

       108
       108
       +
       	client := &OAuthClient{

     

       109
       109
       +
       		SealSecret: generateSealSecret(),

     

       110
       110
       +
       	}

     

       111
       111
       +
       

     

       112
       112
       +
       	tests := []struct {

     

       113
       113
       +
       		name  string

     

       114
       114
       +
       		token string

     

       115
       115
       +
       	}{

     

       116
       116
       +
       		{

     

       117
       117
       +
       			name:  "empty token",

     

       118
       118
       +
       			token: "",

     

       119
       119
       +
       		},

     

       120
       120
       +
       		{

     

       121
       121
       +
       			name:  "invalid base64",

     

       122
       122
       +
       			token: "not-valid-base64!@#$",

     

       123
       123
       +
       		},

     

       124
       124
       +
       		{

     

       125
       125
       +
       			name:  "too short",

     

       126
       126
       +
       			token: base64.RawURLEncoding.EncodeToString([]byte("short")),

     

       127
       127
       +
       		},

     

       128
       128
       +
       		{

     

       129
       129
       +
       			name:  "random bytes",

     

       130
       130
       +
       			token: base64.RawURLEncoding.EncodeToString(make([]byte, 50)),

     

       131
       131
       +
       		},

     

       132
       132
       +
       	}

     

       133
       133
       +
       

     

       134
       134
       +
       	for _, tt := range tests {

     

       135
       135
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       136
       136
       +
       			session, err := client.UnsealSession(tt.token)

     

       137
       137
       +
       			assert.Error(t, err)

     

       138
       138
       +
       			assert.Nil(t, session)

     

       139
       139
       +
       		})

     

       140
       140
       +
       	}

     

       141
       141
       +
       }

     

       142
       142
       +
       

     

       143
       143
       +
       func TestSealSession_DifferentSecrets(t *testing.T) {

     

       144
       144
       +
       	// Create two clients with different secrets

     

       145
       145
       +
       	client1 := &OAuthClient{

     

       146
       146
       +
       		SealSecret: generateSealSecret(),

     

       147
       147
       +
       	}

     

       148
       148
       +
       	client2 := &OAuthClient{

     

       149
       149
       +
       		SealSecret: generateSealSecret(),

     

       150
       150
       +
       	}

     

       151
       151
       +
       

     

       152
       152
       +
       	did := "did:plc:abc123"

     

       153
       153
       +
       	sessionID := "session-xyz"

     

       154
       154
       +
       	ttl := 1 * time.Hour

     

       155
       155
       +
       

     

       156
       156
       +
       	// Seal with client1

     

       157
       157
       +
       	token, err := client1.SealSession(did, sessionID, ttl)

     

       158
       158
       +
       	require.NoError(t, err)

     

       159
       159
       +
       

     

       160
       160
       +
       	// Try to unseal with client2 (different secret)

     

       161
       161
       +
       	session, err := client2.UnsealSession(token)

     

       162
       162
       +
       	assert.Error(t, err)

     

       163
       163
       +
       	assert.Nil(t, session)

     

       164
       164
       +
       	assert.Contains(t, err.Error(), "failed to decrypt token")

     

       165
       165
       +
       }

     

       166
       166
       +
       

     

       167
       167
       +
       func TestSealSession_NoSecretConfigured(t *testing.T) {

     

       168
       168
       +
       	client := &OAuthClient{

     

       169
       169
       +
       		SealSecret: nil,

     

       170
       170
       +
       	}

     

       171
       171
       +
       

     

       172
       172
       +
       	did := "did:plc:abc123"

     

       173
       173
       +
       	sessionID := "session-xyz"

     

       174
       174
       +
       	ttl := 1 * time.Hour

     

       175
       175
       +
       

     

       176
       176
       +
       	// Should fail to seal without secret

     

       177
       177
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       178
       178
       +
       	assert.Error(t, err)

     

       179
       179
       +
       	assert.Empty(t, token)

     

       180
       180
       +
       	assert.Contains(t, err.Error(), "seal secret not configured")

     

       181
       181
       +
       

     

       182
       182
       +
       	// Should fail to unseal without secret

     

       183
       183
       +
       	session, err := client.UnsealSession("dummy-token")

     

       184
       184
       +
       	assert.Error(t, err)

     

       185
       185
       +
       	assert.Nil(t, session)

     

       186
       186
       +
       	assert.Contains(t, err.Error(), "seal secret not configured")

     

       187
       187
       +
       }

     

       188
       188
       +
       

     

       189
       189
       +
       func TestSealSession_MissingRequiredFields(t *testing.T) {

     

       190
       190
       +
       	client := &OAuthClient{

     

       191
       191
       +
       		SealSecret: generateSealSecret(),

     

       192
       192
       +
       	}

     

       193
       193
       +
       

     

       194
       194
       +
       	ttl := 1 * time.Hour

     

       195
       195
       +
       

     

       196
       196
       +
       	tests := []struct {

     

       197
       197
       +
       		name      string

     

       198
       198
       +
       		did       string

     

       199
       199
       +
       		sessionID string

     

       200
       200
       +
       		errorMsg  string

     

       201
       201
       +
       	}{

     

       202
       202
       +
       		{

     

       203
       203
       +
       			name:      "missing DID",

     

       204
       204
       +
       			did:       "",

     

       205
       205
       +
       			sessionID: "session-123",

     

       206
       206
       +
       			errorMsg:  "DID is required",

     

       207
       207
       +
       		},

     

       208
       208
       +
       		{

     

       209
       209
       +
       			name:      "missing session ID",

     

       210
       210
       +
       			did:       "did:plc:abc123",

     

       211
       211
       +
       			sessionID: "",

     

       212
       212
       +
       			errorMsg:  "session ID is required",

     

       213
       213
       +
       		},

     

       214
       214
       +
       	}

     

       215
       215
       +
       

     

       216
       216
       +
       	for _, tt := range tests {

     

       217
       217
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       218
       218
       +
       			token, err := client.SealSession(tt.did, tt.sessionID, ttl)

     

       219
       219
       +
       			assert.Error(t, err)

     

       220
       220
       +
       			assert.Empty(t, token)

     

       221
       221
       +
       			assert.Contains(t, err.Error(), tt.errorMsg)

     

       222
       222
       +
       		})

     

       223
       223
       +
       	}

     

       224
       224
       +
       }

     

       225
       225
       +
       

     

       226
       226
       +
       func TestSealSession_UniquenessPerCall(t *testing.T) {

     

       227
       227
       +
       	client := &OAuthClient{

     

       228
       228
       +
       		SealSecret: generateSealSecret(),

     

       229
       229
       +
       	}

     

       230
       230
       +
       

     

       231
       231
       +
       	did := "did:plc:abc123"

     

       232
       232
       +
       	sessionID := "session-xyz"

     

       233
       233
       +
       	ttl := 1 * time.Hour

     

       234
       234
       +
       

     

       235
       235
       +
       	// Seal the same session twice

     

       236
       236
       +
       	token1, err := client.SealSession(did, sessionID, ttl)

     

       237
       237
       +
       	require.NoError(t, err)

     

       238
       238
       +
       

     

       239
       239
       +
       	token2, err := client.SealSession(did, sessionID, ttl)

     

       240
       240
       +
       	require.NoError(t, err)

     

       241
       241
       +
       

     

       242
       242
       +
       	// Tokens should be different (different nonces)

     

       243
       243
       +
       	assert.NotEqual(t, token1, token2, "tokens should be unique due to different nonces")

     

       244
       244
       +
       

     

       245
       245
       +
       	// But both should unseal to the same session data

     

       246
       246
       +
       	session1, err := client.UnsealSession(token1)

     

       247
       247
       +
       	require.NoError(t, err)

     

       248
       248
       +
       

     

       249
       249
       +
       	session2, err := client.UnsealSession(token2)

     

       250
       250
       +
       	require.NoError(t, err)

     

       251
       251
       +
       

     

       252
       252
       +
       	assert.Equal(t, session1.DID, session2.DID)

     

       253
       253
       +
       	assert.Equal(t, session1.SessionID, session2.SessionID)

     

       254
       254
       +
       }

     

       255
       255
       +
       

     

       256
       256
       +
       func TestSealSession_LongDIDAndSessionID(t *testing.T) {

     

       257
       257
       +
       	client := &OAuthClient{

     

       258
       258
       +
       		SealSecret: generateSealSecret(),

     

       259
       259
       +
       	}

     

       260
       260
       +
       

     

       261
       261
       +
       	// Test with very long DID and session ID

     

       262
       262
       +
       	did := "did:plc:" + strings.Repeat("a", 200)

     

       263
       263
       +
       	sessionID := "session-" + strings.Repeat("x", 200)

     

       264
       264
       +
       	ttl := 1 * time.Hour

     

       265
       265
       +
       

     

       266
       266
       +
       	// Should work with long values

     

       267
       267
       +
       	token, err := client.SealSession(did, sessionID, ttl)

     

       268
       268
       +
       	require.NoError(t, err)

     

       269
       269
       +
       

     

       270
       270
       +
       	session, err := client.UnsealSession(token)

     

       271
       271
       +
       	require.NoError(t, err)

     

       272
       272
       +
       	assert.Equal(t, did, session.DID)

     

       273
       273
       +
       	assert.Equal(t, sessionID, session.SessionID)

     

       274
       274
       +
       }

     

       275
       275
       +
       

     

       276
       276
       +
       func TestSealSession_URLSafeEncoding(t *testing.T) {

     

       277
       277
       +
       	client := &OAuthClient{

     

       278
       278
       +
       		SealSecret: generateSealSecret(),

     

       279
       279
       +
       	}

     

       280
       280
       +
       

     

       281
       281
       +
       	did := "did:plc:abc123"

     

       282
       282
       +
       	sessionID := "session-xyz"

     

       283
       283
       +
       	ttl := 1 * time.Hour

     

       284
       284
       +
       

     

       285
       285
       +
       	// Seal multiple times to get different nonces

     

       286
       286
       +
       	for i := 0; i < 100; i++ {

     

       287
       287
       +
       		token, err := client.SealSession(did, sessionID, ttl)

     

       288
       288
       +
       		require.NoError(t, err)

     

       289
       289
       +
       

     

       290
       290
       +
       		// Token should not contain URL-unsafe characters

     

       291
       291
       +
       		assert.NotContains(t, token, "+", "token should not contain '+'")

     

       292
       292
       +
       		assert.NotContains(t, token, "/", "token should not contain '/'")

     

       293
       293
       +
       		assert.NotContains(t, token, "=", "token should not contain '='")

     

       294
       294
       +
       

     

       295
       295
       +
       		// Should unseal successfully

     

       296
       296
       +
       		session, err := client.UnsealSession(token)

     

       297
       297
       +
       		require.NoError(t, err)

     

       298
       298
       +
       		assert.Equal(t, did, session.DID)

     

       299
       299
       +
       	}

     

       300
       300
       +
       }

     

       301
       301
       +
       

     

       302
       302
       +
       func TestSealSession_ConcurrentAccess(t *testing.T) {

     

       303
       303
       +
       	client := &OAuthClient{

     

       304
       304
       +
       		SealSecret: generateSealSecret(),

     

       305
       305
       +
       	}

     

       306
       306
       +
       

     

       307
       307
       +
       	did := "did:plc:abc123"

     

       308
       308
       +
       	sessionID := "session-xyz"

     

       309
       309
       +
       	ttl := 1 * time.Hour

     

       310
       310
       +
       

     

       311
       311
       +
       	// Run concurrent seal/unseal operations

     

       312
       312
       +
       	done := make(chan bool)

     

       313
       313
       +
       	for i := 0; i < 10; i++ {

     

       314
       314
       +
       		go func() {

     

       315
       315
       +
       			for j := 0; j < 100; j++ {

     

       316
       316
       +
       				token, err := client.SealSession(did, sessionID, ttl)

     

       317
       317
       +
       				require.NoError(t, err)

     

       318
       318
       +
       

     

       319
       319
       +
       				session, err := client.UnsealSession(token)

     

       320
       320
       +
       				require.NoError(t, err)

     

       321
       321
       +
       				assert.Equal(t, did, session.DID)

     

       322
       322
       +
       			}

     

       323
       323
       +
       			done <- true

     

       324
       324
       +
       		}()

     

       325
       325
       +
       	}

     

       326
       326
       +
       

     

       327
       327
       +
       	// Wait for all goroutines

     

       328
       328
       +
       	for i := 0; i < 10; i++ {

     

       329
       329
       +
       		<-done

     

       330
       330
       +
       	}

     

       331
       331
       +
       }

+614

internal/atproto/oauth/store.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       	"errors"

     

       7
       7
       +
       	"fmt"

     

       8
       8
       +
       	"log/slog"

     

       9
       9
       +
       	"net/url"

     

       10
       10
       +
       	"strings"

     

       11
       11
       +
       	"time"

     

       12
       12
       +
       

     

       13
       13
       +
       	"github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       14
       14
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       15
       15
       +
       	"github.com/lib/pq"

     

       16
       16
       +
       )

     

       17
       17
       +
       

     

       18
       18
       +
       var (

     

       19
       19
       +
       	ErrSessionNotFound     = errors.New("oauth session not found")

     

       20
       20
       +
       	ErrAuthRequestNotFound = errors.New("oauth auth request not found")

     

       21
       21
       +
       )

     

       22
       22
       +
       

     

       23
       23
       +
       // PostgresOAuthStore implements oauth.ClientAuthStore interface using PostgreSQL

     

       24
       24
       +
       type PostgresOAuthStore struct {

     

       25
       25
       +
       	db         *sql.DB

     

       26
       26
       +
       	sessionTTL time.Duration

     

       27
       27
       +
       }

     

       28
       28
       +
       

     

       29
       29
       +
       // NewPostgresOAuthStore creates a new PostgreSQL-backed OAuth store

     

       30
       30
       +
       func NewPostgresOAuthStore(db *sql.DB, sessionTTL time.Duration) oauth.ClientAuthStore {

     

       31
       31
       +
       	if sessionTTL == 0 {

     

       32
       32
       +
       		sessionTTL = 7 * 24 * time.Hour // Default to 7 days

     

       33
       33
       +
       	}

     

       34
       34
       +
       	return &PostgresOAuthStore{

     

       35
       35
       +
       		db:         db,

     

       36
       36
       +
       		sessionTTL: sessionTTL,

     

       37
       37
       +
       	}

     

       38
       38
       +
       }

     

       39
       39
       +
       

     

       40
       40
       +
       // GetSession retrieves a session by DID and session ID

     

       41
       41
       +
       func (s *PostgresOAuthStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauth.ClientSessionData, error) {

     

       42
       42
       +
       	query := `

     

       43
       43
       +
       		SELECT

     

       44
       44
       +
       			did, session_id, host_url, auth_server_iss,

     

       45
       45
       +
       			auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       46
       46
       +
       			scopes, access_token, refresh_token,

     

       47
       47
       +
       			dpop_authserver_nonce, dpop_pds_nonce, dpop_private_key_multibase

     

       48
       48
       +
       		FROM oauth_sessions

     

       49
       49
       +
       		WHERE did = $1 AND session_id = $2 AND expires_at > NOW()

     

       50
       50
       +
       	`

     

       51
       51
       +
       

     

       52
       52
       +
       	var session oauth.ClientSessionData

     

       53
       53
       +
       	var authServerIss, authServerTokenEndpoint, authServerRevocationEndpoint sql.NullString

     

       54
       54
       +
       	var hostURL, dpopPrivateKeyMultibase sql.NullString

     

       55
       55
       +
       	var scopes pq.StringArray

     

       56
       56
       +
       	var dpopAuthServerNonce, dpopHostNonce sql.NullString

     

       57
       57
       +
       

     

       58
       58
       +
       	err := s.db.QueryRowContext(ctx, query, did.String(), sessionID).Scan(

     

       59
       59
       +
       		&session.AccountDID,

     

       60
       60
       +
       		&session.SessionID,

     

       61
       61
       +
       		&hostURL,

     

       62
       62
       +
       		&authServerIss,

     

       63
       63
       +
       		&authServerTokenEndpoint,

     

       64
       64
       +
       		&authServerRevocationEndpoint,

     

       65
       65
       +
       		&scopes,

     

       66
       66
       +
       		&session.AccessToken,

     

       67
       67
       +
       		&session.RefreshToken,

     

       68
       68
       +
       		&dpopAuthServerNonce,

     

       69
       69
       +
       		&dpopHostNonce,

     

       70
       70
       +
       		&dpopPrivateKeyMultibase,

     

       71
       71
       +
       	)

     

       72
       72
       +
       

     

       73
       73
       +
       	if err == sql.ErrNoRows {

     

       74
       74
       +
       		return nil, ErrSessionNotFound

     

       75
       75
       +
       	}

     

       76
       76
       +
       	if err != nil {

     

       77
       77
       +
       		return nil, fmt.Errorf("failed to get session: %w", err)

     

       78
       78
       +
       	}

     

       79
       79
       +
       

     

       80
       80
       +
       	// Convert nullable fields

     

       81
       81
       +
       	if hostURL.Valid {

     

       82
       82
       +
       		session.HostURL = hostURL.String

     

       83
       83
       +
       	}

     

       84
       84
       +
       	if authServerIss.Valid {

     

       85
       85
       +
       		session.AuthServerURL = authServerIss.String

     

       86
       86
       +
       	}

     

       87
       87
       +
       	if authServerTokenEndpoint.Valid {

     

       88
       88
       +
       		session.AuthServerTokenEndpoint = authServerTokenEndpoint.String

     

       89
       89
       +
       	}

     

       90
       90
       +
       	if authServerRevocationEndpoint.Valid {

     

       91
       91
       +
       		session.AuthServerRevocationEndpoint = authServerRevocationEndpoint.String

     

       92
       92
       +
       	}

     

       93
       93
       +
       	if dpopAuthServerNonce.Valid {

     

       94
       94
       +
       		session.DPoPAuthServerNonce = dpopAuthServerNonce.String

     

       95
       95
       +
       	}

     

       96
       96
       +
       	if dpopHostNonce.Valid {

     

       97
       97
       +
       		session.DPoPHostNonce = dpopHostNonce.String

     

       98
       98
       +
       	}

     

       99
       99
       +
       	if dpopPrivateKeyMultibase.Valid {

     

       100
       100
       +
       		session.DPoPPrivateKeyMultibase = dpopPrivateKeyMultibase.String

     

       101
       101
       +
       	}

     

       102
       102
       +
       	session.Scopes = scopes

     

       103
       103
       +
       

     

       104
       104
       +
       	return &session, nil

     

       105
       105
       +
       }

     

       106
       106
       +
       

     

       107
       107
       +
       // SaveSession saves or updates a session (upsert operation)

     

       108
       108
       +
       func (s *PostgresOAuthStore) SaveSession(ctx context.Context, sess oauth.ClientSessionData) error {

     

       109
       109
       +
       	// Input validation per atProto OAuth security requirements

     

       110
       110
       +
       

     

       111
       111
       +
       	// Validate DID format

     

       112
       112
       +
       	if _, err := syntax.ParseDID(sess.AccountDID.String()); err != nil {

     

       113
       113
       +
       		return fmt.Errorf("invalid DID format: %w", err)

     

       114
       114
       +
       	}

     

       115
       115
       +
       

     

       116
       116
       +
       	// Validate token lengths (max 10000 chars to prevent memory issues)

     

       117
       117
       +
       	const maxTokenLength = 10000

     

       118
       118
       +
       	if len(sess.AccessToken) > maxTokenLength {

     

       119
       119
       +
       		return fmt.Errorf("access_token exceeds maximum length of %d characters", maxTokenLength)

     

       120
       120
       +
       	}

     

       121
       121
       +
       	if len(sess.RefreshToken) > maxTokenLength {

     

       122
       122
       +
       		return fmt.Errorf("refresh_token exceeds maximum length of %d characters", maxTokenLength)

     

       123
       123
       +
       	}

     

       124
       124
       +
       

     

       125
       125
       +
       	// Validate session ID is not empty

     

       126
       126
       +
       	if sess.SessionID == "" {

     

       127
       127
       +
       		return fmt.Errorf("session_id cannot be empty")

     

       128
       128
       +
       	}

     

       129
       129
       +
       

     

       130
       130
       +
       	// Validate URLs if provided

     

       131
       131
       +
       	if sess.HostURL != "" {

     

       132
       132
       +
       		if _, err := url.Parse(sess.HostURL); err != nil {

     

       133
       133
       +
       			return fmt.Errorf("invalid host_url: %w", err)

     

       134
       134
       +
       		}

     

       135
       135
       +
       	}

     

       136
       136
       +
       	if sess.AuthServerURL != "" {

     

       137
       137
       +
       		if _, err := url.Parse(sess.AuthServerURL); err != nil {

     

       138
       138
       +
       			return fmt.Errorf("invalid auth_server URL: %w", err)

     

       139
       139
       +
       		}

     

       140
       140
       +
       	}

     

       141
       141
       +
       	if sess.AuthServerTokenEndpoint != "" {

     

       142
       142
       +
       		if _, err := url.Parse(sess.AuthServerTokenEndpoint); err != nil {

     

       143
       143
       +
       			return fmt.Errorf("invalid auth_server_token_endpoint: %w", err)

     

       144
       144
       +
       		}

     

       145
       145
       +
       	}

     

       146
       146
       +
       	if sess.AuthServerRevocationEndpoint != "" {

     

       147
       147
       +
       		if _, err := url.Parse(sess.AuthServerRevocationEndpoint); err != nil {

     

       148
       148
       +
       			return fmt.Errorf("invalid auth_server_revocation_endpoint: %w", err)

     

       149
       149
       +
       		}

     

       150
       150
       +
       	}

     

       151
       151
       +
       

     

       152
       152
       +
       	query := `

     

       153
       153
       +
       		INSERT INTO oauth_sessions (

     

       154
       154
       +
       			did, session_id, handle, pds_url, host_url,

     

       155
       155
       +
       			access_token, refresh_token,

     

       156
       156
       +
       			dpop_private_jwk, dpop_private_key_multibase,

     

       157
       157
       +
       			dpop_authserver_nonce, dpop_pds_nonce,

     

       158
       158
       +
       			auth_server_iss, auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       159
       159
       +
       			scopes, expires_at, created_at, updated_at

     

       160
       160
       +
       		) VALUES (

     

       161
       161
       +
       			$1, $2, $3, $4, $5,

     

       162
       162
       +
       			$6, $7,

     

       163
       163
       +
       			NULL, $8,

     

       164
       164
       +
       			$9, $10,

     

       165
       165
       +
       			$11, $12, $13,

     

       166
       166
       +
       			$14, $15, NOW(), NOW()

     

       167
       167
       +
       		)

     

       168
       168
       +
       		ON CONFLICT (did, session_id) DO UPDATE SET

     

       169
       169
       +
       			handle = EXCLUDED.handle,

     

       170
       170
       +
       			pds_url = EXCLUDED.pds_url,

     

       171
       171
       +
       			host_url = EXCLUDED.host_url,

     

       172
       172
       +
       			access_token = EXCLUDED.access_token,

     

       173
       173
       +
       			refresh_token = EXCLUDED.refresh_token,

     

       174
       174
       +
       			dpop_private_key_multibase = EXCLUDED.dpop_private_key_multibase,

     

       175
       175
       +
       			dpop_authserver_nonce = EXCLUDED.dpop_authserver_nonce,

     

       176
       176
       +
       			dpop_pds_nonce = EXCLUDED.dpop_pds_nonce,

     

       177
       177
       +
       			auth_server_iss = EXCLUDED.auth_server_iss,

     

       178
       178
       +
       			auth_server_token_endpoint = EXCLUDED.auth_server_token_endpoint,

     

       179
       179
       +
       			auth_server_revocation_endpoint = EXCLUDED.auth_server_revocation_endpoint,

     

       180
       180
       +
       			scopes = EXCLUDED.scopes,

     

       181
       181
       +
       			expires_at = EXCLUDED.expires_at,

     

       182
       182
       +
       			updated_at = NOW()

     

       183
       183
       +
       	`

     

       184
       184
       +
       

     

       185
       185
       +
       	// Calculate token expiration using configured TTL

     

       186
       186
       +
       	expiresAt := time.Now().Add(s.sessionTTL)

     

       187
       187
       +
       

     

       188
       188
       +
       	// Convert empty strings to NULL for optional fields

     

       189
       189
       +
       	var authServerRevocationEndpoint sql.NullString

     

       190
       190
       +
       	if sess.AuthServerRevocationEndpoint != "" {

     

       191
       191
       +
       		authServerRevocationEndpoint.String = sess.AuthServerRevocationEndpoint

     

       192
       192
       +
       		authServerRevocationEndpoint.Valid = true

     

       193
       193
       +
       	}

     

       194
       194
       +
       

     

       195
       195
       +
       	// Extract handle from DID (placeholder - in real implementation, resolve from identity)

     

       196
       196
       +
       	// For now, use DID as handle since we don't have the handle in ClientSessionData

     

       197
       197
       +
       	handle := sess.AccountDID.String()

     

       198
       198
       +
       

     

       199
       199
       +
       	// Use HostURL as PDS URL

     

       200
       200
       +
       	pdsURL := sess.HostURL

     

       201
       201
       +
       	if pdsURL == "" {

     

       202
       202
       +
       		pdsURL = sess.AuthServerURL // Fallback to auth server URL

     

       203
       203
       +
       	}

     

       204
       204
       +
       

     

       205
       205
       +
       	_, err := s.db.ExecContext(

     

       206
       206
       +
       		ctx, query,

     

       207
       207
       +
       		sess.AccountDID.String(),

     

       208
       208
       +
       		sess.SessionID,

     

       209
       209
       +
       		handle,

     

       210
       210
       +
       		pdsURL,

     

       211
       211
       +
       		sess.HostURL,

     

       212
       212
       +
       		sess.AccessToken,

     

       213
       213
       +
       		sess.RefreshToken,

     

       214
       214
       +
       		sess.DPoPPrivateKeyMultibase,

     

       215
       215
       +
       		sess.DPoPAuthServerNonce,

     

       216
       216
       +
       		sess.DPoPHostNonce,

     

       217
       217
       +
       		sess.AuthServerURL,

     

       218
       218
       +
       		sess.AuthServerTokenEndpoint,

     

       219
       219
       +
       		authServerRevocationEndpoint,

     

       220
       220
       +
       		pq.Array(sess.Scopes),

     

       221
       221
       +
       		expiresAt,

     

       222
       222
       +
       	)

     

       223
       223
       +
       	if err != nil {

     

       224
       224
       +
       		return fmt.Errorf("failed to save session: %w", err)

     

       225
       225
       +
       	}

     

       226
       226
       +
       

     

       227
       227
       +
       	return nil

     

       228
       228
       +
       }

     

       229
       229
       +
       

     

       230
       230
       +
       // DeleteSession deletes a session by DID and session ID

     

       231
       231
       +
       func (s *PostgresOAuthStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error {

     

       232
       232
       +
       	query := `DELETE FROM oauth_sessions WHERE did = $1 AND session_id = $2`

     

       233
       233
       +
       

     

       234
       234
       +
       	result, err := s.db.ExecContext(ctx, query, did.String(), sessionID)

     

       235
       235
       +
       	if err != nil {

     

       236
       236
       +
       		return fmt.Errorf("failed to delete session: %w", err)

     

       237
       237
       +
       	}

     

       238
       238
       +
       

     

       239
       239
       +
       	rows, err := result.RowsAffected()

     

       240
       240
       +
       	if err != nil {

     

       241
       241
       +
       		return fmt.Errorf("failed to get rows affected: %w", err)

     

       242
       242
       +
       	}

     

       243
       243
       +
       

     

       244
       244
       +
       	if rows == 0 {

     

       245
       245
       +
       		return ErrSessionNotFound

     

       246
       246
       +
       	}

     

       247
       247
       +
       

     

       248
       248
       +
       	return nil

     

       249
       249
       +
       }

     

       250
       250
       +
       

     

       251
       251
       +
       // GetAuthRequestInfo retrieves auth request information by state

     

       252
       252
       +
       func (s *PostgresOAuthStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauth.AuthRequestData, error) {

     

       253
       253
       +
       	query := `

     

       254
       254
       +
       		SELECT

     

       255
       255
       +
       			state, did, handle, pds_url, pkce_verifier,

     

       256
       256
       +
       			dpop_private_key_multibase, dpop_authserver_nonce,

     

       257
       257
       +
       			auth_server_iss, request_uri,

     

       258
       258
       +
       			auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       259
       259
       +
       			scopes, created_at

     

       260
       260
       +
       		FROM oauth_requests

     

       261
       261
       +
       		WHERE state = $1

     

       262
       262
       +
       	`

     

       263
       263
       +
       

     

       264
       264
       +
       	var info oauth.AuthRequestData

     

       265
       265
       +
       	var did, handle, pdsURL sql.NullString

     

       266
       266
       +
       	var dpopPrivateKeyMultibase, dpopAuthServerNonce sql.NullString

     

       267
       267
       +
       	var requestURI, authServerTokenEndpoint, authServerRevocationEndpoint sql.NullString

     

       268
       268
       +
       	var scopes pq.StringArray

     

       269
       269
       +
       	var createdAt time.Time

     

       270
       270
       +
       

     

       271
       271
       +
       	err := s.db.QueryRowContext(ctx, query, state).Scan(

     

       272
       272
       +
       		&info.State,

     

       273
       273
       +
       		&did,

     

       274
       274
       +
       		&handle,

     

       275
       275
       +
       		&pdsURL,

     

       276
       276
       +
       		&info.PKCEVerifier,

     

       277
       277
       +
       		&dpopPrivateKeyMultibase,

     

       278
       278
       +
       		&dpopAuthServerNonce,

     

       279
       279
       +
       		&info.AuthServerURL,

     

       280
       280
       +
       		&requestURI,

     

       281
       281
       +
       		&authServerTokenEndpoint,

     

       282
       282
       +
       		&authServerRevocationEndpoint,

     

       283
       283
       +
       		&scopes,

     

       284
       284
       +
       		&createdAt,

     

       285
       285
       +
       	)

     

       286
       286
       +
       

     

       287
       287
       +
       	if err == sql.ErrNoRows {

     

       288
       288
       +
       		return nil, ErrAuthRequestNotFound

     

       289
       289
       +
       	}

     

       290
       290
       +
       	if err != nil {

     

       291
       291
       +
       		return nil, fmt.Errorf("failed to get auth request info: %w", err)

     

       292
       292
       +
       	}

     

       293
       293
       +
       

     

       294
       294
       +
       	// Parse DID if present

     

       295
       295
       +
       	if did.Valid && did.String != "" {

     

       296
       296
       +
       		parsedDID, err := syntax.ParseDID(did.String)

     

       297
       297
       +
       		if err != nil {

     

       298
       298
       +
       			return nil, fmt.Errorf("failed to parse DID: %w", err)

     

       299
       299
       +
       		}

     

       300
       300
       +
       		info.AccountDID = &parsedDID

     

       301
       301
       +
       	}

     

       302
       302
       +
       

     

       303
       303
       +
       	// Convert nullable fields

     

       304
       304
       +
       	if dpopPrivateKeyMultibase.Valid {

     

       305
       305
       +
       		info.DPoPPrivateKeyMultibase = dpopPrivateKeyMultibase.String

     

       306
       306
       +
       	}

     

       307
       307
       +
       	if dpopAuthServerNonce.Valid {

     

       308
       308
       +
       		info.DPoPAuthServerNonce = dpopAuthServerNonce.String

     

       309
       309
       +
       	}

     

       310
       310
       +
       	if requestURI.Valid {

     

       311
       311
       +
       		info.RequestURI = requestURI.String

     

       312
       312
       +
       	}

     

       313
       313
       +
       	if authServerTokenEndpoint.Valid {

     

       314
       314
       +
       		info.AuthServerTokenEndpoint = authServerTokenEndpoint.String

     

       315
       315
       +
       	}

     

       316
       316
       +
       	if authServerRevocationEndpoint.Valid {

     

       317
       317
       +
       		info.AuthServerRevocationEndpoint = authServerRevocationEndpoint.String

     

       318
       318
       +
       	}

     

       319
       319
       +
       	info.Scopes = scopes

     

       320
       320
       +
       

     

       321
       321
       +
       	return &info, nil

     

       322
       322
       +
       }

     

       323
       323
       +
       

     

       324
       324
       +
       // SaveAuthRequestInfo saves auth request information (create only, not upsert)

     

       325
       325
       +
       func (s *PostgresOAuthStore) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error {

     

       326
       326
       +
       	query := `

     

       327
       327
       +
       		INSERT INTO oauth_requests (

     

       328
       328
       +
       			state, did, handle, pds_url, pkce_verifier,

     

       329
       329
       +
       			dpop_private_key_multibase, dpop_authserver_nonce,

     

       330
       330
       +
       			auth_server_iss, request_uri,

     

       331
       331
       +
       			auth_server_token_endpoint, auth_server_revocation_endpoint,

     

       332
       332
       +
       			scopes, return_url, created_at

     

       333
       333
       +
       		) VALUES (

     

       334
       334
       +
       			$1, $2, $3, $4, $5,

     

       335
       335
       +
       			$6, $7,

     

       336
       336
       +
       			$8, $9,

     

       337
       337
       +
       			$10, $11,

     

       338
       338
       +
       			$12, NULL, NOW()

     

       339
       339
       +
       		)

     

       340
       340
       +
       	`

     

       341
       341
       +
       

     

       342
       342
       +
       	// Extract DID string if present

     

       343
       343
       +
       	var didStr sql.NullString

     

       344
       344
       +
       	if info.AccountDID != nil {

     

       345
       345
       +
       		didStr.String = info.AccountDID.String()

     

       346
       346
       +
       		didStr.Valid = true

     

       347
       347
       +
       	}

     

       348
       348
       +
       

     

       349
       349
       +
       	// Convert empty strings to NULL for optional fields

     

       350
       350
       +
       	var authServerRevocationEndpoint sql.NullString

     

       351
       351
       +
       	if info.AuthServerRevocationEndpoint != "" {

     

       352
       352
       +
       		authServerRevocationEndpoint.String = info.AuthServerRevocationEndpoint

     

       353
       353
       +
       		authServerRevocationEndpoint.Valid = true

     

       354
       354
       +
       	}

     

       355
       355
       +
       

     

       356
       356
       +
       	// Placeholder values for handle and pds_url (not in AuthRequestData)

     

       357
       357
       +
       	// In production, these would be resolved during the auth flow

     

       358
       358
       +
       	handle := ""

     

       359
       359
       +
       	pdsURL := ""

     

       360
       360
       +
       	if info.AccountDID != nil {

     

       361
       361
       +
       		handle = info.AccountDID.String() // Temporary placeholder

     

       362
       362
       +
       		pdsURL = info.AuthServerURL       // Temporary placeholder

     

       363
       363
       +
       	}

     

       364
       364
       +
       

     

       365
       365
       +
       	_, err := s.db.ExecContext(

     

       366
       366
       +
       		ctx, query,

     

       367
       367
       +
       		info.State,

     

       368
       368
       +
       		didStr,

     

       369
       369
       +
       		handle,

     

       370
       370
       +
       		pdsURL,

     

       371
       371
       +
       		info.PKCEVerifier,

     

       372
       372
       +
       		info.DPoPPrivateKeyMultibase,

     

       373
       373
       +
       		info.DPoPAuthServerNonce,

     

       374
       374
       +
       		info.AuthServerURL,

     

       375
       375
       +
       		info.RequestURI,

     

       376
       376
       +
       		info.AuthServerTokenEndpoint,

     

       377
       377
       +
       		authServerRevocationEndpoint,

     

       378
       378
       +
       		pq.Array(info.Scopes),

     

       379
       379
       +
       	)

     

       380
       380
       +
       	if err != nil {

     

       381
       381
       +
       		// Check for duplicate state

     

       382
       382
       +
       		if strings.Contains(err.Error(), "duplicate key") && strings.Contains(err.Error(), "oauth_requests_state_key") {

     

       383
       383
       +
       			return fmt.Errorf("auth request with state already exists: %s", info.State)

     

       384
       384
       +
       		}

     

       385
       385
       +
       		return fmt.Errorf("failed to save auth request info: %w", err)

     

       386
       386
       +
       	}

     

       387
       387
       +
       

     

       388
       388
       +
       	return nil

     

       389
       389
       +
       }

     

       390
       390
       +
       

     

       391
       391
       +
       // DeleteAuthRequestInfo deletes auth request information by state

     

       392
       392
       +
       func (s *PostgresOAuthStore) DeleteAuthRequestInfo(ctx context.Context, state string) error {

     

       393
       393
       +
       	query := `DELETE FROM oauth_requests WHERE state = $1`

     

       394
       394
       +
       

     

       395
       395
       +
       	result, err := s.db.ExecContext(ctx, query, state)

     

       396
       396
       +
       	if err != nil {

     

       397
       397
       +
       		return fmt.Errorf("failed to delete auth request info: %w", err)

     

       398
       398
       +
       	}

     

       399
       399
       +
       

     

       400
       400
       +
       	rows, err := result.RowsAffected()

     

       401
       401
       +
       	if err != nil {

     

       402
       402
       +
       		return fmt.Errorf("failed to get rows affected: %w", err)

     

       403
       403
       +
       	}

     

       404
       404
       +
       

     

       405
       405
       +
       	if rows == 0 {

     

       406
       406
       +
       		return ErrAuthRequestNotFound

     

       407
       407
       +
       	}

     

       408
       408
       +
       

     

       409
       409
       +
       	return nil

     

       410
       410
       +
       }

     

       411
       411
       +
       

     

       412
       412
       +
       // CleanupExpiredSessions removes sessions that have expired

     

       413
       413
       +
       // Should be called periodically (e.g., via cron job)

     

       414
       414
       +
       func (s *PostgresOAuthStore) CleanupExpiredSessions(ctx context.Context) (int64, error) {

     

       415
       415
       +
       	query := `DELETE FROM oauth_sessions WHERE expires_at < NOW()`

     

       416
       416
       +
       

     

       417
       417
       +
       	result, err := s.db.ExecContext(ctx, query)

     

       418
       418
       +
       	if err != nil {

     

       419
       419
       +
       		return 0, fmt.Errorf("failed to cleanup expired sessions: %w", err)

     

       420
       420
       +
       	}

     

       421
       421
       +
       

     

       422
       422
       +
       	rows, err := result.RowsAffected()

     

       423
       423
       +
       	if err != nil {

     

       424
       424
       +
       		return 0, fmt.Errorf("failed to get rows affected: %w", err)

     

       425
       425
       +
       	}

     

       426
       426
       +
       

     

       427
       427
       +
       	return rows, nil

     

       428
       428
       +
       }

     

       429
       429
       +
       

     

       430
       430
       +
       // CleanupExpiredAuthRequests removes auth requests older than 30 minutes

     

       431
       431
       +
       // Should be called periodically (e.g., via cron job)

     

       432
       432
       +
       func (s *PostgresOAuthStore) CleanupExpiredAuthRequests(ctx context.Context) (int64, error) {

     

       433
       433
       +
       	query := `DELETE FROM oauth_requests WHERE created_at < NOW() - INTERVAL '30 minutes'`

     

       434
       434
       +
       

     

       435
       435
       +
       	result, err := s.db.ExecContext(ctx, query)

     

       436
       436
       +
       	if err != nil {

     

       437
       437
       +
       		return 0, fmt.Errorf("failed to cleanup expired auth requests: %w", err)

     

       438
       438
       +
       	}

     

       439
       439
       +
       

     

       440
       440
       +
       	rows, err := result.RowsAffected()

     

       441
       441
       +
       	if err != nil {

     

       442
       442
       +
       		return 0, fmt.Errorf("failed to get rows affected: %w", err)

     

       443
       443
       +
       	}

     

       444
       444
       +
       

     

       445
       445
       +
       	return rows, nil

     

       446
       446
       +
       }

     

       447
       447
       +
       

     

       448
       448
       +
       // MobileOAuthData holds mobile-specific OAuth flow data

     

       449
       449
       +
       type MobileOAuthData struct {

     

       450
       450
       +
       	CSRFToken   string

     

       451
       451
       +
       	RedirectURI string

     

       452
       452
       +
       }

     

       453
       453
       +
       

     

       454
       454
       +
       // mobileFlowContextKey is the context key for mobile flow data

     

       455
       455
       +
       type mobileFlowContextKey struct{}

     

       456
       456
       +
       

     

       457
       457
       +
       // ContextWithMobileFlowData adds mobile flow data to a context.

     

       458
       458
       +
       // This is used by HandleMobileLogin to pass mobile data to the store wrapper,

     

       459
       459
       +
       // which will save it when SaveAuthRequestInfo is called by indigo.

     

       460
       460
       +
       func ContextWithMobileFlowData(ctx context.Context, data MobileOAuthData) context.Context {

     

       461
       461
       +
       	return context.WithValue(ctx, mobileFlowContextKey{}, data)

     

       462
       462
       +
       }

     

       463
       463
       +
       

     

       464
       464
       +
       // getMobileFlowDataFromContext retrieves mobile flow data from context, if present

     

       465
       465
       +
       func getMobileFlowDataFromContext(ctx context.Context) (MobileOAuthData, bool) {

     

       466
       466
       +
       	data, ok := ctx.Value(mobileFlowContextKey{}).(MobileOAuthData)

     

       467
       467
       +
       	return data, ok

     

       468
       468
       +
       }

     

       469
       469
       +
       

     

       470
       470
       +
       // MobileAwareClientStore is a marker interface that indicates a store is properly

     

       471
       471
       +
       // configured for mobile OAuth flows. Only stores that intercept SaveAuthRequestInfo

     

       472
       472
       +
       // to save mobile CSRF data should implement this interface.

     

       473
       473
       +
       // This prevents silent mobile OAuth breakage when a plain PostgresOAuthStore is used.

     

       474
       474
       +
       type MobileAwareClientStore interface {

     

       475
       475
       +
       	IsMobileAware() bool

     

       476
       476
       +
       }

     

       477
       477
       +
       

     

       478
       478
       +
       // MobileAwareStoreWrapper wraps a ClientAuthStore to automatically save mobile

     

       479
       479
       +
       // CSRF data when SaveAuthRequestInfo is called during a mobile OAuth flow.

     

       480
       480
       +
       // This is necessary because indigo's StartAuthFlow doesn't expose the OAuth state,

     

       481
       481
       +
       // so we intercept the SaveAuthRequestInfo call to capture it.

     

       482
       482
       +
       type MobileAwareStoreWrapper struct {

     

       483
       483
       +
       	oauth.ClientAuthStore

     

       484
       484
       +
       	mobileStore MobileOAuthStore

     

       485
       485
       +
       }

     

       486
       486
       +
       

     

       487
       487
       +
       // IsMobileAware implements MobileAwareClientStore, indicating this store

     

       488
       488
       +
       // properly saves mobile CSRF data during OAuth flow initiation.

     

       489
       489
       +
       func (w *MobileAwareStoreWrapper) IsMobileAware() bool {

     

       490
       490
       +
       	return true

     

       491
       491
       +
       }

     

       492
       492
       +
       

     

       493
       493
       +
       // NewMobileAwareStoreWrapper creates a wrapper that intercepts SaveAuthRequestInfo

     

       494
       494
       +
       // to also save mobile CSRF data when present in context.

     

       495
       495
       +
       func NewMobileAwareStoreWrapper(store oauth.ClientAuthStore) *MobileAwareStoreWrapper {

     

       496
       496
       +
       	wrapper := &MobileAwareStoreWrapper{

     

       497
       497
       +
       		ClientAuthStore: store,

     

       498
       498
       +
       	}

     

       499
       499
       +
       	// Check if the underlying store implements MobileOAuthStore

     

       500
       500
       +
       	if ms, ok := store.(MobileOAuthStore); ok {

     

       501
       501
       +
       		wrapper.mobileStore = ms

     

       502
       502
       +
       	}

     

       503
       503
       +
       	return wrapper

     

       504
       504
       +
       }

     

       505
       505
       +
       

     

       506
       506
       +
       // SaveAuthRequestInfo saves the auth request and also saves mobile CSRF data

     

       507
       507
       +
       // if mobile flow data is present in the context.

     

       508
       508
       +
       func (w *MobileAwareStoreWrapper) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error {

     

       509
       509
       +
       	// First, save the auth request to the underlying store

     

       510
       510
       +
       	if err := w.ClientAuthStore.SaveAuthRequestInfo(ctx, info); err != nil {

     

       511
       511
       +
       		return err

     

       512
       512
       +
       	}

     

       513
       513
       +
       

     

       514
       514
       +
       	// Check if this is a mobile flow (mobile data in context)

     

       515
       515
       +
       	if mobileData, ok := getMobileFlowDataFromContext(ctx); ok && w.mobileStore != nil {

     

       516
       516
       +
       		// Save mobile CSRF data tied to this OAuth state

     

       517
       517
       +
       		// IMPORTANT: If this fails, we MUST propagate the error. Otherwise:

     

       518
       518
       +
       		// 1. No server-side CSRF record is stored

     

       519
       519
       +
       		// 2. Every mobile callback will "fail closed" to web flow

     

       520
       520
       +
       		// 3. Mobile sign-in silently breaks with no indication

     

       521
       521
       +
       		// Failing loudly here lets the user retry rather than being confused

     

       522
       522
       +
       		// about why they're getting a web flow instead of mobile.

     

       523
       523
       +
       		if err := w.mobileStore.SaveMobileOAuthData(ctx, info.State, mobileData); err != nil {

     

       524
       524
       +
       			slog.Error("failed to save mobile CSRF data - mobile login will fail",

     

       525
       525
       +
       				"state", info.State, "error", err)

     

       526
       526
       +
       			return fmt.Errorf("failed to save mobile OAuth data: %w", err)

     

       527
       527
       +
       		}

     

       528
       528
       +
       	}

     

       529
       529
       +
       

     

       530
       530
       +
       	return nil

     

       531
       531
       +
       }

     

       532
       532
       +
       

     

       533
       533
       +
       // GetMobileOAuthData implements MobileOAuthStore interface by delegating to underlying store

     

       534
       534
       +
       func (w *MobileAwareStoreWrapper) GetMobileOAuthData(ctx context.Context, state string) (*MobileOAuthData, error) {

     

       535
       535
       +
       	if w.mobileStore != nil {

     

       536
       536
       +
       		return w.mobileStore.GetMobileOAuthData(ctx, state)

     

       537
       537
       +
       	}

     

       538
       538
       +
       	return nil, nil

     

       539
       539
       +
       }

     

       540
       540
       +
       

     

       541
       541
       +
       // SaveMobileOAuthData implements MobileOAuthStore interface by delegating to underlying store

     

       542
       542
       +
       func (w *MobileAwareStoreWrapper) SaveMobileOAuthData(ctx context.Context, state string, data MobileOAuthData) error {

     

       543
       543
       +
       	if w.mobileStore != nil {

     

       544
       544
       +
       		return w.mobileStore.SaveMobileOAuthData(ctx, state, data)

     

       545
       545
       +
       	}

     

       546
       546
       +
       	return nil

     

       547
       547
       +
       }

     

       548
       548
       +
       

     

       549
       549
       +
       // UnwrapPostgresStore returns the underlying PostgresOAuthStore if present.

     

       550
       550
       +
       // This is useful for accessing cleanup methods that aren't part of the interface.

     

       551
       551
       +
       func (w *MobileAwareStoreWrapper) UnwrapPostgresStore() *PostgresOAuthStore {

     

       552
       552
       +
       	if ps, ok := w.ClientAuthStore.(*PostgresOAuthStore); ok {

     

       553
       553
       +
       		return ps

     

       554
       554
       +
       	}

     

       555
       555
       +
       	return nil

     

       556
       556
       +
       }

     

       557
       557
       +
       

     

       558
       558
       +
       // SaveMobileOAuthData stores mobile CSRF data tied to an OAuth state

     

       559
       559
       +
       // This ties the CSRF token to the OAuth flow via the state parameter,

     

       560
       560
       +
       // which comes back through the OAuth response for server-side validation.

     

       561
       561
       +
       func (s *PostgresOAuthStore) SaveMobileOAuthData(ctx context.Context, state string, data MobileOAuthData) error {

     

       562
       562
       +
       	query := `

     

       563
       563
       +
       		UPDATE oauth_requests

     

       564
       564
       +
       		SET mobile_csrf_token = $2, mobile_redirect_uri = $3

     

       565
       565
       +
       		WHERE state = $1

     

       566
       566
       +
       	`

     

       567
       567
       +
       

     

       568
       568
       +
       	result, err := s.db.ExecContext(ctx, query, state, data.CSRFToken, data.RedirectURI)

     

       569
       569
       +
       	if err != nil {

     

       570
       570
       +
       		return fmt.Errorf("failed to save mobile OAuth data: %w", err)

     

       571
       571
       +
       	}

     

       572
       572
       +
       

     

       573
       573
       +
       	rows, err := result.RowsAffected()

     

       574
       574
       +
       	if err != nil {

     

       575
       575
       +
       		return fmt.Errorf("failed to get rows affected: %w", err)

     

       576
       576
       +
       	}

     

       577
       577
       +
       

     

       578
       578
       +
       	if rows == 0 {

     

       579
       579
       +
       		return ErrAuthRequestNotFound

     

       580
       580
       +
       	}

     

       581
       581
       +
       

     

       582
       582
       +
       	return nil

     

       583
       583
       +
       }

     

       584
       584
       +
       

     

       585
       585
       +
       // GetMobileOAuthData retrieves mobile CSRF data by OAuth state

     

       586
       586
       +
       // This is called during callback to compare the server-side CSRF token

     

       587
       587
       +
       // (retrieved by state from the OAuth response) against the cookie CSRF.

     

       588
       588
       +
       func (s *PostgresOAuthStore) GetMobileOAuthData(ctx context.Context, state string) (*MobileOAuthData, error) {

     

       589
       589
       +
       	query := `

     

       590
       590
       +
       		SELECT mobile_csrf_token, mobile_redirect_uri

     

       591
       591
       +
       		FROM oauth_requests

     

       592
       592
       +
       		WHERE state = $1

     

       593
       593
       +
       	`

     

       594
       594
       +
       

     

       595
       595
       +
       	var csrfToken, redirectURI sql.NullString

     

       596
       596
       +
       	err := s.db.QueryRowContext(ctx, query, state).Scan(&csrfToken, &redirectURI)

     

       597
       597
       +
       

     

       598
       598
       +
       	if err == sql.ErrNoRows {

     

       599
       599
       +
       		return nil, ErrAuthRequestNotFound

     

       600
       600
       +
       	}

     

       601
       601
       +
       	if err != nil {

     

       602
       602
       +
       		return nil, fmt.Errorf("failed to get mobile OAuth data: %w", err)

     

       603
       603
       +
       	}

     

       604
       604
       +
       

     

       605
       605
       +
       	// Return nil if no mobile data was stored (this was a web flow)

     

       606
       606
       +
       	if !csrfToken.Valid {

     

       607
       607
       +
       		return nil, nil

     

       608
       608
       +
       	}

     

       609
       609
       +
       

     

       610
       610
       +
       	return &MobileOAuthData{

     

       611
       611
       +
       		CSRFToken:   csrfToken.String,

     

       612
       612
       +
       		RedirectURI: redirectURI.String,

     

       613
       613
       +
       	}, nil

     

       614
       614
       +
       }

+522

internal/atproto/oauth/store_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"database/sql"

     

       6
       6
       +
       	"os"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       11
       11
       +
       	_ "github.com/lib/pq"

     

       12
       12
       +
       	"github.com/pressly/goose/v3"

     

       13
       13
       +
       	"github.com/stretchr/testify/assert"

     

       14
       14
       +
       	"github.com/stretchr/testify/require"

     

       15
       15
       +
       )

     

       16
       16
       +
       

     

       17
       17
       +
       // setupTestDB creates a test database connection and runs migrations

     

       18
       18
       +
       func setupTestDB(t *testing.T) *sql.DB {

     

       19
       19
       +
       	dsn := os.Getenv("TEST_DATABASE_URL")

     

       20
       20
       +
       	if dsn == "" {

     

       21
       21
       +
       		dsn = "postgres://test_user:test_password@localhost:5434/coves_test?sslmode=disable"

     

       22
       22
       +
       	}

     

       23
       23
       +
       

     

       24
       24
       +
       	db, err := sql.Open("postgres", dsn)

     

       25
       25
       +
       	require.NoError(t, err, "Failed to connect to test database")

     

       26
       26
       +
       

     

       27
       27
       +
       	// Run migrations

     

       28
       28
       +
       	require.NoError(t, goose.Up(db, "../../db/migrations"), "Failed to run migrations")

     

       29
       29
       +
       

     

       30
       30
       +
       	return db

     

       31
       31
       +
       }

     

       32
       32
       +
       

     

       33
       33
       +
       // cleanupOAuth removes all test OAuth data from the database

     

       34
       34
       +
       func cleanupOAuth(t *testing.T, db *sql.DB) {

     

       35
       35
       +
       	_, err := db.Exec("DELETE FROM oauth_sessions WHERE did LIKE 'did:plc:test%'")

     

       36
       36
       +
       	require.NoError(t, err, "Failed to cleanup oauth_sessions")

     

       37
       37
       +
       

     

       38
       38
       +
       	_, err = db.Exec("DELETE FROM oauth_requests WHERE state LIKE 'test%'")

     

       39
       39
       +
       	require.NoError(t, err, "Failed to cleanup oauth_requests")

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       func TestPostgresOAuthStore_SaveAndGetSession(t *testing.T) {

     

       43
       43
       +
       	db := setupTestDB(t)

     

       44
       44
       +
       	defer func() { _ = db.Close() }()

     

       45
       45
       +
       	defer cleanupOAuth(t, db)

     

       46
       46
       +
       

     

       47
       47
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       48
       48
       +
       	ctx := context.Background()

     

       49
       49
       +
       

     

       50
       50
       +
       	did, err := syntax.ParseDID("did:plc:test123abc")

     

       51
       51
       +
       	require.NoError(t, err)

     

       52
       52
       +
       

     

       53
       53
       +
       	session := oauth.ClientSessionData{

     

       54
       54
       +
       		AccountDID:                   did,

     

       55
       55
       +
       		SessionID:                    "session123",

     

       56
       56
       +
       		HostURL:                      "https://pds.example.com",

     

       57
       57
       +
       		AuthServerURL:                "https://auth.example.com",

     

       58
       58
       +
       		AuthServerTokenEndpoint:      "https://auth.example.com/oauth/token",

     

       59
       59
       +
       		AuthServerRevocationEndpoint: "https://auth.example.com/oauth/revoke",

     

       60
       60
       +
       		Scopes:                       []string{"atproto"},

     

       61
       61
       +
       		AccessToken:                  "at_test_token_abc123",

     

       62
       62
       +
       		RefreshToken:                 "rt_test_token_xyz789",

     

       63
       63
       +
       		DPoPAuthServerNonce:          "nonce_auth_123",

     

       64
       64
       +
       		DPoPHostNonce:                "nonce_host_456",

     

       65
       65
       +
       		DPoPPrivateKeyMultibase:      "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       66
       66
       +
       	}

     

       67
       67
       +
       

     

       68
       68
       +
       	// Save session

     

       69
       69
       +
       	err = store.SaveSession(ctx, session)

     

       70
       70
       +
       	assert.NoError(t, err)

     

       71
       71
       +
       

     

       72
       72
       +
       	// Retrieve session

     

       73
       73
       +
       	retrieved, err := store.GetSession(ctx, did, "session123")

     

       74
       74
       +
       	assert.NoError(t, err)

     

       75
       75
       +
       	assert.NotNil(t, retrieved)

     

       76
       76
       +
       	assert.Equal(t, session.AccountDID.String(), retrieved.AccountDID.String())

     

       77
       77
       +
       	assert.Equal(t, session.SessionID, retrieved.SessionID)

     

       78
       78
       +
       	assert.Equal(t, session.HostURL, retrieved.HostURL)

     

       79
       79
       +
       	assert.Equal(t, session.AuthServerURL, retrieved.AuthServerURL)

     

       80
       80
       +
       	assert.Equal(t, session.AuthServerTokenEndpoint, retrieved.AuthServerTokenEndpoint)

     

       81
       81
       +
       	assert.Equal(t, session.AccessToken, retrieved.AccessToken)

     

       82
       82
       +
       	assert.Equal(t, session.RefreshToken, retrieved.RefreshToken)

     

       83
       83
       +
       	assert.Equal(t, session.DPoPAuthServerNonce, retrieved.DPoPAuthServerNonce)

     

       84
       84
       +
       	assert.Equal(t, session.DPoPHostNonce, retrieved.DPoPHostNonce)

     

       85
       85
       +
       	assert.Equal(t, session.DPoPPrivateKeyMultibase, retrieved.DPoPPrivateKeyMultibase)

     

       86
       86
       +
       	assert.Equal(t, session.Scopes, retrieved.Scopes)

     

       87
       87
       +
       }

     

       88
       88
       +
       

     

       89
       89
       +
       func TestPostgresOAuthStore_SaveSession_Upsert(t *testing.T) {

     

       90
       90
       +
       	db := setupTestDB(t)

     

       91
       91
       +
       	defer func() { _ = db.Close() }()

     

       92
       92
       +
       	defer cleanupOAuth(t, db)

     

       93
       93
       +
       

     

       94
       94
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       95
       95
       +
       	ctx := context.Background()

     

       96
       96
       +
       

     

       97
       97
       +
       	did, err := syntax.ParseDID("did:plc:testupsert")

     

       98
       98
       +
       	require.NoError(t, err)

     

       99
       99
       +
       

     

       100
       100
       +
       	// Initial session

     

       101
       101
       +
       	session1 := oauth.ClientSessionData{

     

       102
       102
       +
       		AccountDID:              did,

     

       103
       103
       +
       		SessionID:               "session_upsert",

     

       104
       104
       +
       		HostURL:                 "https://pds1.example.com",

     

       105
       105
       +
       		AuthServerURL:           "https://auth1.example.com",

     

       106
       106
       +
       		AuthServerTokenEndpoint: "https://auth1.example.com/oauth/token",

     

       107
       107
       +
       		Scopes:                  []string{"atproto"},

     

       108
       108
       +
       		AccessToken:             "old_access_token",

     

       109
       109
       +
       		RefreshToken:            "old_refresh_token",

     

       110
       110
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       111
       111
       +
       	}

     

       112
       112
       +
       

     

       113
       113
       +
       	err = store.SaveSession(ctx, session1)

     

       114
       114
       +
       	require.NoError(t, err)

     

       115
       115
       +
       

     

       116
       116
       +
       	// Updated session (same DID and session ID)

     

       117
       117
       +
       	session2 := oauth.ClientSessionData{

     

       118
       118
       +
       		AccountDID:              did,

     

       119
       119
       +
       		SessionID:               "session_upsert",

     

       120
       120
       +
       		HostURL:                 "https://pds2.example.com",

     

       121
       121
       +
       		AuthServerURL:           "https://auth2.example.com",

     

       122
       122
       +
       		AuthServerTokenEndpoint: "https://auth2.example.com/oauth/token",

     

       123
       123
       +
       		Scopes:                  []string{"atproto", "transition:generic"},

     

       124
       124
       +
       		AccessToken:             "new_access_token",

     

       125
       125
       +
       		RefreshToken:            "new_refresh_token",

     

       126
       126
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktX",

     

       127
       127
       +
       	}

     

       128
       128
       +
       

     

       129
       129
       +
       	// Save again - should update

     

       130
       130
       +
       	err = store.SaveSession(ctx, session2)

     

       131
       131
       +
       	assert.NoError(t, err)

     

       132
       132
       +
       

     

       133
       133
       +
       	// Retrieve should get updated values

     

       134
       134
       +
       	retrieved, err := store.GetSession(ctx, did, "session_upsert")

     

       135
       135
       +
       	assert.NoError(t, err)

     

       136
       136
       +
       	assert.Equal(t, "new_access_token", retrieved.AccessToken)

     

       137
       137
       +
       	assert.Equal(t, "new_refresh_token", retrieved.RefreshToken)

     

       138
       138
       +
       	assert.Equal(t, "https://pds2.example.com", retrieved.HostURL)

     

       139
       139
       +
       	assert.Equal(t, []string{"atproto", "transition:generic"}, retrieved.Scopes)

     

       140
       140
       +
       }

     

       141
       141
       +
       

     

       142
       142
       +
       func TestPostgresOAuthStore_GetSession_NotFound(t *testing.T) {

     

       143
       143
       +
       	db := setupTestDB(t)

     

       144
       144
       +
       	defer func() { _ = db.Close() }()

     

       145
       145
       +
       

     

       146
       146
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       147
       147
       +
       	ctx := context.Background()

     

       148
       148
       +
       

     

       149
       149
       +
       	did, err := syntax.ParseDID("did:plc:nonexistent")

     

       150
       150
       +
       	require.NoError(t, err)

     

       151
       151
       +
       

     

       152
       152
       +
       	_, err = store.GetSession(ctx, did, "nonexistent_session")

     

       153
       153
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       154
       154
       +
       }

     

       155
       155
       +
       

     

       156
       156
       +
       func TestPostgresOAuthStore_DeleteSession(t *testing.T) {

     

       157
       157
       +
       	db := setupTestDB(t)

     

       158
       158
       +
       	defer func() { _ = db.Close() }()

     

       159
       159
       +
       	defer cleanupOAuth(t, db)

     

       160
       160
       +
       

     

       161
       161
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       162
       162
       +
       	ctx := context.Background()

     

       163
       163
       +
       

     

       164
       164
       +
       	did, err := syntax.ParseDID("did:plc:testdelete")

     

       165
       165
       +
       	require.NoError(t, err)

     

       166
       166
       +
       

     

       167
       167
       +
       	session := oauth.ClientSessionData{

     

       168
       168
       +
       		AccountDID:              did,

     

       169
       169
       +
       		SessionID:               "session_delete",

     

       170
       170
       +
       		HostURL:                 "https://pds.example.com",

     

       171
       171
       +
       		AuthServerURL:           "https://auth.example.com",

     

       172
       172
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       173
       173
       +
       		Scopes:                  []string{"atproto"},

     

       174
       174
       +
       		AccessToken:             "test_token",

     

       175
       175
       +
       		RefreshToken:            "test_refresh",

     

       176
       176
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       177
       177
       +
       	}

     

       178
       178
       +
       

     

       179
       179
       +
       	// Save session

     

       180
       180
       +
       	err = store.SaveSession(ctx, session)

     

       181
       181
       +
       	require.NoError(t, err)

     

       182
       182
       +
       

     

       183
       183
       +
       	// Delete session

     

       184
       184
       +
       	err = store.DeleteSession(ctx, did, "session_delete")

     

       185
       185
       +
       	assert.NoError(t, err)

     

       186
       186
       +
       

     

       187
       187
       +
       	// Verify session is gone

     

       188
       188
       +
       	_, err = store.GetSession(ctx, did, "session_delete")

     

       189
       189
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       190
       190
       +
       }

     

       191
       191
       +
       

     

       192
       192
       +
       func TestPostgresOAuthStore_DeleteSession_NotFound(t *testing.T) {

     

       193
       193
       +
       	db := setupTestDB(t)

     

       194
       194
       +
       	defer func() { _ = db.Close() }()

     

       195
       195
       +
       

     

       196
       196
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       197
       197
       +
       	ctx := context.Background()

     

       198
       198
       +
       

     

       199
       199
       +
       	did, err := syntax.ParseDID("did:plc:nonexistent")

     

       200
       200
       +
       	require.NoError(t, err)

     

       201
       201
       +
       

     

       202
       202
       +
       	err = store.DeleteSession(ctx, did, "nonexistent_session")

     

       203
       203
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       204
       204
       +
       }

     

       205
       205
       +
       

     

       206
       206
       +
       func TestPostgresOAuthStore_SaveAndGetAuthRequestInfo(t *testing.T) {

     

       207
       207
       +
       	db := setupTestDB(t)

     

       208
       208
       +
       	defer func() { _ = db.Close() }()

     

       209
       209
       +
       	defer cleanupOAuth(t, db)

     

       210
       210
       +
       

     

       211
       211
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       212
       212
       +
       	ctx := context.Background()

     

       213
       213
       +
       

     

       214
       214
       +
       	did, err := syntax.ParseDID("did:plc:testrequest")

     

       215
       215
       +
       	require.NoError(t, err)

     

       216
       216
       +
       

     

       217
       217
       +
       	info := oauth.AuthRequestData{

     

       218
       218
       +
       		State:                        "test_state_abc123",

     

       219
       219
       +
       		AuthServerURL:                "https://auth.example.com",

     

       220
       220
       +
       		AccountDID:                   &did,

     

       221
       221
       +
       		Scopes:                       []string{"atproto"},

     

       222
       222
       +
       		RequestURI:                   "urn:ietf:params:oauth:request_uri:abc123",

     

       223
       223
       +
       		AuthServerTokenEndpoint:      "https://auth.example.com/oauth/token",

     

       224
       224
       +
       		AuthServerRevocationEndpoint: "https://auth.example.com/oauth/revoke",

     

       225
       225
       +
       		PKCEVerifier:                 "verifier_xyz789",

     

       226
       226
       +
       		DPoPAuthServerNonce:          "nonce_abc",

     

       227
       227
       +
       		DPoPPrivateKeyMultibase:      "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       228
       228
       +
       	}

     

       229
       229
       +
       

     

       230
       230
       +
       	// Save auth request info

     

       231
       231
       +
       	err = store.SaveAuthRequestInfo(ctx, info)

     

       232
       232
       +
       	assert.NoError(t, err)

     

       233
       233
       +
       

     

       234
       234
       +
       	// Retrieve auth request info

     

       235
       235
       +
       	retrieved, err := store.GetAuthRequestInfo(ctx, "test_state_abc123")

     

       236
       236
       +
       	assert.NoError(t, err)

     

       237
       237
       +
       	assert.NotNil(t, retrieved)

     

       238
       238
       +
       	assert.Equal(t, info.State, retrieved.State)

     

       239
       239
       +
       	assert.Equal(t, info.AuthServerURL, retrieved.AuthServerURL)

     

       240
       240
       +
       	assert.NotNil(t, retrieved.AccountDID)

     

       241
       241
       +
       	assert.Equal(t, info.AccountDID.String(), retrieved.AccountDID.String())

     

       242
       242
       +
       	assert.Equal(t, info.Scopes, retrieved.Scopes)

     

       243
       243
       +
       	assert.Equal(t, info.RequestURI, retrieved.RequestURI)

     

       244
       244
       +
       	assert.Equal(t, info.AuthServerTokenEndpoint, retrieved.AuthServerTokenEndpoint)

     

       245
       245
       +
       	assert.Equal(t, info.PKCEVerifier, retrieved.PKCEVerifier)

     

       246
       246
       +
       	assert.Equal(t, info.DPoPAuthServerNonce, retrieved.DPoPAuthServerNonce)

     

       247
       247
       +
       	assert.Equal(t, info.DPoPPrivateKeyMultibase, retrieved.DPoPPrivateKeyMultibase)

     

       248
       248
       +
       }

     

       249
       249
       +
       

     

       250
       250
       +
       func TestPostgresOAuthStore_SaveAuthRequestInfo_NoDID(t *testing.T) {

     

       251
       251
       +
       	db := setupTestDB(t)

     

       252
       252
       +
       	defer func() { _ = db.Close() }()

     

       253
       253
       +
       	defer cleanupOAuth(t, db)

     

       254
       254
       +
       

     

       255
       255
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       256
       256
       +
       	ctx := context.Background()

     

       257
       257
       +
       

     

       258
       258
       +
       	info := oauth.AuthRequestData{

     

       259
       259
       +
       		State:                   "test_state_nodid",

     

       260
       260
       +
       		AuthServerURL:           "https://auth.example.com",

     

       261
       261
       +
       		AccountDID:              nil, // No DID provided

     

       262
       262
       +
       		Scopes:                  []string{"atproto"},

     

       263
       263
       +
       		RequestURI:              "urn:ietf:params:oauth:request_uri:nodid",

     

       264
       264
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       265
       265
       +
       		PKCEVerifier:            "verifier_nodid",

     

       266
       266
       +
       		DPoPAuthServerNonce:     "nonce_nodid",

     

       267
       267
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       268
       268
       +
       	}

     

       269
       269
       +
       

     

       270
       270
       +
       	// Save auth request info without DID

     

       271
       271
       +
       	err := store.SaveAuthRequestInfo(ctx, info)

     

       272
       272
       +
       	assert.NoError(t, err)

     

       273
       273
       +
       

     

       274
       274
       +
       	// Retrieve and verify DID is nil

     

       275
       275
       +
       	retrieved, err := store.GetAuthRequestInfo(ctx, "test_state_nodid")

     

       276
       276
       +
       	assert.NoError(t, err)

     

       277
       277
       +
       	assert.Nil(t, retrieved.AccountDID)

     

       278
       278
       +
       	assert.Equal(t, info.State, retrieved.State)

     

       279
       279
       +
       }

     

       280
       280
       +
       

     

       281
       281
       +
       func TestPostgresOAuthStore_GetAuthRequestInfo_NotFound(t *testing.T) {

     

       282
       282
       +
       	db := setupTestDB(t)

     

       283
       283
       +
       	defer func() { _ = db.Close() }()

     

       284
       284
       +
       

     

       285
       285
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       286
       286
       +
       	ctx := context.Background()

     

       287
       287
       +
       

     

       288
       288
       +
       	_, err := store.GetAuthRequestInfo(ctx, "nonexistent_state")

     

       289
       289
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       290
       290
       +
       }

     

       291
       291
       +
       

     

       292
       292
       +
       func TestPostgresOAuthStore_DeleteAuthRequestInfo(t *testing.T) {

     

       293
       293
       +
       	db := setupTestDB(t)

     

       294
       294
       +
       	defer func() { _ = db.Close() }()

     

       295
       295
       +
       	defer cleanupOAuth(t, db)

     

       296
       296
       +
       

     

       297
       297
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       298
       298
       +
       	ctx := context.Background()

     

       299
       299
       +
       

     

       300
       300
       +
       	info := oauth.AuthRequestData{

     

       301
       301
       +
       		State:                   "test_state_delete",

     

       302
       302
       +
       		AuthServerURL:           "https://auth.example.com",

     

       303
       303
       +
       		Scopes:                  []string{"atproto"},

     

       304
       304
       +
       		RequestURI:              "urn:ietf:params:oauth:request_uri:delete",

     

       305
       305
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       306
       306
       +
       		PKCEVerifier:            "verifier_delete",

     

       307
       307
       +
       		DPoPAuthServerNonce:     "nonce_delete",

     

       308
       308
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       309
       309
       +
       	}

     

       310
       310
       +
       

     

       311
       311
       +
       	// Save auth request info

     

       312
       312
       +
       	err := store.SaveAuthRequestInfo(ctx, info)

     

       313
       313
       +
       	require.NoError(t, err)

     

       314
       314
       +
       

     

       315
       315
       +
       	// Delete auth request info

     

       316
       316
       +
       	err = store.DeleteAuthRequestInfo(ctx, "test_state_delete")

     

       317
       317
       +
       	assert.NoError(t, err)

     

       318
       318
       +
       

     

       319
       319
       +
       	// Verify it's gone

     

       320
       320
       +
       	_, err = store.GetAuthRequestInfo(ctx, "test_state_delete")

     

       321
       321
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       322
       322
       +
       }

     

       323
       323
       +
       

     

       324
       324
       +
       func TestPostgresOAuthStore_DeleteAuthRequestInfo_NotFound(t *testing.T) {

     

       325
       325
       +
       	db := setupTestDB(t)

     

       326
       326
       +
       	defer func() { _ = db.Close() }()

     

       327
       327
       +
       

     

       328
       328
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       329
       329
       +
       	ctx := context.Background()

     

       330
       330
       +
       

     

       331
       331
       +
       	err := store.DeleteAuthRequestInfo(ctx, "nonexistent_state")

     

       332
       332
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       333
       333
       +
       }

     

       334
       334
       +
       

     

       335
       335
       +
       func TestPostgresOAuthStore_CleanupExpiredSessions(t *testing.T) {

     

       336
       336
       +
       	db := setupTestDB(t)

     

       337
       337
       +
       	defer func() { _ = db.Close() }()

     

       338
       338
       +
       	defer cleanupOAuth(t, db)

     

       339
       339
       +
       

     

       340
       340
       +
       	storeInterface := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       341
       341
       +
       	store, ok := storeInterface.(*PostgresOAuthStore)

     

       342
       342
       +
       	require.True(t, ok, "store should be *PostgresOAuthStore")

     

       343
       343
       +
       	ctx := context.Background()

     

       344
       344
       +
       

     

       345
       345
       +
       	did1, err := syntax.ParseDID("did:plc:testexpired1")

     

       346
       346
       +
       	require.NoError(t, err)

     

       347
       347
       +
       	did2, err := syntax.ParseDID("did:plc:testexpired2")

     

       348
       348
       +
       	require.NoError(t, err)

     

       349
       349
       +
       

     

       350
       350
       +
       	// Create an expired session (manually insert with past expiration)

     

       351
       351
       +
       	_, err = db.ExecContext(ctx, `

     

       352
       352
       +
       		INSERT INTO oauth_sessions (

     

       353
       353
       +
       			did, session_id, handle, pds_url, host_url,

     

       354
       354
       +
       			access_token, refresh_token,

     

       355
       355
       +
       			dpop_private_key_multibase, auth_server_iss,

     

       356
       356
       +
       			auth_server_token_endpoint, scopes,

     

       357
       357
       +
       			expires_at, created_at

     

       358
       358
       +
       		) VALUES (

     

       359
       359
       +
       			$1, $2, $3, $4, $5,

     

       360
       360
       +
       			$6, $7,

     

       361
       361
       +
       			$8, $9,

     

       362
       362
       +
       			$10, $11,

     

       363
       363
       +
       			NOW() - INTERVAL '1 day', NOW()

     

       364
       364
       +
       		)

     

       365
       365
       +
       	`, did1.String(), "expired_session", "test.handle", "https://pds.example.com", "https://pds.example.com",

     

       366
       366
       +
       		"expired_token", "expired_refresh",

     

       367
       367
       +
       		"z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH", "https://auth.example.com",

     

       368
       368
       +
       		"https://auth.example.com/oauth/token", `{"atproto"}`)

     

       369
       369
       +
       	require.NoError(t, err)

     

       370
       370
       +
       

     

       371
       371
       +
       	// Create a valid session

     

       372
       372
       +
       	validSession := oauth.ClientSessionData{

     

       373
       373
       +
       		AccountDID:              did2,

     

       374
       374
       +
       		SessionID:               "valid_session",

     

       375
       375
       +
       		HostURL:                 "https://pds.example.com",

     

       376
       376
       +
       		AuthServerURL:           "https://auth.example.com",

     

       377
       377
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       378
       378
       +
       		Scopes:                  []string{"atproto"},

     

       379
       379
       +
       		AccessToken:             "valid_token",

     

       380
       380
       +
       		RefreshToken:            "valid_refresh",

     

       381
       381
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       382
       382
       +
       	}

     

       383
       383
       +
       	err = store.SaveSession(ctx, validSession)

     

       384
       384
       +
       	require.NoError(t, err)

     

       385
       385
       +
       

     

       386
       386
       +
       	// Cleanup expired sessions

     

       387
       387
       +
       	count, err := store.CleanupExpiredSessions(ctx)

     

       388
       388
       +
       	assert.NoError(t, err)

     

       389
       389
       +
       	assert.Equal(t, int64(1), count, "Should delete 1 expired session")

     

       390
       390
       +
       

     

       391
       391
       +
       	// Verify expired session is gone

     

       392
       392
       +
       	_, err = store.GetSession(ctx, did1, "expired_session")

     

       393
       393
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       394
       394
       +
       

     

       395
       395
       +
       	// Verify valid session still exists

     

       396
       396
       +
       	_, err = store.GetSession(ctx, did2, "valid_session")

     

       397
       397
       +
       	assert.NoError(t, err)

     

       398
       398
       +
       }

     

       399
       399
       +
       

     

       400
       400
       +
       func TestPostgresOAuthStore_CleanupExpiredAuthRequests(t *testing.T) {

     

       401
       401
       +
       	db := setupTestDB(t)

     

       402
       402
       +
       	defer func() { _ = db.Close() }()

     

       403
       403
       +
       	defer cleanupOAuth(t, db)

     

       404
       404
       +
       

     

       405
       405
       +
       	storeInterface := NewPostgresOAuthStore(db, 0)

     

       406
       406
       +
       	pgStore, ok := storeInterface.(*PostgresOAuthStore)

     

       407
       407
       +
       	require.True(t, ok, "store should be *PostgresOAuthStore")

     

       408
       408
       +
       	store := oauth.ClientAuthStore(pgStore)

     

       409
       409
       +
       	ctx := context.Background()

     

       410
       410
       +
       

     

       411
       411
       +
       	// Create an old auth request (manually insert with old timestamp)

     

       412
       412
       +
       	_, err := db.ExecContext(ctx, `

     

       413
       413
       +
       		INSERT INTO oauth_requests (

     

       414
       414
       +
       			state, did, handle, pds_url, pkce_verifier,

     

       415
       415
       +
       			dpop_private_key_multibase, dpop_authserver_nonce,

     

       416
       416
       +
       			auth_server_iss, request_uri,

     

       417
       417
       +
       			auth_server_token_endpoint, scopes,

     

       418
       418
       +
       			created_at

     

       419
       419
       +
       		) VALUES (

     

       420
       420
       +
       			$1, $2, $3, $4, $5,

     

       421
       421
       +
       			$6, $7,

     

       422
       422
       +
       			$8, $9,

     

       423
       423
       +
       			$10, $11,

     

       424
       424
       +
       			NOW() - INTERVAL '1 hour'

     

       425
       425
       +
       		)

     

       426
       426
       +
       	`, "test_old_state", "did:plc:testold", "test.handle", "https://pds.example.com",

     

       427
       427
       +
       		"old_verifier", "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       428
       428
       +
       		"nonce_old", "https://auth.example.com", "urn:ietf:params:oauth:request_uri:old",

     

       429
       429
       +
       		"https://auth.example.com/oauth/token", `{"atproto"}`)

     

       430
       430
       +
       	require.NoError(t, err)

     

       431
       431
       +
       

     

       432
       432
       +
       	// Create a recent auth request

     

       433
       433
       +
       	recentInfo := oauth.AuthRequestData{

     

       434
       434
       +
       		State:                   "test_recent_state",

     

       435
       435
       +
       		AuthServerURL:           "https://auth.example.com",

     

       436
       436
       +
       		Scopes:                  []string{"atproto"},

     

       437
       437
       +
       		RequestURI:              "urn:ietf:params:oauth:request_uri:recent",

     

       438
       438
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       439
       439
       +
       		PKCEVerifier:            "recent_verifier",

     

       440
       440
       +
       		DPoPAuthServerNonce:     "nonce_recent",

     

       441
       441
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       442
       442
       +
       	}

     

       443
       443
       +
       	err = store.SaveAuthRequestInfo(ctx, recentInfo)

     

       444
       444
       +
       	require.NoError(t, err)

     

       445
       445
       +
       

     

       446
       446
       +
       	// Cleanup expired auth requests (older than 30 minutes)

     

       447
       447
       +
       	count, err := pgStore.CleanupExpiredAuthRequests(ctx)

     

       448
       448
       +
       	assert.NoError(t, err)

     

       449
       449
       +
       	assert.Equal(t, int64(1), count, "Should delete 1 expired auth request")

     

       450
       450
       +
       

     

       451
       451
       +
       	// Verify old request is gone

     

       452
       452
       +
       	_, err = store.GetAuthRequestInfo(ctx, "test_old_state")

     

       453
       453
       +
       	assert.ErrorIs(t, err, ErrAuthRequestNotFound)

     

       454
       454
       +
       

     

       455
       455
       +
       	// Verify recent request still exists

     

       456
       456
       +
       	_, err = store.GetAuthRequestInfo(ctx, "test_recent_state")

     

       457
       457
       +
       	assert.NoError(t, err)

     

       458
       458
       +
       }

     

       459
       459
       +
       

     

       460
       460
       +
       func TestPostgresOAuthStore_MultipleSessions(t *testing.T) {

     

       461
       461
       +
       	db := setupTestDB(t)

     

       462
       462
       +
       	defer func() { _ = db.Close() }()

     

       463
       463
       +
       	defer cleanupOAuth(t, db)

     

       464
       464
       +
       

     

       465
       465
       +
       	store := NewPostgresOAuthStore(db, 0) // Use default TTL

     

       466
       466
       +
       	ctx := context.Background()

     

       467
       467
       +
       

     

       468
       468
       +
       	did, err := syntax.ParseDID("did:plc:testmulti")

     

       469
       469
       +
       	require.NoError(t, err)

     

       470
       470
       +
       

     

       471
       471
       +
       	// Create multiple sessions for the same DID

     

       472
       472
       +
       	session1 := oauth.ClientSessionData{

     

       473
       473
       +
       		AccountDID:              did,

     

       474
       474
       +
       		SessionID:               "browser1",

     

       475
       475
       +
       		HostURL:                 "https://pds.example.com",

     

       476
       476
       +
       		AuthServerURL:           "https://auth.example.com",

     

       477
       477
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       478
       478
       +
       		Scopes:                  []string{"atproto"},

     

       479
       479
       +
       		AccessToken:             "token_browser1",

     

       480
       480
       +
       		RefreshToken:            "refresh_browser1",

     

       481
       481
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH",

     

       482
       482
       +
       	}

     

       483
       483
       +
       

     

       484
       484
       +
       	session2 := oauth.ClientSessionData{

     

       485
       485
       +
       		AccountDID:              did,

     

       486
       486
       +
       		SessionID:               "mobile_app",

     

       487
       487
       +
       		HostURL:                 "https://pds.example.com",

     

       488
       488
       +
       		AuthServerURL:           "https://auth.example.com",

     

       489
       489
       +
       		AuthServerTokenEndpoint: "https://auth.example.com/oauth/token",

     

       490
       490
       +
       		Scopes:                  []string{"atproto"},

     

       491
       491
       +
       		AccessToken:             "token_mobile",

     

       492
       492
       +
       		RefreshToken:            "refresh_mobile",

     

       493
       493
       +
       		DPoPPrivateKeyMultibase: "z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktX",

     

       494
       494
       +
       	}

     

       495
       495
       +
       

     

       496
       496
       +
       	// Save both sessions

     

       497
       497
       +
       	err = store.SaveSession(ctx, session1)

     

       498
       498
       +
       	require.NoError(t, err)

     

       499
       499
       +
       	err = store.SaveSession(ctx, session2)

     

       500
       500
       +
       	require.NoError(t, err)

     

       501
       501
       +
       

     

       502
       502
       +
       	// Retrieve both sessions

     

       503
       503
       +
       	retrieved1, err := store.GetSession(ctx, did, "browser1")

     

       504
       504
       +
       	assert.NoError(t, err)

     

       505
       505
       +
       	assert.Equal(t, "token_browser1", retrieved1.AccessToken)

     

       506
       506
       +
       

     

       507
       507
       +
       	retrieved2, err := store.GetSession(ctx, did, "mobile_app")

     

       508
       508
       +
       	assert.NoError(t, err)

     

       509
       509
       +
       	assert.Equal(t, "token_mobile", retrieved2.AccessToken)

     

       510
       510
       +
       

     

       511
       511
       +
       	// Delete one session

     

       512
       512
       +
       	err = store.DeleteSession(ctx, did, "browser1")

     

       513
       513
       +
       	assert.NoError(t, err)

     

       514
       514
       +
       

     

       515
       515
       +
       	// Verify only browser1 is deleted

     

       516
       516
       +
       	_, err = store.GetSession(ctx, did, "browser1")

     

       517
       517
       +
       	assert.ErrorIs(t, err, ErrSessionNotFound)

     

       518
       518
       +
       

     

       519
       519
       +
       	// mobile_app should still exist

     

       520
       520
       +
       	_, err = store.GetSession(ctx, did, "mobile_app")

     

       521
       521
       +
       	assert.NoError(t, err)

     

       522
       522
       +
       }

+99

internal/atproto/oauth/transport.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"net"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // ssrfSafeTransport wraps http.Transport to prevent SSRF attacks

     

       11
       11
       +
       type ssrfSafeTransport struct {

     

       12
       12
       +
       	base         *http.Transport

     

       13
       13
       +
       	allowPrivate bool // For dev/testing only

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // isPrivateIP checks if an IP is in a private/reserved range

     

       17
       17
       +
       func isPrivateIP(ip net.IP) bool {

     

       18
       18
       +
       	if ip == nil {

     

       19
       19
       +
       		return false

     

       20
       20
       +
       	}

     

       21
       21
       +
       

     

       22
       22
       +
       	// Check for loopback

     

       23
       23
       +
       	if ip.IsLoopback() {

     

       24
       24
       +
       		return true

     

       25
       25
       +
       	}

     

       26
       26
       +
       

     

       27
       27
       +
       	// Check for link-local

     

       28
       28
       +
       	if ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {

     

       29
       29
       +
       		return true

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	// Check for private ranges

     

       33
       33
       +
       	privateRanges := []string{

     

       34
       34
       +
       		"10.0.0.0/8",

     

       35
       35
       +
       		"172.16.0.0/12",

     

       36
       36
       +
       		"192.168.0.0/16",

     

       37
       37
       +
       		"169.254.0.0/16",

     

       38
       38
       +
       		"::1/128",

     

       39
       39
       +
       		"fc00::/7",

     

       40
       40
       +
       		"fe80::/10",

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	for _, cidr := range privateRanges {

     

       44
       44
       +
       		_, network, err := net.ParseCIDR(cidr)

     

       45
       45
       +
       		if err == nil && network.Contains(ip) {

     

       46
       46
       +
       			return true

     

       47
       47
       +
       		}

     

       48
       48
       +
       	}

     

       49
       49
       +
       

     

       50
       50
       +
       	return false

     

       51
       51
       +
       }

     

       52
       52
       +
       

     

       53
       53
       +
       func (t *ssrfSafeTransport) RoundTrip(req *http.Request) (*http.Response, error) {

     

       54
       54
       +
       	host := req.URL.Hostname()

     

       55
       55
       +
       

     

       56
       56
       +
       	// Resolve hostname to IP

     

       57
       57
       +
       	ips, err := net.LookupIP(host)

     

       58
       58
       +
       	if err != nil {

     

       59
       59
       +
       		return nil, fmt.Errorf("failed to resolve host: %w", err)

     

       60
       60
       +
       	}

     

       61
       61
       +
       

     

       62
       62
       +
       	// Check all resolved IPs

     

       63
       63
       +
       	if !t.allowPrivate {

     

       64
       64
       +
       		for _, ip := range ips {

     

       65
       65
       +
       			if isPrivateIP(ip) {

     

       66
       66
       +
       				return nil, fmt.Errorf("SSRF blocked: %s resolves to private IP %s", host, ip)

     

       67
       67
       +
       			}

     

       68
       68
       +
       		}

     

       69
       69
       +
       	}

     

       70
       70
       +
       

     

       71
       71
       +
       	return t.base.RoundTrip(req)

     

       72
       72
       +
       }

     

       73
       73
       +
       

     

       74
       74
       +
       // NewSSRFSafeHTTPClient creates an HTTP client with SSRF protections

     

       75
       75
       +
       func NewSSRFSafeHTTPClient(allowPrivate bool) *http.Client {

     

       76
       76
       +
       	transport := &ssrfSafeTransport{

     

       77
       77
       +
       		base: &http.Transport{

     

       78
       78
       +
       			DialContext: (&net.Dialer{

     

       79
       79
       +
       				Timeout:   10 * time.Second,

     

       80
       80
       +
       				KeepAlive: 30 * time.Second,

     

       81
       81
       +
       			}).DialContext,

     

       82
       82
       +
       			MaxIdleConns:        100,

     

       83
       83
       +
       			IdleConnTimeout:     90 * time.Second,

     

       84
       84
       +
       			TLSHandshakeTimeout: 10 * time.Second,

     

       85
       85
       +
       		},

     

       86
       86
       +
       		allowPrivate: allowPrivate,

     

       87
       87
       +
       	}

     

       88
       88
       +
       

     

       89
       89
       +
       	return &http.Client{

     

       90
       90
       +
       		Timeout:   15 * time.Second,

     

       91
       91
       +
       		Transport: transport,

     

       92
       92
       +
       		CheckRedirect: func(req *http.Request, via []*http.Request) error {

     

       93
       93
       +
       			if len(via) >= 5 {

     

       94
       94
       +
       				return fmt.Errorf("too many redirects")

     

       95
       95
       +
       			}

     

       96
       96
       +
       			return nil

     

       97
       97
       +
       		},

     

       98
       98
       +
       	}

     

       99
       99
       +
       }

+132

internal/atproto/oauth/transport_test.go

···

       1
       1
       +
       package oauth

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"net"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"testing"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       func TestIsPrivateIP(t *testing.T) {

     

       10
       10
       +
       	tests := []struct {

     

       11
       11
       +
       		name     string

     

       12
       12
       +
       		ip       string

     

       13
       13
       +
       		expected bool

     

       14
       14
       +
       	}{

     

       15
       15
       +
       		// Loopback addresses

     

       16
       16
       +
       		{"IPv4 loopback", "127.0.0.1", true},

     

       17
       17
       +
       		{"IPv6 loopback", "::1", true},

     

       18
       18
       +
       

     

       19
       19
       +
       		// Private IPv4 ranges

     

       20
       20
       +
       		{"Private 10.x.x.x", "10.0.0.1", true},

     

       21
       21
       +
       		{"Private 10.x.x.x edge", "10.255.255.255", true},

     

       22
       22
       +
       		{"Private 172.16.x.x", "172.16.0.1", true},

     

       23
       23
       +
       		{"Private 172.31.x.x edge", "172.31.255.255", true},

     

       24
       24
       +
       		{"Private 192.168.x.x", "192.168.1.1", true},

     

       25
       25
       +
       		{"Private 192.168.x.x edge", "192.168.255.255", true},

     

       26
       26
       +
       

     

       27
       27
       +
       		// Link-local addresses

     

       28
       28
       +
       		{"Link-local IPv4", "169.254.1.1", true},

     

       29
       29
       +
       		{"Link-local IPv6", "fe80::1", true},

     

       30
       30
       +
       

     

       31
       31
       +
       		// IPv6 private ranges

     

       32
       32
       +
       		{"IPv6 unique local fc00", "fc00::1", true},

     

       33
       33
       +
       		{"IPv6 unique local fd00", "fd00::1", true},

     

       34
       34
       +
       

     

       35
       35
       +
       		// Public addresses

     

       36
       36
       +
       		{"Public IP 1.1.1.1", "1.1.1.1", false},

     

       37
       37
       +
       		{"Public IP 8.8.8.8", "8.8.8.8", false},

     

       38
       38
       +
       		{"Public IP 172.15.0.1", "172.15.0.1", false},  // Just before 172.16/12

     

       39
       39
       +
       		{"Public IP 172.32.0.1", "172.32.0.1", false},  // Just after 172.31/12

     

       40
       40
       +
       		{"Public IP 11.0.0.1", "11.0.0.1", false},      // Just after 10/8

     

       41
       41
       +
       		{"Public IPv6", "2001:4860:4860::8888", false}, // Google DNS

     

       42
       42
       +
       	}

     

       43
       43
       +
       

     

       44
       44
       +
       	for _, tt := range tests {

     

       45
       45
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       46
       46
       +
       			ip := net.ParseIP(tt.ip)

     

       47
       47
       +
       			if ip == nil {

     

       48
       48
       +
       				t.Fatalf("Failed to parse IP: %s", tt.ip)

     

       49
       49
       +
       			}

     

       50
       50
       +
       

     

       51
       51
       +
       			result := isPrivateIP(ip)

     

       52
       52
       +
       			if result != tt.expected {

     

       53
       53
       +
       				t.Errorf("isPrivateIP(%s) = %v, expected %v", tt.ip, result, tt.expected)

     

       54
       54
       +
       			}

     

       55
       55
       +
       		})

     

       56
       56
       +
       	}

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       func TestIsPrivateIP_NilIP(t *testing.T) {

     

       60
       60
       +
       	result := isPrivateIP(nil)

     

       61
       61
       +
       	if result != false {

     

       62
       62
       +
       		t.Errorf("isPrivateIP(nil) = %v, expected false", result)

     

       63
       63
       +
       	}

     

       64
       64
       +
       }

     

       65
       65
       +
       

     

       66
       66
       +
       func TestNewSSRFSafeHTTPClient(t *testing.T) {

     

       67
       67
       +
       	tests := []struct {

     

       68
       68
       +
       		name         string

     

       69
       69
       +
       		allowPrivate bool

     

       70
       70
       +
       	}{

     

       71
       71
       +
       		{"Production client (no private IPs)", false},

     

       72
       72
       +
       		{"Development client (allow private IPs)", true},

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	for _, tt := range tests {

     

       76
       76
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       77
       77
       +
       			client := NewSSRFSafeHTTPClient(tt.allowPrivate)

     

       78
       78
       +
       

     

       79
       79
       +
       			if client == nil {

     

       80
       80
       +
       				t.Fatal("NewSSRFSafeHTTPClient returned nil")

     

       81
       81
       +
       			}

     

       82
       82
       +
       

     

       83
       83
       +
       			if client.Timeout == 0 {

     

       84
       84
       +
       				t.Error("Expected timeout to be set")

     

       85
       85
       +
       			}

     

       86
       86
       +
       

     

       87
       87
       +
       			if client.Transport == nil {

     

       88
       88
       +
       				t.Error("Expected transport to be set")

     

       89
       89
       +
       			}

     

       90
       90
       +
       

     

       91
       91
       +
       			transport, ok := client.Transport.(*ssrfSafeTransport)

     

       92
       92
       +
       			if !ok {

     

       93
       93
       +
       				t.Error("Expected ssrfSafeTransport")

     

       94
       94
       +
       			}

     

       95
       95
       +
       

     

       96
       96
       +
       			if transport.allowPrivate != tt.allowPrivate {

     

       97
       97
       +
       				t.Errorf("Expected allowPrivate=%v, got %v", tt.allowPrivate, transport.allowPrivate)

     

       98
       98
       +
       			}

     

       99
       99
       +
       		})

     

       100
       100
       +
       	}

     

       101
       101
       +
       }

     

       102
       102
       +
       

     

       103
       103
       +
       func TestSSRFSafeHTTPClient_RedirectLimit(t *testing.T) {

     

       104
       104
       +
       	client := NewSSRFSafeHTTPClient(false)

     

       105
       105
       +
       

     

       106
       106
       +
       	// Simulate checking redirect limit

     

       107
       107
       +
       	if client.CheckRedirect == nil {

     

       108
       108
       +
       		t.Fatal("Expected CheckRedirect to be set")

     

       109
       109
       +
       	}

     

       110
       110
       +
       

     

       111
       111
       +
       	// Test redirect limit (5 redirects)

     

       112
       112
       +
       	var via []*http.Request

     

       113
       113
       +
       	for i := 0; i < 5; i++ {

     

       114
       114
       +
       		req := &http.Request{}

     

       115
       115
       +
       		via = append(via, req)

     

       116
       116
       +
       	}

     

       117
       117
       +
       

     

       118
       118
       +
       	err := client.CheckRedirect(nil, via)

     

       119
       119
       +
       	if err == nil {

     

       120
       120
       +
       		t.Error("Expected error for too many redirects")

     

       121
       121
       +
       	}

     

       122
       122
       +
       	if err.Error() != "too many redirects" {

     

       123
       123
       +
       		t.Errorf("Expected 'too many redirects' error, got: %v", err)

     

       124
       124
       +
       	}

     

       125
       125
       +
       

     

       126
       126
       +
       	// Test within limit (4 redirects)

     

       127
       127
       +
       	via = via[:4]

     

       128
       128
       +
       	err = client.CheckRedirect(nil, via)

     

       129
       129
       +
       	if err != nil {

     

       130
       130
       +
       		t.Errorf("Expected no error for 4 redirects, got: %v", err)

     

       131
       131
       +
       	}

     

       132
       132
       +
       }

+124

internal/db/migrations/019_update_oauth_for_indigo.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Update OAuth tables to match indigo's ClientAuthStore interface requirements

     

       3
       3
       +
       -- This migration adds columns needed for OAuth client sessions and auth requests

     

       4
       4
       +
       

     

       5
       5
       +
       -- Update oauth_requests table

     

       6
       6
       +
       -- Add columns for request URI, auth server endpoints, scopes, and DPoP key

     

       7
       7
       +
       ALTER TABLE oauth_requests

     

       8
       8
       +
           ADD COLUMN request_uri TEXT,

     

       9
       9
       +
           ADD COLUMN auth_server_token_endpoint TEXT,

     

       10
       10
       +
           ADD COLUMN auth_server_revocation_endpoint TEXT,

     

       11
       11
       +
           ADD COLUMN scopes TEXT[],

     

       12
       12
       +
           ADD COLUMN dpop_private_key_multibase TEXT;

     

       13
       13
       +
       

     

       14
       14
       +
       -- Make original dpop_private_jwk nullable (we now use dpop_private_key_multibase)

     

       15
       15
       +
       ALTER TABLE oauth_requests ALTER COLUMN dpop_private_jwk DROP NOT NULL;

     

       16
       16
       +
       

     

       17
       17
       +
       -- Make did nullable (indigo's AuthRequestData.AccountDID is a pointer - optional)

     

       18
       18
       +
       ALTER TABLE oauth_requests ALTER COLUMN did DROP NOT NULL;

     

       19
       19
       +
       

     

       20
       20
       +
       -- Make handle and pds_url nullable too (derived from DID resolution, not always available at auth request time)

     

       21
       21
       +
       ALTER TABLE oauth_requests ALTER COLUMN handle DROP NOT NULL;

     

       22
       22
       +
       ALTER TABLE oauth_requests ALTER COLUMN pds_url DROP NOT NULL;

     

       23
       23
       +
       

     

       24
       24
       +
       -- Update existing oauth_requests data

     

       25
       25
       +
       -- Convert dpop_private_jwk (JSONB) to multibase format if needed

     

       26
       26
       +
       -- Note: This will leave the multibase column NULL for now since conversion requires crypto logic

     

       27
       27
       +
       -- The application will need to handle NULL values or regenerate keys on next auth flow

     

       28
       28
       +
       UPDATE oauth_requests

     

       29
       29
       +
       SET

     

       30
       30
       +
           auth_server_token_endpoint = auth_server_iss || '/oauth/token',

     

       31
       31
       +
           scopes = ARRAY['atproto']::TEXT[]

     

       32
       32
       +
       WHERE auth_server_token_endpoint IS NULL;

     

       33
       33
       +
       

     

       34
       34
       +
       -- Add indexes for new columns

     

       35
       35
       +
       CREATE INDEX idx_oauth_requests_request_uri ON oauth_requests(request_uri) WHERE request_uri IS NOT NULL;

     

       36
       36
       +
       

     

       37
       37
       +
       -- Update oauth_sessions table

     

       38
       38
       +
       -- Add session_id column (will become part of composite key)

     

       39
       39
       +
       ALTER TABLE oauth_sessions

     

       40
       40
       +
           ADD COLUMN session_id TEXT,

     

       41
       41
       +
           ADD COLUMN host_url TEXT,

     

       42
       42
       +
           ADD COLUMN auth_server_token_endpoint TEXT,

     

       43
       43
       +
           ADD COLUMN auth_server_revocation_endpoint TEXT,

     

       44
       44
       +
           ADD COLUMN scopes TEXT[],

     

       45
       45
       +
           ADD COLUMN dpop_private_key_multibase TEXT;

     

       46
       46
       +
       

     

       47
       47
       +
       -- Make original dpop_private_jwk nullable (we now use dpop_private_key_multibase)

     

       48
       48
       +
       ALTER TABLE oauth_sessions ALTER COLUMN dpop_private_jwk DROP NOT NULL;

     

       49
       49
       +
       

     

       50
       50
       +
       -- Populate session_id for existing sessions (use DID as default for single-session per account)

     

       51
       51
       +
       -- In production, you may want to generate unique session IDs

     

       52
       52
       +
       UPDATE oauth_sessions

     

       53
       53
       +
       SET

     

       54
       54
       +
           session_id = 'default',

     

       55
       55
       +
           host_url = pds_url,

     

       56
       56
       +
           auth_server_token_endpoint = auth_server_iss || '/oauth/token',

     

       57
       57
       +
           scopes = ARRAY['atproto']::TEXT[]

     

       58
       58
       +
       WHERE session_id IS NULL;

     

       59
       59
       +
       

     

       60
       60
       +
       -- Make session_id NOT NULL after populating existing data

     

       61
       61
       +
       ALTER TABLE oauth_sessions

     

       62
       62
       +
           ALTER COLUMN session_id SET NOT NULL;

     

       63
       63
       +
       

     

       64
       64
       +
       -- Drop old unique constraint on did only

     

       65
       65
       +
       ALTER TABLE oauth_sessions

     

       66
       66
       +
           DROP CONSTRAINT IF EXISTS oauth_sessions_did_key;

     

       67
       67
       +
       

     

       68
       68
       +
       -- Create new composite unique constraint for (did, session_id)

     

       69
       69
       +
       -- This allows multiple sessions per account

     

       70
       70
       +
       -- Note: UNIQUE constraint automatically creates an index, so no separate index needed

     

       71
       71
       +
       ALTER TABLE oauth_sessions

     

       72
       72
       +
           ADD CONSTRAINT oauth_sessions_did_session_id_key UNIQUE (did, session_id);

     

       73
       73
       +
       

     

       74
       74
       +
       -- Add comment explaining the schema change

     

       75
       75
       +
       COMMENT ON COLUMN oauth_sessions.session_id IS 'Session identifier to support multiple concurrent sessions per account';

     

       76
       76
       +
       COMMENT ON CONSTRAINT oauth_sessions_did_session_id_key ON oauth_sessions IS 'Composite key allowing multiple sessions per DID';

     

       77
       77
       +
       

     

       78
       78
       +
       -- +goose Down

     

       79
       79
       +
       -- Rollback: Remove added columns and restore original unique constraint

     

       80
       80
       +
       

     

       81
       81
       +
       -- oauth_sessions rollback

     

       82
       82
       +
       -- Drop composite unique constraint (this also drops the associated index)

     

       83
       83
       +
       ALTER TABLE oauth_sessions

     

       84
       84
       +
           DROP CONSTRAINT IF EXISTS oauth_sessions_did_session_id_key;

     

       85
       85
       +
       

     

       86
       86
       +
       -- Delete all but the most recent session per DID before restoring unique constraint

     

       87
       87
       +
       -- This ensures the UNIQUE (did) constraint can be added without conflicts

     

       88
       88
       +
       DELETE FROM oauth_sessions a

     

       89
       89
       +
       USING oauth_sessions b

     

       90
       90
       +
       WHERE a.did = b.did

     

       91
       91
       +
         AND a.created_at < b.created_at;

     

       92
       92
       +
       

     

       93
       93
       +
       -- Restore old unique constraint

     

       94
       94
       +
       ALTER TABLE oauth_sessions

     

       95
       95
       +
           ADD CONSTRAINT oauth_sessions_did_key UNIQUE (did);

     

       96
       96
       +
       

     

       97
       97
       +
       -- Restore NOT NULL constraint on dpop_private_jwk

     

       98
       98
       +
       ALTER TABLE oauth_sessions

     

       99
       99
       +
           ALTER COLUMN dpop_private_jwk SET NOT NULL;

     

       100
       100
       +
       

     

       101
       101
       +
       ALTER TABLE oauth_sessions

     

       102
       102
       +
           DROP COLUMN IF EXISTS dpop_private_key_multibase,

     

       103
       103
       +
           DROP COLUMN IF EXISTS scopes,

     

       104
       104
       +
           DROP COLUMN IF EXISTS auth_server_revocation_endpoint,

     

       105
       105
       +
           DROP COLUMN IF EXISTS auth_server_token_endpoint,

     

       106
       106
       +
           DROP COLUMN IF EXISTS host_url,

     

       107
       107
       +
           DROP COLUMN IF EXISTS session_id;

     

       108
       108
       +
       

     

       109
       109
       +
       -- oauth_requests rollback

     

       110
       110
       +
       DROP INDEX IF EXISTS idx_oauth_requests_request_uri;

     

       111
       111
       +
       

     

       112
       112
       +
       -- Restore NOT NULL constraints

     

       113
       113
       +
       ALTER TABLE oauth_requests

     

       114
       114
       +
           ALTER COLUMN dpop_private_jwk SET NOT NULL,

     

       115
       115
       +
           ALTER COLUMN did SET NOT NULL,

     

       116
       116
       +
           ALTER COLUMN handle SET NOT NULL,

     

       117
       117
       +
           ALTER COLUMN pds_url SET NOT NULL;

     

       118
       118
       +
       

     

       119
       119
       +
       ALTER TABLE oauth_requests

     

       120
       120
       +
           DROP COLUMN IF EXISTS dpop_private_key_multibase,

     

       121
       121
       +
           DROP COLUMN IF EXISTS scopes,

     

       122
       122
       +
           DROP COLUMN IF EXISTS auth_server_revocation_endpoint,

     

       123
       123
       +
           DROP COLUMN IF EXISTS auth_server_token_endpoint,

     

       124
       124
       +
           DROP COLUMN IF EXISTS request_uri;

+23

internal/db/migrations/020_add_mobile_oauth_csrf.sql

···

       1
       1
       +
       -- +goose Up

     

       2
       2
       +
       -- Add columns for mobile OAuth CSRF protection with server-side state

     

       3
       3
       +
       -- This ties the CSRF token to the OAuth state, allowing validation against

     

       4
       4
       +
       -- a value that comes back through the OAuth response (the state parameter)

     

       5
       5
       +
       -- rather than only validating cookies against each other.

     

       6
       6
       +
       

     

       7
       7
       +
       ALTER TABLE oauth_requests

     

       8
       8
       +
           ADD COLUMN mobile_csrf_token TEXT,

     

       9
       9
       +
           ADD COLUMN mobile_redirect_uri TEXT;

     

       10
       10
       +
       

     

       11
       11
       +
       -- Index for quick lookup of mobile data when callback is received

     

       12
       12
       +
       CREATE INDEX idx_oauth_requests_mobile_csrf ON oauth_requests(state)

     

       13
       13
       +
           WHERE mobile_csrf_token IS NOT NULL;

     

       14
       14
       +
       

     

       15
       15
       +
       COMMENT ON COLUMN oauth_requests.mobile_csrf_token IS 'CSRF token for mobile OAuth flows, validated against cookie on callback';

     

       16
       16
       +
       COMMENT ON COLUMN oauth_requests.mobile_redirect_uri IS 'Mobile redirect URI (Universal Link) for this OAuth flow';

     

       17
       17
       +
       

     

       18
       18
       +
       -- +goose Down

     

       19
       19
       +
       DROP INDEX IF EXISTS idx_oauth_requests_mobile_csrf;

     

       20
       20
       +
       

     

       21
       21
       +
       ALTER TABLE oauth_requests

     

       22
       22
       +
           DROP COLUMN IF EXISTS mobile_redirect_uri,

     

       23
       23
       +
           DROP COLUMN IF EXISTS mobile_csrf_token;

+137

internal/api/handlers/wellknown/universal_links.go

···

       1
       1
       +
       package wellknown

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"encoding/json"

     

       5
       5
       +
       	"log/slog"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       	"os"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       // HandleAppleAppSiteAssociation serves the iOS Universal Links configuration

     

       11
       11
       +
       // GET /.well-known/apple-app-site-association

     

       12
       12
       +
       //

     

       13
       13
       +
       // Universal Links provide cryptographic binding between the app and domain:

     

       14
       14
       +
       // - Requires apple-app-site-association file served over HTTPS

     

       15
       15
       +
       // - App must have Associated Domains capability configured

     

       16
       16
       +
       // - System verifies domain ownership before routing deep links

     

       17
       17
       +
       // - Prevents malicious apps from intercepting deep links

     

       18
       18
       +
       //

     

       19
       19
       +
       // Spec: https://developer.apple.com/documentation/xcode/supporting-universal-links-in-your-app

     

       20
       20
       +
       func HandleAppleAppSiteAssociation(w http.ResponseWriter, r *http.Request) {

     

       21
       21
       +
       	// Get Apple App ID from environment (format: <Team ID>.<Bundle ID>)

     

       22
       22
       +
       	// Example: "ABCD1234.social.coves.app"

     

       23
       23
       +
       	// Find Team ID in Apple Developer Portal -> Membership

     

       24
       24
       +
       	// Bundle ID is configured in Xcode project

     

       25
       25
       +
       	appleAppID := os.Getenv("APPLE_APP_ID")

     

       26
       26
       +
       	if appleAppID == "" {

     

       27
       27
       +
       		// Development fallback - allows testing without real Team ID

     

       28
       28
       +
       		// IMPORTANT: This MUST be set in production for Universal Links to work

     

       29
       29
       +
       		appleAppID = "DEVELOPMENT.social.coves.app"

     

       30
       30
       +
       		slog.Warn("APPLE_APP_ID not set, using development placeholder",

     

       31
       31
       +
       			"app_id", appleAppID,

     

       32
       32
       +
       			"note", "Set APPLE_APP_ID env var for production Universal Links")

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	// Apple requires application/json content type (no charset)

     

       36
       36
       +
       	w.Header().Set("Content-Type", "application/json")

     

       37
       37
       +
       

     

       38
       38
       +
       	// Construct the response per Apple's spec

     

       39
       39
       +
       	// See: https://developer.apple.com/documentation/bundleresources/applinks

     

       40
       40
       +
       	response := map[string]interface{}{

     

       41
       41
       +
       		"applinks": map[string]interface{}{

     

       42
       42
       +
       			"apps": []string{}, // Must be empty array per Apple spec

     

       43
       43
       +
       			"details": []map[string]interface{}{

     

       44
       44
       +
       				{

     

       45
       45
       +
       					"appID": appleAppID,

     

       46
       46
       +
       					// Paths that trigger Universal Links when opened in Safari/other apps

     

       47
       47
       +
       					// These URLs will open the app instead of the browser

     

       48
       48
       +
       					"paths": []string{

     

       49
       49
       +
       						"/app/oauth/callback",   // Primary Universal Link OAuth callback

     

       50
       50
       +
       						"/app/oauth/callback/*", // Catch-all for query params

     

       51
       51
       +
       					},

     

       52
       52
       +
       				},

     

       53
       53
       +
       			},

     

       54
       54
       +
       		},

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	if err := json.NewEncoder(w).Encode(response); err != nil {

     

       58
       58
       +
       		slog.Error("failed to encode apple-app-site-association", "error", err)

     

       59
       59
       +
       		http.Error(w, "internal server error", http.StatusInternalServerError)

     

       60
       60
       +
       		return

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	slog.Debug("served apple-app-site-association", "app_id", appleAppID)

     

       64
       64
       +
       }

     

       65
       65
       +
       

     

       66
       66
       +
       // HandleAssetLinks serves the Android App Links configuration

     

       67
       67
       +
       // GET /.well-known/assetlinks.json

     

       68
       68
       +
       //

     

       69
       69
       +
       // App Links provide cryptographic binding between the app and domain:

     

       70
       70
       +
       // - Requires assetlinks.json file served over HTTPS

     

       71
       71
       +
       // - App must have intent-filter with android:autoVerify="true"

     

       72
       72
       +
       // - System verifies domain ownership via SHA-256 certificate fingerprint

     

       73
       73
       +
       // - Prevents malicious apps from intercepting deep links

     

       74
       74
       +
       //

     

       75
       75
       +
       // Spec: https://developer.android.com/training/app-links/verify-android-applinks

     

       76
       76
       +
       func HandleAssetLinks(w http.ResponseWriter, r *http.Request) {

     

       77
       77
       +
       	// Get Android package name from environment

     

       78
       78
       +
       	// Example: "social.coves.app"

     

       79
       79
       +
       	androidPackage := os.Getenv("ANDROID_PACKAGE_NAME")

     

       80
       80
       +
       	if androidPackage == "" {

     

       81
       81
       +
       		androidPackage = "social.coves.app" // Default for development

     

       82
       82
       +
       		slog.Warn("ANDROID_PACKAGE_NAME not set, using default",

     

       83
       83
       +
       			"package", androidPackage,

     

       84
       84
       +
       			"note", "Set ANDROID_PACKAGE_NAME env var for production App Links")

     

       85
       85
       +
       	}

     

       86
       86
       +
       

     

       87
       87
       +
       	// Get SHA-256 fingerprint from environment

     

       88
       88
       +
       	// This is the SHA-256 fingerprint of the app's signing certificate

     

       89
       89
       +
       	//

     

       90
       90
       +
       	// To get the fingerprint:

     

       91
       91
       +
       	// Production: keytool -list -v -keystore release.jks -alias release

     

       92
       92
       +
       	// Debug: keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android

     

       93
       93
       +
       	//

     

       94
       94
       +
       	// Look for "SHA256:" in the output

     

       95
       95
       +
       	// Format: AA:BB:CC:DD:...:FF (64 hex characters separated by colons)

     

       96
       96
       +
       	androidFingerprint := os.Getenv("ANDROID_SHA256_FINGERPRINT")

     

       97
       97
       +
       	if androidFingerprint == "" {

     

       98
       98
       +
       		// Development fallback - this won't work for real App Links verification

     

       99
       99
       +
       		// IMPORTANT: This MUST be set in production for App Links to work

     

       100
       100
       +
       		androidFingerprint = "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"

     

       101
       101
       +
       		slog.Warn("ANDROID_SHA256_FINGERPRINT not set, using development placeholder",

     

       102
       102
       +
       			"fingerprint", androidFingerprint,

     

       103
       103
       +
       			"note", "Set ANDROID_SHA256_FINGERPRINT env var for production App Links")

     

       104
       104
       +
       	}

     

       105
       105
       +
       

     

       106
       106
       +
       	w.Header().Set("Content-Type", "application/json")

     

       107
       107
       +
       

     

       108
       108
       +
       	// Construct the response per Google's Digital Asset Links spec

     

       109
       109
       +
       	// See: https://developers.google.com/digital-asset-links/v1/getting-started

     

       110
       110
       +
       	response := []map[string]interface{}{

     

       111
       111
       +
       		{

     

       112
       112
       +
       			// delegate_permission/common.handle_all_urls grants the app permission

     

       113
       113
       +
       			// to handle URLs for this domain

     

       114
       114
       +
       			"relation": []string{"delegate_permission/common.handle_all_urls"},

     

       115
       115
       +
       			"target": map[string]interface{}{

     

       116
       116
       +
       				"namespace":    "android_app",

     

       117
       117
       +
       				"package_name": androidPackage,

     

       118
       118
       +
       				// List of certificate fingerprints that can sign the app

     

       119
       119
       +
       				// Multiple fingerprints can be provided for different signing keys

     

       120
       120
       +
       				// (e.g., debug + release)

     

       121
       121
       +
       				"sha256_cert_fingerprints": []string{

     

       122
       122
       +
       					androidFingerprint,

     

       123
       123
       +
       				},

     

       124
       124
       +
       			},

     

       125
       125
       +
       		},

     

       126
       126
       +
       	}

     

       127
       127
       +
       

     

       128
       128
       +
       	if err := json.NewEncoder(w).Encode(response); err != nil {

     

       129
       129
       +
       		slog.Error("failed to encode assetlinks.json", "error", err)

     

       130
       130
       +
       		http.Error(w, "internal server error", http.StatusInternalServerError)

     

       131
       131
       +
       		return

     

       132
       132
       +
       	}

     

       133
       133
       +
       

     

       134
       134
       +
       	slog.Debug("served assetlinks.json",

     

       135
       135
       +
       		"package", androidPackage,

     

       136
       136
       +
       		"fingerprint", androidFingerprint)

     

       137
       137
       +
       }

+25

internal/api/routes/wellknown.go

···

       1
       1
       +
       package routes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/wellknown"

     

       5
       5
       +
       

     

       6
       6
       +
       	"github.com/go-chi/chi/v5"

     

       7
       7
       +
       )

     

       8
       8
       +
       

     

       9
       9
       +
       // RegisterWellKnownRoutes registers RFC 8615 well-known URI endpoints

     

       10
       10
       +
       // These endpoints are used for service discovery and mobile app deep linking

     

       11
       11
       +
       //

     

       12
       12
       +
       // Spec: https://www.rfc-editor.org/rfc/rfc8615.html

     

       13
       13
       +
       func RegisterWellKnownRoutes(r chi.Router) {

     

       14
       14
       +
       	// iOS Universal Links configuration

     

       15
       15
       +
       	// Required for cryptographically-bound deep linking on iOS

     

       16
       16
       +
       	// Must be served at exact path /.well-known/apple-app-site-association

     

       17
       17
       +
       	// Content-Type: application/json (no redirects allowed)

     

       18
       18
       +
       	r.Get("/.well-known/apple-app-site-association", wellknown.HandleAppleAppSiteAssociation)

     

       19
       19
       +
       

     

       20
       20
       +
       	// Android App Links configuration

     

       21
       21
       +
       	// Required for cryptographically-bound deep linking on Android

     

       22
       22
       +
       	// Must be served at exact path /.well-known/assetlinks.json

     

       23
       23
       +
       	// Content-Type: application/json (no redirects allowed)

     

       24
       24
       +
       	r.Get("/.well-known/assetlinks.json", wellknown.HandleAssetLinks)

     

       25
       25
       +
       }

+1 -1

internal/api/handlers/comments/middleware.go

···

       17
       17
        
       // The middleware extracts the viewer DID from the Authorization header if present and valid,

     

       18
       18
        
       // making it available via middleware.GetUserDID(r) in the handler.

     

       19
       19
        
       // If no valid token is present, the request continues as anonymous (empty DID).

     

       20
       20
       -
       func OptionalAuthMiddleware(authMiddleware *middleware.AtProtoAuthMiddleware, next http.HandlerFunc) http.Handler {

     

       20
       20
       +
       func OptionalAuthMiddleware(authMiddleware *middleware.OAuthAuthMiddleware, next http.HandlerFunc) http.Handler {

     

       21
       21
        
       	return authMiddleware.OptionalAuth(http.HandlerFunc(next))

     

       22
       22
        
       }

+164 -312

internal/api/middleware/auth.go

···

       1
       1
        
       package middleware

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/auth"

     

       4
       4
       +
       	"Coves/internal/atproto/oauth"

     

       5
       5
        
       	"context"

     

       6
       6
       -
       	"fmt"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
        
       	"log"

     

       8
       8
        
       	"net/http"

     

       9
       9
        
       	"strings"

     

       10
       10
       +
       

     

       11
       11
       +
       	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       12
       12
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       10
       13
        
       )

     

       11
       14
        
       

     

       12
       15
        
       // Context keys for storing user information

     
···

       14
       17
        
       

     

       15
       18
        
       const (

     

       16
       19
        
       	UserDIDKey      contextKey = "user_did"

     

       17
       17
       -
       	JWTClaimsKey    contextKey = "jwt_claims"

     

       18
       18
       -
       	UserAccessToken contextKey = "user_access_token"

     

       19
       19
       -
       	DPoPProofKey    contextKey = "dpop_proof"

     

       20
       20
       +
       	OAuthSessionKey contextKey = "oauth_session"

     

       21
       21
       +
       	UserAccessToken contextKey = "user_access_token" // Kept for backward compatibility

     

       20
       22
        
       )

     

       21
       23
        
       

     

       22
       22
       -
       // AtProtoAuthMiddleware enforces atProto OAuth authentication for protected routes

     

       23
       23
       -
       // Validates JWT Bearer tokens from the Authorization header

     

       24
       24
       -
       // Supports DPoP (RFC 9449) for token binding verification

     

       25
       25
       -
       type AtProtoAuthMiddleware struct {

     

       26
       26
       -
       	jwksFetcher  auth.JWKSFetcher

     

       27
       27
       -
       	dpopVerifier *auth.DPoPVerifier

     

       28
       28
       -
       	skipVerify   bool // For Phase 1 testing only

     

       24
       24
       +
       // SessionUnsealer is an interface for unsealing session tokens

     

       25
       25
       +
       // This allows for mocking in tests

     

       26
       26
       +
       type SessionUnsealer interface {

     

       27
       27
       +
       	UnsealSession(token string) (*oauth.SealedSession, error)

     

       29
       28
        
       }

     

       30
       29
        
       

     

       31
       31
       -
       // NewAtProtoAuthMiddleware creates a new atProto auth middleware

     

       32
       32
       -
       // skipVerify: if true, only parses JWT without signature verification (Phase 1)

     

       33
       33
       -
       //

     

       34
       34
       -
       //	if false, performs full signature verification (Phase 2)

     

       35
       35
       -
       //

     

       36
       36
       -
       // IMPORTANT: Call Stop() when shutting down to clean up background goroutines.

     

       37
       37
       -
       func NewAtProtoAuthMiddleware(jwksFetcher auth.JWKSFetcher, skipVerify bool) *AtProtoAuthMiddleware {

     

       38
       38
       -
       	return &AtProtoAuthMiddleware{

     

       39
       39
       -
       		jwksFetcher:  jwksFetcher,

     

       40
       40
       -
       		dpopVerifier: auth.NewDPoPVerifier(),

     

       41
       41
       -
       		skipVerify:   skipVerify,

     

       42
       42
       -
       	}

     

       30
       30
       +
       // OAuthAuthMiddleware enforces OAuth authentication using sealed session tokens.

     

       31
       31
       +
       type OAuthAuthMiddleware struct {

     

       32
       32
       +
       	unsealer SessionUnsealer

     

       33
       33
       +
       	store    oauthlib.ClientAuthStore

     

       43
       34
        
       }

     

       44
       35
        
       

     

       45
       45
       -
       // Stop stops background goroutines. Call this when shutting down the server.

     

       46
       46
       -
       // This prevents goroutine leaks from the DPoP verifier's replay protection cache.

     

       47
       47
       -
       func (m *AtProtoAuthMiddleware) Stop() {

     

       48
       48
       -
       	if m.dpopVerifier != nil {

     

       49
       49
       -
       		m.dpopVerifier.Stop()

     

       36
       36
       +
       // NewOAuthAuthMiddleware creates a new OAuth auth middleware using sealed session tokens.

     

       37
       37
       +
       func NewOAuthAuthMiddleware(unsealer SessionUnsealer, store oauthlib.ClientAuthStore) *OAuthAuthMiddleware {

     

       38
       38
       +
       	return &OAuthAuthMiddleware{

     

       39
       39
       +
       		unsealer: unsealer,

     

       40
       40
       +
       		store:    store,

     

       50
       41
        
       	}

     

       51
       42
        
       }

     

       52
       43
        
       

     

       53
       53
       -
       // RequireAuth middleware ensures the user is authenticated with a valid JWT

     

       54
       54
       -
       // If not authenticated, returns 401

     

       55
       55
       -
       // If authenticated, injects user DID and JWT claims into context

     

       44
       44
       +
       // RequireAuth middleware ensures the user is authenticated.

     

       45
       45
       +
       // Supports sealed session tokens via:

     

       46
       46
       +
       //   - Authorization: Bearer <sealed_token>

     

       47
       47
       +
       //   - Cookie: coves_session=<sealed_token>

     

       56
       48
        
       //

     

       57
       57
       -
       // Only accepts DPoP authorization scheme per RFC 9449:

     

       58
       58
       -
       // - Authorization: DPoP <token> (DPoP-bound tokens)

     

       59
       59
       -
       func (m *AtProtoAuthMiddleware) RequireAuth(next http.Handler) http.Handler {

     

       49
       49
       +
       // If not authenticated, returns 401.

     

       50
       50
       +
       // If authenticated, injects user DID into context.

     

       51
       51
       +
       func (m *OAuthAuthMiddleware) RequireAuth(next http.Handler) http.Handler {

     

       60
       52
        
       	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       61
       61
       -
       		// Extract Authorization header

     

       53
       53
       +
       		var token string

     

       54
       54
       +
       

     

       55
       55
       +
       		// Try Authorization header first (for mobile/API clients)

     

       62
       56
        
       		authHeader := r.Header.Get("Authorization")

     

       63
       63
       -
       		if authHeader == "" {

     

       64
       64
       -
       			writeAuthError(w, "Missing Authorization header")

     

       65
       65
       -
       			return

     

       57
       57
       +
       		if authHeader != "" {

     

       58
       58
       +
       			var ok bool

     

       59
       59
       +
       			token, ok = extractBearerToken(authHeader)

     

       60
       60
       +
       			if !ok {

     

       61
       61
       +
       				writeAuthError(w, "Invalid Authorization header format. Expected: Bearer <token>")

     

       62
       62
       +
       				return

     

       63
       63
       +
       			}

     

       64
       64
       +
       		}

     

       65
       65
       +
       

     

       66
       66
       +
       		// If no header, try session cookie (for web clients)

     

       67
       67
       +
       		if token == "" {

     

       68
       68
       +
       			if cookie, err := r.Cookie("coves_session"); err == nil {

     

       69
       69
       +
       				token = cookie.Value

     

       70
       70
       +
       			}

     

       66
       71
        
       		}

     

       67
       72
        
       

     

       68
       68
       -
       		// Only accept DPoP scheme per RFC 9449

     

       69
       69
       -
       		// HTTP auth schemes are case-insensitive per RFC 7235

     

       70
       70
       -
       		token, ok := extractDPoPToken(authHeader)

     

       71
       71
       -
       		if !ok {

     

       72
       72
       -
       			writeAuthError(w, "Invalid Authorization header format. Expected: DPoP <token>")

     

       73
       73
       +
       		// Must have authentication from either source

     

       74
       74
       +
       		if token == "" {

     

       75
       75
       +
       			writeAuthError(w, "Missing authentication")

     

       73
       76
        
       			return

     

       74
       77
        
       		}

     

       75
       78
        
       

     

       76
       76
       -
       		var claims *auth.Claims

     

       77
       77
       -
       		var err error

     

       79
       79
       +
       		// Authenticate using sealed token

     

       80
       80
       +
       		sealedSession, err := m.unsealer.UnsealSession(token)

     

       81
       81
       +
       		if err != nil {

     

       82
       82
       +
       			log.Printf("[AUTH_FAILURE] type=unseal_failed ip=%s method=%s path=%s error=%v",

     

       83
       83
       +
       				r.RemoteAddr, r.Method, r.URL.Path, err)

     

       84
       84
       +
       			writeAuthError(w, "Invalid or expired token")

     

       85
       85
       +
       			return

     

       86
       86
       +
       		}

     

       78
       87
        
       

     

       79
       79
       -
       		if m.skipVerify {

     

       80
       80
       -
       			// Phase 1: Parse only (no signature verification)

     

       81
       81
       -
       			claims, err = auth.ParseJWT(token)

     

       82
       82
       -
       			if err != nil {

     

       83
       83
       -
       				log.Printf("[AUTH_FAILURE] type=parse_error ip=%s method=%s path=%s error=%v",

     

       84
       84
       -
       					r.RemoteAddr, r.Method, r.URL.Path, err)

     

       85
       85
       -
       				writeAuthError(w, "Invalid token")

     

       86
       86
       -
       				return

     

       87
       87
       -
       			}

     

       88
       88
       -
       		} else {

     

       89
       89
       -
       			// Phase 2: Full verification with signature check

     

       90
       90
       -
       			//

     

       91
       91
       -
       			// SECURITY: The access token MUST be verified before trusting any claims.

     

       92
       92
       -
       			// DPoP is an ADDITIONAL security layer, not a replacement for signature verification.

     

       93
       93
       -
       			claims, err = auth.VerifyJWT(r.Context(), token, m.jwksFetcher)

     

       94
       94
       -
       			if err != nil {

     

       95
       95
       -
       				// Token verification failed - REJECT

     

       96
       96
       -
       				// DO NOT fall back to DPoP-only verification, as that would trust unverified claims

     

       97
       97
       -
       				issuer := "unknown"

     

       98
       98
       -
       				if parsedClaims, parseErr := auth.ParseJWT(token); parseErr == nil {

     

       99
       99
       -
       					issuer = parsedClaims.Issuer

     

       100
       100
       -
       				}

     

       101
       101
       -
       				log.Printf("[AUTH_FAILURE] type=verification_failed ip=%s method=%s path=%s issuer=%s error=%v",

     

       102
       102
       -
       					r.RemoteAddr, r.Method, r.URL.Path, issuer, err)

     

       103
       103
       -
       				writeAuthError(w, "Invalid or expired token")

     

       104
       104
       -
       				return

     

       105
       105
       -
       			}

     

       88
       88
       +
       		// Parse DID

     

       89
       89
       +
       		did, err := syntax.ParseDID(sealedSession.DID)

     

       90
       90
       +
       		if err != nil {

     

       91
       91
       +
       			log.Printf("[AUTH_FAILURE] type=invalid_did ip=%s method=%s path=%s did=%s error=%v",

     

       92
       92
       +
       				r.RemoteAddr, r.Method, r.URL.Path, sealedSession.DID, err)

     

       93
       93
       +
       			writeAuthError(w, "Invalid DID in token")

     

       94
       94
       +
       			return

     

       95
       95
       +
       		}

     

       106
       96
        
       

     

       107
       107
       -
       			// Token signature verified - now check if DPoP binding is required

     

       108
       108
       -
       			// If the token has a cnf.jkt claim, DPoP proof is REQUIRED

     

       109
       109
       -
       			dpopHeader := r.Header.Get("DPoP")

     

       110
       110
       -
       			hasCnfJkt := claims.Confirmation != nil && claims.Confirmation["jkt"] != nil

     

       111
       111
       -
       

     

       112
       112
       -
       			if hasCnfJkt {

     

       113
       113
       -
       				// Token has DPoP binding - REQUIRE valid DPoP proof

     

       114
       114
       -
       				if dpopHeader == "" {

     

       115
       115
       -
       					log.Printf("[AUTH_FAILURE] type=missing_dpop ip=%s method=%s path=%s error=token has cnf.jkt but no DPoP header",

     

       116
       116
       -
       						r.RemoteAddr, r.Method, r.URL.Path)

     

       117
       117
       -
       					writeAuthError(w, "DPoP proof required")

     

       118
       118
       -
       					return

     

       119
       119
       -
       				}

     

       120
       120
       -
       

     

       121
       121
       -
       				proof, err := m.verifyDPoPBinding(r, claims, dpopHeader, token)

     

       122
       122
       -
       				if err != nil {

     

       123
       123
       -
       					log.Printf("[AUTH_FAILURE] type=dpop_verification_failed ip=%s method=%s path=%s error=%v",

     

       124
       124
       -
       						r.RemoteAddr, r.Method, r.URL.Path, err)

     

       125
       125
       -
       					writeAuthError(w, "Invalid DPoP proof")

     

       126
       126
       -
       					return

     

       127
       127
       -
       				}

     

       128
       128
       -
       

     

       129
       129
       -
       				// Store verified DPoP proof in context

     

       130
       130
       -
       				ctx := context.WithValue(r.Context(), DPoPProofKey, proof)

     

       131
       131
       -
       				r = r.WithContext(ctx)

     

       132
       132
       -
       			} else if dpopHeader != "" {

     

       133
       133
       -
       				// DPoP header present but token doesn't have cnf.jkt - this is suspicious

     

       134
       134
       -
       				// Log warning but don't reject (could be a misconfigured client)

     

       135
       135
       -
       				log.Printf("[AUTH_WARNING] type=unexpected_dpop ip=%s method=%s path=%s warning=DPoP header present but token has no cnf.jkt",

     

       136
       136
       -
       					r.RemoteAddr, r.Method, r.URL.Path)

     

       137
       137
       -
       			}

     

       97
       97
       +
       		// Load full OAuth session from database

     

       98
       98
       +
       		session, err := m.store.GetSession(r.Context(), did, sealedSession.SessionID)

     

       99
       99
       +
       		if err != nil {

     

       100
       100
       +
       			log.Printf("[AUTH_FAILURE] type=session_not_found ip=%s method=%s path=%s did=%s session_id=%s error=%v",

     

       101
       101
       +
       				r.RemoteAddr, r.Method, r.URL.Path, sealedSession.DID, sealedSession.SessionID, err)

     

       102
       102
       +
       			writeAuthError(w, "Session not found or expired")

     

       103
       103
       +
       			return

     

       138
       104
        
       		}

     

       139
       105
        
       

     

       140
       140
       -
       		// Extract user DID from 'sub' claim

     

       141
       141
       -
       		userDID := claims.Subject

     

       142
       142
       -
       		if userDID == "" {

     

       143
       143
       -
       			writeAuthError(w, "Missing user DID in token")

     

       106
       106
       +
       		// Verify session DID matches token DID

     

       107
       107
       +
       		if session.AccountDID.String() != sealedSession.DID {

     

       108
       108
       +
       			log.Printf("[AUTH_FAILURE] type=did_mismatch ip=%s method=%s path=%s token_did=%s session_did=%s",

     

       109
       109
       +
       				r.RemoteAddr, r.Method, r.URL.Path, sealedSession.DID, session.AccountDID.String())

     

       110
       110
       +
       			writeAuthError(w, "Session DID mismatch")

     

       144
       111
        
       			return

     

       145
       112
        
       		}

     

       146
       113
        
       

     

       147
       147
       -
       		// Inject user info and access token into context

     

       148
       148
       -
       		ctx := context.WithValue(r.Context(), UserDIDKey, userDID)

     

       149
       149
       -
       		ctx = context.WithValue(ctx, JWTClaimsKey, claims)

     

       150
       150
       -
       		ctx = context.WithValue(ctx, UserAccessToken, token)

     

       114
       114
       +
       		log.Printf("[AUTH_SUCCESS] ip=%s method=%s path=%s did=%s session_id=%s",

     

       115
       115
       +
       			r.RemoteAddr, r.Method, r.URL.Path, sealedSession.DID, sealedSession.SessionID)

     

       116
       116
       +
       

     

       117
       117
       +
       		// Inject user info and session into context

     

       118
       118
       +
       		ctx := context.WithValue(r.Context(), UserDIDKey, sealedSession.DID)

     

       119
       119
       +
       		ctx = context.WithValue(ctx, OAuthSessionKey, session)

     

       120
       120
       +
       		// Store access token for backward compatibility

     

       121
       121
       +
       		ctx = context.WithValue(ctx, UserAccessToken, session.AccessToken)

     

       151
       122
        
       

     

       152
       123
        
       		// Call next handler

     

       153
       124
        
       		next.ServeHTTP(w, r.WithContext(ctx))

     

       154
       125
        
       	})

     

       155
       126
        
       }

     

       156
       127
        
       

     

       157
       157
       -
       // OptionalAuth middleware loads user info if authenticated, but doesn't require it

     

       158
       158
       -
       // Useful for endpoints that work for both authenticated and anonymous users

     

       128
       128
       +
       // OptionalAuth middleware loads user info if authenticated, but doesn't require it.

     

       129
       129
       +
       // Useful for endpoints that work for both authenticated and anonymous users.

     

       130
       130
       +
       //

     

       131
       131
       +
       // Supports sealed session tokens via:

     

       132
       132
       +
       //   - Authorization: Bearer <sealed_token>

     

       133
       133
       +
       //   - Cookie: coves_session=<sealed_token>

     

       159
       134
        
       //

     

       160
       160
       -
       // Only accepts DPoP authorization scheme per RFC 9449:

     

       161
       161
       -
       // - Authorization: DPoP <token> (DPoP-bound tokens)

     

       162
       162
       -
       func (m *AtProtoAuthMiddleware) OptionalAuth(next http.Handler) http.Handler {

     

       135
       135
       +
       // If authentication fails, continues without user context (does not return error).

     

       136
       136
       +
       func (m *OAuthAuthMiddleware) OptionalAuth(next http.Handler) http.Handler {

     

       163
       137
        
       	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       164
       164
       -
       		// Extract Authorization header

     

       138
       138
       +
       		var token string

     

       139
       139
       +
       

     

       140
       140
       +
       		// Try Authorization header first (for mobile/API clients)

     

       165
       141
        
       		authHeader := r.Header.Get("Authorization")

     

       142
       142
       +
       		if authHeader != "" {

     

       143
       143
       +
       			var ok bool

     

       144
       144
       +
       			token, ok = extractBearerToken(authHeader)

     

       145
       145
       +
       			if !ok {

     

       146
       146
       +
       				// Invalid format - continue without user context

     

       147
       147
       +
       				next.ServeHTTP(w, r)

     

       148
       148
       +
       				return

     

       149
       149
       +
       			}

     

       150
       150
       +
       		}

     

       151
       151
       +
       

     

       152
       152
       +
       		// If no header, try session cookie (for web clients)

     

       153
       153
       +
       		if token == "" {

     

       154
       154
       +
       			if cookie, err := r.Cookie("coves_session"); err == nil {

     

       155
       155
       +
       				token = cookie.Value

     

       156
       156
       +
       			}

     

       157
       157
       +
       		}

     

       166
       158
        
       

     

       167
       167
       -
       		// Only accept DPoP scheme per RFC 9449

     

       168
       168
       -
       		// HTTP auth schemes are case-insensitive per RFC 7235

     

       169
       169
       -
       		token, ok := extractDPoPToken(authHeader)

     

       170
       170
       -
       		if !ok {

     

       171
       171
       -
       			// Not authenticated or invalid format - continue without user context

     

       159
       159
       +
       		// If still no token, continue without authentication

     

       160
       160
       +
       		if token == "" {

     

       172
       161
        
       			next.ServeHTTP(w, r)

     

       173
       162
        
       			return

     

       174
       163
        
       		}

     

       175
       164
        
       

     

       176
       176
       -
       		var claims *auth.Claims

     

       177
       177
       -
       		var err error

     

       165
       165
       +
       		// Try to authenticate (don't write errors, just continue without user context on failure)

     

       166
       166
       +
       		sealedSession, err := m.unsealer.UnsealSession(token)

     

       167
       167
       +
       		if err != nil {

     

       168
       168
       +
       			next.ServeHTTP(w, r)

     

       169
       169
       +
       			return

     

       170
       170
       +
       		}

     

       178
       171
        
       

     

       179
       179
       -
       		if m.skipVerify {

     

       180
       180
       -
       			// Phase 1: Parse only

     

       181
       181
       -
       			claims, err = auth.ParseJWT(token)

     

       182
       182
       -
       		} else {

     

       183
       183
       -
       			// Phase 2: Full verification

     

       184
       184
       -
       			// SECURITY: Token MUST be verified before trusting claims

     

       185
       185
       -
       			claims, err = auth.VerifyJWT(r.Context(), token, m.jwksFetcher)

     

       172
       172
       +
       		// Parse DID

     

       173
       173
       +
       		did, err := syntax.ParseDID(sealedSession.DID)

     

       174
       174
       +
       		if err != nil {

     

       175
       175
       +
       			log.Printf("[AUTH_WARNING] Optional auth: invalid DID: %v", err)

     

       176
       176
       +
       			next.ServeHTTP(w, r)

     

       177
       177
       +
       			return

     

       186
       178
        
       		}

     

       187
       179
        
       

     

       180
       180
       +
       		// Load full OAuth session from database

     

       181
       181
       +
       		session, err := m.store.GetSession(r.Context(), did, sealedSession.SessionID)

     

       188
       182
        
       		if err != nil {

     

       189
       189
       -
       			// Invalid token - continue without user context

     

       190
       190
       -
       			log.Printf("Optional auth failed: %v", err)

     

       183
       183
       +
       			log.Printf("[AUTH_WARNING] Optional auth: session not found: %v", err)

     

       191
       184
        
       			next.ServeHTTP(w, r)

     

       192
       185
        
       			return

     

       193
       186
        
       		}

     

       194
       187
        
       

     

       195
       195
       -
       		// Check DPoP binding if token has cnf.jkt (after successful verification)

     

       196
       196
       -
       		// SECURITY: If token has cnf.jkt but no DPoP header, we cannot trust it

     

       197
       197
       -
       		// (could be a stolen token). Continue as unauthenticated.

     

       198
       198
       -
       		if !m.skipVerify {

     

       199
       199
       -
       			dpopHeader := r.Header.Get("DPoP")

     

       200
       200
       -
       			hasCnfJkt := claims.Confirmation != nil && claims.Confirmation["jkt"] != nil

     

       201
       201
       -
       

     

       202
       202
       -
       			if hasCnfJkt {

     

       203
       203
       -
       				if dpopHeader == "" {

     

       204
       204
       -
       					// Token requires DPoP binding but no proof provided

     

       205
       205
       -
       					// Cannot trust this token - continue without auth

     

       206
       206
       -
       					log.Printf("[AUTH_WARNING] Optional auth: token has cnf.jkt but no DPoP header - treating as unauthenticated (potential token theft)")

     

       207
       207
       -
       					next.ServeHTTP(w, r)

     

       208
       208
       -
       					return

     

       209
       209
       -
       				}

     

       210
       210
       -
       

     

       211
       211
       -
       				proof, err := m.verifyDPoPBinding(r, claims, dpopHeader, token)

     

       212
       212
       -
       				if err != nil {

     

       213
       213
       -
       					// DPoP verification failed - cannot trust this token

     

       214
       214
       -
       					log.Printf("[AUTH_WARNING] Optional auth: DPoP verification failed - treating as unauthenticated: %v", err)

     

       215
       215
       -
       					next.ServeHTTP(w, r)

     

       216
       216
       -
       					return

     

       217
       217
       -
       				}

     

       218
       218
       -
       

     

       219
       219
       -
       				// DPoP verified - inject proof into context

     

       220
       220
       -
       				ctx := context.WithValue(r.Context(), UserDIDKey, claims.Subject)

     

       221
       221
       -
       				ctx = context.WithValue(ctx, JWTClaimsKey, claims)

     

       222
       222
       -
       				ctx = context.WithValue(ctx, UserAccessToken, token)

     

       223
       223
       -
       				ctx = context.WithValue(ctx, DPoPProofKey, proof)

     

       224
       224
       -
       				next.ServeHTTP(w, r.WithContext(ctx))

     

       225
       225
       -
       				return

     

       226
       226
       -
       			}

     

       188
       188
       +
       		// Verify session DID matches token DID

     

       189
       189
       +
       		if session.AccountDID.String() != sealedSession.DID {

     

       190
       190
       +
       			log.Printf("[AUTH_WARNING] Optional auth: DID mismatch")

     

       191
       191
       +
       			next.ServeHTTP(w, r)

     

       192
       192
       +
       			return

     

       227
       193
        
       		}

     

       228
       194
        
       

     

       229
       229
       -
       		// No DPoP binding required - inject user info and access token into context

     

       230
       230
       -
       		ctx := context.WithValue(r.Context(), UserDIDKey, claims.Subject)

     

       231
       231
       -
       		ctx = context.WithValue(ctx, JWTClaimsKey, claims)

     

       232
       232
       -
       		ctx = context.WithValue(ctx, UserAccessToken, token)

     

       195
       195
       +
       		// Build authenticated context

     

       196
       196
       +
       		ctx := context.WithValue(r.Context(), UserDIDKey, sealedSession.DID)

     

       197
       197
       +
       		ctx = context.WithValue(ctx, OAuthSessionKey, session)

     

       198
       198
       +
       		ctx = context.WithValue(ctx, UserAccessToken, session.AccessToken)

     

       233
       199
        
       

     

       234
       234
       -
       		// Call next handler

     

       235
       200
        
       		next.ServeHTTP(w, r.WithContext(ctx))

     

       236
       201
        
       	})

     

       237
       202
        
       }

     
···

       251
       216
        
       	return did

     

       252
       217
        
       }

     

       253
       218
        
       

     

       254
       254
       -
       // GetJWTClaims extracts the JWT claims from the request context

     

       219
       219
       +
       // GetOAuthSession extracts the OAuth session from the request context

     

       255
       220
        
       // Returns nil if not authenticated

     

       256
       256
       -
       func GetJWTClaims(r *http.Request) *auth.Claims {

     

       257
       257
       -
       	claims, _ := r.Context().Value(JWTClaimsKey).(*auth.Claims)

     

       258
       258
       -
       	return claims

     

       259
       259
       -
       }

     

       260
       260
       -
       

     

       261
       261
       -
       // SetTestUserDID sets the user DID in the context for testing purposes

     

       262
       262
       -
       // This function should ONLY be used in tests to mock authenticated users

     

       263
       263
       -
       func SetTestUserDID(ctx context.Context, userDID string) context.Context {

     

       264
       264
       -
       	return context.WithValue(ctx, UserDIDKey, userDID)

     

       221
       221
       +
       // Handlers can use this to make authenticated PDS calls

     

       222
       222
       +
       func GetOAuthSession(r *http.Request) *oauthlib.ClientSessionData {

     

       223
       223
       +
       	session, _ := r.Context().Value(OAuthSessionKey).(*oauthlib.ClientSessionData)

     

       224
       224
       +
       	return session

     

       265
       225
        
       }

     

       266
       226
        
       

     

       267
       227
        
       // GetUserAccessToken extracts the user's access token from the request context

     
···

       271
       231
        
       	return token

     

       272
       232
        
       }

     

       273
       233
        
       

     

       274
       274
       -
       // GetDPoPProof extracts the DPoP proof from the request context

     

       275
       275
       -
       // Returns nil if no DPoP proof was verified

     

       276
       276
       -
       func GetDPoPProof(r *http.Request) *auth.DPoPProof {

     

       277
       277
       -
       	proof, _ := r.Context().Value(DPoPProofKey).(*auth.DPoPProof)

     

       278
       278
       -
       	return proof

     

       279
       279
       -
       }

     

       280
       280
       -
       

     

       281
       281
       -
       // verifyDPoPBinding verifies DPoP proof binding for an ALREADY VERIFIED token.

     

       282
       282
       -
       //

     

       283
       283
       -
       // SECURITY: This function ONLY verifies the DPoP proof and its binding to the token.

     

       284
       284
       -
       // The access token MUST be signature-verified BEFORE calling this function.

     

       285
       285
       -
       // DPoP is an ADDITIONAL security layer, not a replacement for signature verification.

     

       286
       286
       -
       //

     

       287
       287
       -
       // This prevents token theft attacks by proving the client possesses the private key

     

       288
       288
       -
       // corresponding to the public key thumbprint in the token's cnf.jkt claim.

     

       289
       289
       -
       func (m *AtProtoAuthMiddleware) verifyDPoPBinding(r *http.Request, claims *auth.Claims, dpopProofHeader, accessToken string) (*auth.DPoPProof, error) {

     

       290
       290
       -
       	// Extract the cnf.jkt claim from the already-verified token

     

       291
       291
       -
       	jkt, err := auth.ExtractCnfJkt(claims)

     

       292
       292
       -
       	if err != nil {

     

       293
       293
       -
       		return nil, fmt.Errorf("token requires DPoP but missing cnf.jkt: %w", err)

     

       294
       294
       -
       	}

     

       295
       295
       -
       

     

       296
       296
       -
       	// Build the HTTP URI for DPoP verification

     

       297
       297
       -
       	// Use the full URL including scheme and host, respecting proxy headers

     

       298
       298
       -
       	scheme, host := extractSchemeAndHost(r)

     

       299
       299
       -
       

     

       300
       300
       -
       	// Use EscapedPath to preserve percent-encoding (P3 fix)

     

       301
       301
       -
       	// r.URL.Path is decoded, but DPoP proofs contain the raw encoded path

     

       302
       302
       -
       	path := r.URL.EscapedPath()

     

       303
       303
       -
       	if path == "" {

     

       304
       304
       -
       		path = r.URL.Path // Fallback if EscapedPath returns empty

     

       305
       305
       -
       	}

     

       306
       306
       -
       

     

       307
       307
       -
       	httpURI := scheme + "://" + host + path

     

       308
       308
       -
       

     

       309
       309
       -
       	// Verify the DPoP proof

     

       310
       310
       -
       	proof, err := m.dpopVerifier.VerifyDPoPProof(dpopProofHeader, r.Method, httpURI)

     

       311
       311
       -
       	if err != nil {

     

       312
       312
       -
       		return nil, fmt.Errorf("DPoP proof verification failed: %w", err)

     

       313
       313
       -
       	}

     

       314
       314
       -
       

     

       315
       315
       -
       	// Verify the binding between the proof and the token (cnf.jkt)

     

       316
       316
       -
       	if err := m.dpopVerifier.VerifyTokenBinding(proof, jkt); err != nil {

     

       317
       317
       -
       		return nil, fmt.Errorf("DPoP binding verification failed: %w", err)

     

       318
       318
       -
       	}

     

       319
       319
       -
       

     

       320
       320
       -
       	// Verify the access token hash (ath) if present in the proof

     

       321
       321
       -
       	// Per RFC 9449 section 4.2, if ath is present, it MUST match the access token

     

       322
       322
       -
       	if err := m.dpopVerifier.VerifyAccessTokenHash(proof, accessToken); err != nil {

     

       323
       323
       -
       		return nil, fmt.Errorf("DPoP ath verification failed: %w", err)

     

       324
       324
       -
       	}

     

       325
       325
       -
       

     

       326
       326
       -
       	return proof, nil

     

       327
       327
       -
       }

     

       328
       328
       -
       

     

       329
       329
       -
       // extractSchemeAndHost extracts the scheme and host from the request,

     

       330
       330
       -
       // respecting proxy headers (X-Forwarded-Proto, X-Forwarded-Host, Forwarded).

     

       331
       331
       -
       // This is critical for DPoP verification when behind TLS-terminating proxies.

     

       332
       332
       -
       func extractSchemeAndHost(r *http.Request) (scheme, host string) {

     

       333
       333
       -
       	// Start with request defaults

     

       334
       334
       -
       	scheme = r.URL.Scheme

     

       335
       335
       -
       	host = r.Host

     

       336
       336
       -
       

     

       337
       337
       -
       	// Check X-Forwarded-Proto for scheme (most common)

     

       338
       338
       -
       	if forwardedProto := r.Header.Get("X-Forwarded-Proto"); forwardedProto != "" {

     

       339
       339
       -
       		parts := strings.Split(forwardedProto, ",")

     

       340
       340
       -
       		if len(parts) > 0 && strings.TrimSpace(parts[0]) != "" {

     

       341
       341
       -
       			scheme = strings.ToLower(strings.TrimSpace(parts[0]))

     

       342
       342
       -
       		}

     

       343
       343
       -
       	}

     

       344
       344
       -
       

     

       345
       345
       -
       	// Check X-Forwarded-Host for host (common with nginx/traefik)

     

       346
       346
       -
       	if forwardedHost := r.Header.Get("X-Forwarded-Host"); forwardedHost != "" {

     

       347
       347
       -
       		parts := strings.Split(forwardedHost, ",")

     

       348
       348
       -
       		if len(parts) > 0 && strings.TrimSpace(parts[0]) != "" {

     

       349
       349
       -
       			host = strings.TrimSpace(parts[0])

     

       350
       350
       -
       		}

     

       351
       351
       -
       	}

     

       352
       352
       -
       

     

       353
       353
       -
       	// Check standard Forwarded header (RFC 7239) - takes precedence if present

     

       354
       354
       -
       	// Format: Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43;host=example.com

     

       355
       355
       -
       	// RFC 7239 allows: mixed-case keys (Proto, PROTO), quoted values (host="example.com")

     

       356
       356
       -
       	if forwarded := r.Header.Get("Forwarded"); forwarded != "" {

     

       357
       357
       -
       		// Parse the first entry (comma-separated list)

     

       358
       358
       -
       		firstEntry := strings.Split(forwarded, ",")[0]

     

       359
       359
       -
       		for _, part := range strings.Split(firstEntry, ";") {

     

       360
       360
       -
       			part = strings.TrimSpace(part)

     

       361
       361
       -
       			// Split on first '=' to properly handle key=value pairs

     

       362
       362
       -
       			if idx := strings.Index(part, "="); idx != -1 {

     

       363
       363
       -
       				key := strings.ToLower(strings.TrimSpace(part[:idx]))

     

       364
       364
       -
       				value := strings.TrimSpace(part[idx+1:])

     

       365
       365
       -
       				// Strip optional quotes per RFC 7239 section 4

     

       366
       366
       -
       				value = strings.Trim(value, "\"")

     

       367
       367
       -
       

     

       368
       368
       -
       				switch key {

     

       369
       369
       -
       				case "proto":

     

       370
       370
       -
       					scheme = strings.ToLower(value)

     

       371
       371
       -
       				case "host":

     

       372
       372
       -
       					host = value

     

       373
       373
       -
       				}

     

       374
       374
       -
       			}

     

       375
       375
       -
       		}

     

       376
       376
       -
       	}

     

       377
       377
       -
       

     

       378
       378
       -
       	// Fallback scheme detection from TLS

     

       379
       379
       -
       	if scheme == "" {

     

       380
       380
       -
       		if r.TLS != nil {

     

       381
       381
       -
       			scheme = "https"

     

       382
       382
       -
       		} else {

     

       383
       383
       -
       			scheme = "http"

     

       384
       384
       -
       		}

     

       385
       385
       -
       	}

     

       386
       386
       -
       

     

       387
       387
       -
       	return strings.ToLower(scheme), host

     

       388
       388
       -
       }

     

       389
       389
       -
       

     

       390
       390
       -
       // writeAuthError writes a JSON error response for authentication failures

     

       391
       391
       -
       func writeAuthError(w http.ResponseWriter, message string) {

     

       392
       392
       -
       	w.Header().Set("Content-Type", "application/json")

     

       393
       393
       -
       	w.WriteHeader(http.StatusUnauthorized)

     

       394
       394
       -
       	// Simple error response matching XRPC error format

     

       395
       395
       -
       	response := `{"error":"AuthenticationRequired","message":"` + message + `"}`

     

       396
       396
       -
       	if _, err := w.Write([]byte(response)); err != nil {

     

       397
       397
       -
       		log.Printf("Failed to write auth error response: %v", err)

     

       398
       398
       -
       	}

     

       234
       234
       +
       // SetTestUserDID sets the user DID in the context for testing purposes

     

       235
       235
       +
       // This function should ONLY be used in tests to mock authenticated users

     

       236
       236
       +
       func SetTestUserDID(ctx context.Context, userDID string) context.Context {

     

       237
       237
       +
       	return context.WithValue(ctx, UserDIDKey, userDID)

     

       399
       238
        
       }

     

       400
       239
        
       

     

       401
       401
       -
       // extractDPoPToken extracts the token from a DPoP Authorization header.

     

       402
       402
       -
       // HTTP auth schemes are case-insensitive per RFC 7235, so "DPoP", "dpop", "DPOP" are all valid.

     

       403
       403
       -
       // Returns the token and true if valid DPoP scheme, empty string and false otherwise.

     

       404
       404
       -
       func extractDPoPToken(authHeader string) (string, bool) {

     

       240
       240
       +
       // extractBearerToken extracts the token from a Bearer Authorization header.

     

       241
       241
       +
       // HTTP auth schemes are case-insensitive per RFC 7235, so "Bearer", "bearer", "BEARER" are all valid.

     

       242
       242
       +
       // Returns the token and true if valid Bearer scheme, empty string and false otherwise.

     

       243
       243
       +
       func extractBearerToken(authHeader string) (string, bool) {

     

       405
       244
        
       	if authHeader == "" {

     

       406
       245
        
       		return "", false

     

       407
       246
        
       	}

     

       408
       247
        
       

     

       409
       409
       -
       	// Split on first space: "DPoP <token>" -> ["DPoP", "<token>"]

     

       248
       248
       +
       	// Split on first space: "Bearer <token>" -> ["Bearer", "<token>"]

     

       410
       249
        
       	parts := strings.SplitN(authHeader, " ", 2)

     

       411
       250
        
       	if len(parts) != 2 {

     

       412
       251
        
       		return "", false

     

       413
       252
        
       	}

     

       414
       253
        
       

     

       415
       254
        
       	// Case-insensitive scheme comparison per RFC 7235

     

       416
       416
       -
       	if !strings.EqualFold(parts[0], "DPoP") {

     

       255
       255
       +
       	if !strings.EqualFold(parts[0], "Bearer") {

     

       417
       256
        
       		return "", false

     

       418
       257
        
       	}

     

       419
       258
        
       

     
···

       424
       263
        
       

     

       425
       264
        
       	return token, true

     

       426
       265
        
       }

     

       266
       266
       +
       

     

       267
       267
       +
       // writeAuthError writes a JSON error response for authentication failures

     

       268
       268
       +
       func writeAuthError(w http.ResponseWriter, message string) {

     

       269
       269
       +
       	w.Header().Set("Content-Type", "application/json")

     

       270
       270
       +
       	w.WriteHeader(http.StatusUnauthorized)

     

       271
       271
       +
       	// Use json.NewEncoder to properly escape the message and prevent injection

     

       272
       272
       +
       	if err := json.NewEncoder(w).Encode(map[string]string{

     

       273
       273
       +
       		"error":   "AuthenticationRequired",

     

       274
       274
       +
       		"message": message,

     

       275
       275
       +
       	}); err != nil {

     

       276
       276
       +
       		log.Printf("Failed to write auth error response: %v", err)

     

       277
       277
       +
       	}

     

       278
       278
       +
       }

+511 -728

internal/api/middleware/auth_test.go

···

       1
       1
        
       package middleware

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"Coves/internal/atproto/auth"

     

       4
       4
       +
       	"Coves/internal/atproto/oauth"

     

       5
       5
        
       	"context"

     

       6
       6
       -
       	"crypto/ecdsa"

     

       7
       7
       -
       	"crypto/elliptic"

     

       8
       8
       -
       	"crypto/rand"

     

       9
       9
       -
       	"crypto/sha256"

     

       10
       6
        
       	"encoding/base64"

     

       7
       7
       +
       	"encoding/json"

     

       11
       8
        
       	"fmt"

     

       12
       9
        
       	"net/http"

     

       13
       10
        
       	"net/http/httptest"

     
···

       15
       12
        
       	"testing"

     

       16
       13
        
       	"time"

     

       17
       14
        
       

     

       18
       18
       -
       	"github.com/golang-jwt/jwt/v5"

     

       19
       19
       -
       	"github.com/google/uuid"

     

       15
       15
       +
       	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       16
       16
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       20
       17
        
       )

     

       21
       18
        
       

     

       22
       22
       -
       // mockJWKSFetcher is a test double for JWKSFetcher

     

       23
       23
       -
       type mockJWKSFetcher struct {

     

       24
       24
       -
       	shouldFail bool

     

       19
       19
       +
       // mockOAuthClient is a test double for OAuthClient

     

       20
       20
       +
       type mockOAuthClient struct {

     

       21
       21
       +
       	sealSecret     []byte

     

       22
       22
       +
       	shouldFailSeal bool

     

       25
       23
        
       }

     

       26
       24
        
       

     

       27
       27
       -
       func (m *mockJWKSFetcher) FetchPublicKey(ctx context.Context, issuer, token string) (interface{}, error) {

     

       28
       28
       -
       	if m.shouldFail {

     

       29
       29
       -
       		return nil, fmt.Errorf("mock fetch failure")

     

       25
       25
       +
       func newMockOAuthClient() *mockOAuthClient {

     

       26
       26
       +
       	// Create a 32-byte seal secret for testing

     

       27
       27
       +
       	secret := []byte("test-secret-key-32-bytes-long!!")

     

       28
       28
       +
       	return &mockOAuthClient{

     

       29
       29
       +
       		sealSecret: secret,

     

       30
       30
        
       	}

     

       31
       31
       -
       	// Return nil - we won't actually verify signatures in Phase 1 tests

     

       32
       32
       -
       	return nil, nil

     

       33
       31
        
       }

     

       34
       32
        
       

     

       35
       35
       -
       // createTestToken creates a test JWT with the given DID

     

       36
       36
       -
       func createTestToken(did string) string {

     

       37
       37
       -
       	claims := jwt.MapClaims{

     

       38
       38
       -
       		"sub":   did,

     

       39
       39
       -
       		"iss":   "https://test.pds.local",

     

       40
       40
       -
       		"scope": "atproto",

     

       41
       41
       -
       		"exp":   time.Now().Add(1 * time.Hour).Unix(),

     

       42
       42
       -
       		"iat":   time.Now().Unix(),

     

       33
       33
       +
       func (m *mockOAuthClient) UnsealSession(token string) (*oauth.SealedSession, error) {

     

       34
       34
       +
       	if m.shouldFailSeal {

     

       35
       35
       +
       		return nil, fmt.Errorf("mock unseal failure")

     

       43
       36
        
       	}

     

       44
       37
        
       

     

       45
       45
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       46
       46
       -
       	tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       47
       47
       -
       	return tokenString

     

       38
       38
       +
       	// For testing, we'll decode a simple format: base64(did|sessionID|expiresAt)

     

       39
       39
       +
       	// In production this would be AES-GCM encrypted

     

       40
       40
       +
       	// Using pipe separator to avoid conflicts with colon in DIDs

     

       41
       41
       +
       	decoded, err := base64.RawURLEncoding.DecodeString(token)

     

       42
       42
       +
       	if err != nil {

     

       43
       43
       +
       		return nil, fmt.Errorf("invalid token encoding: %w", err)

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	parts := strings.Split(string(decoded), "|")

     

       47
       47
       +
       	if len(parts) != 3 {

     

       48
       48
       +
       		return nil, fmt.Errorf("invalid token format")

     

       49
       49
       +
       	}

     

       50
       50
       +
       

     

       51
       51
       +
       	var expiresAt int64

     

       52
       52
       +
       	_, _ = fmt.Sscanf(parts[2], "%d", &expiresAt)

     

       53
       53
       +
       

     

       54
       54
       +
       	// Check expiration

     

       55
       55
       +
       	if expiresAt <= time.Now().Unix() {

     

       56
       56
       +
       		return nil, fmt.Errorf("token expired")

     

       57
       57
       +
       	}

     

       58
       58
       +
       

     

       59
       59
       +
       	return &oauth.SealedSession{

     

       60
       60
       +
       		DID:       parts[0],

     

       61
       61
       +
       		SessionID: parts[1],

     

       62
       62
       +
       		ExpiresAt: expiresAt,

     

       63
       63
       +
       	}, nil

     

       64
       64
       +
       }

     

       65
       65
       +
       

     

       66
       66
       +
       // Helper to create a test sealed token

     

       67
       67
       +
       func (m *mockOAuthClient) createTestToken(did, sessionID string, ttl time.Duration) string {

     

       68
       68
       +
       	expiresAt := time.Now().Add(ttl).Unix()

     

       69
       69
       +
       	payload := fmt.Sprintf("%s|%s|%d", did, sessionID, expiresAt)

     

       70
       70
       +
       	return base64.RawURLEncoding.EncodeToString([]byte(payload))

     

       71
       71
       +
       }

     

       72
       72
       +
       

     

       73
       73
       +
       // mockOAuthStore is a test double for ClientAuthStore

     

       74
       74
       +
       type mockOAuthStore struct {

     

       75
       75
       +
       	sessions map[string]*oauthlib.ClientSessionData

     

       76
       76
       +
       }

     

       77
       77
       +
       

     

       78
       78
       +
       func newMockOAuthStore() *mockOAuthStore {

     

       79
       79
       +
       	return &mockOAuthStore{

     

       80
       80
       +
       		sessions: make(map[string]*oauthlib.ClientSessionData),

     

       81
       81
       +
       	}

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       func (m *mockOAuthStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauthlib.ClientSessionData, error) {

     

       85
       85
       +
       	key := did.String() + ":" + sessionID

     

       86
       86
       +
       	session, ok := m.sessions[key]

     

       87
       87
       +
       	if !ok {

     

       88
       88
       +
       		return nil, fmt.Errorf("session not found")

     

       89
       89
       +
       	}

     

       90
       90
       +
       	return session, nil

     

       48
       91
        
       }

     

       49
       92
        
       

     

       50
       50
       -
       // TestRequireAuth_ValidToken tests that valid tokens are accepted with DPoP scheme (Phase 1)

     

       93
       93
       +
       func (m *mockOAuthStore) SaveSession(ctx context.Context, session oauthlib.ClientSessionData) error {

     

       94
       94
       +
       	key := session.AccountDID.String() + ":" + session.SessionID

     

       95
       95
       +
       	m.sessions[key] = &session

     

       96
       96
       +
       	return nil

     

       97
       97
       +
       }

     

       98
       98
       +
       

     

       99
       99
       +
       func (m *mockOAuthStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error {

     

       100
       100
       +
       	key := did.String() + ":" + sessionID

     

       101
       101
       +
       	delete(m.sessions, key)

     

       102
       102
       +
       	return nil

     

       103
       103
       +
       }

     

       104
       104
       +
       

     

       105
       105
       +
       func (m *mockOAuthStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauthlib.AuthRequestData, error) {

     

       106
       106
       +
       	return nil, fmt.Errorf("not implemented")

     

       107
       107
       +
       }

     

       108
       108
       +
       

     

       109
       109
       +
       func (m *mockOAuthStore) SaveAuthRequestInfo(ctx context.Context, info oauthlib.AuthRequestData) error {

     

       110
       110
       +
       	return fmt.Errorf("not implemented")

     

       111
       111
       +
       }

     

       112
       112
       +
       

     

       113
       113
       +
       func (m *mockOAuthStore) DeleteAuthRequestInfo(ctx context.Context, state string) error {

     

       114
       114
       +
       	return fmt.Errorf("not implemented")

     

       115
       115
       +
       }

     

       116
       116
       +
       

     

       117
       117
       +
       // TestRequireAuth_ValidToken tests that valid sealed tokens are accepted

     

       51
       118
        
       func TestRequireAuth_ValidToken(t *testing.T) {

     

       52
       52
       -
       	fetcher := &mockJWKSFetcher{}

     

       53
       53
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true) // skipVerify=true

     

       119
       119
       +
       	client := newMockOAuthClient()

     

       120
       120
       +
       	store := newMockOAuthStore()

     

       121
       121
       +
       

     

       122
       122
       +
       	// Create a test session

     

       123
       123
       +
       	did := syntax.DID("did:plc:test123")

     

       124
       124
       +
       	sessionID := "session123"

     

       125
       125
       +
       	session := &oauthlib.ClientSessionData{

     

       126
       126
       +
       		AccountDID:  did,

     

       127
       127
       +
       		SessionID:   sessionID,

     

       128
       128
       +
       		AccessToken: "test_access_token",

     

       129
       129
       +
       		HostURL:     "https://pds.example.com",

     

       130
       130
       +
       	}

     

       131
       131
       +
       	_ = store.SaveSession(context.Background(), *session)

     

       132
       132
       +
       

     

       133
       133
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       54
       134
        
       

     

       55
       135
        
       	handlerCalled := false

     

       56
       136
        
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       57
       137
        
       		handlerCalled = true

     

       58
       138
        
       

     

       59
       139
        
       		// Verify DID was extracted and injected into context

     

       60
       60
       -
       		did := GetUserDID(r)

     

       61
       61
       -
       		if did != "did:plc:test123" {

     

       62
       62
       -
       			t.Errorf("expected DID 'did:plc:test123', got %s", did)

     

       140
       140
       +
       		extractedDID := GetUserDID(r)

     

       141
       141
       +
       		if extractedDID != "did:plc:test123" {

     

       142
       142
       +
       			t.Errorf("expected DID 'did:plc:test123', got %s", extractedDID)

     

       63
       143
        
       		}

     

       64
       144
        
       

     

       65
       65
       -
       		// Verify claims were injected

     

       66
       66
       -
       		claims := GetJWTClaims(r)

     

       67
       67
       -
       		if claims == nil {

     

       68
       68
       -
       			t.Error("expected claims to be non-nil")

     

       145
       145
       +
       		// Verify OAuth session was injected

     

       146
       146
       +
       		oauthSession := GetOAuthSession(r)

     

       147
       147
       +
       		if oauthSession == nil {

     

       148
       148
       +
       			t.Error("expected OAuth session to be non-nil")

     

       69
       149
        
       			return

     

       70
       150
        
       		}

     

       71
       71
       -
       		if claims.Subject != "did:plc:test123" {

     

       72
       72
       -
       			t.Errorf("expected claims.Subject 'did:plc:test123', got %s", claims.Subject)

     

       151
       151
       +
       		if oauthSession.SessionID != sessionID {

     

       152
       152
       +
       			t.Errorf("expected session ID '%s', got %s", sessionID, oauthSession.SessionID)

     

       153
       153
       +
       		}

     

       154
       154
       +
       

     

       155
       155
       +
       		// Verify access token is available

     

       156
       156
       +
       		accessToken := GetUserAccessToken(r)

     

       157
       157
       +
       		if accessToken != "test_access_token" {

     

       158
       158
       +
       			t.Errorf("expected access token 'test_access_token', got %s", accessToken)

     

       73
       159
        
       		}

     

       74
       160
        
       

     

       75
       161
        
       		w.WriteHeader(http.StatusOK)

     

       76
       162
        
       	}))

     

       77
       163
        
       

     

       78
       78
       -
       	token := createTestToken("did:plc:test123")

     

       164
       164
       +
       	token := client.createTestToken("did:plc:test123", sessionID, time.Hour)

     

       79
       165
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       80
       80
       -
       	req.Header.Set("Authorization", "DPoP "+token)

     

       166
       166
       +
       	req.Header.Set("Authorization", "Bearer "+token)

     

       81
       167
        
       	w := httptest.NewRecorder()

     

       82
       168
        
       

     

       83
       169
        
       	handler.ServeHTTP(w, req)

     
···

       93
       179
        
       

     

       94
       180
        
       // TestRequireAuth_MissingAuthHeader tests that missing Authorization header is rejected

     

       95
       181
        
       func TestRequireAuth_MissingAuthHeader(t *testing.T) {

     

       96
       96
       -
       	fetcher := &mockJWKSFetcher{}

     

       97
       97
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       182
       182
       +
       	client := newMockOAuthClient()

     

       183
       183
       +
       	store := newMockOAuthStore()

     

       184
       184
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       98
       185
        
       

     

       99
       186
        
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       100
       187
        
       		t.Error("handler should not be called")

     
···

       111
       198
        
       	}

     

       112
       199
        
       }

     

       113
       200
        
       

     

       114
       114
       -
       // TestRequireAuth_InvalidAuthHeaderFormat tests that non-DPoP tokens are rejected (including Bearer)

     

       201
       201
       +
       // TestRequireAuth_InvalidAuthHeaderFormat tests that non-Bearer tokens are rejected

     

       115
       202
        
       func TestRequireAuth_InvalidAuthHeaderFormat(t *testing.T) {

     

       116
       116
       -
       	fetcher := &mockJWKSFetcher{}

     

       117
       117
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       203
       203
       +
       	client := newMockOAuthClient()

     

       204
       204
       +
       	store := newMockOAuthStore()

     

       205
       205
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       118
       206
        
       

     

       119
       207
        
       	tests := []struct {

     

       120
       208
        
       		name   string

     

       121
       209
        
       		header string

     

       122
       210
        
       	}{

     

       123
       211
        
       		{"Basic auth", "Basic dGVzdDp0ZXN0"},

     

       124
       124
       -
       		{"Bearer scheme", "Bearer some-token"},

     

       212
       212
       +
       		{"DPoP scheme", "DPoP some-token"},

     

       125
       213
        
       		{"Invalid format", "InvalidFormat"},

     

       126
       214
        
       	}

     

       127
       215
        
       

     
···

       144
       232
        
       	}

     

       145
       233
        
       }

     

       146
       234
        
       

     

       147
       147
       -
       // TestRequireAuth_BearerRejectionErrorMessage verifies that Bearer tokens are rejected

     

       148
       148
       -
       // with a helpful error message guiding users to use DPoP scheme

     

       149
       149
       -
       func TestRequireAuth_BearerRejectionErrorMessage(t *testing.T) {

     

       150
       150
       -
       	fetcher := &mockJWKSFetcher{}

     

       151
       151
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       152
       152
       -
       

     

       153
       153
       -
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       154
       154
       -
       		t.Error("handler should not be called")

     

       155
       155
       -
       	}))

     

       156
       156
       -
       

     

       157
       157
       -
       	req := httptest.NewRequest("GET", "/test", nil)

     

       158
       158
       -
       	req.Header.Set("Authorization", "Bearer some-token")

     

       159
       159
       -
       	w := httptest.NewRecorder()

     

       160
       160
       -
       

     

       161
       161
       -
       	handler.ServeHTTP(w, req)

     

       162
       162
       -
       

     

       163
       163
       -
       	if w.Code != http.StatusUnauthorized {

     

       164
       164
       -
       		t.Errorf("expected status 401, got %d", w.Code)

     

       165
       165
       -
       	}

     

       235
       235
       +
       // TestRequireAuth_CaseInsensitiveScheme verifies that Bearer scheme matching is case-insensitive

     

       236
       236
       +
       func TestRequireAuth_CaseInsensitiveScheme(t *testing.T) {

     

       237
       237
       +
       	client := newMockOAuthClient()

     

       238
       238
       +
       	store := newMockOAuthStore()

     

       166
       239
        
       

     

       167
       167
       -
       	// Verify error message guides user to use DPoP

     

       168
       168
       -
       	body := w.Body.String()

     

       169
       169
       -
       	if !strings.Contains(body, "Expected: DPoP") {

     

       170
       170
       -
       		t.Errorf("error message should guide user to use DPoP, got: %s", body)

     

       240
       240
       +
       	// Create a test session

     

       241
       241
       +
       	did := syntax.DID("did:plc:test123")

     

       242
       242
       +
       	sessionID := "session123"

     

       243
       243
       +
       	session := &oauthlib.ClientSessionData{

     

       244
       244
       +
       		AccountDID:  did,

     

       245
       245
       +
       		SessionID:   sessionID,

     

       246
       246
       +
       		AccessToken: "test_access_token",

     

       171
       247
        
       	}

     

       172
       172
       -
       }

     

       173
       173
       -
       

     

       174
       174
       -
       // TestRequireAuth_CaseInsensitiveScheme verifies that DPoP scheme matching is case-insensitive

     

       175
       175
       -
       // per RFC 7235 which states HTTP auth schemes are case-insensitive

     

       176
       176
       -
       func TestRequireAuth_CaseInsensitiveScheme(t *testing.T) {

     

       177
       177
       -
       	fetcher := &mockJWKSFetcher{}

     

       178
       178
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       248
       248
       +
       	_ = store.SaveSession(context.Background(), *session)

     

       179
       249
        
       

     

       180
       180
       -
       	// Create a valid JWT for testing

     

       181
       181
       -
       	validToken := createValidJWT(t, "did:plc:test123", time.Hour)

     

       250
       250
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       251
       251
       +
       	token := client.createTestToken("did:plc:test123", sessionID, time.Hour)

     

       182
       252
        
       

     

       183
       253
        
       	testCases := []struct {

     

       184
       254
        
       		name   string

     

       185
       255
        
       		scheme string

     

       186
       256
        
       	}{

     

       187
       187
       -
       		{"lowercase", "dpop"},

     

       188
       188
       -
       		{"uppercase", "DPOP"},

     

       189
       189
       -
       		{"mixed_case", "DpOp"},

     

       190
       190
       -
       		{"standard", "DPoP"},

     

       257
       257
       +
       		{"lowercase", "bearer"},

     

       258
       258
       +
       		{"uppercase", "BEARER"},

     

       259
       259
       +
       		{"mixed_case", "BeArEr"},

     

       260
       260
       +
       		{"standard", "Bearer"},

     

       191
       261
        
       	}

     

       192
       262
        
       

     

       193
       263
        
       	for _, tc := range testCases {

     
···

       199
       269
        
       			}))

     

       200
       270
        
       

     

       201
       271
        
       			req := httptest.NewRequest("GET", "/test", nil)

     

       202
       202
       -
       			req.Header.Set("Authorization", tc.scheme+" "+validToken)

     

       272
       272
       +
       			req.Header.Set("Authorization", tc.scheme+" "+token)

     

       203
       273
        
       			w := httptest.NewRecorder()

     

       204
       274
        
       

     

       205
       275
        
       			handler.ServeHTTP(w, req)

     
···

       212
       282
        
       	}

     

       213
       283
        
       }

     

       214
       284
        
       

     

       215
       215
       -
       // TestRequireAuth_MalformedToken tests that malformed JWTs are rejected

     

       216
       216
       -
       func TestRequireAuth_MalformedToken(t *testing.T) {

     

       217
       217
       -
       	fetcher := &mockJWKSFetcher{}

     

       218
       218
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       285
       285
       +
       // TestRequireAuth_InvalidToken tests that malformed sealed tokens are rejected

     

       286
       286
       +
       func TestRequireAuth_InvalidToken(t *testing.T) {

     

       287
       287
       +
       	client := newMockOAuthClient()

     

       288
       288
       +
       	store := newMockOAuthStore()

     

       289
       289
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       219
       290
        
       

     

       220
       291
        
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       221
       292
        
       		t.Error("handler should not be called")

     

       222
       293
        
       	}))

     

       223
       294
        
       

     

       224
       295
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       225
       225
       -
       	req.Header.Set("Authorization", "DPoP not-a-valid-jwt")

     

       296
       296
       +
       	req.Header.Set("Authorization", "Bearer not-a-valid-sealed-token")

     

       226
       297
        
       	w := httptest.NewRecorder()

     

       227
       298
        
       

     

       228
       299
        
       	handler.ServeHTTP(w, req)

     
···

       232
       303
        
       	}

     

       233
       304
        
       }

     

       234
       305
        
       

     

       235
       235
       -
       // TestRequireAuth_ExpiredToken tests that expired tokens are rejected

     

       306
       306
       +
       // TestRequireAuth_ExpiredToken tests that expired sealed tokens are rejected

     

       236
       307
        
       func TestRequireAuth_ExpiredToken(t *testing.T) {

     

       237
       237
       -
       	fetcher := &mockJWKSFetcher{}

     

       238
       238
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       308
       308
       +
       	client := newMockOAuthClient()

     

       309
       309
       +
       	store := newMockOAuthStore()

     

       310
       310
       +
       

     

       311
       311
       +
       	// Create a test session

     

       312
       312
       +
       	did := syntax.DID("did:plc:test123")

     

       313
       313
       +
       	sessionID := "session123"

     

       314
       314
       +
       	session := &oauthlib.ClientSessionData{

     

       315
       315
       +
       		AccountDID:  did,

     

       316
       316
       +
       		SessionID:   sessionID,

     

       317
       317
       +
       		AccessToken: "test_access_token",

     

       318
       318
       +
       	}

     

       319
       319
       +
       	_ = store.SaveSession(context.Background(), *session)

     

       320
       320
       +
       

     

       321
       321
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       239
       322
        
       

     

       240
       323
        
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       241
       324
        
       		t.Error("handler should not be called for expired token")

     

       242
       325
        
       	}))

     

       243
       326
        
       

     

       244
       244
       -
       	// Create expired token

     

       245
       245
       -
       	claims := jwt.MapClaims{

     

       246
       246
       -
       		"sub":   "did:plc:test123",

     

       247
       247
       -
       		"iss":   "https://test.pds.local",

     

       248
       248
       -
       		"scope": "atproto",

     

       249
       249
       -
       		"exp":   time.Now().Add(-1 * time.Hour).Unix(), // Expired 1 hour ago

     

       250
       250
       -
       		"iat":   time.Now().Add(-2 * time.Hour).Unix(),

     

       251
       251
       -
       	}

     

       252
       252
       -
       

     

       253
       253
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       254
       254
       -
       	tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       327
       327
       +
       	// Create expired token (expired 1 hour ago)

     

       328
       328
       +
       	token := client.createTestToken("did:plc:test123", sessionID, -time.Hour)

     

       255
       329
        
       

     

       256
       330
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       257
       257
       -
       	req.Header.Set("Authorization", "DPoP "+tokenString)

     

       331
       331
       +
       	req.Header.Set("Authorization", "Bearer "+token)

     

       258
       332
        
       	w := httptest.NewRecorder()

     

       259
       333
        
       

     

       260
       334
        
       	handler.ServeHTTP(w, req)

     
···

       264
       338
        
       	}

     

       265
       339
        
       }

     

       266
       340
        
       

     

       267
       267
       -
       // TestRequireAuth_MissingDID tests that tokens without DID are rejected

     

       268
       268
       -
       func TestRequireAuth_MissingDID(t *testing.T) {

     

       269
       269
       -
       	fetcher := &mockJWKSFetcher{}

     

       270
       270
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       341
       341
       +
       // TestRequireAuth_SessionNotFound tests that tokens with non-existent sessions are rejected

     

       342
       342
       +
       func TestRequireAuth_SessionNotFound(t *testing.T) {

     

       343
       343
       +
       	client := newMockOAuthClient()

     

       344
       344
       +
       	store := newMockOAuthStore()

     

       345
       345
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       271
       346
        
       

     

       272
       347
        
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       273
       348
        
       		t.Error("handler should not be called")

     

       274
       349
        
       	}))

     

       275
       350
        
       

     

       276
       276
       -
       	// Create token without sub claim

     

       277
       277
       -
       	claims := jwt.MapClaims{

     

       278
       278
       -
       		// "sub" missing

     

       279
       279
       -
       		"iss":   "https://test.pds.local",

     

       280
       280
       -
       		"scope": "atproto",

     

       281
       281
       -
       		"exp":   time.Now().Add(1 * time.Hour).Unix(),

     

       282
       282
       -
       		"iat":   time.Now().Unix(),

     

       351
       351
       +
       	// Create token for session that doesn't exist in store

     

       352
       352
       +
       	token := client.createTestToken("did:plc:nonexistent", "session999", time.Hour)

     

       353
       353
       +
       

     

       354
       354
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       355
       355
       +
       	req.Header.Set("Authorization", "Bearer "+token)

     

       356
       356
       +
       	w := httptest.NewRecorder()

     

       357
       357
       +
       

     

       358
       358
       +
       	handler.ServeHTTP(w, req)

     

       359
       359
       +
       

     

       360
       360
       +
       	if w.Code != http.StatusUnauthorized {

     

       361
       361
       +
       		t.Errorf("expected status 401, got %d", w.Code)

     

       362
       362
       +
       	}

     

       363
       363
       +
       }

     

       364
       364
       +
       

     

       365
       365
       +
       // TestRequireAuth_DIDMismatch tests that session DID must match token DID

     

       366
       366
       +
       func TestRequireAuth_DIDMismatch(t *testing.T) {

     

       367
       367
       +
       	client := newMockOAuthClient()

     

       368
       368
       +
       	store := newMockOAuthStore()

     

       369
       369
       +
       

     

       370
       370
       +
       	// Create a session with different DID than token

     

       371
       371
       +
       	did := syntax.DID("did:plc:different")

     

       372
       372
       +
       	sessionID := "session123"

     

       373
       373
       +
       	session := &oauthlib.ClientSessionData{

     

       374
       374
       +
       		AccountDID:  did,

     

       375
       375
       +
       		SessionID:   sessionID,

     

       376
       376
       +
       		AccessToken: "test_access_token",

     

       283
       377
        
       	}

     

       378
       378
       +
       	// Store with key that matches token DID

     

       379
       379
       +
       	key := "did:plc:test123:" + sessionID

     

       380
       380
       +
       	store.sessions[key] = session

     

       284
       381
        
       

     

       285
       285
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       286
       286
       -
       	tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       382
       382
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       383
       383
       +
       

     

       384
       384
       +
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       385
       385
       +
       		t.Error("handler should not be called when DID mismatches")

     

       386
       386
       +
       	}))

     

       387
       387
       +
       

     

       388
       388
       +
       	token := client.createTestToken("did:plc:test123", sessionID, time.Hour)

     

       287
       389
        
       

     

       288
       390
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       289
       289
       -
       	req.Header.Set("Authorization", "DPoP "+tokenString)

     

       391
       391
       +
       	req.Header.Set("Authorization", "Bearer "+token)

     

       290
       392
        
       	w := httptest.NewRecorder()

     

       291
       393
        
       

     

       292
       394
        
       	handler.ServeHTTP(w, req)

     
···

       296
       398
        
       	}

     

       297
       399
        
       }

     

       298
       400
        
       

     

       299
       299
       -
       // TestOptionalAuth_WithToken tests that OptionalAuth accepts valid DPoP tokens

     

       401
       401
       +
       // TestOptionalAuth_WithToken tests that OptionalAuth accepts valid Bearer tokens

     

       300
       402
        
       func TestOptionalAuth_WithToken(t *testing.T) {

     

       301
       301
       -
       	fetcher := &mockJWKSFetcher{}

     

       302
       302
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       403
       403
       +
       	client := newMockOAuthClient()

     

       404
       404
       +
       	store := newMockOAuthStore()

     

       405
       405
       +
       

     

       406
       406
       +
       	// Create a test session

     

       407
       407
       +
       	did := syntax.DID("did:plc:test123")

     

       408
       408
       +
       	sessionID := "session123"

     

       409
       409
       +
       	session := &oauthlib.ClientSessionData{

     

       410
       410
       +
       		AccountDID:  did,

     

       411
       411
       +
       		SessionID:   sessionID,

     

       412
       412
       +
       		AccessToken: "test_access_token",

     

       413
       413
       +
       	}

     

       414
       414
       +
       	_ = store.SaveSession(context.Background(), *session)

     

       415
       415
       +
       

     

       416
       416
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       303
       417
        
       

     

       304
       418
        
       	handlerCalled := false

     

       305
       419
        
       	handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       306
       420
        
       		handlerCalled = true

     

       307
       421
        
       

     

       308
       422
        
       		// Verify DID was extracted

     

       309
       309
       -
       		did := GetUserDID(r)

     

       310
       310
       -
       		if did != "did:plc:test123" {

     

       311
       311
       -
       			t.Errorf("expected DID 'did:plc:test123', got %s", did)

     

       423
       423
       +
       		extractedDID := GetUserDID(r)

     

       424
       424
       +
       		if extractedDID != "did:plc:test123" {

     

       425
       425
       +
       			t.Errorf("expected DID 'did:plc:test123', got %s", extractedDID)

     

       312
       426
        
       		}

     

       313
       427
        
       

     

       314
       428
        
       		w.WriteHeader(http.StatusOK)

     

       315
       429
        
       	}))

     

       316
       430
        
       

     

       317
       317
       -
       	token := createTestToken("did:plc:test123")

     

       431
       431
       +
       	token := client.createTestToken("did:plc:test123", sessionID, time.Hour)

     

       318
       432
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       319
       319
       -
       	req.Header.Set("Authorization", "DPoP "+token)

     

       433
       433
       +
       	req.Header.Set("Authorization", "Bearer "+token)

     

       320
       434
        
       	w := httptest.NewRecorder()

     

       321
       435
        
       

     

       322
       436
        
       	handler.ServeHTTP(w, req)

     
···

       332
       446
        
       

     

       333
       447
        
       // TestOptionalAuth_WithoutToken tests that OptionalAuth allows requests without tokens

     

       334
       448
        
       func TestOptionalAuth_WithoutToken(t *testing.T) {

     

       335
       335
       -
       	fetcher := &mockJWKSFetcher{}

     

       336
       336
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       449
       449
       +
       	client := newMockOAuthClient()

     

       450
       450
       +
       	store := newMockOAuthStore()

     

       451
       451
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       337
       452
        
       

     

       338
       453
        
       	handlerCalled := false

     

       339
       454
        
       	handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     
···

       365
       480
        
       

     

       366
       481
        
       // TestOptionalAuth_InvalidToken tests that OptionalAuth continues without auth on invalid token

     

       367
       482
        
       func TestOptionalAuth_InvalidToken(t *testing.T) {

     

       368
       368
       -
       	fetcher := &mockJWKSFetcher{}

     

       369
       369
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       483
       483
       +
       	client := newMockOAuthClient()

     

       484
       484
       +
       	store := newMockOAuthStore()

     

       485
       485
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       370
       486
        
       

     

       371
       487
        
       	handlerCalled := false

     

       372
       488
        
       	handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     
···

       382
       498
        
       	}))

     

       383
       499
        
       

     

       384
       500
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       385
       385
       -
       	req.Header.Set("Authorization", "DPoP not-a-valid-jwt")

     

       501
       501
       +
       	req.Header.Set("Authorization", "Bearer not-a-valid-sealed-token")

     

       386
       502
        
       	w := httptest.NewRecorder()

     

       387
       503
        
       

     

       388
       504
        
       	handler.ServeHTTP(w, req)

     
···

       406
       522
        
       	}

     

       407
       523
        
       }

     

       408
       524
        
       

     

       409
       409
       -
       // TestGetJWTClaims_NotAuthenticated tests that GetJWTClaims returns nil when not authenticated

     

       410
       410
       -
       func TestGetJWTClaims_NotAuthenticated(t *testing.T) {

     

       525
       525
       +
       // TestGetOAuthSession_NotAuthenticated tests that GetOAuthSession returns nil when not authenticated

     

       526
       526
       +
       func TestGetOAuthSession_NotAuthenticated(t *testing.T) {

     

       411
       527
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       412
       412
       -
       	claims := GetJWTClaims(req)

     

       528
       528
       +
       	session := GetOAuthSession(req)

     

       413
       529
        
       

     

       414
       414
       -
       	if claims != nil {

     

       415
       415
       -
       		t.Errorf("expected nil claims, got %+v", claims)

     

       530
       530
       +
       	if session != nil {

     

       531
       531
       +
       		t.Errorf("expected nil session, got %+v", session)

     

       416
       532
        
       	}

     

       417
       533
        
       }

     

       418
       534
        
       

     

       419
       419
       -
       // TestGetDPoPProof_NotAuthenticated tests that GetDPoPProof returns nil when no DPoP was verified

     

       420
       420
       -
       func TestGetDPoPProof_NotAuthenticated(t *testing.T) {

     

       535
       535
       +
       // TestGetUserAccessToken_NotAuthenticated tests that GetUserAccessToken returns empty when not authenticated

     

       536
       536
       +
       func TestGetUserAccessToken_NotAuthenticated(t *testing.T) {

     

       421
       537
        
       	req := httptest.NewRequest("GET", "/test", nil)

     

       422
       422
       -
       	proof := GetDPoPProof(req)

     

       538
       538
       +
       	token := GetUserAccessToken(req)

     

       423
       539
        
       

     

       424
       424
       -
       	if proof != nil {

     

       425
       425
       -
       		t.Errorf("expected nil proof, got %+v", proof)

     

       540
       540
       +
       	if token != "" {

     

       541
       541
       +
       		t.Errorf("expected empty token, got %s", token)

     

       426
       542
        
       	}

     

       427
       543
        
       }

     

       428
       544
        
       

     

       429
       429
       -
       // TestRequireAuth_WithDPoP_SecurityModel tests the correct DPoP security model:

     

       430
       430
       -
       // Token MUST be verified first, then DPoP is checked as an additional layer.

     

       431
       431
       -
       // DPoP is NOT a fallback for failed token verification.

     

       432
       432
       -
       func TestRequireAuth_WithDPoP_SecurityModel(t *testing.T) {

     

       433
       433
       -
       	// Generate an ECDSA key pair for DPoP

     

       434
       434
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       435
       435
       -
       	if err != nil {

     

       436
       436
       -
       		t.Fatalf("failed to generate key: %v", err)

     

       437
       437
       -
       	}

     

       545
       545
       +
       // TestSetTestUserDID tests the testing helper function

     

       546
       546
       +
       func TestSetTestUserDID(t *testing.T) {

     

       547
       547
       +
       	ctx := context.Background()

     

       548
       548
       +
       	ctx = SetTestUserDID(ctx, "did:plc:testuser")

     

       438
       549
        
       

     

       439
       439
       -
       	// Calculate JWK thumbprint for cnf.jkt

     

       440
       440
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       441
       441
       -
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       442
       442
       -
       	if err != nil {

     

       443
       443
       -
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       550
       550
       +
       	did, ok := ctx.Value(UserDIDKey).(string)

     

       551
       551
       +
       	if !ok {

     

       552
       552
       +
       		t.Error("DID not found in context")

     

       444
       553
        
       	}

     

       554
       554
       +
       	if did != "did:plc:testuser" {

     

       555
       555
       +
       		t.Errorf("expected 'did:plc:testuser', got %s", did)

     

       556
       556
       +
       	}

     

       557
       557
       +
       }

     

       445
       558
        
       

     

       446
       446
       -
       	t.Run("DPoP_is_NOT_fallback_for_failed_verification", func(t *testing.T) {

     

       447
       447
       -
       		// SECURITY TEST: When token verification fails, DPoP should NOT be used as fallback

     

       448
       448
       -
       		// This prevents an attacker from forging a token with their own cnf.jkt

     

       449
       449
       -
       

     

       450
       450
       -
       		// Create a DPoP-bound access token (unsigned - will fail verification)

     

       451
       451
       -
       		claims := auth.Claims{

     

       452
       452
       -
       			RegisteredClaims: jwt.RegisteredClaims{

     

       453
       453
       -
       				Subject:   "did:plc:attacker",

     

       454
       454
       -
       				Issuer:    "https://external.pds.local",

     

       455
       455
       -
       				ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       456
       456
       -
       				IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       457
       457
       -
       			},

     

       458
       458
       -
       			Scope: "atproto",

     

       459
       459
       -
       			Confirmation: map[string]interface{}{

     

       460
       460
       -
       				"jkt": thumbprint,

     

       461
       461
       -
       			},

     

       462
       462
       -
       		}

     

       463
       463
       -
       

     

       464
       464
       -
       		token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       465
       465
       -
       		tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       559
       559
       +
       // TestExtractBearerToken tests the Bearer token extraction logic

     

       560
       560
       +
       func TestExtractBearerToken(t *testing.T) {

     

       561
       561
       +
       	tests := []struct {

     

       562
       562
       +
       		name        string

     

       563
       563
       +
       		authHeader  string

     

       564
       564
       +
       		expectToken string

     

       565
       565
       +
       		expectOK    bool

     

       566
       566
       +
       	}{

     

       567
       567
       +
       		{"valid bearer", "Bearer token123", "token123", true},

     

       568
       568
       +
       		{"lowercase bearer", "bearer token123", "token123", true},

     

       569
       569
       +
       		{"uppercase bearer", "BEARER token123", "token123", true},

     

       570
       570
       +
       		{"mixed case", "BeArEr token123", "token123", true},

     

       571
       571
       +
       		{"empty header", "", "", false},

     

       572
       572
       +
       		{"wrong scheme", "DPoP token123", "", false},

     

       573
       573
       +
       		{"no token", "Bearer", "", false},

     

       574
       574
       +
       		{"no space", "Bearertoken123", "", false},

     

       575
       575
       +
       		{"extra spaces", "Bearer  token123  ", "token123", true},

     

       576
       576
       +
       	}

     

       466
       577
        
       

     

       467
       467
       -
       		// Create valid DPoP proof (attacker has the private key)

     

       468
       468
       -
       		dpopProof := createDPoPProof(t, privateKey, "GET", "https://test.local/api/endpoint")

     

       578
       578
       +
       	for _, tt := range tests {

     

       579
       579
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       580
       580
       +
       			token, ok := extractBearerToken(tt.authHeader)

     

       581
       581
       +
       			if ok != tt.expectOK {

     

       582
       582
       +
       				t.Errorf("expected ok=%v, got %v", tt.expectOK, ok)

     

       583
       583
       +
       			}

     

       584
       584
       +
       			if token != tt.expectToken {

     

       585
       585
       +
       				t.Errorf("expected token '%s', got '%s'", tt.expectToken, token)

     

       586
       586
       +
       			}

     

       587
       587
       +
       		})

     

       588
       588
       +
       	}

     

       589
       589
       +
       }

     

       469
       590
        
       

     

       470
       470
       -
       		// Mock fetcher that fails (simulating external PDS without JWKS)

     

       471
       471
       -
       		fetcher := &mockJWKSFetcher{shouldFail: true}

     

       472
       472
       -
       		middleware := NewAtProtoAuthMiddleware(fetcher, false) // skipVerify=false

     

       591
       591
       +
       // TestRequireAuth_ValidCookie tests that valid session cookies are accepted

     

       592
       592
       +
       func TestRequireAuth_ValidCookie(t *testing.T) {

     

       593
       593
       +
       	client := newMockOAuthClient()

     

       594
       594
       +
       	store := newMockOAuthStore()

     

       473
       595
        
       

     

       474
       474
       -
       		handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       475
       475
       -
       			t.Error("SECURITY VULNERABILITY: handler was called despite token verification failure")

     

       476
       476
       -
       		}))

     

       596
       596
       +
       	// Create a test session

     

       597
       597
       +
       	did := syntax.DID("did:plc:test123")

     

       598
       598
       +
       	sessionID := "session123"

     

       599
       599
       +
       	session := &oauthlib.ClientSessionData{

     

       600
       600
       +
       		AccountDID:  did,

     

       601
       601
       +
       		SessionID:   sessionID,

     

       602
       602
       +
       		AccessToken: "test_access_token",

     

       603
       603
       +
       		HostURL:     "https://pds.example.com",

     

       604
       604
       +
       	}

     

       605
       605
       +
       	_ = store.SaveSession(context.Background(), *session)

     

       477
       606
        
       

     

       478
       478
       -
       		req := httptest.NewRequest("GET", "https://test.local/api/endpoint", nil)

     

       479
       479
       -
       		req.Header.Set("Authorization", "DPoP "+tokenString)

     

       480
       480
       -
       		req.Header.Set("DPoP", dpopProof)

     

       481
       481
       -
       		w := httptest.NewRecorder()

     

       607
       607
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       482
       608
        
       

     

       483
       483
       -
       		handler.ServeHTTP(w, req)

     

       609
       609
       +
       	handlerCalled := false

     

       610
       610
       +
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       611
       611
       +
       		handlerCalled = true

     

       484
       612
        
       

     

       485
       485
       -
       		// MUST reject - token verification failed, DPoP cannot substitute for signature verification

     

       486
       486
       -
       		if w.Code != http.StatusUnauthorized {

     

       487
       487
       -
       			t.Errorf("SECURITY: expected 401 for unverified token, got %d", w.Code)

     

       613
       613
       +
       		// Verify DID was extracted and injected into context

     

       614
       614
       +
       		extractedDID := GetUserDID(r)

     

       615
       615
       +
       		if extractedDID != "did:plc:test123" {

     

       616
       616
       +
       			t.Errorf("expected DID 'did:plc:test123', got %s", extractedDID)

     

       488
       617
        
       		}

     

       489
       489
       -
       	})

     

       490
       618
        
       

     

       491
       491
       -
       	t.Run("DPoP_required_when_cnf_jkt_present_in_verified_token", func(t *testing.T) {

     

       492
       492
       -
       		// When token has cnf.jkt, DPoP header MUST be present

     

       493
       493
       -
       		// This test uses skipVerify=true to simulate a verified token

     

       494
       494
       -
       

     

       495
       495
       -
       		claims := auth.Claims{

     

       496
       496
       -
       			RegisteredClaims: jwt.RegisteredClaims{

     

       497
       497
       -
       				Subject:   "did:plc:test123",

     

       498
       498
       -
       				Issuer:    "https://test.pds.local",

     

       499
       499
       -
       				ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       500
       500
       -
       				IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       501
       501
       -
       			},

     

       502
       502
       -
       			Scope: "atproto",

     

       503
       503
       -
       			Confirmation: map[string]interface{}{

     

       504
       504
       -
       				"jkt": thumbprint,

     

       505
       505
       -
       			},

     

       619
       619
       +
       		// Verify OAuth session was injected

     

       620
       620
       +
       		oauthSession := GetOAuthSession(r)

     

       621
       621
       +
       		if oauthSession == nil {

     

       622
       622
       +
       			t.Error("expected OAuth session to be non-nil")

     

       623
       623
       +
       			return

     

       506
       624
        
       		}

     

       507
       507
       -
       

     

       508
       508
       -
       		token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       509
       509
       -
       		tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       510
       510
       -
       

     

       511
       511
       -
       		// NO DPoP header - should fail when skipVerify is false

     

       512
       512
       -
       		// Note: with skipVerify=true, DPoP is not checked

     

       513
       513
       -
       		fetcher := &mockJWKSFetcher{}

     

       514
       514
       -
       		middleware := NewAtProtoAuthMiddleware(fetcher, true) // skipVerify=true for parsing

     

       515
       515
       -
       

     

       516
       516
       -
       		handlerCalled := false

     

       517
       517
       -
       		handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       518
       518
       -
       			handlerCalled = true

     

       519
       519
       -
       			w.WriteHeader(http.StatusOK)

     

       520
       520
       -
       		}))

     

       521
       521
       -
       

     

       522
       522
       -
       		req := httptest.NewRequest("GET", "https://test.local/api/endpoint", nil)

     

       523
       523
       -
       		req.Header.Set("Authorization", "DPoP "+tokenString)

     

       524
       524
       -
       		// No DPoP header

     

       525
       525
       -
       		w := httptest.NewRecorder()

     

       526
       526
       -
       

     

       527
       527
       -
       		handler.ServeHTTP(w, req)

     

       528
       528
       -
       

     

       529
       529
       -
       		// With skipVerify=true, DPoP is not checked, so this should succeed

     

       530
       530
       -
       		if !handlerCalled {

     

       531
       531
       -
       			t.Error("handler should be called when skipVerify=true")

     

       625
       625
       +
       		if oauthSession.SessionID != sessionID {

     

       626
       626
       +
       			t.Errorf("expected session ID '%s', got %s", sessionID, oauthSession.SessionID)

     

       532
       627
        
       		}

     

       533
       533
       -
       	})

     

       534
       534
       -
       }

     

       535
       535
       -
       

     

       536
       536
       -
       // TestRequireAuth_TokenVerificationFails_DPoPNotUsedAsFallback is the key security test.

     

       537
       537
       -
       // It ensures that DPoP cannot be used as a fallback when token signature verification fails.

     

       538
       538
       -
       func TestRequireAuth_TokenVerificationFails_DPoPNotUsedAsFallback(t *testing.T) {

     

       539
       539
       -
       	// Generate a key pair (attacker's key)

     

       540
       540
       -
       	attackerKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       541
       541
       -
       	jwk := ecdsaPublicKeyToJWK(&attackerKey.PublicKey)

     

       542
       542
       -
       	thumbprint, _ := auth.CalculateJWKThumbprint(jwk)

     

       543
       543
       -
       

     

       544
       544
       -
       	// Create a FORGED token claiming to be the victim

     

       545
       545
       -
       	claims := auth.Claims{

     

       546
       546
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       547
       547
       -
       			Subject:   "did:plc:victim_user", // Attacker claims to be victim

     

       548
       548
       -
       			Issuer:    "https://untrusted.pds",

     

       549
       549
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       550
       550
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       551
       551
       -
       		},

     

       552
       552
       -
       		Scope: "atproto",

     

       553
       553
       -
       		Confirmation: map[string]interface{}{

     

       554
       554
       -
       			"jkt": thumbprint, // Attacker uses their own key

     

       555
       555
       -
       		},

     

       556
       556
       -
       	}

     

       557
       557
       -
       

     

       558
       558
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       559
       559
       -
       	tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       560
       560
       -
       

     

       561
       561
       -
       	// Attacker creates a valid DPoP proof with their key

     

       562
       562
       -
       	dpopProof := createDPoPProof(t, attackerKey, "POST", "https://api.example.com/protected")

     

       563
       628
        
       

     

       564
       564
       -
       	// Fetcher fails (external PDS without JWKS)

     

       565
       565
       -
       	fetcher := &mockJWKSFetcher{shouldFail: true}

     

       566
       566
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, false) // skipVerify=false - REAL verification

     

       567
       567
       -
       

     

       568
       568
       -
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       569
       569
       -
       		t.Fatalf("CRITICAL SECURITY FAILURE: Request authenticated as %s despite forged token!",

     

       570
       570
       -
       			GetUserDID(r))

     

       629
       629
       +
       		w.WriteHeader(http.StatusOK)

     

       571
       630
        
       	}))

     

       572
       631
        
       

     

       573
       573
       -
       	req := httptest.NewRequest("POST", "https://api.example.com/protected", nil)

     

       574
       574
       -
       	req.Header.Set("Authorization", "DPoP "+tokenString)

     

       575
       575
       -
       	req.Header.Set("DPoP", dpopProof)

     

       632
       632
       +
       	token := client.createTestToken("did:plc:test123", sessionID, time.Hour)

     

       633
       633
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       634
       634
       +
       	req.AddCookie(&http.Cookie{

     

       635
       635
       +
       		Name:  "coves_session",

     

       636
       636
       +
       		Value: token,

     

       637
       637
       +
       	})

     

       576
       638
        
       	w := httptest.NewRecorder()

     

       577
       639
        
       

     

       578
       640
        
       	handler.ServeHTTP(w, req)

     

       579
       641
        
       

     

       580
       580
       -
       	// MUST reject - the token signature was never verified

     

       581
       581
       -
       	if w.Code != http.StatusUnauthorized {

     

       582
       582
       -
       		t.Errorf("SECURITY VULNERABILITY: Expected 401, got %d. Token was not properly verified!", w.Code)

     

       642
       642
       +
       	if !handlerCalled {

     

       643
       643
       +
       		t.Error("handler was not called")

     

       583
       644
        
       	}

     

       584
       584
       -
       }

     

       585
       645
        
       

     

       586
       586
       -
       // TestVerifyDPoPBinding_UsesForwardedProto ensures we honor the external HTTPS

     

       587
       587
       -
       // scheme when TLS is terminated upstream and X-Forwarded-Proto is present.

     

       588
       588
       -
       func TestVerifyDPoPBinding_UsesForwardedProto(t *testing.T) {

     

       589
       589
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       590
       590
       -
       	if err != nil {

     

       591
       591
       -
       		t.Fatalf("failed to generate key: %v", err)

     

       646
       646
       +
       	if w.Code != http.StatusOK {

     

       647
       647
       +
       		t.Errorf("expected status 200, got %d: %s", w.Code, w.Body.String())

     

       592
       648
        
       	}

     

       649
       649
       +
       }

     

       593
       650
        
       

     

       594
       594
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       595
       595
       -
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       596
       596
       -
       	if err != nil {

     

       597
       597
       -
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       598
       598
       -
       	}

     

       651
       651
       +
       // TestRequireAuth_HeaderPrecedenceOverCookie tests that Authorization header takes precedence over cookie

     

       652
       652
       +
       func TestRequireAuth_HeaderPrecedenceOverCookie(t *testing.T) {

     

       653
       653
       +
       	client := newMockOAuthClient()

     

       654
       654
       +
       	store := newMockOAuthStore()

     

       599
       655
        
       

     

       600
       600
       -
       	claims := &auth.Claims{

     

       601
       601
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       602
       602
       -
       			Subject:   "did:plc:test123",

     

       603
       603
       -
       			Issuer:    "https://test.pds.local",

     

       604
       604
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       605
       605
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       606
       606
       -
       		},

     

       607
       607
       -
       		Scope: "atproto",

     

       608
       608
       -
       		Confirmation: map[string]interface{}{

     

       609
       609
       -
       			"jkt": thumbprint,

     

       610
       610
       -
       		},

     

       656
       656
       +
       	// Create two test sessions

     

       657
       657
       +
       	did1 := syntax.DID("did:plc:header")

     

       658
       658
       +
       	sessionID1 := "session_header"

     

       659
       659
       +
       	session1 := &oauthlib.ClientSessionData{

     

       660
       660
       +
       		AccountDID:  did1,

     

       661
       661
       +
       		SessionID:   sessionID1,

     

       662
       662
       +
       		AccessToken: "header_token",

     

       663
       663
       +
       		HostURL:     "https://pds.example.com",

     

       611
       664
        
       	}

     

       665
       665
       +
       	_ = store.SaveSession(context.Background(), *session1)

     

       612
       666
        
       

     

       613
       613
       -
       	middleware := NewAtProtoAuthMiddleware(&mockJWKSFetcher{}, false)

     

       614
       614
       -
       	defer middleware.Stop()

     

       615
       615
       -
       

     

       616
       616
       -
       	externalURI := "https://api.example.com/protected/resource"

     

       617
       617
       -
       	dpopProof := createDPoPProof(t, privateKey, "GET", externalURI)

     

       618
       618
       -
       

     

       619
       619
       -
       	req := httptest.NewRequest("GET", "http://internal-service/protected/resource", nil)

     

       620
       620
       -
       	req.Host = "api.example.com"

     

       621
       621
       -
       	req.Header.Set("X-Forwarded-Proto", "https")

     

       622
       622
       -
       

     

       623
       623
       -
       	// Pass a fake access token - ath verification will pass since we don't include ath in the DPoP proof

     

       624
       624
       -
       	fakeAccessToken := "fake-access-token-for-testing"

     

       625
       625
       -
       	proof, err := middleware.verifyDPoPBinding(req, claims, dpopProof, fakeAccessToken)

     

       626
       626
       -
       	if err != nil {

     

       627
       627
       -
       		t.Fatalf("expected DPoP verification to succeed with forwarded proto, got %v", err)

     

       667
       667
       +
       	did2 := syntax.DID("did:plc:cookie")

     

       668
       668
       +
       	sessionID2 := "session_cookie"

     

       669
       669
       +
       	session2 := &oauthlib.ClientSessionData{

     

       670
       670
       +
       		AccountDID:  did2,

     

       671
       671
       +
       		SessionID:   sessionID2,

     

       672
       672
       +
       		AccessToken: "cookie_token",

     

       673
       673
       +
       		HostURL:     "https://pds.example.com",

     

       628
       674
        
       	}

     

       675
       675
       +
       	_ = store.SaveSession(context.Background(), *session2)

     

       629
       676
        
       

     

       630
       630
       -
       	if proof == nil || proof.Claims == nil {

     

       631
       631
       -
       		t.Fatal("expected DPoP proof to be returned")

     

       632
       632
       -
       	}

     

       633
       633
       -
       }

     

       677
       677
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       634
       678
        
       

     

       635
       635
       -
       // TestVerifyDPoPBinding_UsesForwardedHost ensures we honor X-Forwarded-Host header

     

       636
       636
       -
       // when behind a TLS-terminating proxy that rewrites the Host header.

     

       637
       637
       -
       func TestVerifyDPoPBinding_UsesForwardedHost(t *testing.T) {

     

       638
       638
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       639
       639
       -
       	if err != nil {

     

       640
       640
       -
       		t.Fatalf("failed to generate key: %v", err)

     

       641
       641
       -
       	}

     

       679
       679
       +
       	handlerCalled := false

     

       680
       680
       +
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       681
       681
       +
       		handlerCalled = true

     

       642
       682
        
       

     

       643
       643
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       644
       644
       -
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       645
       645
       -
       	if err != nil {

     

       646
       646
       -
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       647
       647
       -
       	}

     

       683
       683
       +
       		// Should get header DID, not cookie DID

     

       684
       684
       +
       		extractedDID := GetUserDID(r)

     

       685
       685
       +
       		if extractedDID != "did:plc:header" {

     

       686
       686
       +
       			t.Errorf("expected header DID 'did:plc:header', got %s", extractedDID)

     

       687
       687
       +
       		}

     

       648
       688
        
       

     

       649
       649
       -
       	claims := &auth.Claims{

     

       650
       650
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       651
       651
       -
       			Subject:   "did:plc:test123",

     

       652
       652
       -
       			Issuer:    "https://test.pds.local",

     

       653
       653
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       654
       654
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       655
       655
       -
       		},

     

       656
       656
       -
       		Scope: "atproto",

     

       657
       657
       -
       		Confirmation: map[string]interface{}{

     

       658
       658
       -
       			"jkt": thumbprint,

     

       659
       659
       -
       		},

     

       660
       660
       -
       	}

     

       689
       689
       +
       		w.WriteHeader(http.StatusOK)

     

       690
       690
       +
       	}))

     

       661
       691
        
       

     

       662
       662
       -
       	middleware := NewAtProtoAuthMiddleware(&mockJWKSFetcher{}, false)

     

       663
       663
       -
       	defer middleware.Stop()

     

       692
       692
       +
       	headerToken := client.createTestToken("did:plc:header", sessionID1, time.Hour)

     

       693
       693
       +
       	cookieToken := client.createTestToken("did:plc:cookie", sessionID2, time.Hour)

     

       664
       694
        
       

     

       665
       665
       -
       	// External URI that the client uses

     

       666
       666
       -
       	externalURI := "https://api.example.com/protected/resource"

     

       667
       667
       -
       	dpopProof := createDPoPProof(t, privateKey, "GET", externalURI)

     

       695
       695
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       696
       696
       +
       	req.Header.Set("Authorization", "Bearer "+headerToken)

     

       697
       697
       +
       	req.AddCookie(&http.Cookie{

     

       698
       698
       +
       		Name:  "coves_session",

     

       699
       699
       +
       		Value: cookieToken,

     

       700
       700
       +
       	})

     

       701
       701
       +
       	w := httptest.NewRecorder()

     

       668
       702
        
       

     

       669
       669
       -
       	// Request hits internal service with internal hostname, but X-Forwarded-Host has public hostname

     

       670
       670
       -
       	req := httptest.NewRequest("GET", "http://internal-service:8080/protected/resource", nil)

     

       671
       671
       -
       	req.Host = "internal-service:8080" // Internal host after proxy

     

       672
       672
       -
       	req.Header.Set("X-Forwarded-Proto", "https")

     

       673
       673
       -
       	req.Header.Set("X-Forwarded-Host", "api.example.com") // Original public host

     

       703
       703
       +
       	handler.ServeHTTP(w, req)

     

       674
       704
        
       

     

       675
       675
       -
       	fakeAccessToken := "fake-access-token-for-testing"

     

       676
       676
       -
       	proof, err := middleware.verifyDPoPBinding(req, claims, dpopProof, fakeAccessToken)

     

       677
       677
       -
       	if err != nil {

     

       678
       678
       -
       		t.Fatalf("expected DPoP verification to succeed with X-Forwarded-Host, got %v", err)

     

       705
       705
       +
       	if !handlerCalled {

     

       706
       706
       +
       		t.Error("handler was not called")

     

       679
       707
        
       	}

     

       680
       708
        
       

     

       681
       681
       -
       	if proof == nil || proof.Claims == nil {

     

       682
       682
       -
       		t.Fatal("expected DPoP proof to be returned")

     

       709
       709
       +
       	if w.Code != http.StatusOK {

     

       710
       710
       +
       		t.Errorf("expected status 200, got %d", w.Code)

     

       683
       711
        
       	}

     

       684
       712
        
       }

     

       685
       713
        
       

     

       686
       686
       -
       // TestVerifyDPoPBinding_UsesStandardForwardedHeader tests RFC 7239 Forwarded header parsing

     

       687
       687
       -
       func TestVerifyDPoPBinding_UsesStandardForwardedHeader(t *testing.T) {

     

       688
       688
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       689
       689
       -
       	if err != nil {

     

       690
       690
       -
       		t.Fatalf("failed to generate key: %v", err)

     

       691
       691
       -
       	}

     

       692
       692
       -
       

     

       693
       693
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       694
       694
       -
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       695
       695
       -
       	if err != nil {

     

       696
       696
       -
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       697
       697
       -
       	}

     

       714
       714
       +
       // TestRequireAuth_MissingBothHeaderAndCookie tests that missing both auth methods is rejected

     

       715
       715
       +
       func TestRequireAuth_MissingBothHeaderAndCookie(t *testing.T) {

     

       716
       716
       +
       	client := newMockOAuthClient()

     

       717
       717
       +
       	store := newMockOAuthStore()

     

       718
       718
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       698
       719
        
       

     

       699
       699
       -
       	claims := &auth.Claims{

     

       700
       700
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       701
       701
       -
       			Subject:   "did:plc:test123",

     

       702
       702
       -
       			Issuer:    "https://test.pds.local",

     

       703
       703
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       704
       704
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       705
       705
       -
       		},

     

       706
       706
       -
       		Scope: "atproto",

     

       707
       707
       -
       		Confirmation: map[string]interface{}{

     

       708
       708
       -
       			"jkt": thumbprint,

     

       709
       709
       -
       		},

     

       710
       710
       -
       	}

     

       711
       711
       -
       

     

       712
       712
       -
       	middleware := NewAtProtoAuthMiddleware(&mockJWKSFetcher{}, false)

     

       713
       713
       -
       	defer middleware.Stop()

     

       714
       714
       -
       

     

       715
       715
       -
       	// External URI

     

       716
       716
       -
       	externalURI := "https://api.example.com/protected/resource"

     

       717
       717
       -
       	dpopProof := createDPoPProof(t, privateKey, "GET", externalURI)

     

       720
       720
       +
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       721
       721
       +
       		t.Error("handler should not be called")

     

       722
       722
       +
       	}))

     

       718
       723
        
       

     

       719
       719
       -
       	// Request with standard Forwarded header (RFC 7239)

     

       720
       720
       -
       	req := httptest.NewRequest("GET", "http://internal-service/protected/resource", nil)

     

       721
       721
       -
       	req.Host = "internal-service"

     

       722
       722
       -
       	req.Header.Set("Forwarded", "for=192.0.2.60;proto=https;host=api.example.com")

     

       724
       724
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       725
       725
       +
       	// No Authorization header and no cookie

     

       726
       726
       +
       	w := httptest.NewRecorder()

     

       723
       727
        
       

     

       724
       724
       -
       	fakeAccessToken := "fake-access-token-for-testing"

     

       725
       725
       -
       	proof, err := middleware.verifyDPoPBinding(req, claims, dpopProof, fakeAccessToken)

     

       726
       726
       -
       	if err != nil {

     

       727
       727
       -
       		t.Fatalf("expected DPoP verification to succeed with Forwarded header, got %v", err)

     

       728
       728
       -
       	}

     

       728
       728
       +
       	handler.ServeHTTP(w, req)

     

       729
       729
        
       

     

       730
       730
       -
       	if proof == nil {

     

       731
       731
       -
       		t.Fatal("expected DPoP proof to be returned")

     

       730
       730
       +
       	if w.Code != http.StatusUnauthorized {

     

       731
       731
       +
       		t.Errorf("expected status 401, got %d", w.Code)

     

       732
       732
        
       	}

     

       733
       733
        
       }

     

       734
       734
        
       

     

       735
       735
       -
       // TestVerifyDPoPBinding_ForwardedMixedCaseAndQuotes tests RFC 7239 edge cases:

     

       736
       736
       -
       // mixed-case keys (Proto vs proto) and quoted values (host="example.com")

     

       737
       737
       -
       func TestVerifyDPoPBinding_ForwardedMixedCaseAndQuotes(t *testing.T) {

     

       738
       738
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       739
       739
       -
       	if err != nil {

     

       740
       740
       -
       		t.Fatalf("failed to generate key: %v", err)

     

       741
       741
       -
       	}

     

       742
       742
       -
       

     

       743
       743
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       744
       744
       -
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       745
       745
       -
       	if err != nil {

     

       746
       746
       -
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       747
       747
       -
       	}

     

       735
       735
       +
       // TestRequireAuth_InvalidCookie tests that malformed cookie tokens are rejected

     

       736
       736
       +
       func TestRequireAuth_InvalidCookie(t *testing.T) {

     

       737
       737
       +
       	client := newMockOAuthClient()

     

       738
       738
       +
       	store := newMockOAuthStore()

     

       739
       739
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       748
       740
        
       

     

       749
       749
       -
       	claims := &auth.Claims{

     

       750
       750
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       751
       751
       -
       			Subject:   "did:plc:test123",

     

       752
       752
       -
       			Issuer:    "https://test.pds.local",

     

       753
       753
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       754
       754
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       755
       755
       -
       		},

     

       756
       756
       -
       		Scope: "atproto",

     

       757
       757
       -
       		Confirmation: map[string]interface{}{

     

       758
       758
       -
       			"jkt": thumbprint,

     

       759
       759
       -
       		},

     

       760
       760
       -
       	}

     

       761
       761
       -
       

     

       762
       762
       -
       	middleware := NewAtProtoAuthMiddleware(&mockJWKSFetcher{}, false)

     

       763
       763
       -
       	defer middleware.Stop()

     

       764
       764
       -
       

     

       765
       765
       -
       	// External URI that the client uses

     

       766
       766
       -
       	externalURI := "https://api.example.com/protected/resource"

     

       767
       767
       -
       	dpopProof := createDPoPProof(t, privateKey, "GET", externalURI)

     

       741
       741
       +
       	handler := middleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       742
       742
       +
       		t.Error("handler should not be called")

     

       743
       743
       +
       	}))

     

       768
       744
        
       

     

       769
       769
       -
       	// Request with RFC 7239 Forwarded header using:

     

       770
       770
       -
       	// - Mixed-case keys: "Proto" instead of "proto", "Host" instead of "host"

     

       771
       771
       -
       	// - Quoted value: Host="api.example.com" (legal per RFC 7239 section 4)

     

       772
       772
       -
       	req := httptest.NewRequest("GET", "http://internal-service/protected/resource", nil)

     

       773
       773
       -
       	req.Host = "internal-service"

     

       774
       774
       -
       	req.Header.Set("Forwarded", `for=192.0.2.60;Proto=https;Host="api.example.com"`)

     

       745
       745
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       746
       746
       +
       	req.AddCookie(&http.Cookie{

     

       747
       747
       +
       		Name:  "coves_session",

     

       748
       748
       +
       		Value: "not-a-valid-sealed-token",

     

       749
       749
       +
       	})

     

       750
       750
       +
       	w := httptest.NewRecorder()

     

       775
       751
        
       

     

       776
       776
       -
       	fakeAccessToken := "fake-access-token-for-testing"

     

       777
       777
       -
       	proof, err := middleware.verifyDPoPBinding(req, claims, dpopProof, fakeAccessToken)

     

       778
       778
       -
       	if err != nil {

     

       779
       779
       -
       		t.Fatalf("expected DPoP verification to succeed with mixed-case/quoted Forwarded header, got %v", err)

     

       780
       780
       -
       	}

     

       752
       752
       +
       	handler.ServeHTTP(w, req)

     

       781
       753
        
       

     

       782
       782
       -
       	if proof == nil {

     

       783
       783
       -
       		t.Fatal("expected DPoP proof to be returned")

     

       754
       754
       +
       	if w.Code != http.StatusUnauthorized {

     

       755
       755
       +
       		t.Errorf("expected status 401, got %d", w.Code)

     

       784
       756
        
       	}

     

       785
       757
        
       }

     

       786
       758
        
       

     

       787
       787
       -
       // TestVerifyDPoPBinding_AthValidation tests access token hash (ath) claim validation

     

       788
       788
       -
       func TestVerifyDPoPBinding_AthValidation(t *testing.T) {

     

       789
       789
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       790
       790
       -
       	if err != nil {

     

       791
       791
       -
       		t.Fatalf("failed to generate key: %v", err)

     

       792
       792
       -
       	}

     

       759
       759
       +
       // TestOptionalAuth_WithCookie tests that OptionalAuth accepts valid session cookies

     

       760
       760
       +
       func TestOptionalAuth_WithCookie(t *testing.T) {

     

       761
       761
       +
       	client := newMockOAuthClient()

     

       762
       762
       +
       	store := newMockOAuthStore()

     

       793
       763
        
       

     

       794
       794
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       795
       795
       -
       	thumbprint, err := auth.CalculateJWKThumbprint(jwk)

     

       796
       796
       -
       	if err != nil {

     

       797
       797
       -
       		t.Fatalf("failed to calculate thumbprint: %v", err)

     

       764
       764
       +
       	// Create a test session

     

       765
       765
       +
       	did := syntax.DID("did:plc:test123")

     

       766
       766
       +
       	sessionID := "session123"

     

       767
       767
       +
       	session := &oauthlib.ClientSessionData{

     

       768
       768
       +
       		AccountDID:  did,

     

       769
       769
       +
       		SessionID:   sessionID,

     

       770
       770
       +
       		AccessToken: "test_access_token",

     

       798
       771
        
       	}

     

       772
       772
       +
       	_ = store.SaveSession(context.Background(), *session)

     

       799
       773
        
       

     

       800
       800
       -
       	claims := &auth.Claims{

     

       801
       801
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       802
       802
       -
       			Subject:   "did:plc:test123",

     

       803
       803
       -
       			Issuer:    "https://test.pds.local",

     

       804
       804
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       805
       805
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       806
       806
       -
       		},

     

       807
       807
       -
       		Scope: "atproto",

     

       808
       808
       -
       		Confirmation: map[string]interface{}{

     

       809
       809
       -
       			"jkt": thumbprint,

     

       810
       810
       -
       		},

     

       811
       811
       -
       	}

     

       812
       812
       -
       

     

       813
       813
       -
       	middleware := NewAtProtoAuthMiddleware(&mockJWKSFetcher{}, false)

     

       814
       814
       -
       	defer middleware.Stop()

     

       815
       815
       -
       

     

       816
       816
       -
       	accessToken := "real-access-token-12345"

     

       817
       817
       -
       

     

       818
       818
       -
       	t.Run("ath_matches_access_token", func(t *testing.T) {

     

       819
       819
       -
       		// Create DPoP proof with ath claim matching the access token

     

       820
       820
       -
       		dpopProof := createDPoPProofWithAth(t, privateKey, "GET", "https://api.example.com/resource", accessToken)

     

       774
       774
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       821
       775
        
       

     

       822
       822
       -
       		req := httptest.NewRequest("GET", "https://api.example.com/resource", nil)

     

       823
       823
       -
       		req.Host = "api.example.com"

     

       776
       776
       +
       	handlerCalled := false

     

       777
       777
       +
       	handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       778
       778
       +
       		handlerCalled = true

     

       824
       779
        
       

     

       825
       825
       -
       		proof, err := middleware.verifyDPoPBinding(req, claims, dpopProof, accessToken)

     

       826
       826
       -
       		if err != nil {

     

       827
       827
       -
       			t.Fatalf("expected verification to succeed with matching ath, got %v", err)

     

       828
       828
       -
       		}

     

       829
       829
       -
       		if proof == nil {

     

       830
       830
       -
       			t.Fatal("expected proof to be returned")

     

       780
       780
       +
       		// Verify DID was extracted

     

       781
       781
       +
       		extractedDID := GetUserDID(r)

     

       782
       782
       +
       		if extractedDID != "did:plc:test123" {

     

       783
       783
       +
       			t.Errorf("expected DID 'did:plc:test123', got %s", extractedDID)

     

       831
       784
        
       		}

     

       832
       832
       -
       	})

     

       833
       785
        
       

     

       834
       834
       -
       	t.Run("ath_mismatch_rejected", func(t *testing.T) {

     

       835
       835
       -
       		// Create DPoP proof with ath for a DIFFERENT token

     

       836
       836
       -
       		differentToken := "different-token-67890"

     

       837
       837
       -
       		dpopProof := createDPoPProofWithAth(t, privateKey, "POST", "https://api.example.com/resource", differentToken)

     

       838
       838
       -
       

     

       839
       839
       -
       		req := httptest.NewRequest("POST", "https://api.example.com/resource", nil)

     

       840
       840
       -
       		req.Host = "api.example.com"

     

       786
       786
       +
       		w.WriteHeader(http.StatusOK)

     

       787
       787
       +
       	}))

     

       841
       788
        
       

     

       842
       842
       -
       		// Try to use with the original access token - should fail

     

       843
       843
       -
       		_, err := middleware.verifyDPoPBinding(req, claims, dpopProof, accessToken)

     

       844
       844
       -
       		if err == nil {

     

       845
       845
       -
       			t.Fatal("SECURITY: expected verification to fail when ath doesn't match access token")

     

       846
       846
       -
       		}

     

       847
       847
       -
       		if !strings.Contains(err.Error(), "ath") {

     

       848
       848
       -
       			t.Errorf("error should mention ath mismatch, got: %v", err)

     

       849
       849
       -
       		}

     

       789
       789
       +
       	token := client.createTestToken("did:plc:test123", sessionID, time.Hour)

     

       790
       790
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       791
       791
       +
       	req.AddCookie(&http.Cookie{

     

       792
       792
       +
       		Name:  "coves_session",

     

       793
       793
       +
       		Value: token,

     

       850
       794
        
       	})

     

       851
       851
       -
       }

     

       795
       795
       +
       	w := httptest.NewRecorder()

     

       852
       796
        
       

     

       853
       853
       -
       // TestMiddlewareStop tests that the middleware can be stopped properly

     

       854
       854
       -
       func TestMiddlewareStop(t *testing.T) {

     

       855
       855
       -
       	fetcher := &mockJWKSFetcher{}

     

       856
       856
       -
       	middleware := NewAtProtoAuthMiddleware(fetcher, false)

     

       797
       797
       +
       	handler.ServeHTTP(w, req)

     

       857
       798
        
       

     

       858
       858
       -
       	// Stop should not panic and should clean up resources

     

       859
       859
       -
       	middleware.Stop()

     

       799
       799
       +
       	if !handlerCalled {

     

       800
       800
       +
       		t.Error("handler was not called")

     

       801
       801
       +
       	}

     

       860
       802
        
       

     

       861
       861
       -
       	// Calling Stop again should also be safe (idempotent-ish)

     

       862
       862
       -
       	// Note: The underlying DPoPVerifier.Stop() closes a channel, so this might panic

     

       863
       863
       -
       	// if not handled properly. We test that at least one Stop works.

     

       803
       803
       +
       	if w.Code != http.StatusOK {

     

       804
       804
       +
       		t.Errorf("expected status 200, got %d", w.Code)

     

       805
       805
       +
       	}

     

       864
       806
        
       }

     

       865
       807
        
       

     

       866
       866
       -
       // TestOptionalAuth_DPoPBoundToken_NoDPoPHeader tests that OptionalAuth treats

     

       867
       867
       -
       // tokens with cnf.jkt but no DPoP header as unauthenticated (potential token theft)

     

       868
       868
       -
       func TestOptionalAuth_DPoPBoundToken_NoDPoPHeader(t *testing.T) {

     

       869
       869
       -
       	// Generate a key pair for DPoP binding

     

       870
       870
       -
       	privateKey, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       871
       871
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       872
       872
       -
       	thumbprint, _ := auth.CalculateJWKThumbprint(jwk)

     

       873
       873
       -
       

     

       874
       874
       -
       	// Create a DPoP-bound token (has cnf.jkt)

     

       875
       875
       -
       	claims := auth.Claims{

     

       876
       876
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       877
       877
       -
       			Subject:   "did:plc:user123",

     

       878
       878
       -
       			Issuer:    "https://test.pds.local",

     

       879
       879
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       880
       880
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       881
       881
       -
       		},

     

       882
       882
       -
       		Scope: "atproto",

     

       883
       883
       -
       		Confirmation: map[string]interface{}{

     

       884
       884
       -
       			"jkt": thumbprint,

     

       885
       885
       -
       		},

     

       886
       886
       -
       	}

     

       808
       808
       +
       // TestOptionalAuth_InvalidCookie tests that OptionalAuth continues without auth on invalid cookie

     

       809
       809
       +
       func TestOptionalAuth_InvalidCookie(t *testing.T) {

     

       810
       810
       +
       	client := newMockOAuthClient()

     

       811
       811
       +
       	store := newMockOAuthStore()

     

       812
       812
       +
       	middleware := NewOAuthAuthMiddleware(client, store)

     

       887
       813
        
       

     

       888
       888
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       889
       889
       -
       	tokenString, _ := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       890
       890
       -
       

     

       891
       891
       -
       	// Use skipVerify=true to simulate a verified token

     

       892
       892
       -
       	// (In production, skipVerify would be false and VerifyJWT would be called)

     

       893
       893
       -
       	// However, for this test we need skipVerify=false to trigger DPoP checking

     

       894
       894
       -
       	// But the fetcher will fail, so let's use skipVerify=true and verify the logic

     

       895
       895
       -
       	// Actually, the DPoP check only happens when skipVerify=false

     

       896
       896
       -
       

     

       897
       897
       -
       	t.Run("with_skipVerify_false", func(t *testing.T) {

     

       898
       898
       -
       		// This will fail at JWT verification level, but that's expected

     

       899
       899
       -
       		// The important thing is the code path for DPoP checking

     

       900
       900
       -
       		fetcher := &mockJWKSFetcher{shouldFail: true}

     

       901
       901
       -
       		middleware := NewAtProtoAuthMiddleware(fetcher, false)

     

       902
       902
       -
       		defer middleware.Stop()

     

       903
       903
       -
       

     

       904
       904
       -
       		handlerCalled := false

     

       905
       905
       -
       		var capturedDID string

     

       906
       906
       -
       		handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       907
       907
       -
       			handlerCalled = true

     

       908
       908
       -
       			capturedDID = GetUserDID(r)

     

       909
       909
       -
       			w.WriteHeader(http.StatusOK)

     

       910
       910
       -
       		}))

     

       911
       911
       -
       

     

       912
       912
       -
       		req := httptest.NewRequest("GET", "/test", nil)

     

       913
       913
       -
       		req.Header.Set("Authorization", "DPoP "+tokenString)

     

       914
       914
       -
       		// Deliberately NOT setting DPoP header

     

       915
       915
       -
       		w := httptest.NewRecorder()

     

       916
       916
       -
       

     

       917
       917
       -
       		handler.ServeHTTP(w, req)

     

       918
       918
       -
       

     

       919
       919
       -
       		// Handler should be called (optional auth doesn't block)

     

       920
       920
       -
       		if !handlerCalled {

     

       921
       921
       -
       			t.Error("handler should be called")

     

       922
       922
       -
       		}

     

       814
       814
       +
       	handlerCalled := false

     

       815
       815
       +
       	handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       816
       816
       +
       		handlerCalled = true

     

       923
       817
        
       

     

       924
       924
       -
       		// But since JWT verification fails, user should not be authenticated

     

       925
       925
       -
       		if capturedDID != "" {

     

       926
       926
       -
       			t.Errorf("expected empty DID when verification fails, got %s", capturedDID)

     

       818
       818
       +
       		// Verify no DID is set (invalid cookie ignored)

     

       819
       819
       +
       		did := GetUserDID(r)

     

       820
       820
       +
       		if did != "" {

     

       821
       821
       +
       			t.Errorf("expected empty DID for invalid cookie, got %s", did)

     

       927
       822
        
       		}

     

       928
       928
       -
       	})

     

       929
       823
        
       

     

       930
       930
       -
       	t.Run("with_skipVerify_true_dpop_not_checked", func(t *testing.T) {

     

       931
       931
       -
       		// When skipVerify=true, DPoP is not checked (Phase 1 mode)

     

       932
       932
       -
       		fetcher := &mockJWKSFetcher{}

     

       933
       933
       -
       		middleware := NewAtProtoAuthMiddleware(fetcher, true)

     

       934
       934
       -
       		defer middleware.Stop()

     

       935
       935
       -
       

     

       936
       936
       -
       		handlerCalled := false

     

       937
       937
       -
       		var capturedDID string

     

       938
       938
       -
       		handler := middleware.OptionalAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       939
       939
       -
       			handlerCalled = true

     

       940
       940
       -
       			capturedDID = GetUserDID(r)

     

       941
       941
       -
       			w.WriteHeader(http.StatusOK)

     

       942
       942
       -
       		}))

     

       943
       943
       -
       

     

       944
       944
       -
       		req := httptest.NewRequest("GET", "/test", nil)

     

       945
       945
       -
       		req.Header.Set("Authorization", "DPoP "+tokenString)

     

       946
       946
       -
       		// No DPoP header

     

       947
       947
       -
       		w := httptest.NewRecorder()

     

       948
       948
       -
       

     

       949
       949
       -
       		handler.ServeHTTP(w, req)

     

       950
       950
       -
       

     

       951
       951
       -
       		if !handlerCalled {

     

       952
       952
       -
       			t.Error("handler should be called")

     

       953
       953
       -
       		}

     

       824
       824
       +
       		w.WriteHeader(http.StatusOK)

     

       825
       825
       +
       	}))

     

       954
       826
        
       

     

       955
       955
       -
       		// With skipVerify=true, DPoP check is bypassed - token is trusted

     

       956
       956
       -
       		if capturedDID != "did:plc:user123" {

     

       957
       957
       -
       			t.Errorf("expected DID when skipVerify=true, got %s", capturedDID)

     

       958
       958
       -
       		}

     

       827
       827
       +
       	req := httptest.NewRequest("GET", "/test", nil)

     

       828
       828
       +
       	req.AddCookie(&http.Cookie{

     

       829
       829
       +
       		Name:  "coves_session",

     

       830
       830
       +
       		Value: "not-a-valid-sealed-token",

     

       959
       831
        
       	})

     

       960
       960
       -
       }

     

       961
       961
       -
       

     

       962
       962
       -
       // TestDPoPReplayProtection tests that the same DPoP proof cannot be used twice

     

       963
       963
       -
       func TestDPoPReplayProtection(t *testing.T) {

     

       964
       964
       -
       	// This tests the NonceCache functionality

     

       965
       965
       -
       	cache := auth.NewNonceCache(5 * time.Minute)

     

       966
       966
       -
       	defer cache.Stop()

     

       967
       967
       -
       

     

       968
       968
       -
       	jti := "unique-proof-id-123"

     

       969
       969
       -
       

     

       970
       970
       -
       	// First use should succeed

     

       971
       971
       -
       	if !cache.CheckAndStore(jti) {

     

       972
       972
       -
       		t.Error("First use of jti should succeed")

     

       973
       973
       -
       	}

     

       974
       974
       -
       

     

       975
       975
       -
       	// Second use should fail (replay detected)

     

       976
       976
       -
       	if cache.CheckAndStore(jti) {

     

       977
       977
       -
       		t.Error("SECURITY: Replay attack not detected - same jti accepted twice")

     

       978
       978
       -
       	}

     

       832
       832
       +
       	w := httptest.NewRecorder()

     

       979
       833
        
       

     

       980
       980
       -
       	// Different jti should succeed

     

       981
       981
       -
       	if !cache.CheckAndStore("different-jti-456") {

     

       982
       982
       -
       		t.Error("Different jti should succeed")

     

       983
       983
       -
       	}

     

       984
       984
       -
       }

     

       834
       834
       +
       	handler.ServeHTTP(w, req)

     

       985
       835
        
       

     

       986
       986
       -
       // Helper: createDPoPProof creates a DPoP proof JWT for testing

     

       987
       987
       -
       func createDPoPProof(t *testing.T, privateKey *ecdsa.PrivateKey, method, uri string) string {

     

       988
       988
       -
       	// Create JWK from public key

     

       989
       989
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       990
       990
       -
       

     

       991
       991
       -
       	// Create DPoP claims with UUID for jti to ensure uniqueness across tests

     

       992
       992
       -
       	claims := auth.DPoPClaims{

     

       993
       993
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       994
       994
       -
       			IssuedAt: jwt.NewNumericDate(time.Now()),

     

       995
       995
       -
       			ID:       uuid.New().String(),

     

       996
       996
       -
       		},

     

       997
       997
       -
       		HTTPMethod: method,

     

       998
       998
       -
       		HTTPURI:    uri,

     

       836
       836
       +
       	if !handlerCalled {

     

       837
       837
       +
       		t.Error("handler was not called")

     

       999
       838
        
       	}

     

       1000
       839
        
       

     

       1001
       1001
       -
       	// Create token with custom header

     

       1002
       1002
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1003
       1003
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1004
       1004
       -
       	token.Header["jwk"] = jwk

     

       1005
       1005
       -
       

     

       1006
       1006
       -
       	// Sign with private key

     

       1007
       1007
       -
       	signedToken, err := token.SignedString(privateKey)

     

       1008
       1008
       -
       	if err != nil {

     

       1009
       1009
       -
       		t.Fatalf("failed to sign DPoP proof: %v", err)

     

       840
       840
       +
       	if w.Code != http.StatusOK {

     

       841
       841
       +
       		t.Errorf("expected status 200, got %d", w.Code)

     

       1010
       842
        
       	}

     

       1011
       1011
       -
       

     

       1012
       1012
       -
       	return signedToken

     

       1013
       843
        
       }

     

       1014
       844
        
       

     

       1015
       1015
       -
       // Helper: createDPoPProofWithAth creates a DPoP proof JWT with ath (access token hash) claim

     

       1016
       1016
       -
       func createDPoPProofWithAth(t *testing.T, privateKey *ecdsa.PrivateKey, method, uri, accessToken string) string {

     

       1017
       1017
       -
       	// Create JWK from public key

     

       1018
       1018
       -
       	jwk := ecdsaPublicKeyToJWK(&privateKey.PublicKey)

     

       1019
       1019
       -
       

     

       1020
       1020
       -
       	// Calculate ath: base64url(SHA-256(access_token))

     

       1021
       1021
       -
       	hash := sha256.Sum256([]byte(accessToken))

     

       1022
       1022
       -
       	ath := base64.RawURLEncoding.EncodeToString(hash[:])

     

       1023
       1023
       -
       

     

       1024
       1024
       -
       	// Create DPoP claims with ath

     

       1025
       1025
       -
       	claims := auth.DPoPClaims{

     

       1026
       1026
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1027
       1027
       -
       			IssuedAt: jwt.NewNumericDate(time.Now()),

     

       1028
       1028
       -
       			ID:       uuid.New().String(),

     

       1029
       1029
       -
       		},

     

       1030
       1030
       -
       		HTTPMethod:      method,

     

       1031
       1031
       -
       		HTTPURI:         uri,

     

       1032
       1032
       -
       		AccessTokenHash: ath,

     

       1033
       1033
       -
       	}

     

       1034
       1034
       -
       

     

       1035
       1035
       -
       	// Create token with custom header

     

       1036
       1036
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1037
       1037
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1038
       1038
       -
       	token.Header["jwk"] = jwk

     

       1039
       1039
       -
       

     

       1040
       1040
       -
       	// Sign with private key

     

       1041
       1041
       -
       	signedToken, err := token.SignedString(privateKey)

     

       1042
       1042
       -
       	if err != nil {

     

       1043
       1043
       -
       		t.Fatalf("failed to sign DPoP proof: %v", err)

     

       845
       845
       +
       // TestWriteAuthError_JSONEscaping tests that writeAuthError properly escapes messages

     

       846
       846
       +
       func TestWriteAuthError_JSONEscaping(t *testing.T) {

     

       847
       847
       +
       	tests := []struct {

     

       848
       848
       +
       		name    string

     

       849
       849
       +
       		message string

     

       850
       850
       +
       	}{

     

       851
       851
       +
       		{"simple message", "Missing authentication"},

     

       852
       852
       +
       		{"message with quotes", `Invalid "token" format`},

     

       853
       853
       +
       		{"message with newlines", "Invalid\ntoken\nformat"},

     

       854
       854
       +
       		{"message with backslashes", `Invalid \ token`},

     

       855
       855
       +
       		{"message with special chars", `Invalid <script>alert("xss")</script> token`},

     

       856
       856
       +
       		{"message with unicode", "Invalid token: \u2028\u2029"},

     

       1044
       857
        
       	}

     

       1045
       858
        
       

     

       1046
       1046
       -
       	return signedToken

     

       1047
       1047
       -
       }

     

       859
       859
       +
       	for _, tt := range tests {

     

       860
       860
       +
       		t.Run(tt.name, func(t *testing.T) {

     

       861
       861
       +
       			w := httptest.NewRecorder()

     

       862
       862
       +
       			writeAuthError(w, tt.message)

     

       1048
       863
        
       

     

       1049
       1049
       -
       // Helper: ecdsaPublicKeyToJWK converts an ECDSA public key to JWK map

     

       1050
       1050
       -
       func ecdsaPublicKeyToJWK(pubKey *ecdsa.PublicKey) map[string]interface{} {

     

       1051
       1051
       -
       	// Get curve name

     

       1052
       1052
       -
       	var crv string

     

       1053
       1053
       -
       	switch pubKey.Curve {

     

       1054
       1054
       -
       	case elliptic.P256():

     

       1055
       1055
       -
       		crv = "P-256"

     

       1056
       1056
       -
       	case elliptic.P384():

     

       1057
       1057
       -
       		crv = "P-384"

     

       1058
       1058
       -
       	case elliptic.P521():

     

       1059
       1059
       -
       		crv = "P-521"

     

       1060
       1060
       -
       	default:

     

       1061
       1061
       -
       		panic("unsupported curve")

     

       1062
       1062
       -
       	}

     

       864
       864
       +
       			// Verify status code

     

       865
       865
       +
       			if w.Code != http.StatusUnauthorized {

     

       866
       866
       +
       				t.Errorf("expected status 401, got %d", w.Code)

     

       867
       867
       +
       			}

     

       1063
       868
        
       

     

       1064
       1064
       -
       	// Encode coordinates

     

       1065
       1065
       -
       	xBytes := pubKey.X.Bytes()

     

       1066
       1066
       -
       	yBytes := pubKey.Y.Bytes()

     

       1067
       1067
       -
       

     

       1068
       1068
       -
       	// Ensure proper byte length (pad if needed)

     

       1069
       1069
       -
       	keySize := (pubKey.Curve.Params().BitSize + 7) / 8

     

       1070
       1070
       -
       	xPadded := make([]byte, keySize)

     

       1071
       1071
       -
       	yPadded := make([]byte, keySize)

     

       1072
       1072
       -
       	copy(xPadded[keySize-len(xBytes):], xBytes)

     

       1073
       1073
       -
       	copy(yPadded[keySize-len(yBytes):], yBytes)

     

       1074
       1074
       -
       

     

       1075
       1075
       -
       	return map[string]interface{}{

     

       1076
       1076
       -
       		"kty": "EC",

     

       1077
       1077
       -
       		"crv": crv,

     

       1078
       1078
       -
       		"x":   base64.RawURLEncoding.EncodeToString(xPadded),

     

       1079
       1079
       -
       		"y":   base64.RawURLEncoding.EncodeToString(yPadded),

     

       1080
       1080
       -
       	}

     

       1081
       1081
       -
       }

     

       869
       869
       +
       			// Verify content type

     

       870
       870
       +
       			if ct := w.Header().Get("Content-Type"); ct != "application/json" {

     

       871
       871
       +
       				t.Errorf("expected Content-Type 'application/json', got %s", ct)

     

       872
       872
       +
       			}

     

       1082
       873
        
       

     

       1083
       1083
       -
       // Helper: createValidJWT creates a valid unsigned JWT token for testing

     

       1084
       1084
       -
       // This is used with skipVerify=true middleware where signature verification is skipped

     

       1085
       1085
       -
       func createValidJWT(t *testing.T, subject string, expiry time.Duration) string {

     

       1086
       1086
       -
       	t.Helper()

     

       1087
       1087
       -
       

     

       1088
       1088
       -
       	claims := auth.Claims{

     

       1089
       1089
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1090
       1090
       -
       			Subject:   subject,

     

       1091
       1091
       -
       			Issuer:    "https://test.pds.local",

     

       1092
       1092
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(expiry)),

     

       1093
       1093
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       1094
       1094
       -
       		},

     

       1095
       1095
       -
       		Scope: "atproto",

     

       1096
       1096
       -
       	}

     

       874
       874
       +
       			// Verify response is valid JSON

     

       875
       875
       +
       			var response map[string]string

     

       876
       876
       +
       			if err := json.Unmarshal(w.Body.Bytes(), &response); err != nil {

     

       877
       877
       +
       				t.Fatalf("response is not valid JSON: %v\nBody: %s", err, w.Body.String())

     

       878
       878
       +
       			}

     

       1097
       879
        
       

     

       1098
       1098
       -
       	// Create unsigned token (for skipVerify=true tests)

     

       1099
       1099
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodNone, claims)

     

       1100
       1100
       -
       	signedToken, err := token.SignedString(jwt.UnsafeAllowNoneSignatureType)

     

       1101
       1101
       -
       	if err != nil {

     

       1102
       1102
       -
       		t.Fatalf("failed to create test JWT: %v", err)

     

       880
       880
       +
       			// Verify fields

     

       881
       881
       +
       			if response["error"] != "AuthenticationRequired" {

     

       882
       882
       +
       				t.Errorf("expected error 'AuthenticationRequired', got %s", response["error"])

     

       883
       883
       +
       			}

     

       884
       884
       +
       			if response["message"] != tt.message {

     

       885
       885
       +
       				t.Errorf("expected message %q, got %q", tt.message, response["message"])

     

       886
       886
       +
       			}

     

       887
       887
       +
       		})

     

       1103
       888
        
       	}

     

       1104
       1104
       -
       

     

       1105
       1105
       -
       	return signedToken

     

       1106
       889
        
       }

+1 -1

internal/api/routes/post.go

···

       10
       10
        
       

     

       11
       11
        
       // RegisterPostRoutes registers post-related XRPC endpoints on the router

     

       12
       12
        
       // Implements social.coves.community.post.* lexicon endpoints

     

       13
       13
       -
       func RegisterPostRoutes(r chi.Router, service posts.Service, authMiddleware *middleware.AtProtoAuthMiddleware) {

     

       13
       13
       +
       func RegisterPostRoutes(r chi.Router, service posts.Service, authMiddleware *middleware.OAuthAuthMiddleware) {

     

       14
       14
        
       	// Initialize handlers

     

       15
       15
        
       	createHandler := post.NewCreateHandler(service)

     

       16
       16

+1 -1

internal/api/routes/timeline.go

···

       12
       12
        
       func RegisterTimelineRoutes(

     

       13
       13
        
       	r chi.Router,

     

       14
       14
        
       	timelineService timelineCore.Service,

     

       15
       15
       -
       	authMiddleware *middleware.AtProtoAuthMiddleware,

     

       15
       15
       +
       	authMiddleware *middleware.OAuthAuthMiddleware,

     

       16
       16
        
       ) {

     

       17
       17
        
       	// Create handlers

     

       18
       18
        
       	getTimelineHandler := timeline.NewGetTimelineHandler(timelineService)

+291

tests/e2e/oauth_ratelimit_e2e_test.go

···

       1
       1
       +
       package e2e

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"net/http"

     

       6
       6
       +
       	"net/http/httptest"

     

       7
       7
       +
       	"testing"

     

       8
       8
       +
       	"time"

     

       9
       9
       +
       

     

       10
       10
       +
       	"github.com/stretchr/testify/assert"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // TestRateLimiting_E2E_OAuthEndpoints tests OAuth-specific rate limiting

     

       14
       14
       +
       // OAuth endpoints have stricter rate limits to prevent:

     

       15
       15
       +
       // - Credential stuffing attacks on login endpoints (10 req/min)

     

       16
       16
       +
       // - OAuth state exhaustion

     

       17
       17
       +
       // - Refresh token abuse (20 req/min)

     

       18
       18
       +
       func TestRateLimiting_E2E_OAuthEndpoints(t *testing.T) {

     

       19
       19
       +
       	t.Run("Login endpoints have 10 req/min limit", func(t *testing.T) {

     

       20
       20
       +
       		// Create rate limiter matching oauth.go config: 10 requests per minute

     

       21
       21
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       22
       22
       +
       

     

       23
       23
       +
       		// Mock OAuth login handler

     

       24
       24
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       25
       25
       +
       			w.WriteHeader(http.StatusOK)

     

       26
       26
       +
       			_, _ = w.Write([]byte("OK"))

     

       27
       27
       +
       		})

     

       28
       28
       +
       

     

       29
       29
       +
       		handler := loginLimiter.Middleware(testHandler)

     

       30
       30
       +
       		clientIP := "192.168.1.200:12345"

     

       31
       31
       +
       

     

       32
       32
       +
       		// Make exactly 10 requests (at limit)

     

       33
       33
       +
       		for i := 0; i < 10; i++ {

     

       34
       34
       +
       			req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       35
       35
       +
       			req.RemoteAddr = clientIP

     

       36
       36
       +
       			rr := httptest.NewRecorder()

     

       37
       37
       +
       

     

       38
       38
       +
       			handler.ServeHTTP(rr, req)

     

       39
       39
       +
       

     

       40
       40
       +
       			assert.Equal(t, http.StatusOK, rr.Code, "Request %d should succeed", i+1)

     

       41
       41
       +
       		}

     

       42
       42
       +
       

     

       43
       43
       +
       		// 11th request should be rate limited

     

       44
       44
       +
       		req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       45
       45
       +
       		req.RemoteAddr = clientIP

     

       46
       46
       +
       		rr := httptest.NewRecorder()

     

       47
       47
       +
       

     

       48
       48
       +
       		handler.ServeHTTP(rr, req)

     

       49
       49
       +
       

     

       50
       50
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Request 11 should be rate limited")

     

       51
       51
       +
       		assert.Contains(t, rr.Body.String(), "Rate limit exceeded", "Should have rate limit error message")

     

       52
       52
       +
       	})

     

       53
       53
       +
       

     

       54
       54
       +
       	t.Run("Mobile login endpoints have 10 req/min limit", func(t *testing.T) {

     

       55
       55
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       56
       56
       +
       

     

       57
       57
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       58
       58
       +
       			w.WriteHeader(http.StatusOK)

     

       59
       59
       +
       		})

     

       60
       60
       +
       

     

       61
       61
       +
       		handler := loginLimiter.Middleware(testHandler)

     

       62
       62
       +
       		clientIP := "192.168.1.201:12345"

     

       63
       63
       +
       

     

       64
       64
       +
       		// Make 10 requests

     

       65
       65
       +
       		for i := 0; i < 10; i++ {

     

       66
       66
       +
       			req := httptest.NewRequest("GET", "/oauth/mobile/login", nil)

     

       67
       67
       +
       			req.RemoteAddr = clientIP

     

       68
       68
       +
       			rr := httptest.NewRecorder()

     

       69
       69
       +
       			handler.ServeHTTP(rr, req)

     

       70
       70
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       71
       71
       +
       		}

     

       72
       72
       +
       

     

       73
       73
       +
       		// 11th request blocked

     

       74
       74
       +
       		req := httptest.NewRequest("GET", "/oauth/mobile/login", nil)

     

       75
       75
       +
       		req.RemoteAddr = clientIP

     

       76
       76
       +
       		rr := httptest.NewRecorder()

     

       77
       77
       +
       		handler.ServeHTTP(rr, req)

     

       78
       78
       +
       

     

       79
       79
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Mobile login should be rate limited at 10 req/min")

     

       80
       80
       +
       	})

     

       81
       81
       +
       

     

       82
       82
       +
       	t.Run("Refresh endpoint has 20 req/min limit", func(t *testing.T) {

     

       83
       83
       +
       		// Refresh has higher limit (20 req/min) for legitimate token refresh

     

       84
       84
       +
       		refreshLimiter := middleware.NewRateLimiter(20, 1*time.Minute)

     

       85
       85
       +
       

     

       86
       86
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       87
       87
       +
       			w.WriteHeader(http.StatusOK)

     

       88
       88
       +
       		})

     

       89
       89
       +
       

     

       90
       90
       +
       		handler := refreshLimiter.Middleware(testHandler)

     

       91
       91
       +
       		clientIP := "192.168.1.202:12345"

     

       92
       92
       +
       

     

       93
       93
       +
       		// Make 20 requests

     

       94
       94
       +
       		for i := 0; i < 20; i++ {

     

       95
       95
       +
       			req := httptest.NewRequest("POST", "/oauth/refresh", nil)

     

       96
       96
       +
       			req.RemoteAddr = clientIP

     

       97
       97
       +
       			rr := httptest.NewRecorder()

     

       98
       98
       +
       			handler.ServeHTTP(rr, req)

     

       99
       99
       +
       			assert.Equal(t, http.StatusOK, rr.Code, "Request %d should succeed", i+1)

     

       100
       100
       +
       		}

     

       101
       101
       +
       

     

       102
       102
       +
       		// 21st request blocked

     

       103
       103
       +
       		req := httptest.NewRequest("POST", "/oauth/refresh", nil)

     

       104
       104
       +
       		req.RemoteAddr = clientIP

     

       105
       105
       +
       		rr := httptest.NewRecorder()

     

       106
       106
       +
       		handler.ServeHTTP(rr, req)

     

       107
       107
       +
       

     

       108
       108
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Refresh should be rate limited at 20 req/min")

     

       109
       109
       +
       	})

     

       110
       110
       +
       

     

       111
       111
       +
       	t.Run("Logout endpoint has 10 req/min limit", func(t *testing.T) {

     

       112
       112
       +
       		logoutLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       113
       113
       +
       

     

       114
       114
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       115
       115
       +
       			w.WriteHeader(http.StatusOK)

     

       116
       116
       +
       		})

     

       117
       117
       +
       

     

       118
       118
       +
       		handler := logoutLimiter.Middleware(testHandler)

     

       119
       119
       +
       		clientIP := "192.168.1.203:12345"

     

       120
       120
       +
       

     

       121
       121
       +
       		// Make 10 requests

     

       122
       122
       +
       		for i := 0; i < 10; i++ {

     

       123
       123
       +
       			req := httptest.NewRequest("POST", "/oauth/logout", nil)

     

       124
       124
       +
       			req.RemoteAddr = clientIP

     

       125
       125
       +
       			rr := httptest.NewRecorder()

     

       126
       126
       +
       			handler.ServeHTTP(rr, req)

     

       127
       127
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       128
       128
       +
       		}

     

       129
       129
       +
       

     

       130
       130
       +
       		// 11th request blocked

     

       131
       131
       +
       		req := httptest.NewRequest("POST", "/oauth/logout", nil)

     

       132
       132
       +
       		req.RemoteAddr = clientIP

     

       133
       133
       +
       		rr := httptest.NewRecorder()

     

       134
       134
       +
       		handler.ServeHTTP(rr, req)

     

       135
       135
       +
       

     

       136
       136
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Logout should be rate limited at 10 req/min")

     

       137
       137
       +
       	})

     

       138
       138
       +
       

     

       139
       139
       +
       	t.Run("OAuth callback has 10 req/min limit", func(t *testing.T) {

     

       140
       140
       +
       		// Callback uses same limiter as login (part of auth flow)

     

       141
       141
       +
       		callbackLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       142
       142
       +
       

     

       143
       143
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       144
       144
       +
       			w.WriteHeader(http.StatusOK)

     

       145
       145
       +
       		})

     

       146
       146
       +
       

     

       147
       147
       +
       		handler := callbackLimiter.Middleware(testHandler)

     

       148
       148
       +
       		clientIP := "192.168.1.204:12345"

     

       149
       149
       +
       

     

       150
       150
       +
       		// Make 10 requests

     

       151
       151
       +
       		for i := 0; i < 10; i++ {

     

       152
       152
       +
       			req := httptest.NewRequest("GET", "/oauth/callback", nil)

     

       153
       153
       +
       			req.RemoteAddr = clientIP

     

       154
       154
       +
       			rr := httptest.NewRecorder()

     

       155
       155
       +
       			handler.ServeHTTP(rr, req)

     

       156
       156
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       157
       157
       +
       		}

     

       158
       158
       +
       

     

       159
       159
       +
       		// 11th request blocked

     

       160
       160
       +
       		req := httptest.NewRequest("GET", "/oauth/callback", nil)

     

       161
       161
       +
       		req.RemoteAddr = clientIP

     

       162
       162
       +
       		rr := httptest.NewRecorder()

     

       163
       163
       +
       		handler.ServeHTTP(rr, req)

     

       164
       164
       +
       

     

       165
       165
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Callback should be rate limited at 10 req/min")

     

       166
       166
       +
       	})

     

       167
       167
       +
       

     

       168
       168
       +
       	t.Run("OAuth rate limits are stricter than global limit", func(t *testing.T) {

     

       169
       169
       +
       		// Verify OAuth limits are more restrictive than global 100 req/min

     

       170
       170
       +
       		const globalLimit = 100

     

       171
       171
       +
       		const oauthLoginLimit = 10

     

       172
       172
       +
       		const oauthRefreshLimit = 20

     

       173
       173
       +
       

     

       174
       174
       +
       		assert.Less(t, oauthLoginLimit, globalLimit, "OAuth login limit should be stricter than global")

     

       175
       175
       +
       		assert.Less(t, oauthRefreshLimit, globalLimit, "OAuth refresh limit should be stricter than global")

     

       176
       176
       +
       		assert.Greater(t, oauthRefreshLimit, oauthLoginLimit, "Refresh limit should be higher than login (legitimate use case)")

     

       177
       177
       +
       	})

     

       178
       178
       +
       

     

       179
       179
       +
       	t.Run("OAuth limits prevent credential stuffing", func(t *testing.T) {

     

       180
       180
       +
       		// Simulate credential stuffing attack

     

       181
       181
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       182
       182
       +
       

     

       183
       183
       +
       		testHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       184
       184
       +
       			// Simulate failed login attempts

     

       185
       185
       +
       			w.WriteHeader(http.StatusUnauthorized)

     

       186
       186
       +
       		})

     

       187
       187
       +
       

     

       188
       188
       +
       		handler := loginLimiter.Middleware(testHandler)

     

       189
       189
       +
       		attackerIP := "203.0.113.50:12345"

     

       190
       190
       +
       

     

       191
       191
       +
       		// Attacker tries 15 login attempts (credential stuffing)

     

       192
       192
       +
       		successfulAttempts := 0

     

       193
       193
       +
       		blockedAttempts := 0

     

       194
       194
       +
       

     

       195
       195
       +
       		for i := 0; i < 15; i++ {

     

       196
       196
       +
       			req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       197
       197
       +
       			req.RemoteAddr = attackerIP

     

       198
       198
       +
       			rr := httptest.NewRecorder()

     

       199
       199
       +
       

     

       200
       200
       +
       			handler.ServeHTTP(rr, req)

     

       201
       201
       +
       

     

       202
       202
       +
       			if rr.Code == http.StatusUnauthorized {

     

       203
       203
       +
       				successfulAttempts++ // Reached handler (even if auth failed)

     

       204
       204
       +
       			} else if rr.Code == http.StatusTooManyRequests {

     

       205
       205
       +
       				blockedAttempts++

     

       206
       206
       +
       			}

     

       207
       207
       +
       		}

     

       208
       208
       +
       

     

       209
       209
       +
       		// Rate limiter should block 5 attempts after first 10

     

       210
       210
       +
       		assert.Equal(t, 10, successfulAttempts, "Should allow 10 login attempts")

     

       211
       211
       +
       		assert.Equal(t, 5, blockedAttempts, "Should block 5 attempts after limit reached")

     

       212
       212
       +
       	})

     

       213
       213
       +
       

     

       214
       214
       +
       	t.Run("OAuth limits are per-endpoint", func(t *testing.T) {

     

       215
       215
       +
       		// Each endpoint gets its own rate limiter

     

       216
       216
       +
       		// This test verifies that limits are independent per endpoint

     

       217
       217
       +
       		loginLimiter := middleware.NewRateLimiter(10, 1*time.Minute)

     

       218
       218
       +
       		refreshLimiter := middleware.NewRateLimiter(20, 1*time.Minute)

     

       219
       219
       +
       

     

       220
       220
       +
       		loginHandler := loginLimiter.Middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       221
       221
       +
       			w.WriteHeader(http.StatusOK)

     

       222
       222
       +
       		}))

     

       223
       223
       +
       

     

       224
       224
       +
       		refreshHandler := refreshLimiter.Middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       225
       225
       +
       			w.WriteHeader(http.StatusOK)

     

       226
       226
       +
       		}))

     

       227
       227
       +
       

     

       228
       228
       +
       		clientIP := "192.168.1.205:12345"

     

       229
       229
       +
       

     

       230
       230
       +
       		// Exhaust login limit

     

       231
       231
       +
       		for i := 0; i < 10; i++ {

     

       232
       232
       +
       			req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       233
       233
       +
       			req.RemoteAddr = clientIP

     

       234
       234
       +
       			rr := httptest.NewRecorder()

     

       235
       235
       +
       			loginHandler.ServeHTTP(rr, req)

     

       236
       236
       +
       			assert.Equal(t, http.StatusOK, rr.Code)

     

       237
       237
       +
       		}

     

       238
       238
       +
       

     

       239
       239
       +
       		// Login limit exhausted

     

       240
       240
       +
       		req := httptest.NewRequest("GET", "/oauth/login", nil)

     

       241
       241
       +
       		req.RemoteAddr = clientIP

     

       242
       242
       +
       		rr := httptest.NewRecorder()

     

       243
       243
       +
       		loginHandler.ServeHTTP(rr, req)

     

       244
       244
       +
       		assert.Equal(t, http.StatusTooManyRequests, rr.Code, "Login should be rate limited")

     

       245
       245
       +
       

     

       246
       246
       +
       		// Refresh endpoint should still work (independent limiter)

     

       247
       247
       +
       		req = httptest.NewRequest("POST", "/oauth/refresh", nil)

     

       248
       248
       +
       		req.RemoteAddr = clientIP

     

       249
       249
       +
       		rr = httptest.NewRecorder()

     

       250
       250
       +
       		refreshHandler.ServeHTTP(rr, req)

     

       251
       251
       +
       		assert.Equal(t, http.StatusOK, rr.Code, "Refresh should not be affected by login rate limit")

     

       252
       252
       +
       	})

     

       253
       253
       +
       }

     

       254
       254
       +
       

     

       255
       255
       +
       // OAuth Rate Limiting Configuration Documentation

     

       256
       256
       +
       // ================================================

     

       257
       257
       +
       // This test file validates OAuth-specific rate limits applied in oauth.go:

     

       258
       258
       +
       //

     

       259
       259
       +
       // 1. Login Endpoints (Credential Stuffing Protection)

     

       260
       260
       +
       //    - Endpoints: /oauth/login, /oauth/mobile/login, /oauth/callback

     

       261
       261
       +
       //    - Limit: 10 requests per minute per IP

     

       262
       262
       +
       //    - Reason: Prevent brute force and credential stuffing attacks

     

       263
       263
       +
       //    - Implementation: internal/api/routes/oauth.go:21

     

       264
       264
       +
       //

     

       265
       265
       +
       // 2. Refresh Endpoint (Token Refresh)

     

       266
       266
       +
       //    - Endpoint: /oauth/refresh

     

       267
       267
       +
       //    - Limit: 20 requests per minute per IP

     

       268
       268
       +
       //    - Reason: Allow legitimate token refresh while preventing abuse

     

       269
       269
       +
       //    - Implementation: internal/api/routes/oauth.go:24

     

       270
       270
       +
       //

     

       271
       271
       +
       // 3. Logout Endpoint

     

       272
       272
       +
       //    - Endpoint: /oauth/logout

     

       273
       273
       +
       //    - Limit: 10 requests per minute per IP

     

       274
       274
       +
       //    - Reason: Prevent session exhaustion attacks

     

       275
       275
       +
       //    - Implementation: internal/api/routes/oauth.go:27

     

       276
       276
       +
       //

     

       277
       277
       +
       // 4. Metadata Endpoints (No Extra Limit)

     

       278
       278
       +
       //    - Endpoints: /oauth/client-metadata.json, /oauth/jwks.json

     

       279
       279
       +
       //    - Limit: Global 100 requests per minute (from main.go)

     

       280
       280
       +
       //    - Reason: Public metadata, not sensitive to rate abuse

     

       281
       281
       +
       //

     

       282
       282
       +
       // Security Benefits:

     

       283
       283
       +
       //    - Credential Stuffing: Limits password guessing to 10 attempts/min

     

       284
       284
       +
       //    - State Exhaustion: Prevents OAuth state generation spam

     

       285
       285
       +
       //    - Token Abuse: Limits refresh token usage while allowing legitimate refresh

     

       286
       286
       +
       //

     

       287
       287
       +
       // Rate Limit Hierarchy:

     

       288
       288
       +
       //    - OAuth login: 10 req/min (most restrictive)

     

       289
       289
       +
       //    - OAuth refresh: 20 req/min (moderate)

     

       290
       290
       +
       //    - Comments: 20 req/min (expensive queries)

     

       291
       291
       +
       //    - Global: 100 req/min (baseline)

-208

tests/integration/jwt_verification_test.go

···

       1
       1
       -
       package integration

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"Coves/internal/api/middleware"

     

       5
       5
       -
       	"Coves/internal/atproto/auth"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"net/http"

     

       8
       8
       -
       	"net/http/httptest"

     

       9
       9
       -
       	"os"

     

       10
       10
       -
       	"strings"

     

       11
       11
       -
       	"testing"

     

       12
       12
       -
       	"time"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       // TestJWTSignatureVerification tests end-to-end JWT signature verification

     

       16
       16
       -
       // with a real PDS-issued token. This verifies that AUTH_SKIP_VERIFY=false works.

     

       17
       17
       -
       //

     

       18
       18
       -
       // Flow:

     

       19
       19
       -
       // 1. Create account on local PDS (or use existing)

     

       20
       20
       -
       // 2. Authenticate to get a real signed JWT token

     

       21
       21
       -
       // 3. Verify our auth middleware can fetch JWKS and verify the signature

     

       22
       22
       -
       // 4. Test with AUTH_SKIP_VERIFY=false (production mode)

     

       23
       23
       -
       //

     

       24
       24
       -
       // NOTE: Local dev PDS (docker-compose.dev.yml) uses symmetric JWT_SECRET signing

     

       25
       25
       -
       // instead of asymmetric JWKS keys. This test verifies the code path works, but

     

       26
       26
       -
       // full JWKS verification requires a production PDS or setting up proper keys.

     

       27
       27
       -
       func TestJWTSignatureVerification(t *testing.T) {

     

       28
       28
       -
       	// Skip in short mode since this requires real PDS

     

       29
       29
       -
       	if testing.Short() {

     

       30
       30
       -
       		t.Skip("Skipping JWT verification test in short mode")

     

       31
       31
       -
       	}

     

       32
       32
       -
       

     

       33
       33
       -
       	pdsURL := os.Getenv("PDS_URL")

     

       34
       34
       -
       	if pdsURL == "" {

     

       35
       35
       -
       		pdsURL = "http://localhost:3001"

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	// Check if PDS is running

     

       39
       39
       -
       	healthResp, err := http.Get(pdsURL + "/xrpc/_health")

     

       40
       40
       -
       	if err != nil {

     

       41
       41
       -
       		t.Skipf("PDS not running at %s: %v", pdsURL, err)

     

       42
       42
       -
       	}

     

       43
       43
       -
       	_ = healthResp.Body.Close()

     

       44
       44
       -
       

     

       45
       45
       -
       	// Check if JWKS is available (production PDS) or symmetric secret (dev PDS)

     

       46
       46
       -
       	jwksResp, _ := http.Get(pdsURL + "/oauth/jwks")

     

       47
       47
       -
       	if jwksResp != nil {

     

       48
       48
       -
       		defer func() { _ = jwksResp.Body.Close() }()

     

       49
       49
       -
       	}

     

       50
       50
       -
       

     

       51
       51
       -
       	t.Run("JWT parsing and middleware integration", func(t *testing.T) {

     

       52
       52
       -
       		// Step 1: Create a test account on PDS

     

       53
       53
       -
       		// Keep handle short to avoid PDS validation errors

     

       54
       54
       -
       		timestamp := time.Now().Unix() % 100000 // Last 5 digits

     

       55
       55
       -
       		handle := fmt.Sprintf("jwt%d.local.coves.dev", timestamp)

     

       56
       56
       -
       		password := "testpass123"

     

       57
       57
       -
       		email := fmt.Sprintf("jwt%d@test.com", timestamp)

     

       58
       58
       -
       

     

       59
       59
       -
       		accessToken, did, err := createPDSAccount(pdsURL, handle, email, password)

     

       60
       60
       -
       		if err != nil {

     

       61
       61
       -
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       62
       62
       -
       		}

     

       63
       63
       -
       		t.Logf("✓ Created test account: %s (DID: %s)", handle, did)

     

       64
       64
       -
       		t.Logf("✓ Received JWT token from PDS (length: %d)", len(accessToken))

     

       65
       65
       -
       

     

       66
       66
       -
       		// Step 3: Test JWT parsing (should work regardless of verification)

     

       67
       67
       -
       		claims, err := auth.ParseJWT(accessToken)

     

       68
       68
       -
       		if err != nil {

     

       69
       69
       -
       			t.Fatalf("Failed to parse JWT: %v", err)

     

       70
       70
       -
       		}

     

       71
       71
       -
       		t.Logf("✓ JWT parsed successfully")

     

       72
       72
       -
       		t.Logf("  Subject (DID): %s", claims.Subject)

     

       73
       73
       -
       		t.Logf("  Issuer: %s", claims.Issuer)

     

       74
       74
       -
       		t.Logf("  Scope: %s", claims.Scope)

     

       75
       75
       -
       

     

       76
       76
       -
       		if claims.Subject != did {

     

       77
       77
       -
       			t.Errorf("Token DID mismatch: expected %s, got %s", did, claims.Subject)

     

       78
       78
       -
       		}

     

       79
       79
       -
       

     

       80
       80
       -
       		// Step 4: Test JWKS fetching and signature verification

     

       81
       81
       -
       		// NOTE: Local dev PDS uses symmetric secret, not JWKS

     

       82
       82
       -
       		// For production, we'd verify the full signature here

     

       83
       83
       -
       		t.Log("Checking JWKS availability...")

     

       84
       84
       -
       

     

       85
       85
       -
       		jwksFetcher := auth.NewCachedJWKSFetcher(1 * time.Hour)

     

       86
       86
       -
       		verifiedClaims, err := auth.VerifyJWT(httptest.NewRequest("GET", "/", nil).Context(), accessToken, jwksFetcher)

     

       87
       87
       -
       		if err != nil {

     

       88
       88
       -
       			// Expected for local dev PDS - log and continue

     

       89
       89
       -
       			t.Logf("ℹ️  JWKS verification skipped (expected for local dev PDS): %v", err)

     

       90
       90
       -
       			t.Logf("   Local PDS uses symmetric JWT_SECRET instead of JWKS")

     

       91
       91
       -
       			t.Logf("   In production, this would verify against proper JWKS keys")

     

       92
       92
       -
       		} else {

     

       93
       93
       -
       			// Unexpected success - means we're testing against a production PDS

     

       94
       94
       -
       			t.Logf("✓ JWT signature verified successfully!")

     

       95
       95
       -
       			t.Logf("  Verified DID: %s", verifiedClaims.Subject)

     

       96
       96
       -
       			t.Logf("  Verified Issuer: %s", verifiedClaims.Issuer)

     

       97
       97
       -
       

     

       98
       98
       -
       			if verifiedClaims.Subject != did {

     

       99
       99
       -
       				t.Errorf("Verified token DID mismatch: expected %s, got %s", did, verifiedClaims.Subject)

     

       100
       100
       -
       			}

     

       101
       101
       -
       		}

     

       102
       102
       -
       

     

       103
       103
       -
       		// Step 5: Test auth middleware with skipVerify=true (for dev PDS)

     

       104
       104
       -
       		t.Log("Testing auth middleware with skipVerify=true (dev mode)...")

     

       105
       105
       -
       

     

       106
       106
       -
       		authMiddleware := middleware.NewAtProtoAuthMiddleware(jwksFetcher, true) // skipVerify=true for dev PDS

     

       107
       107
       -
       		defer authMiddleware.Stop()                                               // Clean up DPoP replay cache goroutine

     

       108
       108
       -
       

     

       109
       109
       -
       		handlerCalled := false

     

       110
       110
       -
       		var extractedDID string

     

       111
       111
       -
       

     

       112
       112
       -
       		testHandler := authMiddleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       113
       113
       -
       			handlerCalled = true

     

       114
       114
       -
       			extractedDID = middleware.GetUserDID(r)

     

       115
       115
       -
       			w.WriteHeader(http.StatusOK)

     

       116
       116
       -
       			_, _ = w.Write([]byte(`{"success": true}`))

     

       117
       117
       -
       		}))

     

       118
       118
       -
       

     

       119
       119
       -
       		req := httptest.NewRequest("GET", "/test", nil)

     

       120
       120
       -
       		req.Header.Set("Authorization", "DPoP "+accessToken)

     

       121
       121
       -
       		w := httptest.NewRecorder()

     

       122
       122
       -
       

     

       123
       123
       -
       		testHandler.ServeHTTP(w, req)

     

       124
       124
       -
       

     

       125
       125
       -
       		if !handlerCalled {

     

       126
       126
       -
       			t.Errorf("Handler was not called - auth middleware rejected valid token")

     

       127
       127
       -
       			t.Logf("Response status: %d", w.Code)

     

       128
       128
       -
       			t.Logf("Response body: %s", w.Body.String())

     

       129
       129
       -
       		}

     

       130
       130
       -
       

     

       131
       131
       -
       		if w.Code != http.StatusOK {

     

       132
       132
       -
       			t.Errorf("Expected status 200, got %d", w.Code)

     

       133
       133
       -
       			t.Logf("Response body: %s", w.Body.String())

     

       134
       134
       -
       		}

     

       135
       135
       -
       

     

       136
       136
       -
       		if extractedDID != did {

     

       137
       137
       -
       			t.Errorf("Middleware extracted wrong DID: expected %s, got %s", did, extractedDID)

     

       138
       138
       -
       		}

     

       139
       139
       -
       

     

       140
       140
       -
       		t.Logf("✅ Auth middleware with signature verification working correctly!")

     

       141
       141
       -
       		t.Logf("  Handler called: %v", handlerCalled)

     

       142
       142
       -
       		t.Logf("  Extracted DID: %s", extractedDID)

     

       143
       143
       -
       		t.Logf("  Response status: %d", w.Code)

     

       144
       144
       -
       	})

     

       145
       145
       -
       

     

       146
       146
       -
       	t.Run("Rejects tampered JWT", func(t *testing.T) {

     

       147
       147
       -
       		// Create valid token

     

       148
       148
       -
       		timestamp := time.Now().Unix() % 100000

     

       149
       149
       -
       		handle := fmt.Sprintf("tamp%d.local.coves.dev", timestamp)

     

       150
       150
       -
       		password := "testpass456"

     

       151
       151
       -
       		email := fmt.Sprintf("tamp%d@test.com", timestamp)

     

       152
       152
       -
       

     

       153
       153
       -
       		accessToken, _, err := createPDSAccount(pdsURL, handle, email, password)

     

       154
       154
       -
       		if err != nil {

     

       155
       155
       -
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       156
       156
       -
       		}

     

       157
       157
       -
       

     

       158
       158
       -
       		// Tamper with the token more aggressively to break JWT structure

     

       159
       159
       -
       		parts := splitToken(accessToken)

     

       160
       160
       -
       		if len(parts) != 3 {

     

       161
       161
       -
       			t.Fatalf("Invalid JWT structure: expected 3 parts, got %d", len(parts))

     

       162
       162
       -
       		}

     

       163
       163
       -
       		// Replace the payload with invalid base64 that will fail decoding

     

       164
       164
       -
       		tamperedToken := parts[0] + ".!!!invalid-base64!!!." + parts[2]

     

       165
       165
       -
       

     

       166
       166
       -
       		// Test with middleware (skipVerify=true since dev PDS doesn't use JWKS)

     

       167
       167
       -
       		// Tampered payload should fail JWT parsing even without signature check

     

       168
       168
       -
       		jwksFetcher := auth.NewCachedJWKSFetcher(1 * time.Hour)

     

       169
       169
       -
       		authMiddleware := middleware.NewAtProtoAuthMiddleware(jwksFetcher, true)

     

       170
       170
       -
       		defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine

     

       171
       171
       -
       

     

       172
       172
       -
       		handlerCalled := false

     

       173
       173
       -
       		testHandler := authMiddleware.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       174
       174
       -
       			handlerCalled = true

     

       175
       175
       -
       			w.WriteHeader(http.StatusOK)

     

       176
       176
       -
       		}))

     

       177
       177
       -
       

     

       178
       178
       -
       		req := httptest.NewRequest("GET", "/test", nil)

     

       179
       179
       -
       		req.Header.Set("Authorization", "DPoP "+tamperedToken)

     

       180
       180
       -
       		w := httptest.NewRecorder()

     

       181
       181
       -
       

     

       182
       182
       -
       		testHandler.ServeHTTP(w, req)

     

       183
       183
       -
       

     

       184
       184
       -
       		if handlerCalled {

     

       185
       185
       -
       			t.Error("Handler was called for tampered token - should have been rejected")

     

       186
       186
       -
       		}

     

       187
       187
       -
       

     

       188
       188
       -
       		if w.Code != http.StatusUnauthorized {

     

       189
       189
       -
       			t.Errorf("Expected status 401 for tampered token, got %d", w.Code)

     

       190
       190
       -
       		}

     

       191
       191
       -
       

     

       192
       192
       -
       		t.Logf("✅ Middleware correctly rejected tampered token with status %d", w.Code)

     

       193
       193
       -
       	})

     

       194
       194
       -
       

     

       195
       195
       -
       	t.Run("Rejects expired JWT with signature verification", func(t *testing.T) {

     

       196
       196
       -
       		// For this test, we'd need to create a token and wait for expiry,

     

       197
       197
       -
       		// or mock the time. For now, we'll just verify the validation logic exists.

     

       198
       198
       -
       		// In production, PDS tokens expire after a certain period.

     

       199
       199
       -
       		t.Log("ℹ️  Expiration test would require waiting for token expiry or time mocking")

     

       200
       200
       -
       		t.Log("   Token expiration validation is covered by unit tests in auth_test.go")

     

       201
       201
       -
       		t.Skip("Skipping expiration test - requires time manipulation")

     

       202
       202
       -
       	})

     

       203
       203
       -
       }

     

       204
       204
       -
       

     

       205
       205
       -
       // splitToken splits a JWT into its three parts (header.payload.signature)

     

       206
       206
       -
       func splitToken(token string) []string {

     

       207
       207
       -
       	return strings.Split(token, ".")

     

       208
       208
       -
       }

+910

tests/integration/oauth_e2e_test.go

···

       1
       1
       +
       package integration

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/oauth"

     

       5
       5
       +
       	"context"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"fmt"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       	"net/http/httptest"

     

       10
       10
       +
       	"strings"

     

       11
       11
       +
       	"testing"

     

       12
       12
       +
       	"time"

     

       13
       13
       +
       

     

       14
       14
       +
       	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       15
       15
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       16
       16
       +
       	"github.com/go-chi/chi/v5"

     

       17
       17
       +
       	_ "github.com/lib/pq"

     

       18
       18
       +
       	"github.com/pressly/goose/v3"

     

       19
       19
       +
       	"github.com/stretchr/testify/assert"

     

       20
       20
       +
       	"github.com/stretchr/testify/require"

     

       21
       21
       +
       )

     

       22
       22
       +
       

     

       23
       23
       +
       // TestOAuth_Components tests OAuth component functionality without requiring PDS.

     

       24
       24
       +
       // This validates all Coves OAuth code:

     

       25
       25
       +
       // - Session storage and retrieval (PostgreSQL)

     

       26
       26
       +
       // - Token sealing (AES-GCM encryption)

     

       27
       27
       +
       // - Token unsealing (decryption + validation)

     

       28
       28
       +
       // - Session cleanup

     

       29
       29
       +
       //

     

       30
       30
       +
       // NOTE: Full OAuth redirect flow testing requires both HTTPS PDS and HTTPS Coves deployment.

     

       31
       31
       +
       // The OAuth redirect flow is handled by indigo's library and enforces OAuth 2.0 spec

     

       32
       32
       +
       // (HTTPS required for authorization servers and redirect URIs).

     

       33
       33
       +
       func TestOAuth_Components(t *testing.T) {

     

       34
       34
       +
       	if testing.Short() {

     

       35
       35
       +
       		t.Skip("Skipping OAuth component test in short mode")

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	// Setup test database

     

       39
       39
       +
       	db := setupTestDB(t)

     

       40
       40
       +
       	defer func() {

     

       41
       41
       +
       		if err := db.Close(); err != nil {

     

       42
       42
       +
       			t.Logf("Failed to close database: %v", err)

     

       43
       43
       +
       		}

     

       44
       44
       +
       	}()

     

       45
       45
       +
       

     

       46
       46
       +
       	// Run migrations to ensure OAuth tables exist

     

       47
       47
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       48
       48
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       49
       49
       +
       

     

       50
       50
       +
       	t.Log("🔧 Testing OAuth Components")

     

       51
       51
       +
       

     

       52
       52
       +
       	ctx := context.Background()

     

       53
       53
       +
       

     

       54
       54
       +
       	// Setup OAuth client and store

     

       55
       55
       +
       	store := SetupOAuthTestStore(t, db)

     

       56
       56
       +
       	client := SetupOAuthTestClient(t, store)

     

       57
       57
       +
       	require.NotNil(t, client, "OAuth client should be initialized")

     

       58
       58
       +
       

     

       59
       59
       +
       	// Use a test DID (doesn't need to exist on PDS for component tests)

     

       60
       60
       +
       	testDID := "did:plc:componenttest123"

     

       61
       61
       +
       

     

       62
       62
       +
       	// Run component tests

     

       63
       63
       +
       	testOAuthComponentsWithMockedSession(t, ctx, nil, store, client, testDID, "")

     

       64
       64
       +
       

     

       65
       65
       +
       	t.Log("")

     

       66
       66
       +
       	t.Log(strings.Repeat("=", 60))

     

       67
       67
       +
       	t.Log("✅ OAuth Component Tests Complete")

     

       68
       68
       +
       	t.Log(strings.Repeat("=", 60))

     

       69
       69
       +
       	t.Log("Components validated:")

     

       70
       70
       +
       	t.Log("  ✓ Session storage (PostgreSQL)")

     

       71
       71
       +
       	t.Log("  ✓ Token sealing (AES-GCM encryption)")

     

       72
       72
       +
       	t.Log("  ✓ Token unsealing (decryption + validation)")

     

       73
       73
       +
       	t.Log("  ✓ Session cleanup")

     

       74
       74
       +
       	t.Log("")

     

       75
       75
       +
       	t.Log("NOTE: Full OAuth redirect flow requires HTTPS PDS + HTTPS Coves")

     

       76
       76
       +
       	t.Log(strings.Repeat("=", 60))

     

       77
       77
       +
       }

     

       78
       78
       +
       

     

       79
       79
       +
       // testOAuthComponentsWithMockedSession tests OAuth components that work without PDS redirect flow.

     

       80
       80
       +
       // This is used when testing with localhost PDS, where the indigo library rejects http:// URLs.

     

       81
       81
       +
       func testOAuthComponentsWithMockedSession(t *testing.T, ctx context.Context, _ interface{}, store oauthlib.ClientAuthStore, client *oauth.OAuthClient, userDID, _ string) {

     

       82
       82
       +
       	t.Helper()

     

       83
       83
       +
       

     

       84
       84
       +
       	t.Log("🔧 Testing OAuth components with mocked session...")

     

       85
       85
       +
       

     

       86
       86
       +
       	// Parse DID

     

       87
       87
       +
       	parsedDID, err := syntax.ParseDID(userDID)

     

       88
       88
       +
       	require.NoError(t, err, "Should parse DID")

     

       89
       89
       +
       

     

       90
       90
       +
       	// Component 1: Session Storage

     

       91
       91
       +
       	t.Log("   📦 Component 1: Testing session storage...")

     

       92
       92
       +
       	testSession := oauthlib.ClientSessionData{

     

       93
       93
       +
       		AccountDID:  parsedDID,

     

       94
       94
       +
       		SessionID:   fmt.Sprintf("localhost-test-%d", time.Now().UnixNano()),

     

       95
       95
       +
       		HostURL:     "http://localhost:3001",

     

       96
       96
       +
       		AccessToken: "mocked-access-token",

     

       97
       97
       +
       		Scopes:      []string{"atproto", "transition:generic"},

     

       98
       98
       +
       	}

     

       99
       99
       +
       

     

       100
       100
       +
       	err = store.SaveSession(ctx, testSession)

     

       101
       101
       +
       	require.NoError(t, err, "Should save session")

     

       102
       102
       +
       

     

       103
       103
       +
       	retrieved, err := store.GetSession(ctx, parsedDID, testSession.SessionID)

     

       104
       104
       +
       	require.NoError(t, err, "Should retrieve session")

     

       105
       105
       +
       	require.Equal(t, testSession.SessionID, retrieved.SessionID)

     

       106
       106
       +
       	require.Equal(t, testSession.AccessToken, retrieved.AccessToken)

     

       107
       107
       +
       	t.Log("   ✅ Session storage working")

     

       108
       108
       +
       

     

       109
       109
       +
       	// Component 2: Token Sealing

     

       110
       110
       +
       	t.Log("   🔐 Component 2: Testing token sealing...")

     

       111
       111
       +
       	sealedToken, err := client.SealSession(parsedDID.String(), testSession.SessionID, time.Hour)

     

       112
       112
       +
       	require.NoError(t, err, "Should seal token")

     

       113
       113
       +
       	require.NotEmpty(t, sealedToken, "Sealed token should not be empty")

     

       114
       114
       +
       	tokenPreview := sealedToken

     

       115
       115
       +
       	if len(tokenPreview) > 50 {

     

       116
       116
       +
       		tokenPreview = tokenPreview[:50]

     

       117
       117
       +
       	}

     

       118
       118
       +
       	t.Logf("   ✅ Token sealed: %s...", tokenPreview)

     

       119
       119
       +
       

     

       120
       120
       +
       	// Component 3: Token Unsealing

     

       121
       121
       +
       	t.Log("   🔓 Component 3: Testing token unsealing...")

     

       122
       122
       +
       	unsealed, err := client.UnsealSession(sealedToken)

     

       123
       123
       +
       	require.NoError(t, err, "Should unseal token")

     

       124
       124
       +
       	require.Equal(t, userDID, unsealed.DID)

     

       125
       125
       +
       	require.Equal(t, testSession.SessionID, unsealed.SessionID)

     

       126
       126
       +
       	t.Log("   ✅ Token unsealing working")

     

       127
       127
       +
       

     

       128
       128
       +
       	// Component 4: Session Cleanup

     

       129
       129
       +
       	t.Log("   🧹 Component 4: Testing session cleanup...")

     

       130
       130
       +
       	err = store.DeleteSession(ctx, parsedDID, testSession.SessionID)

     

       131
       131
       +
       	require.NoError(t, err, "Should delete session")

     

       132
       132
       +
       

     

       133
       133
       +
       	_, err = store.GetSession(ctx, parsedDID, testSession.SessionID)

     

       134
       134
       +
       	require.Error(t, err, "Session should not exist after deletion")

     

       135
       135
       +
       	t.Log("   ✅ Session cleanup working")

     

       136
       136
       +
       

     

       137
       137
       +
       	t.Log("✅ All OAuth components verified!")

     

       138
       138
       +
       	t.Log("")

     

       139
       139
       +
       	t.Log("📝 Summary: OAuth implementation validated with mocked session")

     

       140
       140
       +
       	t.Log("   - Session storage: ✓")

     

       141
       141
       +
       	t.Log("   - Token sealing: ✓")

     

       142
       142
       +
       	t.Log("   - Token unsealing: ✓")

     

       143
       143
       +
       	t.Log("   - Session cleanup: ✓")

     

       144
       144
       +
       	t.Log("")

     

       145
       145
       +
       	t.Log("⚠️  To test full OAuth redirect flow, use a production PDS with HTTPS")

     

       146
       146
       +
       }

     

       147
       147
       +
       

     

       148
       148
       +
       // TestOAuthE2E_TokenExpiration tests that expired sealed tokens are rejected

     

       149
       149
       +
       func TestOAuthE2E_TokenExpiration(t *testing.T) {

     

       150
       150
       +
       	if testing.Short() {

     

       151
       151
       +
       		t.Skip("Skipping OAuth token expiration test in short mode")

     

       152
       152
       +
       	}

     

       153
       153
       +
       

     

       154
       154
       +
       	db := setupTestDB(t)

     

       155
       155
       +
       	defer func() { _ = db.Close() }()

     

       156
       156
       +
       

     

       157
       157
       +
       	// Run migrations

     

       158
       158
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       159
       159
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       160
       160
       +
       

     

       161
       161
       +
       	ctx := context.Background()

     

       162
       162
       +
       

     

       163
       163
       +
       	t.Log("⏰ Testing OAuth token expiration...")

     

       164
       164
       +
       

     

       165
       165
       +
       	// Setup OAuth client and store

     

       166
       166
       +
       	store := SetupOAuthTestStore(t, db)

     

       167
       167
       +
       	client := SetupOAuthTestClient(t, store)

     

       168
       168
       +
       	_ = oauth.NewOAuthHandler(client, store) // Handler created for completeness

     

       169
       169
       +
       

     

       170
       170
       +
       	// Create test session with past expiration

     

       171
       171
       +
       	did, err := syntax.ParseDID("did:plc:expiredtest123")

     

       172
       172
       +
       	require.NoError(t, err)

     

       173
       173
       +
       

     

       174
       174
       +
       	testSession := oauthlib.ClientSessionData{

     

       175
       175
       +
       		AccountDID:  did,

     

       176
       176
       +
       		SessionID:   "expired-session",

     

       177
       177
       +
       		HostURL:     "http://localhost:3001",

     

       178
       178
       +
       		AccessToken: "expired-token",

     

       179
       179
       +
       		Scopes:      []string{"atproto"},

     

       180
       180
       +
       	}

     

       181
       181
       +
       

     

       182
       182
       +
       	// Save session

     

       183
       183
       +
       	err = store.SaveSession(ctx, testSession)

     

       184
       184
       +
       	require.NoError(t, err)

     

       185
       185
       +
       

     

       186
       186
       +
       	// Manually update expiration to the past

     

       187
       187
       +
       	_, err = db.ExecContext(ctx,

     

       188
       188
       +
       		"UPDATE oauth_sessions SET expires_at = NOW() - INTERVAL '1 day' WHERE did = $1 AND session_id = $2",

     

       189
       189
       +
       		did.String(), testSession.SessionID)

     

       190
       190
       +
       	require.NoError(t, err)

     

       191
       191
       +
       

     

       192
       192
       +
       	// Try to retrieve expired session

     

       193
       193
       +
       	_, err = store.GetSession(ctx, did, testSession.SessionID)

     

       194
       194
       +
       	assert.Error(t, err, "Should not be able to retrieve expired session")

     

       195
       195
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "Should return ErrSessionNotFound for expired session")

     

       196
       196
       +
       

     

       197
       197
       +
       	// Test cleanup of expired sessions

     

       198
       198
       +
       	cleaned, err := store.(*oauth.PostgresOAuthStore).CleanupExpiredSessions(ctx)

     

       199
       199
       +
       	require.NoError(t, err, "Cleanup should succeed")

     

       200
       200
       +
       	assert.Greater(t, cleaned, int64(0), "Should have cleaned up at least one session")

     

       201
       201
       +
       

     

       202
       202
       +
       	t.Logf("✅ Expired session handling verified (cleaned %d sessions)", cleaned)

     

       203
       203
       +
       }

     

       204
       204
       +
       

     

       205
       205
       +
       // TestOAuthE2E_InvalidToken tests that invalid/tampered tokens are rejected

     

       206
       206
       +
       func TestOAuthE2E_InvalidToken(t *testing.T) {

     

       207
       207
       +
       	if testing.Short() {

     

       208
       208
       +
       		t.Skip("Skipping OAuth invalid token test in short mode")

     

       209
       209
       +
       	}

     

       210
       210
       +
       

     

       211
       211
       +
       	db := setupTestDB(t)

     

       212
       212
       +
       	defer func() { _ = db.Close() }()

     

       213
       213
       +
       

     

       214
       214
       +
       	// Run migrations

     

       215
       215
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       216
       216
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       217
       217
       +
       

     

       218
       218
       +
       	t.Log("🔒 Testing OAuth invalid token rejection...")

     

       219
       219
       +
       

     

       220
       220
       +
       	// Setup OAuth client and store

     

       221
       221
       +
       	store := SetupOAuthTestStore(t, db)

     

       222
       222
       +
       	client := SetupOAuthTestClient(t, store)

     

       223
       223
       +
       	handler := oauth.NewOAuthHandler(client, store)

     

       224
       224
       +
       

     

       225
       225
       +
       	// Setup test server with protected endpoint

     

       226
       226
       +
       	r := chi.NewRouter()

     

       227
       227
       +
       	r.Get("/api/me", func(w http.ResponseWriter, r *http.Request) {

     

       228
       228
       +
       		sessData, err := handler.GetSessionFromRequest(r)

     

       229
       229
       +
       		if err != nil {

     

       230
       230
       +
       			http.Error(w, "Unauthorized", http.StatusUnauthorized)

     

       231
       231
       +
       			return

     

       232
       232
       +
       		}

     

       233
       233
       +
       		w.Header().Set("Content-Type", "application/json")

     

       234
       234
       +
       		_ = json.NewEncoder(w).Encode(map[string]string{"did": sessData.AccountDID.String()})

     

       235
       235
       +
       	})

     

       236
       236
       +
       

     

       237
       237
       +
       	server := httptest.NewServer(r)

     

       238
       238
       +
       	defer server.Close()

     

       239
       239
       +
       

     

       240
       240
       +
       	// Test with invalid token formats

     

       241
       241
       +
       	testCases := []struct {

     

       242
       242
       +
       		name  string

     

       243
       243
       +
       		token string

     

       244
       244
       +
       	}{

     

       245
       245
       +
       		{"Empty token", ""},

     

       246
       246
       +
       		{"Invalid base64", "not-valid-base64!!!"},

     

       247
       247
       +
       		{"Tampered token", "dGFtcGVyZWQtdG9rZW4tZGF0YQ=="}, // Valid base64 but invalid content

     

       248
       248
       +
       		{"Short token", "abc"},

     

       249
       249
       +
       	}

     

       250
       250
       +
       

     

       251
       251
       +
       	for _, tc := range testCases {

     

       252
       252
       +
       		t.Run(tc.name, func(t *testing.T) {

     

       253
       253
       +
       			req, _ := http.NewRequest("GET", server.URL+"/api/me", nil)

     

       254
       254
       +
       			if tc.token != "" {

     

       255
       255
       +
       				req.Header.Set("Authorization", "Bearer "+tc.token)

     

       256
       256
       +
       			}

     

       257
       257
       +
       

     

       258
       258
       +
       			resp, err := http.DefaultClient.Do(req)

     

       259
       259
       +
       			require.NoError(t, err)

     

       260
       260
       +
       			defer func() { _ = resp.Body.Close() }()

     

       261
       261
       +
       

     

       262
       262
       +
       			assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       263
       263
       +
       				"Invalid token should be rejected with 401")

     

       264
       264
       +
       		})

     

       265
       265
       +
       	}

     

       266
       266
       +
       

     

       267
       267
       +
       	t.Logf("✅ Invalid token rejection verified")

     

       268
       268
       +
       }

     

       269
       269
       +
       

     

       270
       270
       +
       // TestOAuthE2E_SessionNotFound tests behavior when session doesn't exist in DB

     

       271
       271
       +
       func TestOAuthE2E_SessionNotFound(t *testing.T) {

     

       272
       272
       +
       	if testing.Short() {

     

       273
       273
       +
       		t.Skip("Skipping OAuth session not found test in short mode")

     

       274
       274
       +
       	}

     

       275
       275
       +
       

     

       276
       276
       +
       	db := setupTestDB(t)

     

       277
       277
       +
       	defer func() { _ = db.Close() }()

     

       278
       278
       +
       

     

       279
       279
       +
       	// Run migrations

     

       280
       280
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       281
       281
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       282
       282
       +
       

     

       283
       283
       +
       	ctx := context.Background()

     

       284
       284
       +
       

     

       285
       285
       +
       	t.Log("🔍 Testing OAuth session not found behavior...")

     

       286
       286
       +
       

     

       287
       287
       +
       	// Setup OAuth store

     

       288
       288
       +
       	store := SetupOAuthTestStore(t, db)

     

       289
       289
       +
       

     

       290
       290
       +
       	// Try to retrieve non-existent session

     

       291
       291
       +
       	nonExistentDID, err := syntax.ParseDID("did:plc:nonexistent123")

     

       292
       292
       +
       	require.NoError(t, err)

     

       293
       293
       +
       

     

       294
       294
       +
       	_, err = store.GetSession(ctx, nonExistentDID, "nonexistent-session")

     

       295
       295
       +
       	assert.Error(t, err, "Should return error for non-existent session")

     

       296
       296
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "Should return ErrSessionNotFound")

     

       297
       297
       +
       

     

       298
       298
       +
       	// Try to delete non-existent session

     

       299
       299
       +
       	err = store.DeleteSession(ctx, nonExistentDID, "nonexistent-session")

     

       300
       300
       +
       	assert.Error(t, err, "Should return error when deleting non-existent session")

     

       301
       301
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "Should return ErrSessionNotFound")

     

       302
       302
       +
       

     

       303
       303
       +
       	t.Logf("✅ Session not found handling verified")

     

       304
       304
       +
       }

     

       305
       305
       +
       

     

       306
       306
       +
       // TestOAuthE2E_MultipleSessionsPerUser tests that a user can have multiple active sessions

     

       307
       307
       +
       func TestOAuthE2E_MultipleSessionsPerUser(t *testing.T) {

     

       308
       308
       +
       	if testing.Short() {

     

       309
       309
       +
       		t.Skip("Skipping OAuth multiple sessions test in short mode")

     

       310
       310
       +
       	}

     

       311
       311
       +
       

     

       312
       312
       +
       	db := setupTestDB(t)

     

       313
       313
       +
       	defer func() { _ = db.Close() }()

     

       314
       314
       +
       

     

       315
       315
       +
       	// Run migrations

     

       316
       316
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       317
       317
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       318
       318
       +
       

     

       319
       319
       +
       	ctx := context.Background()

     

       320
       320
       +
       

     

       321
       321
       +
       	t.Log("👥 Testing multiple OAuth sessions per user...")

     

       322
       322
       +
       

     

       323
       323
       +
       	// Setup OAuth store

     

       324
       324
       +
       	store := SetupOAuthTestStore(t, db)

     

       325
       325
       +
       

     

       326
       326
       +
       	// Create a test DID

     

       327
       327
       +
       	did, err := syntax.ParseDID("did:plc:multisession123")

     

       328
       328
       +
       	require.NoError(t, err)

     

       329
       329
       +
       

     

       330
       330
       +
       	// Create multiple sessions for the same user

     

       331
       331
       +
       	sessions := []oauthlib.ClientSessionData{

     

       332
       332
       +
       		{

     

       333
       333
       +
       			AccountDID:  did,

     

       334
       334
       +
       			SessionID:   "session-1-web",

     

       335
       335
       +
       			HostURL:     "http://localhost:3001",

     

       336
       336
       +
       			AccessToken: "token-1",

     

       337
       337
       +
       			Scopes:      []string{"atproto"},

     

       338
       338
       +
       		},

     

       339
       339
       +
       		{

     

       340
       340
       +
       			AccountDID:  did,

     

       341
       341
       +
       			SessionID:   "session-2-mobile",

     

       342
       342
       +
       			HostURL:     "http://localhost:3001",

     

       343
       343
       +
       			AccessToken: "token-2",

     

       344
       344
       +
       			Scopes:      []string{"atproto"},

     

       345
       345
       +
       		},

     

       346
       346
       +
       		{

     

       347
       347
       +
       			AccountDID:  did,

     

       348
       348
       +
       			SessionID:   "session-3-tablet",

     

       349
       349
       +
       			HostURL:     "http://localhost:3001",

     

       350
       350
       +
       			AccessToken: "token-3",

     

       351
       351
       +
       			Scopes:      []string{"atproto"},

     

       352
       352
       +
       		},

     

       353
       353
       +
       	}

     

       354
       354
       +
       

     

       355
       355
       +
       	// Save all sessions

     

       356
       356
       +
       	for i, session := range sessions {

     

       357
       357
       +
       		err := store.SaveSession(ctx, session)

     

       358
       358
       +
       		require.NoError(t, err, "Should be able to save session %d", i+1)

     

       359
       359
       +
       	}

     

       360
       360
       +
       

     

       361
       361
       +
       	t.Logf("✅ Created %d sessions for user", len(sessions))

     

       362
       362
       +
       

     

       363
       363
       +
       	// Verify all sessions can be retrieved independently

     

       364
       364
       +
       	for i, session := range sessions {

     

       365
       365
       +
       		retrieved, err := store.GetSession(ctx, did, session.SessionID)

     

       366
       366
       +
       		require.NoError(t, err, "Should be able to retrieve session %d", i+1)

     

       367
       367
       +
       		assert.Equal(t, session.SessionID, retrieved.SessionID, "Session ID should match")

     

       368
       368
       +
       		assert.Equal(t, session.AccessToken, retrieved.AccessToken, "Access token should match")

     

       369
       369
       +
       	}

     

       370
       370
       +
       

     

       371
       371
       +
       	t.Logf("✅ All sessions retrieved independently")

     

       372
       372
       +
       

     

       373
       373
       +
       	// Delete one session and verify others remain

     

       374
       374
       +
       	err = store.DeleteSession(ctx, did, sessions[0].SessionID)

     

       375
       375
       +
       	require.NoError(t, err, "Should be able to delete first session")

     

       376
       376
       +
       

     

       377
       377
       +
       	// Verify first session is deleted

     

       378
       378
       +
       	_, err = store.GetSession(ctx, did, sessions[0].SessionID)

     

       379
       379
       +
       	assert.Equal(t, oauth.ErrSessionNotFound, err, "First session should be deleted")

     

       380
       380
       +
       

     

       381
       381
       +
       	// Verify other sessions still exist

     

       382
       382
       +
       	for i := 1; i < len(sessions); i++ {

     

       383
       383
       +
       		_, err := store.GetSession(ctx, did, sessions[i].SessionID)

     

       384
       384
       +
       		require.NoError(t, err, "Session %d should still exist", i+1)

     

       385
       385
       +
       	}

     

       386
       386
       +
       

     

       387
       387
       +
       	t.Logf("✅ Multiple sessions per user verified")

     

       388
       388
       +
       

     

       389
       389
       +
       	// Cleanup

     

       390
       390
       +
       	for i := 1; i < len(sessions); i++ {

     

       391
       391
       +
       		_ = store.DeleteSession(ctx, did, sessions[i].SessionID)

     

       392
       392
       +
       	}

     

       393
       393
       +
       }

     

       394
       394
       +
       

     

       395
       395
       +
       // TestOAuthE2E_AuthRequestStorage tests OAuth auth request storage and retrieval

     

       396
       396
       +
       func TestOAuthE2E_AuthRequestStorage(t *testing.T) {

     

       397
       397
       +
       	if testing.Short() {

     

       398
       398
       +
       		t.Skip("Skipping OAuth auth request storage test in short mode")

     

       399
       399
       +
       	}

     

       400
       400
       +
       

     

       401
       401
       +
       	db := setupTestDB(t)

     

       402
       402
       +
       	defer func() { _ = db.Close() }()

     

       403
       403
       +
       

     

       404
       404
       +
       	// Run migrations

     

       405
       405
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       406
       406
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       407
       407
       +
       

     

       408
       408
       +
       	ctx := context.Background()

     

       409
       409
       +
       

     

       410
       410
       +
       	t.Log("📝 Testing OAuth auth request storage...")

     

       411
       411
       +
       

     

       412
       412
       +
       	// Setup OAuth store

     

       413
       413
       +
       	store := SetupOAuthTestStore(t, db)

     

       414
       414
       +
       

     

       415
       415
       +
       	// Create test auth request data

     

       416
       416
       +
       	did, err := syntax.ParseDID("did:plc:authrequest123")

     

       417
       417
       +
       	require.NoError(t, err)

     

       418
       418
       +
       

     

       419
       419
       +
       	authRequest := oauthlib.AuthRequestData{

     

       420
       420
       +
       		State:                        "test-state-12345",

     

       421
       421
       +
       		AccountDID:                   &did,

     

       422
       422
       +
       		PKCEVerifier:                 "test-pkce-verifier",

     

       423
       423
       +
       		DPoPPrivateKeyMultibase:      "test-dpop-key",

     

       424
       424
       +
       		DPoPAuthServerNonce:          "test-nonce",

     

       425
       425
       +
       		AuthServerURL:                "http://localhost:3001",

     

       426
       426
       +
       		RequestURI:                   "http://localhost:3001/authorize",

     

       427
       427
       +
       		AuthServerTokenEndpoint:      "http://localhost:3001/oauth/token",

     

       428
       428
       +
       		AuthServerRevocationEndpoint: "http://localhost:3001/oauth/revoke",

     

       429
       429
       +
       		Scopes:                       []string{"atproto", "transition:generic"},

     

       430
       430
       +
       	}

     

       431
       431
       +
       

     

       432
       432
       +
       	// Save auth request

     

       433
       433
       +
       	err = store.SaveAuthRequestInfo(ctx, authRequest)

     

       434
       434
       +
       	require.NoError(t, err, "Should be able to save auth request")

     

       435
       435
       +
       

     

       436
       436
       +
       	t.Logf("✅ Auth request saved")

     

       437
       437
       +
       

     

       438
       438
       +
       	// Retrieve auth request

     

       439
       439
       +
       	retrieved, err := store.GetAuthRequestInfo(ctx, authRequest.State)

     

       440
       440
       +
       	require.NoError(t, err, "Should be able to retrieve auth request")

     

       441
       441
       +
       	assert.Equal(t, authRequest.State, retrieved.State, "State should match")

     

       442
       442
       +
       	assert.Equal(t, authRequest.PKCEVerifier, retrieved.PKCEVerifier, "PKCE verifier should match")

     

       443
       443
       +
       	assert.Equal(t, authRequest.AuthServerURL, retrieved.AuthServerURL, "Auth server URL should match")

     

       444
       444
       +
       	assert.Equal(t, len(authRequest.Scopes), len(retrieved.Scopes), "Scopes length should match")

     

       445
       445
       +
       

     

       446
       446
       +
       	t.Logf("✅ Auth request retrieved and verified")

     

       447
       447
       +
       

     

       448
       448
       +
       	// Test duplicate state error

     

       449
       449
       +
       	err = store.SaveAuthRequestInfo(ctx, authRequest)

     

       450
       450
       +
       	assert.Error(t, err, "Should not allow duplicate state")

     

       451
       451
       +
       	assert.Contains(t, err.Error(), "already exists", "Error should indicate duplicate")

     

       452
       452
       +
       

     

       453
       453
       +
       	t.Logf("✅ Duplicate state prevention verified")

     

       454
       454
       +
       

     

       455
       455
       +
       	// Delete auth request

     

       456
       456
       +
       	err = store.DeleteAuthRequestInfo(ctx, authRequest.State)

     

       457
       457
       +
       	require.NoError(t, err, "Should be able to delete auth request")

     

       458
       458
       +
       

     

       459
       459
       +
       	// Verify deletion

     

       460
       460
       +
       	_, err = store.GetAuthRequestInfo(ctx, authRequest.State)

     

       461
       461
       +
       	assert.Equal(t, oauth.ErrAuthRequestNotFound, err, "Auth request should be deleted")

     

       462
       462
       +
       

     

       463
       463
       +
       	t.Logf("✅ Auth request deletion verified")

     

       464
       464
       +
       

     

       465
       465
       +
       	// Test cleanup of expired auth requests

     

       466
       466
       +
       	// Create an auth request and manually set created_at to the past

     

       467
       467
       +
       	oldAuthRequest := oauthlib.AuthRequestData{

     

       468
       468
       +
       		State:         "old-state-12345",

     

       469
       469
       +
       		PKCEVerifier:  "old-verifier",

     

       470
       470
       +
       		AuthServerURL: "http://localhost:3001",

     

       471
       471
       +
       		Scopes:        []string{"atproto"},

     

       472
       472
       +
       	}

     

       473
       473
       +
       

     

       474
       474
       +
       	err = store.SaveAuthRequestInfo(ctx, oldAuthRequest)

     

       475
       475
       +
       	require.NoError(t, err)

     

       476
       476
       +
       

     

       477
       477
       +
       	// Update created_at to 1 hour ago

     

       478
       478
       +
       	_, err = db.ExecContext(ctx,

     

       479
       479
       +
       		"UPDATE oauth_requests SET created_at = NOW() - INTERVAL '1 hour' WHERE state = $1",

     

       480
       480
       +
       		oldAuthRequest.State)

     

       481
       481
       +
       	require.NoError(t, err)

     

       482
       482
       +
       

     

       483
       483
       +
       	// Cleanup expired requests

     

       484
       484
       +
       	cleaned, err := store.(*oauth.PostgresOAuthStore).CleanupExpiredAuthRequests(ctx)

     

       485
       485
       +
       	require.NoError(t, err, "Cleanup should succeed")

     

       486
       486
       +
       	assert.Greater(t, cleaned, int64(0), "Should have cleaned up at least one auth request")

     

       487
       487
       +
       

     

       488
       488
       +
       	t.Logf("✅ Expired auth request cleanup verified (cleaned %d requests)", cleaned)

     

       489
       489
       +
       }

     

       490
       490
       +
       

     

       491
       491
       +
       // TestOAuthE2E_TokenRefresh tests the refresh token flow

     

       492
       492
       +
       func TestOAuthE2E_TokenRefresh(t *testing.T) {

     

       493
       493
       +
       	if testing.Short() {

     

       494
       494
       +
       		t.Skip("Skipping OAuth token refresh test in short mode")

     

       495
       495
       +
       	}

     

       496
       496
       +
       

     

       497
       497
       +
       	db := setupTestDB(t)

     

       498
       498
       +
       	defer func() { _ = db.Close() }()

     

       499
       499
       +
       

     

       500
       500
       +
       	// Run migrations

     

       501
       501
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       502
       502
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       503
       503
       +
       

     

       504
       504
       +
       	ctx := context.Background()

     

       505
       505
       +
       

     

       506
       506
       +
       	t.Log("🔄 Testing OAuth token refresh flow...")

     

       507
       507
       +
       

     

       508
       508
       +
       	// Setup OAuth client and store

     

       509
       509
       +
       	store := SetupOAuthTestStore(t, db)

     

       510
       510
       +
       	client := SetupOAuthTestClient(t, store)

     

       511
       511
       +
       	handler := oauth.NewOAuthHandler(client, store)

     

       512
       512
       +
       

     

       513
       513
       +
       	// Create a test DID and session

     

       514
       514
       +
       	did, err := syntax.ParseDID("did:plc:refreshtest123")

     

       515
       515
       +
       	require.NoError(t, err)

     

       516
       516
       +
       

     

       517
       517
       +
       	// Create initial session with refresh token

     

       518
       518
       +
       	initialSession := oauthlib.ClientSessionData{

     

       519
       519
       +
       		AccountDID:                   did,

     

       520
       520
       +
       		SessionID:                    "refresh-session-1",

     

       521
       521
       +
       		HostURL:                      "http://localhost:3001",

     

       522
       522
       +
       		AuthServerURL:                "http://localhost:3001",

     

       523
       523
       +
       		AuthServerTokenEndpoint:      "http://localhost:3001/oauth/token",

     

       524
       524
       +
       		AuthServerRevocationEndpoint: "http://localhost:3001/oauth/revoke",

     

       525
       525
       +
       		AccessToken:                  "initial-access-token",

     

       526
       526
       +
       		RefreshToken:                 "initial-refresh-token",

     

       527
       527
       +
       		DPoPPrivateKeyMultibase:      "test-dpop-key",

     

       528
       528
       +
       		DPoPAuthServerNonce:          "test-nonce",

     

       529
       529
       +
       		Scopes:                       []string{"atproto", "transition:generic"},

     

       530
       530
       +
       	}

     

       531
       531
       +
       

     

       532
       532
       +
       	// Save the session

     

       533
       533
       +
       	err = store.SaveSession(ctx, initialSession)

     

       534
       534
       +
       	require.NoError(t, err, "Should save initial session")

     

       535
       535
       +
       

     

       536
       536
       +
       	t.Logf("✅ Initial session created")

     

       537
       537
       +
       

     

       538
       538
       +
       	// Create a sealed token for this session

     

       539
       539
       +
       	sealedToken, err := client.SealSession(did.String(), initialSession.SessionID, time.Hour)

     

       540
       540
       +
       	require.NoError(t, err, "Should seal session token")

     

       541
       541
       +
       	require.NotEmpty(t, sealedToken, "Sealed token should not be empty")

     

       542
       542
       +
       

     

       543
       543
       +
       	t.Logf("✅ Session token sealed")

     

       544
       544
       +
       

     

       545
       545
       +
       	// Setup test server with refresh endpoint

     

       546
       546
       +
       	r := chi.NewRouter()

     

       547
       547
       +
       	r.Post("/oauth/refresh", handler.HandleRefresh)

     

       548
       548
       +
       

     

       549
       549
       +
       	server := httptest.NewServer(r)

     

       550
       550
       +
       	defer server.Close()

     

       551
       551
       +
       

     

       552
       552
       +
       	t.Run("Valid refresh request", func(t *testing.T) {

     

       553
       553
       +
       		// NOTE: This test verifies that the refresh endpoint can be called

     

       554
       554
       +
       		// In a real scenario, the indigo client's RefreshTokens() would call the PDS

     

       555
       555
       +
       		// Since we're in a component test, we're testing the Coves handler logic

     

       556
       556
       +
       

     

       557
       557
       +
       		// Create refresh request

     

       558
       558
       +
       		refreshReq := map[string]interface{}{

     

       559
       559
       +
       			"did":          did.String(),

     

       560
       560
       +
       			"session_id":   initialSession.SessionID,

     

       561
       561
       +
       			"sealed_token": sealedToken,

     

       562
       562
       +
       		}

     

       563
       563
       +
       

     

       564
       564
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       565
       565
       +
       		require.NoError(t, err)

     

       566
       566
       +
       

     

       567
       567
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       568
       568
       +
       		require.NoError(t, err)

     

       569
       569
       +
       		req.Header.Set("Content-Type", "application/json")

     

       570
       570
       +
       

     

       571
       571
       +
       		// NOTE: In component testing mode, the indigo client may not have

     

       572
       572
       +
       		// real PDS credentials, so RefreshTokens() might fail

     

       573
       573
       +
       		// We're testing that the handler correctly processes the request

     

       574
       574
       +
       		resp, err := http.DefaultClient.Do(req)

     

       575
       575
       +
       		require.NoError(t, err)

     

       576
       576
       +
       		defer func() { _ = resp.Body.Close() }()

     

       577
       577
       +
       

     

       578
       578
       +
       		// In component test mode without real PDS, we may get 401

     

       579
       579
       +
       		// In production with real PDS, this would return 200 with new tokens

     

       580
       580
       +
       		t.Logf("Refresh response status: %d", resp.StatusCode)

     

       581
       581
       +
       

     

       582
       582
       +
       		// The important thing is that the handler doesn't crash

     

       583
       583
       +
       		// and properly validates the request structure

     

       584
       584
       +
       		assert.True(t, resp.StatusCode == http.StatusOK || resp.StatusCode == http.StatusUnauthorized,

     

       585
       585
       +
       			"Refresh should return either success or auth failure, got %d", resp.StatusCode)

     

       586
       586
       +
       	})

     

       587
       587
       +
       

     

       588
       588
       +
       	t.Run("Invalid DID format (with valid token)", func(t *testing.T) {

     

       589
       589
       +
       		// Create a sealed token with an invalid DID format

     

       590
       590
       +
       		invalidDID := "invalid-did-format"

     

       591
       591
       +
       		// Create the token with a valid DID first, then we'll try to use it with invalid DID in request

     

       592
       592
       +
       		validToken, err := client.SealSession(did.String(), initialSession.SessionID, 30*24*time.Hour)

     

       593
       593
       +
       		require.NoError(t, err)

     

       594
       594
       +
       

     

       595
       595
       +
       		refreshReq := map[string]interface{}{

     

       596
       596
       +
       			"did":          invalidDID, // Invalid DID format in request

     

       597
       597
       +
       			"session_id":   initialSession.SessionID,

     

       598
       598
       +
       			"sealed_token": validToken, // Valid token for different DID

     

       599
       599
       +
       		}

     

       600
       600
       +
       

     

       601
       601
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       602
       602
       +
       		require.NoError(t, err)

     

       603
       603
       +
       

     

       604
       604
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       605
       605
       +
       		require.NoError(t, err)

     

       606
       606
       +
       		req.Header.Set("Content-Type", "application/json")

     

       607
       607
       +
       

     

       608
       608
       +
       		resp, err := http.DefaultClient.Do(req)

     

       609
       609
       +
       		require.NoError(t, err)

     

       610
       610
       +
       		defer func() { _ = resp.Body.Close() }()

     

       611
       611
       +
       

     

       612
       612
       +
       		// Should reject with 401 due to DID mismatch (not 400) since auth happens first

     

       613
       613
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       614
       614
       +
       			"DID mismatch should be rejected with 401 (auth check happens before format validation)")

     

       615
       615
       +
       	})

     

       616
       616
       +
       

     

       617
       617
       +
       	t.Run("Missing sealed_token (security test)", func(t *testing.T) {

     

       618
       618
       +
       		refreshReq := map[string]interface{}{

     

       619
       619
       +
       			"did":        did.String(),

     

       620
       620
       +
       			"session_id": initialSession.SessionID,

     

       621
       621
       +
       			// Missing sealed_token - should be rejected for security

     

       622
       622
       +
       		}

     

       623
       623
       +
       

     

       624
       624
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       625
       625
       +
       		require.NoError(t, err)

     

       626
       626
       +
       

     

       627
       627
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       628
       628
       +
       		require.NoError(t, err)

     

       629
       629
       +
       		req.Header.Set("Content-Type", "application/json")

     

       630
       630
       +
       

     

       631
       631
       +
       		resp, err := http.DefaultClient.Do(req)

     

       632
       632
       +
       		require.NoError(t, err)

     

       633
       633
       +
       		defer func() { _ = resp.Body.Close() }()

     

       634
       634
       +
       

     

       635
       635
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       636
       636
       +
       			"Missing sealed_token should be rejected (proof of possession required)")

     

       637
       637
       +
       	})

     

       638
       638
       +
       

     

       639
       639
       +
       	t.Run("Invalid sealed_token", func(t *testing.T) {

     

       640
       640
       +
       		refreshReq := map[string]interface{}{

     

       641
       641
       +
       			"did":          did.String(),

     

       642
       642
       +
       			"session_id":   initialSession.SessionID,

     

       643
       643
       +
       			"sealed_token": "invalid-token-data",

     

       644
       644
       +
       		}

     

       645
       645
       +
       

     

       646
       646
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       647
       647
       +
       		require.NoError(t, err)

     

       648
       648
       +
       

     

       649
       649
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       650
       650
       +
       		require.NoError(t, err)

     

       651
       651
       +
       		req.Header.Set("Content-Type", "application/json")

     

       652
       652
       +
       

     

       653
       653
       +
       		resp, err := http.DefaultClient.Do(req)

     

       654
       654
       +
       		require.NoError(t, err)

     

       655
       655
       +
       		defer func() { _ = resp.Body.Close() }()

     

       656
       656
       +
       

     

       657
       657
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       658
       658
       +
       			"Invalid sealed_token should be rejected")

     

       659
       659
       +
       	})

     

       660
       660
       +
       

     

       661
       661
       +
       	t.Run("DID mismatch (security test)", func(t *testing.T) {

     

       662
       662
       +
       		// Create a sealed token for a different DID

     

       663
       663
       +
       		wrongDID := "did:plc:wronguser123"

     

       664
       664
       +
       		wrongToken, err := client.SealSession(wrongDID, initialSession.SessionID, 30*24*time.Hour)

     

       665
       665
       +
       		require.NoError(t, err)

     

       666
       666
       +
       

     

       667
       667
       +
       		// Try to use it to refresh the original session

     

       668
       668
       +
       		refreshReq := map[string]interface{}{

     

       669
       669
       +
       			"did":          did.String(), // Claiming original DID

     

       670
       670
       +
       			"session_id":   initialSession.SessionID,

     

       671
       671
       +
       			"sealed_token": wrongToken, // But token is for different DID

     

       672
       672
       +
       		}

     

       673
       673
       +
       

     

       674
       674
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       675
       675
       +
       		require.NoError(t, err)

     

       676
       676
       +
       

     

       677
       677
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       678
       678
       +
       		require.NoError(t, err)

     

       679
       679
       +
       		req.Header.Set("Content-Type", "application/json")

     

       680
       680
       +
       

     

       681
       681
       +
       		resp, err := http.DefaultClient.Do(req)

     

       682
       682
       +
       		require.NoError(t, err)

     

       683
       683
       +
       		defer func() { _ = resp.Body.Close() }()

     

       684
       684
       +
       

     

       685
       685
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       686
       686
       +
       			"DID mismatch should be rejected (prevents session hijacking)")

     

       687
       687
       +
       	})

     

       688
       688
       +
       

     

       689
       689
       +
       	t.Run("Session ID mismatch (security test)", func(t *testing.T) {

     

       690
       690
       +
       		// Create a sealed token with wrong session ID

     

       691
       691
       +
       		wrongSessionID := "wrong-session-id"

     

       692
       692
       +
       		wrongToken, err := client.SealSession(did.String(), wrongSessionID, 30*24*time.Hour)

     

       693
       693
       +
       		require.NoError(t, err)

     

       694
       694
       +
       

     

       695
       695
       +
       		// Try to use it to refresh the original session

     

       696
       696
       +
       		refreshReq := map[string]interface{}{

     

       697
       697
       +
       			"did":          did.String(),

     

       698
       698
       +
       			"session_id":   initialSession.SessionID, // Claiming original session

     

       699
       699
       +
       			"sealed_token": wrongToken,               // But token is for different session

     

       700
       700
       +
       		}

     

       701
       701
       +
       

     

       702
       702
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       703
       703
       +
       		require.NoError(t, err)

     

       704
       704
       +
       

     

       705
       705
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       706
       706
       +
       		require.NoError(t, err)

     

       707
       707
       +
       		req.Header.Set("Content-Type", "application/json")

     

       708
       708
       +
       

     

       709
       709
       +
       		resp, err := http.DefaultClient.Do(req)

     

       710
       710
       +
       		require.NoError(t, err)

     

       711
       711
       +
       		defer func() { _ = resp.Body.Close() }()

     

       712
       712
       +
       

     

       713
       713
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       714
       714
       +
       			"Session ID mismatch should be rejected (prevents session hijacking)")

     

       715
       715
       +
       	})

     

       716
       716
       +
       

     

       717
       717
       +
       	t.Run("Non-existent session", func(t *testing.T) {

     

       718
       718
       +
       		// Create a valid sealed token for a non-existent session

     

       719
       719
       +
       		nonExistentSessionID := "nonexistent-session-id"

     

       720
       720
       +
       		validToken, err := client.SealSession(did.String(), nonExistentSessionID, 30*24*time.Hour)

     

       721
       721
       +
       		require.NoError(t, err)

     

       722
       722
       +
       

     

       723
       723
       +
       		refreshReq := map[string]interface{}{

     

       724
       724
       +
       			"did":          did.String(),

     

       725
       725
       +
       			"session_id":   nonExistentSessionID,

     

       726
       726
       +
       			"sealed_token": validToken, // Valid token but session doesn't exist

     

       727
       727
       +
       		}

     

       728
       728
       +
       

     

       729
       729
       +
       		reqBody, err := json.Marshal(refreshReq)

     

       730
       730
       +
       		require.NoError(t, err)

     

       731
       731
       +
       

     

       732
       732
       +
       		req, err := http.NewRequest("POST", server.URL+"/oauth/refresh", strings.NewReader(string(reqBody)))

     

       733
       733
       +
       		require.NoError(t, err)

     

       734
       734
       +
       		req.Header.Set("Content-Type", "application/json")

     

       735
       735
       +
       

     

       736
       736
       +
       		resp, err := http.DefaultClient.Do(req)

     

       737
       737
       +
       		require.NoError(t, err)

     

       738
       738
       +
       		defer func() { _ = resp.Body.Close() }()

     

       739
       739
       +
       

     

       740
       740
       +
       		assert.Equal(t, http.StatusUnauthorized, resp.StatusCode,

     

       741
       741
       +
       			"Non-existent session should be rejected with 401")

     

       742
       742
       +
       	})

     

       743
       743
       +
       

     

       744
       744
       +
       	t.Logf("✅ Token refresh endpoint validation verified")

     

       745
       745
       +
       }

     

       746
       746
       +
       

     

       747
       747
       +
       // TestOAuthE2E_SessionUpdate tests that refresh updates the session in database

     

       748
       748
       +
       func TestOAuthE2E_SessionUpdate(t *testing.T) {

     

       749
       749
       +
       	if testing.Short() {

     

       750
       750
       +
       		t.Skip("Skipping OAuth session update test in short mode")

     

       751
       751
       +
       	}

     

       752
       752
       +
       

     

       753
       753
       +
       	db := setupTestDB(t)

     

       754
       754
       +
       	defer func() { _ = db.Close() }()

     

       755
       755
       +
       

     

       756
       756
       +
       	// Run migrations

     

       757
       757
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       758
       758
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       759
       759
       +
       

     

       760
       760
       +
       	ctx := context.Background()

     

       761
       761
       +
       

     

       762
       762
       +
       	t.Log("💾 Testing OAuth session update on refresh...")

     

       763
       763
       +
       

     

       764
       764
       +
       	// Setup OAuth store

     

       765
       765
       +
       	store := SetupOAuthTestStore(t, db)

     

       766
       766
       +
       

     

       767
       767
       +
       	// Create a test session

     

       768
       768
       +
       	did, err := syntax.ParseDID("did:plc:sessionupdate123")

     

       769
       769
       +
       	require.NoError(t, err)

     

       770
       770
       +
       

     

       771
       771
       +
       	originalSession := oauthlib.ClientSessionData{

     

       772
       772
       +
       		AccountDID:              did,

     

       773
       773
       +
       		SessionID:               "update-session-1",

     

       774
       774
       +
       		HostURL:                 "http://localhost:3001",

     

       775
       775
       +
       		AuthServerURL:           "http://localhost:3001",

     

       776
       776
       +
       		AuthServerTokenEndpoint: "http://localhost:3001/oauth/token",

     

       777
       777
       +
       		AccessToken:             "original-access-token",

     

       778
       778
       +
       		RefreshToken:            "original-refresh-token",

     

       779
       779
       +
       		DPoPPrivateKeyMultibase: "original-dpop-key",

     

       780
       780
       +
       		Scopes:                  []string{"atproto"},

     

       781
       781
       +
       	}

     

       782
       782
       +
       

     

       783
       783
       +
       	// Save original session

     

       784
       784
       +
       	err = store.SaveSession(ctx, originalSession)

     

       785
       785
       +
       	require.NoError(t, err)

     

       786
       786
       +
       

     

       787
       787
       +
       	t.Logf("✅ Original session saved")

     

       788
       788
       +
       

     

       789
       789
       +
       	// Simulate a token refresh by updating the session with new tokens

     

       790
       790
       +
       	updatedSession := originalSession

     

       791
       791
       +
       	updatedSession.AccessToken = "new-access-token"

     

       792
       792
       +
       	updatedSession.RefreshToken = "new-refresh-token"

     

       793
       793
       +
       	updatedSession.DPoPAuthServerNonce = "new-nonce"

     

       794
       794
       +
       

     

       795
       795
       +
       	// Update the session (upsert)

     

       796
       796
       +
       	err = store.SaveSession(ctx, updatedSession)

     

       797
       797
       +
       	require.NoError(t, err)

     

       798
       798
       +
       

     

       799
       799
       +
       	t.Logf("✅ Session updated with new tokens")

     

       800
       800
       +
       

     

       801
       801
       +
       	// Retrieve the session and verify it was updated

     

       802
       802
       +
       	retrieved, err := store.GetSession(ctx, did, originalSession.SessionID)

     

       803
       803
       +
       	require.NoError(t, err, "Should retrieve updated session")

     

       804
       804
       +
       

     

       805
       805
       +
       	assert.Equal(t, "new-access-token", retrieved.AccessToken,

     

       806
       806
       +
       		"Access token should be updated")

     

       807
       807
       +
       	assert.Equal(t, "new-refresh-token", retrieved.RefreshToken,

     

       808
       808
       +
       		"Refresh token should be updated")

     

       809
       809
       +
       	assert.Equal(t, "new-nonce", retrieved.DPoPAuthServerNonce,

     

       810
       810
       +
       		"DPoP nonce should be updated")

     

       811
       811
       +
       

     

       812
       812
       +
       	// Verify session ID and DID remain the same

     

       813
       813
       +
       	assert.Equal(t, originalSession.SessionID, retrieved.SessionID,

     

       814
       814
       +
       		"Session ID should remain the same")

     

       815
       815
       +
       	assert.Equal(t, did, retrieved.AccountDID,

     

       816
       816
       +
       		"DID should remain the same")

     

       817
       817
       +
       

     

       818
       818
       +
       	t.Logf("✅ Session update verified - tokens refreshed in database")

     

       819
       819
       +
       

     

       820
       820
       +
       	// Verify updated_at was changed

     

       821
       821
       +
       	var updatedAt time.Time

     

       822
       822
       +
       	err = db.QueryRowContext(ctx,

     

       823
       823
       +
       		"SELECT updated_at FROM oauth_sessions WHERE did = $1 AND session_id = $2",

     

       824
       824
       +
       		did.String(), originalSession.SessionID).Scan(&updatedAt)

     

       825
       825
       +
       	require.NoError(t, err)

     

       826
       826
       +
       

     

       827
       827
       +
       	// Updated timestamp should be recent (within last minute)

     

       828
       828
       +
       	assert.WithinDuration(t, time.Now(), updatedAt, time.Minute,

     

       829
       829
       +
       		"Session updated_at should be recent")

     

       830
       830
       +
       

     

       831
       831
       +
       	t.Logf("✅ Session timestamp update verified")

     

       832
       832
       +
       }

     

       833
       833
       +
       

     

       834
       834
       +
       // TestOAuthE2E_RefreshTokenRotation tests refresh token rotation behavior

     

       835
       835
       +
       func TestOAuthE2E_RefreshTokenRotation(t *testing.T) {

     

       836
       836
       +
       	if testing.Short() {

     

       837
       837
       +
       		t.Skip("Skipping OAuth refresh token rotation test in short mode")

     

       838
       838
       +
       	}

     

       839
       839
       +
       

     

       840
       840
       +
       	db := setupTestDB(t)

     

       841
       841
       +
       	defer func() { _ = db.Close() }()

     

       842
       842
       +
       

     

       843
       843
       +
       	// Run migrations

     

       844
       844
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       845
       845
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       846
       846
       +
       

     

       847
       847
       +
       	ctx := context.Background()

     

       848
       848
       +
       

     

       849
       849
       +
       	t.Log("🔄 Testing OAuth refresh token rotation...")

     

       850
       850
       +
       

     

       851
       851
       +
       	// Setup OAuth store

     

       852
       852
       +
       	store := SetupOAuthTestStore(t, db)

     

       853
       853
       +
       

     

       854
       854
       +
       	// Create a test session

     

       855
       855
       +
       	did, err := syntax.ParseDID("did:plc:rotation123")

     

       856
       856
       +
       	require.NoError(t, err)

     

       857
       857
       +
       

     

       858
       858
       +
       	// Simulate multiple refresh cycles

     

       859
       859
       +
       	sessionID := "rotation-session-1"

     

       860
       860
       +
       	tokens := []struct {

     

       861
       861
       +
       		access  string

     

       862
       862
       +
       		refresh string

     

       863
       863
       +
       	}{

     

       864
       864
       +
       		{"access-token-v1", "refresh-token-v1"},

     

       865
       865
       +
       		{"access-token-v2", "refresh-token-v2"},

     

       866
       866
       +
       		{"access-token-v3", "refresh-token-v3"},

     

       867
       867
       +
       	}

     

       868
       868
       +
       

     

       869
       869
       +
       	for i, tokenPair := range tokens {

     

       870
       870
       +
       		session := oauthlib.ClientSessionData{

     

       871
       871
       +
       			AccountDID:              did,

     

       872
       872
       +
       			SessionID:               sessionID,

     

       873
       873
       +
       			HostURL:                 "http://localhost:3001",

     

       874
       874
       +
       			AuthServerURL:           "http://localhost:3001",

     

       875
       875
       +
       			AuthServerTokenEndpoint: "http://localhost:3001/oauth/token",

     

       876
       876
       +
       			AccessToken:             tokenPair.access,

     

       877
       877
       +
       			RefreshToken:            tokenPair.refresh,

     

       878
       878
       +
       			Scopes:                  []string{"atproto"},

     

       879
       879
       +
       		}

     

       880
       880
       +
       

     

       881
       881
       +
       		// Save/update session

     

       882
       882
       +
       		err = store.SaveSession(ctx, session)

     

       883
       883
       +
       		require.NoError(t, err, "Should save session iteration %d", i+1)

     

       884
       884
       +
       

     

       885
       885
       +
       		// Retrieve and verify

     

       886
       886
       +
       		retrieved, err := store.GetSession(ctx, did, sessionID)

     

       887
       887
       +
       		require.NoError(t, err, "Should retrieve session iteration %d", i+1)

     

       888
       888
       +
       

     

       889
       889
       +
       		assert.Equal(t, tokenPair.access, retrieved.AccessToken,

     

       890
       890
       +
       			"Access token should match iteration %d", i+1)

     

       891
       891
       +
       		assert.Equal(t, tokenPair.refresh, retrieved.RefreshToken,

     

       892
       892
       +
       			"Refresh token should match iteration %d", i+1)

     

       893
       893
       +
       

     

       894
       894
       +
       		// Small delay to ensure timestamp differences

     

       895
       895
       +
       		time.Sleep(10 * time.Millisecond)

     

       896
       896
       +
       	}

     

       897
       897
       +
       

     

       898
       898
       +
       	t.Logf("✅ Refresh token rotation verified through %d cycles", len(tokens))

     

       899
       899
       +
       

     

       900
       900
       +
       	// Verify final state

     

       901
       901
       +
       	finalSession, err := store.GetSession(ctx, did, sessionID)

     

       902
       902
       +
       	require.NoError(t, err)

     

       903
       903
       +
       

     

       904
       904
       +
       	assert.Equal(t, "access-token-v3", finalSession.AccessToken,

     

       905
       905
       +
       		"Final access token should be from last rotation")

     

       906
       906
       +
       	assert.Equal(t, "refresh-token-v3", finalSession.RefreshToken,

     

       907
       907
       +
       		"Final refresh token should be from last rotation")

     

       908
       908
       +
       

     

       909
       909
       +
       	t.Logf("✅ Token rotation state verified")

     

       910
       910
       +
       }

+312

tests/integration/oauth_session_fixation_test.go

···

       1
       1
       +
       package integration

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/atproto/oauth"

     

       5
       5
       +
       	"context"

     

       6
       6
       +
       	"crypto/sha256"

     

       7
       7
       +
       	"encoding/base64"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       	"net/http/httptest"

     

       10
       10
       +
       	"net/url"

     

       11
       11
       +
       	"testing"

     

       12
       12
       +
       	"time"

     

       13
       13
       +
       

     

       14
       14
       +
       	oauthlib "github.com/bluesky-social/indigo/atproto/auth/oauth"

     

       15
       15
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       16
       16
       +
       	"github.com/go-chi/chi/v5"

     

       17
       17
       +
       	"github.com/pressly/goose/v3"

     

       18
       18
       +
       	"github.com/stretchr/testify/assert"

     

       19
       19
       +
       	"github.com/stretchr/testify/require"

     

       20
       20
       +
       )

     

       21
       21
       +
       

     

       22
       22
       +
       // TestOAuth_SessionFixationAttackPrevention tests that the mobile redirect binding

     

       23
       23
       +
       // prevents session fixation attacks where an attacker plants a mobile_redirect_uri

     

       24
       24
       +
       // cookie, then the user does a web login, and credentials get sent to attacker's deep link.

     

       25
       25
       +
       //

     

       26
       26
       +
       // Attack scenario:

     

       27
       27
       +
       // 1. Attacker tricks user into visiting /oauth/mobile/login?redirect_uri=evil://steal

     

       28
       28
       +
       // 2. This plants a mobile_redirect_uri cookie (lives 10 minutes)

     

       29
       29
       +
       // 3. User later does normal web OAuth login via /oauth/login

     

       30
       30
       +
       // 4. HandleCallback sees the stale mobile_redirect_uri cookie

     

       31
       31
       +
       // 5. WITHOUT THE FIX: Callback sends sealed token, DID, session_id to attacker's deep link

     

       32
       32
       +
       // 6. WITH THE FIX: Binding mismatch is detected, mobile cookies cleared, user gets web session

     

       33
       33
       +
       func TestOAuth_SessionFixationAttackPrevention(t *testing.T) {

     

       34
       34
       +
       	if testing.Short() {

     

       35
       35
       +
       		t.Skip("Skipping OAuth session fixation test in short mode")

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	// Setup test database

     

       39
       39
       +
       	db := setupTestDB(t)

     

       40
       40
       +
       	defer func() {

     

       41
       41
       +
       		if err := db.Close(); err != nil {

     

       42
       42
       +
       			t.Logf("Failed to close database: %v", err)

     

       43
       43
       +
       		}

     

       44
       44
       +
       	}()

     

       45
       45
       +
       

     

       46
       46
       +
       	// Run migrations

     

       47
       47
       +
       	require.NoError(t, goose.SetDialect("postgres"))

     

       48
       48
       +
       	require.NoError(t, goose.Up(db, "../../internal/db/migrations"))

     

       49
       49
       +
       

     

       50
       50
       +
       	// Setup OAuth client and store

     

       51
       51
       +
       	store := SetupOAuthTestStore(t, db)

     

       52
       52
       +
       	client := SetupOAuthTestClient(t, store)

     

       53
       53
       +
       	require.NotNil(t, client, "OAuth client should be initialized")

     

       54
       54
       +
       

     

       55
       55
       +
       	// Setup handler

     

       56
       56
       +
       	handler := oauth.NewOAuthHandler(client, store)

     

       57
       57
       +
       

     

       58
       58
       +
       	// Setup router

     

       59
       59
       +
       	r := chi.NewRouter()

     

       60
       60
       +
       	r.Get("/oauth/callback", handler.HandleCallback)

     

       61
       61
       +
       

     

       62
       62
       +
       	t.Run("attack scenario - planted mobile cookie without binding", func(t *testing.T) {

     

       63
       63
       +
       		ctx := context.Background()

     

       64
       64
       +
       

     

       65
       65
       +
       		// Step 1: Simulate a successful OAuth callback (like a user did web login)

     

       66
       66
       +
       		// We'll create a mock session to simulate what ProcessCallback would return

     

       67
       67
       +
       		testDID := "did:plc:test123456"

     

       68
       68
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       69
       69
       +
       		require.NoError(t, err)

     

       70
       70
       +
       

     

       71
       71
       +
       		sessionID := "test-session-" + time.Now().Format("20060102150405")

     

       72
       72
       +
       		testSession := oauthlib.ClientSessionData{

     

       73
       73
       +
       			AccountDID:  parsedDID,

     

       74
       74
       +
       			SessionID:   sessionID,

     

       75
       75
       +
       			HostURL:     "http://localhost:3001",

     

       76
       76
       +
       			AccessToken: "test-access-token",

     

       77
       77
       +
       			Scopes:      []string{"atproto"},

     

       78
       78
       +
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		// Save the session (simulating successful OAuth flow)

     

       81
       81
       +
       		err = store.SaveSession(ctx, testSession)

     

       82
       82
       +
       		require.NoError(t, err)

     

       83
       83
       +
       

     

       84
       84
       +
       		// Step 2: Attacker planted a mobile_redirect_uri cookie (without binding)

     

       85
       85
       +
       		// This simulates the cookie being planted earlier by attacker

     

       86
       86
       +
       		attackerRedirectURI := "evil://steal"

     

       87
       87
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       88
       88
       +
       

     

       89
       89
       +
       		// Plant the attacker's cookie (URL escaped as it would be in real scenario)

     

       90
       90
       +
       		req.AddCookie(&http.Cookie{

     

       91
       91
       +
       			Name:  "mobile_redirect_uri",

     

       92
       92
       +
       			Value: url.QueryEscape(attackerRedirectURI),

     

       93
       93
       +
       			Path:  "/oauth",

     

       94
       94
       +
       		})

     

       95
       95
       +
       		// NOTE: No mobile_redirect_binding cookie! This is the attack scenario.

     

       96
       96
       +
       

     

       97
       97
       +
       		rec := httptest.NewRecorder()

     

       98
       98
       +
       

     

       99
       99
       +
       		// Step 3: Try to process the callback

     

       100
       100
       +
       		// This would fail because ProcessCallback needs real OAuth code/state

     

       101
       101
       +
       		// For this test, we're verifying the handler's security checks work

     

       102
       102
       +
       		// even before ProcessCallback is called

     

       103
       103
       +
       

     

       104
       104
       +
       		// The handler will try to call ProcessCallback which will fail

     

       105
       105
       +
       		// But we're testing that even if it succeeded, the mobile redirect

     

       106
       106
       +
       		// validation would prevent the attack

     

       107
       107
       +
       		handler.HandleCallback(rec, req)

     

       108
       108
       +
       

     

       109
       109
       +
       		// Step 4: Verify the attack was prevented

     

       110
       110
       +
       		// The handler should reject the request due to missing binding

     

       111
       111
       +
       		// Since ProcessCallback will fail first (no real OAuth code), we expect

     

       112
       112
       +
       		// a 400 error, but the important thing is it doesn't redirect to evil://steal

     

       113
       113
       +
       

     

       114
       114
       +
       		assert.NotEqual(t, http.StatusFound, rec.Code,

     

       115
       115
       +
       			"Should not redirect when ProcessCallback fails")

     

       116
       116
       +
       		assert.NotContains(t, rec.Header().Get("Location"), "evil://",

     

       117
       117
       +
       			"Should never redirect to attacker's URI")

     

       118
       118
       +
       	})

     

       119
       119
       +
       

     

       120
       120
       +
       	t.Run("legitimate mobile flow - with valid binding", func(t *testing.T) {

     

       121
       121
       +
       		ctx := context.Background()

     

       122
       122
       +
       

     

       123
       123
       +
       		// Setup a legitimate mobile session

     

       124
       124
       +
       		testDID := "did:plc:mobile123"

     

       125
       125
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       126
       126
       +
       		require.NoError(t, err)

     

       127
       127
       +
       

     

       128
       128
       +
       		sessionID := "mobile-session-" + time.Now().Format("20060102150405")

     

       129
       129
       +
       		testSession := oauthlib.ClientSessionData{

     

       130
       130
       +
       			AccountDID:  parsedDID,

     

       131
       131
       +
       			SessionID:   sessionID,

     

       132
       132
       +
       			HostURL:     "http://localhost:3001",

     

       133
       133
       +
       			AccessToken: "mobile-access-token",

     

       134
       134
       +
       			Scopes:      []string{"atproto"},

     

       135
       135
       +
       		}

     

       136
       136
       +
       

     

       137
       137
       +
       		// Save the session

     

       138
       138
       +
       		err = store.SaveSession(ctx, testSession)

     

       139
       139
       +
       		require.NoError(t, err)

     

       140
       140
       +
       

     

       141
       141
       +
       		// Create request with BOTH mobile_redirect_uri AND valid binding

     

       142
       142
       +
       		// Use Universal Link URI that's in the allowlist

     

       143
       143
       +
       		legitRedirectURI := "https://coves.social/app/oauth/callback"

     

       144
       144
       +
       		csrfToken := "valid-csrf-token-for-mobile"

     

       145
       145
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       146
       146
       +
       

     

       147
       147
       +
       		// Add mobile redirect URI cookie

     

       148
       148
       +
       		req.AddCookie(&http.Cookie{

     

       149
       149
       +
       			Name:  "mobile_redirect_uri",

     

       150
       150
       +
       			Value: url.QueryEscape(legitRedirectURI),

     

       151
       151
       +
       			Path:  "/oauth",

     

       152
       152
       +
       		})

     

       153
       153
       +
       

     

       154
       154
       +
       		// Add CSRF token (required for mobile flow)

     

       155
       155
       +
       		req.AddCookie(&http.Cookie{

     

       156
       156
       +
       			Name:  "oauth_csrf",

     

       157
       157
       +
       			Value: csrfToken,

     

       158
       158
       +
       			Path:  "/oauth",

     

       159
       159
       +
       		})

     

       160
       160
       +
       

     

       161
       161
       +
       		// Add VALID binding cookie (this is what prevents the attack)

     

       162
       162
       +
       		// In real flow, this would be set by HandleMobileLogin

     

       163
       163
       +
       		// The binding now includes the CSRF token for double-submit validation

     

       164
       164
       +
       		mobileBinding := generateMobileRedirectBindingForTest(csrfToken, legitRedirectURI)

     

       165
       165
       +
       		req.AddCookie(&http.Cookie{

     

       166
       166
       +
       			Name:  "mobile_redirect_binding",

     

       167
       167
       +
       			Value: mobileBinding,

     

       168
       168
       +
       			Path:  "/oauth",

     

       169
       169
       +
       		})

     

       170
       170
       +
       

     

       171
       171
       +
       		rec := httptest.NewRecorder()

     

       172
       172
       +
       		handler.HandleCallback(rec, req)

     

       173
       173
       +
       

     

       174
       174
       +
       		// This will also fail at ProcessCallback (no real OAuth code)

     

       175
       175
       +
       		// but we're verifying the binding validation logic is in place

     

       176
       176
       +
       		// In a real integration test with PDS, this would succeed

     

       177
       177
       +
       		assert.NotEqual(t, http.StatusFound, rec.Code,

     

       178
       178
       +
       			"Should not redirect when ProcessCallback fails (expected in mock test)")

     

       179
       179
       +
       	})

     

       180
       180
       +
       

     

       181
       181
       +
       	t.Run("binding mismatch - attacker tries wrong binding", func(t *testing.T) {

     

       182
       182
       +
       		ctx := context.Background()

     

       183
       183
       +
       

     

       184
       184
       +
       		// Setup session

     

       185
       185
       +
       		testDID := "did:plc:bindingtest"

     

       186
       186
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       187
       187
       +
       		require.NoError(t, err)

     

       188
       188
       +
       

     

       189
       189
       +
       		sessionID := "binding-test-" + time.Now().Format("20060102150405")

     

       190
       190
       +
       		testSession := oauthlib.ClientSessionData{

     

       191
       191
       +
       			AccountDID:  parsedDID,

     

       192
       192
       +
       			SessionID:   sessionID,

     

       193
       193
       +
       			HostURL:     "http://localhost:3001",

     

       194
       194
       +
       			AccessToken: "binding-test-token",

     

       195
       195
       +
       			Scopes:      []string{"atproto"},

     

       196
       196
       +
       		}

     

       197
       197
       +
       

     

       198
       198
       +
       		err = store.SaveSession(ctx, testSession)

     

       199
       199
       +
       		require.NoError(t, err)

     

       200
       200
       +
       

     

       201
       201
       +
       		// Attacker tries to plant evil redirect with a binding from different URI

     

       202
       202
       +
       		attackerRedirectURI := "evil://steal"

     

       203
       203
       +
       		attackerCSRF := "attacker-csrf-token"

     

       204
       204
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       205
       205
       +
       

     

       206
       206
       +
       		req.AddCookie(&http.Cookie{

     

       207
       207
       +
       			Name:  "mobile_redirect_uri",

     

       208
       208
       +
       			Value: url.QueryEscape(attackerRedirectURI),

     

       209
       209
       +
       			Path:  "/oauth",

     

       210
       210
       +
       		})

     

       211
       211
       +
       

     

       212
       212
       +
       		req.AddCookie(&http.Cookie{

     

       213
       213
       +
       			Name:  "oauth_csrf",

     

       214
       214
       +
       			Value: attackerCSRF,

     

       215
       215
       +
       			Path:  "/oauth",

     

       216
       216
       +
       		})

     

       217
       217
       +
       

     

       218
       218
       +
       		// Use binding from a DIFFERENT CSRF token and URI (attacker's attempt to forge)

     

       219
       219
       +
       		// Even if attacker knows the redirect URI, they don't know the user's CSRF token

     

       220
       220
       +
       		wrongBinding := generateMobileRedirectBindingForTest("different-csrf", "https://coves.social/app/oauth/callback")

     

       221
       221
       +
       		req.AddCookie(&http.Cookie{

     

       222
       222
       +
       			Name:  "mobile_redirect_binding",

     

       223
       223
       +
       			Value: wrongBinding,

     

       224
       224
       +
       			Path:  "/oauth",

     

       225
       225
       +
       		})

     

       226
       226
       +
       

     

       227
       227
       +
       		rec := httptest.NewRecorder()

     

       228
       228
       +
       		handler.HandleCallback(rec, req)

     

       229
       229
       +
       

     

       230
       230
       +
       		// Should fail due to binding mismatch (even before ProcessCallback)

     

       231
       231
       +
       		// The binding validation happens after ProcessCallback in the real code,

     

       232
       232
       +
       		// but the mismatch would be caught and cookies cleared

     

       233
       233
       +
       		assert.NotContains(t, rec.Header().Get("Location"), "evil://",

     

       234
       234
       +
       			"Should never redirect to attacker's URI on binding mismatch")

     

       235
       235
       +
       	})

     

       236
       236
       +
       

     

       237
       237
       +
       	t.Run("CSRF token value mismatch - attacker tries different CSRF", func(t *testing.T) {

     

       238
       238
       +
       		ctx := context.Background()

     

       239
       239
       +
       

     

       240
       240
       +
       		// Setup session

     

       241
       241
       +
       		testDID := "did:plc:csrftest"

     

       242
       242
       +
       		parsedDID, err := syntax.ParseDID(testDID)

     

       243
       243
       +
       		require.NoError(t, err)

     

       244
       244
       +
       

     

       245
       245
       +
       		sessionID := "csrf-test-" + time.Now().Format("20060102150405")

     

       246
       246
       +
       		testSession := oauthlib.ClientSessionData{

     

       247
       247
       +
       			AccountDID:  parsedDID,

     

       248
       248
       +
       			SessionID:   sessionID,

     

       249
       249
       +
       			HostURL:     "http://localhost:3001",

     

       250
       250
       +
       			AccessToken: "csrf-test-token",

     

       251
       251
       +
       			Scopes:      []string{"atproto"},

     

       252
       252
       +
       		}

     

       253
       253
       +
       

     

       254
       254
       +
       		err = store.SaveSession(ctx, testSession)

     

       255
       255
       +
       		require.NoError(t, err)

     

       256
       256
       +
       

     

       257
       257
       +
       		// This tests the P1 security fix: CSRF token VALUE must be validated, not just presence

     

       258
       258
       +
       		// Attack scenario:

     

       259
       259
       +
       		// 1. User starts mobile login with CSRF token A and redirect URI X

     

       260
       260
       +
       		// 2. Binding = hash(A + X) is stored in cookie

     

       261
       261
       +
       		// 3. Attacker somehow gets user to have CSRF token B in cookie (different from A)

     

       262
       262
       +
       		// 4. Callback receives CSRF token B, redirect URI X, binding = hash(A + X)

     

       263
       263
       +
       		// 5. hash(B + X) != hash(A + X), so attack is detected

     

       264
       264
       +
       

     

       265
       265
       +
       		originalCSRF := "original-csrf-token-set-at-login"

     

       266
       266
       +
       		redirectURI := "https://coves.social/app/oauth/callback"

     

       267
       267
       +
       		// Binding was created with original CSRF token

     

       268
       268
       +
       		originalBinding := generateMobileRedirectBindingForTest(originalCSRF, redirectURI)

     

       269
       269
       +
       

     

       270
       270
       +
       		// But attacker managed to change the CSRF cookie

     

       271
       271
       +
       		attackerCSRF := "attacker-replaced-csrf"

     

       272
       272
       +
       

     

       273
       273
       +
       		req := httptest.NewRequest("GET", "/oauth/callback?code=test&state=test&iss=http://localhost:3001", nil)

     

       274
       274
       +
       

     

       275
       275
       +
       		req.AddCookie(&http.Cookie{

     

       276
       276
       +
       			Name:  "mobile_redirect_uri",

     

       277
       277
       +
       			Value: url.QueryEscape(redirectURI),

     

       278
       278
       +
       			Path:  "/oauth",

     

       279
       279
       +
       		})

     

       280
       280
       +
       

     

       281
       281
       +
       		// Attacker's CSRF token (different from what created the binding)

     

       282
       282
       +
       		req.AddCookie(&http.Cookie{

     

       283
       283
       +
       			Name:  "oauth_csrf",

     

       284
       284
       +
       			Value: attackerCSRF,

     

       285
       285
       +
       			Path:  "/oauth",

     

       286
       286
       +
       		})

     

       287
       287
       +
       

     

       288
       288
       +
       		// Original binding (created with original CSRF token)

     

       289
       289
       +
       		req.AddCookie(&http.Cookie{

     

       290
       290
       +
       			Name:  "mobile_redirect_binding",

     

       291
       291
       +
       			Value: originalBinding,

     

       292
       292
       +
       			Path:  "/oauth",

     

       293
       293
       +
       		})

     

       294
       294
       +
       

     

       295
       295
       +
       		rec := httptest.NewRecorder()

     

       296
       296
       +
       		handler.HandleCallback(rec, req)

     

       297
       297
       +
       

     

       298
       298
       +
       		// Should fail because hash(attackerCSRF + redirectURI) != hash(originalCSRF + redirectURI)

     

       299
       299
       +
       		// This is the key security fix - CSRF token VALUE is now validated

     

       300
       300
       +
       		assert.NotEqual(t, http.StatusFound, rec.Code,

     

       301
       301
       +
       			"Should not redirect when CSRF token doesn't match binding")

     

       302
       302
       +
       	})

     

       303
       303
       +
       }

     

       304
       304
       +
       

     

       305
       305
       +
       // generateMobileRedirectBindingForTest generates a binding for testing

     

       306
       306
       +
       // This mirrors the actual logic in handlers_security.go:

     

       307
       307
       +
       // binding = base64(sha256(csrfToken + "|" + redirectURI)[:16])

     

       308
       308
       +
       func generateMobileRedirectBindingForTest(csrfToken, mobileRedirectURI string) string {

     

       309
       309
       +
       	combined := csrfToken + "|" + mobileRedirectURI

     

       310
       310
       +
       	hash := sha256.Sum256([]byte(combined))

     

       311
       311
       +
       	return base64.URLEncoding.EncodeToString(hash[:16])

     

       312
       312
       +
       }

+169

tests/integration/oauth_token_verification_test.go

···

       1
       1
       +
       package integration

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"net/http"

     

       7
       7
       +
       	"net/http/httptest"

     

       8
       8
       +
       	"os"

     

       9
       9
       +
       	"testing"

     

       10
       10
       +
       	"time"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       // TestOAuthTokenVerification tests end-to-end OAuth token verification

     

       14
       14
       +
       // with real PDS-issued OAuth tokens. This replaces the old JWT verification test

     

       15
       15
       +
       // since we now use OAuth sealed session tokens instead of raw JWTs.

     

       16
       16
       +
       //

     

       17
       17
       +
       // Flow:

     

       18
       18
       +
       // 1. Create account on local PDS (or use existing)

     

       19
       19
       +
       // 2. Authenticate to get OAuth tokens and create sealed session token

     

       20
       20
       +
       // 3. Verify our auth middleware can unseal and validate the token

     

       21
       21
       +
       // 4. Test token validation and session retrieval

     

       22
       22
       +
       //

     

       23
       23
       +
       // NOTE: This test uses the E2E OAuth middleware which mocks the session unsealing

     

       24
       24
       +
       // for testing purposes. Real OAuth tokens from PDS would be sealed using the

     

       25
       25
       +
       // OAuth client's seal secret.

     

       26
       26
       +
       func TestOAuthTokenVerification(t *testing.T) {

     

       27
       27
       +
       	// Skip in short mode since this requires real PDS

     

       28
       28
       +
       	if testing.Short() {

     

       29
       29
       +
       		t.Skip("Skipping OAuth token verification test in short mode")

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	pdsURL := os.Getenv("PDS_URL")

     

       33
       33
       +
       	if pdsURL == "" {

     

       34
       34
       +
       		pdsURL = "http://localhost:3001"

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	// Check if PDS is running

     

       38
       38
       +
       	healthResp, err := http.Get(pdsURL + "/xrpc/_health")

     

       39
       39
       +
       	if err != nil {

     

       40
       40
       +
       		t.Skipf("PDS not running at %s: %v", pdsURL, err)

     

       41
       41
       +
       	}

     

       42
       42
       +
       	_ = healthResp.Body.Close()

     

       43
       43
       +
       

     

       44
       44
       +
       	t.Run("OAuth token validation and middleware integration", func(t *testing.T) {

     

       45
       45
       +
       		// Step 1: Create a test account on PDS

     

       46
       46
       +
       		// Keep handle short to avoid PDS validation errors

     

       47
       47
       +
       		timestamp := time.Now().Unix() % 100000 // Last 5 digits

     

       48
       48
       +
       		handle := fmt.Sprintf("oauth%d.local.coves.dev", timestamp)

     

       49
       49
       +
       		password := "testpass123"

     

       50
       50
       +
       		email := fmt.Sprintf("oauth%d@test.com", timestamp)

     

       51
       51
       +
       

     

       52
       52
       +
       		_, did, err := createPDSAccount(pdsURL, handle, email, password)

     

       53
       53
       +
       		if err != nil {

     

       54
       54
       +
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       55
       55
       +
       		}

     

       56
       56
       +
       		t.Logf("✓ Created test account: %s (DID: %s)", handle, did)

     

       57
       57
       +
       

     

       58
       58
       +
       		// Step 2: Create OAuth middleware with mock unsealer for testing

     

       59
       59
       +
       		// In production, this would unseal real OAuth tokens from PDS

     

       60
       60
       +
       		t.Log("Testing OAuth middleware with sealed session tokens...")

     

       61
       61
       +
       

     

       62
       62
       +
       		e2eAuth := NewE2EOAuthMiddleware()

     

       63
       63
       +
       		testToken := e2eAuth.AddUser(did)

     

       64
       64
       +
       

     

       65
       65
       +
       		handlerCalled := false

     

       66
       66
       +
       		var extractedDID string

     

       67
       67
       +
       

     

       68
       68
       +
       		testHandler := e2eAuth.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       69
       69
       +
       			handlerCalled = true

     

       70
       70
       +
       			extractedDID = middleware.GetUserDID(r)

     

       71
       71
       +
       			w.WriteHeader(http.StatusOK)

     

       72
       72
       +
       			_, _ = w.Write([]byte(`{"success": true}`))

     

       73
       73
       +
       		}))

     

       74
       74
       +
       

     

       75
       75
       +
       		req := httptest.NewRequest("GET", "/test", nil)

     

       76
       76
       +
       		req.Header.Set("Authorization", "Bearer "+testToken)

     

       77
       77
       +
       		w := httptest.NewRecorder()

     

       78
       78
       +
       

     

       79
       79
       +
       		testHandler.ServeHTTP(w, req)

     

       80
       80
       +
       

     

       81
       81
       +
       		if !handlerCalled {

     

       82
       82
       +
       			t.Errorf("Handler was not called - auth middleware rejected valid token")

     

       83
       83
       +
       			t.Logf("Response status: %d", w.Code)

     

       84
       84
       +
       			t.Logf("Response body: %s", w.Body.String())

     

       85
       85
       +
       		}

     

       86
       86
       +
       

     

       87
       87
       +
       		if w.Code != http.StatusOK {

     

       88
       88
       +
       			t.Errorf("Expected status 200, got %d", w.Code)

     

       89
       89
       +
       			t.Logf("Response body: %s", w.Body.String())

     

       90
       90
       +
       		}

     

       91
       91
       +
       

     

       92
       92
       +
       		if extractedDID != did {

     

       93
       93
       +
       			t.Errorf("Middleware extracted wrong DID: expected %s, got %s", did, extractedDID)

     

       94
       94
       +
       		}

     

       95
       95
       +
       

     

       96
       96
       +
       		t.Logf("✅ OAuth middleware with token validation working correctly!")

     

       97
       97
       +
       		t.Logf("  Handler called: %v", handlerCalled)

     

       98
       98
       +
       		t.Logf("  Extracted DID: %s", extractedDID)

     

       99
       99
       +
       		t.Logf("  Response status: %d", w.Code)

     

       100
       100
       +
       	})

     

       101
       101
       +
       

     

       102
       102
       +
       	t.Run("Rejects tampered/invalid sealed tokens", func(t *testing.T) {

     

       103
       103
       +
       		// Create valid user

     

       104
       104
       +
       		timestamp := time.Now().Unix() % 100000

     

       105
       105
       +
       		handle := fmt.Sprintf("tamp%d.local.coves.dev", timestamp)

     

       106
       106
       +
       		password := "testpass456"

     

       107
       107
       +
       		email := fmt.Sprintf("tamp%d@test.com", timestamp)

     

       108
       108
       +
       

     

       109
       109
       +
       		_, did, err := createPDSAccount(pdsURL, handle, email, password)

     

       110
       110
       +
       		if err != nil {

     

       111
       111
       +
       			t.Fatalf("Failed to create PDS account: %v", err)

     

       112
       112
       +
       		}

     

       113
       113
       +
       

     

       114
       114
       +
       		// Create OAuth middleware

     

       115
       115
       +
       		e2eAuth := NewE2EOAuthMiddleware()

     

       116
       116
       +
       		validToken := e2eAuth.AddUser(did)

     

       117
       117
       +
       

     

       118
       118
       +
       		// Create various invalid tokens to test

     

       119
       119
       +
       		testCases := []struct {

     

       120
       120
       +
       			name  string

     

       121
       121
       +
       			token string

     

       122
       122
       +
       		}{

     

       123
       123
       +
       			{"Empty token", ""},

     

       124
       124
       +
       			{"Invalid base64", "not-valid-base64!!!"},

     

       125
       125
       +
       			{"Tampered token", "dGFtcGVyZWQtdG9rZW4tZGF0YQ=="}, // Valid base64 but not a real sealed session

     

       126
       126
       +
       			{"Short token", "abc"},

     

       127
       127
       +
       			{"Modified valid token", validToken + "extra"},

     

       128
       128
       +
       		}

     

       129
       129
       +
       

     

       130
       130
       +
       		for _, tc := range testCases {

     

       131
       131
       +
       			t.Run(tc.name, func(t *testing.T) {

     

       132
       132
       +
       				handlerCalled := false

     

       133
       133
       +
       				testHandler := e2eAuth.RequireAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

     

       134
       134
       +
       					handlerCalled = true

     

       135
       135
       +
       					w.WriteHeader(http.StatusOK)

     

       136
       136
       +
       				}))

     

       137
       137
       +
       

     

       138
       138
       +
       				req := httptest.NewRequest("GET", "/test", nil)

     

       139
       139
       +
       				if tc.token != "" {

     

       140
       140
       +
       					req.Header.Set("Authorization", "Bearer "+tc.token)

     

       141
       141
       +
       				}

     

       142
       142
       +
       				w := httptest.NewRecorder()

     

       143
       143
       +
       

     

       144
       144
       +
       				testHandler.ServeHTTP(w, req)

     

       145
       145
       +
       

     

       146
       146
       +
       				if handlerCalled {

     

       147
       147
       +
       					t.Error("Handler was called for invalid token - should have been rejected")

     

       148
       148
       +
       				}

     

       149
       149
       +
       

     

       150
       150
       +
       				if w.Code != http.StatusUnauthorized {

     

       151
       151
       +
       					t.Errorf("Expected status 401 for invalid token, got %d", w.Code)

     

       152
       152
       +
       				}

     

       153
       153
       +
       

     

       154
       154
       +
       				t.Logf("✓ Middleware correctly rejected %s with status %d", tc.name, w.Code)

     

       155
       155
       +
       			})

     

       156
       156
       +
       		}

     

       157
       157
       +
       

     

       158
       158
       +
       		t.Logf("✅ All invalid token types correctly rejected")

     

       159
       159
       +
       	})

     

       160
       160
       +
       

     

       161
       161
       +
       	t.Run("Session expiration handling", func(t *testing.T) {

     

       162
       162
       +
       		// OAuth session expiration is handled at the database level

     

       163
       163
       +
       		// See TestOAuthE2E_TokenExpiration in oauth_e2e_test.go for full expiration testing

     

       164
       164
       +
       		t.Log("ℹ️  Session expiration testing is covered in oauth_e2e_test.go")

     

       165
       165
       +
       		t.Log("   OAuth sessions expire based on database timestamps and are cleaned up periodically")

     

       166
       166
       +
       		t.Log("   This is different from JWT expiration which was timestamp-based in the token itself")

     

       167
       167
       +
       		t.Skip("Session expiration is tested in oauth_e2e_test.go - see TestOAuthE2E_TokenExpiration")

     

       168
       168
       +
       	})

     

       169
       169
       +
       }

+16 -20

tests/integration/community_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"Coves/internal/api/middleware"

     

       5
       4
        
       	"Coves/internal/api/routes"

     

       6
       5
        
       	"Coves/internal/atproto/identity"

     

       7
       6
        
       	"Coves/internal/atproto/jetstream"

     
···

       108
       107
        
       

     

       109
       108
        
       	t.Logf("✅ Authenticated - Instance DID: %s", instanceDID)

     

       110
       109
        
       

     

       111
       111
       -
       	// Initialize auth middleware with skipVerify=true

     

       112
       112
       -
       	// IMPORTANT: PDS password authentication returns Bearer tokens (not DPoP-bound tokens).

     

       113
       113
       -
       	// E2E tests use these Bearer tokens with the DPoP scheme header, which only works

     

       114
       114
       -
       	// because skipVerify=true bypasses signature and DPoP binding verification.

     

       115
       115
       -
       	// In production, skipVerify=false requires proper DPoP-bound tokens from OAuth flow.

     

       116
       116
       -
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true)

     

       117
       117
       -
       	defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine

     

       110
       110
       +
       	// Initialize OAuth auth middleware for E2E testing

     

       111
       111
       +
       	e2eAuth := NewE2EOAuthMiddleware()

     

       112
       112
       +
       	// Register the instance user for OAuth authentication

     

       113
       113
       +
       	token := e2eAuth.AddUser(instanceDID)

     

       118
       114
        
       

     

       119
       115
        
       	// V2.0: Extract instance domain for community provisioning

     

       120
       116
        
       	var instanceDomain string

     
···

       152
       148
        
       

     

       153
       149
        
       	// Setup HTTP server with XRPC routes

     

       154
       150
        
       	r := chi.NewRouter()

     

       155
       155
       -
       	routes.RegisterCommunityRoutes(r, communityService, authMiddleware, nil) // nil = allow all community creators

     

       151
       151
       +
       	routes.RegisterCommunityRoutes(r, communityService, e2eAuth.OAuthAuthMiddleware, nil) // nil = allow all community creators

     

       156
       152
        
       	httpServer := httptest.NewServer(r)

     

       157
       153
        
       	defer httpServer.Close()

     

       158
       154
        
       

     
···

       387
       383
        
       				t.Fatalf("Failed to create request: %v", err)

     

       388
       384
        
       			}

     

       389
       385
        
       			req.Header.Set("Content-Type", "application/json")

     

       390
       390
       -
       			// Use real PDS access token for E2E authentication

     

       391
       391
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       386
       386
       +
       			// Use OAuth token for Coves API authentication

     

       387
       387
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       392
       388
        
       

     

       393
       389
        
       			resp, err := http.DefaultClient.Do(req)

     

       394
       390
        
       			if err != nil {

     
···

       773
       769
        
       				t.Fatalf("Failed to create request: %v", err)

     

       774
       770
        
       			}

     

       775
       771
        
       			req.Header.Set("Content-Type", "application/json")

     

       776
       776
       -
       			// Use real PDS access token for E2E authentication

     

       777
       777
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       772
       772
       +
       			// Use OAuth token for Coves API authentication

     

       773
       773
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       778
       774
        
       

     

       779
       775
        
       			resp, err := http.DefaultClient.Do(req)

     

       780
       776
        
       			if err != nil {

     
···

       1008
       1004
        
       				t.Fatalf("Failed to create request: %v", err)

     

       1009
       1005
        
       			}

     

       1010
       1006
        
       			req.Header.Set("Content-Type", "application/json")

     

       1011
       1011
       -
       			// Use real PDS access token for E2E authentication

     

       1012
       1012
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1007
       1007
       +
       			// Use OAuth token for Coves API authentication

     

       1008
       1008
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1013
       1009
        
       

     

       1014
       1010
        
       			resp, err := http.DefaultClient.Do(req)

     

       1015
       1011
        
       			if err != nil {

     
···

       1141
       1137
        
       				t.Fatalf("Failed to create block request: %v", err)

     

       1142
       1138
        
       			}

     

       1143
       1139
        
       			req.Header.Set("Content-Type", "application/json")

     

       1144
       1144
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1140
       1140
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1145
       1141
        
       

     

       1146
       1142
        
       			resp, err := http.DefaultClient.Do(req)

     

       1147
       1143
        
       			if err != nil {

     
···

       1261
       1257
        
       				t.Fatalf("Failed to create block request: %v", err)

     

       1262
       1258
        
       			}

     

       1263
       1259
        
       			blockHttpReq.Header.Set("Content-Type", "application/json")

     

       1264
       1264
       -
       			blockHttpReq.Header.Set("Authorization", "DPoP "+accessToken)

     

       1260
       1260
       +
       			blockHttpReq.Header.Set("Authorization", "Bearer "+token)

     

       1265
       1261
        
       

     

       1266
       1262
        
       			blockResp, err := http.DefaultClient.Do(blockHttpReq)

     

       1267
       1263
        
       			if err != nil {

     
···

       1321
       1317
        
       				t.Fatalf("Failed to create unblock request: %v", err)

     

       1322
       1318
        
       			}

     

       1323
       1319
        
       			req.Header.Set("Content-Type", "application/json")

     

       1324
       1324
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1320
       1320
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1325
       1321
        
       

     

       1326
       1322
        
       			resp, err := http.DefaultClient.Do(req)

     

       1327
       1323
        
       			if err != nil {

     
···

       1477
       1473
        
       				t.Fatalf("Failed to create request: %v", err)

     

       1478
       1474
        
       			}

     

       1479
       1475
        
       			req.Header.Set("Content-Type", "application/json")

     

       1480
       1480
       -
       			// Use real PDS access token for E2E authentication

     

       1481
       1481
       -
       			req.Header.Set("Authorization", "DPoP "+accessToken)

     

       1476
       1476
       +
       			// Use OAuth token for Coves API authentication

     

       1477
       1477
       +
       			req.Header.Set("Authorization", "Bearer "+token)

     

       1482
       1478
        
       

     

       1483
       1479
        
       			resp, err := http.DefaultClient.Do(req)

     

       1484
       1480
        
       			if err != nil {

+22 -19

tests/integration/user_journey_e2e_test.go

···

       1
       1
        
       package integration

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"Coves/internal/api/middleware"

     

       5
       4
        
       	"Coves/internal/api/routes"

     

       6
       5
        
       	"Coves/internal/atproto/identity"

     

       7
       6
        
       	"Coves/internal/atproto/jetstream"

     
···

       22
       21
        
       	"testing"

     

       23
       22
        
       	"time"

     

       24
       23
        
       

     

       25
       25
       -
       	timelineCore "Coves/internal/core/timeline"

     

       26
       26
       -
       

     

       27
       24
        
       	"github.com/go-chi/chi/v5"

     

       28
       25
        
       	"github.com/gorilla/websocket"

     

       29
       26
        
       	_ "github.com/lib/pq"

     

       30
       27
        
       	"github.com/pressly/goose/v3"

     

       31
       28
        
       	"github.com/stretchr/testify/assert"

     

       32
       29
        
       	"github.com/stretchr/testify/require"

     

       30
       30
       +
       

     

       31
       31
       +
       	timelineCore "Coves/internal/core/timeline"

     

       33
       32
        
       )

     

       34
       33
        
       

     

       35
       34
        
       // TestFullUserJourney_E2E tests the complete user experience from signup to interaction:

     
···

       139
       138
        
       	commentConsumer := jetstream.NewCommentEventConsumer(commentRepo, db)

     

       140
       139
        
       	voteConsumer := jetstream.NewVoteEventConsumer(voteRepo, userService, db)

     

       141
       140
        
       

     

       142
       142
       -
       	// Setup HTTP server with all routes

     

       143
       143
       -
       	// IMPORTANT: skipVerify=true because PDS password auth returns Bearer tokens (not DPoP-bound).

     

       144
       144
       -
       	// E2E tests use Bearer tokens with DPoP scheme header, which only works with skipVerify=true.

     

       145
       145
       -
       	// In production, skipVerify=false requires proper DPoP-bound tokens from OAuth flow.

     

       146
       146
       -
       	authMiddleware := middleware.NewAtProtoAuthMiddleware(nil, true)

     

       147
       147
       -
       	defer authMiddleware.Stop() // Clean up DPoP replay cache goroutine

     

       141
       141
       +
       	// Setup HTTP server with all routes using OAuth middleware

     

       142
       142
       +
       	e2eAuth := NewE2EOAuthMiddleware()

     

       148
       143
        
       	r := chi.NewRouter()

     

       149
       149
       -
       	routes.RegisterCommunityRoutes(r, communityService, authMiddleware, nil) // nil = allow all community creators

     

       150
       150
       -
       	routes.RegisterPostRoutes(r, postService, authMiddleware)

     

       151
       151
       -
       	routes.RegisterTimelineRoutes(r, timelineService, authMiddleware)

     

       144
       144
       +
       	routes.RegisterCommunityRoutes(r, communityService, e2eAuth.OAuthAuthMiddleware, nil) // nil = allow all community creators

     

       145
       145
       +
       	routes.RegisterPostRoutes(r, postService, e2eAuth.OAuthAuthMiddleware)

     

       146
       146
       +
       	routes.RegisterTimelineRoutes(r, timelineService, e2eAuth.OAuthAuthMiddleware)

     

       152
       147
        
       	httpServer := httptest.NewServer(r)

     

       153
       148
        
       	defer httpServer.Close()

     

       154
       149
        
       

     
···

       181
       176
        
       	var (

     

       182
       177
        
       		userAHandle     string

     

       183
       178
        
       		userADID        string

     

       184
       184
       -
       		userAToken      string

     

       179
       179
       +
       		userAToken      string // PDS access token for direct PDS requests

     

       180
       180
       +
       		userAAPIToken   string // Coves API token for Coves API requests

     

       185
       181
        
       		userBHandle     string

     

       186
       182
        
       		userBDID        string

     

       187
       187
       -
       		userBToken      string

     

       183
       183
       +
       		userBToken      string // PDS access token for direct PDS requests

     

       184
       184
       +
       		userBAPIToken   string // Coves API token for Coves API requests

     

       188
       185
        
       		communityDID    string

     

       189
       186
        
       		communityHandle string

     

       190
       187
        
       		postURI         string

     
···

       217
       214
        
       		userA := createTestUser(t, db, userAHandle, userADID)

     

       218
       215
        
       		require.NotNil(t, userA)

     

       219
       216
        
       

     

       217
       217
       +
       		// Register user with OAuth middleware for Coves API requests

     

       218
       218
       +
       		userAAPIToken = e2eAuth.AddUser(userADID)

     

       219
       219
       +
       

     

       220
       220
        
       		t.Logf("✅ User A indexed in AppView")

     

       221
       221
        
       	})

     

       222
       222
        
       

     
···

       244
       244
        
       			httpServer.URL+"/xrpc/social.coves.community.create",

     

       245
       245
        
       			bytes.NewBuffer(reqBody))

     

       246
       246
        
       		req.Header.Set("Content-Type", "application/json")

     

       247
       247
       -
       		req.Header.Set("Authorization", "DPoP "+userAToken)

     

       247
       247
       +
       		req.Header.Set("Authorization", "Bearer "+userAAPIToken)

     

       248
       248
        
       

     

       249
       249
        
       		resp, err := http.DefaultClient.Do(req)

     

       250
       250
        
       		require.NoError(t, err)

     
···

       328
       328
        
       			httpServer.URL+"/xrpc/social.coves.community.post.create",

     

       329
       329
        
       			bytes.NewBuffer(reqBody))

     

       330
       330
        
       		req.Header.Set("Content-Type", "application/json")

     

       331
       331
       -
       		req.Header.Set("Authorization", "DPoP "+userAToken)

     

       331
       331
       +
       		req.Header.Set("Authorization", "Bearer "+userAAPIToken)

     

       332
       332
        
       

     

       333
       333
        
       		resp, err := http.DefaultClient.Do(req)

     

       334
       334
        
       		require.NoError(t, err)

     
···

       413
       413
        
       		userB := createTestUser(t, db, userBHandle, userBDID)

     

       414
       414
        
       		require.NotNil(t, userB)

     

       415
       415
        
       

     

       416
       416
       +
       		// Register user with OAuth middleware for Coves API requests

     

       417
       417
       +
       		userBAPIToken = e2eAuth.AddUser(userBDID)

     

       418
       418
       +
       

     

       416
       419
        
       		t.Logf("✅ User B indexed in AppView")

     

       417
       420
        
       	})

     

       418
       421
        
       

     
···

       437
       440
        
       			httpServer.URL+"/xrpc/social.coves.community.subscribe",

     

       438
       441
        
       			bytes.NewBuffer(reqBody))

     

       439
       442
        
       		req.Header.Set("Content-Type", "application/json")

     

       440
       440
       -
       		req.Header.Set("Authorization", "DPoP "+userBToken)

     

       443
       443
       +
       		req.Header.Set("Authorization", "Bearer "+userBAPIToken)

     

       441
       444
        
       

     

       442
       445
        
       		resp, err := http.DefaultClient.Do(req)

     

       443
       446
        
       		require.NoError(t, err)

     
···

       669
       672
        
       	t.Run("9. User B - Verify Timeline Feed Shows Subscribed Community Posts", func(t *testing.T) {

     

       670
       673
        
       		t.Log("\n📰 Part 9: User B checks timeline feed...")

     

       671
       674
        
       

     

       672
       672
       -
       		// Use HTTP client to properly go through auth middleware with DPoP token

     

       675
       675
       +
       		// Use HTTP client to properly go through auth middleware with Bearer token

     

       673
       676
        
       		req, _ := http.NewRequest(http.MethodGet,

     

       674
       677
        
       			httpServer.URL+"/xrpc/social.coves.feed.getTimeline?sort=new&limit=10", nil)

     

       675
       675
       -
       		req.Header.Set("Authorization", "DPoP "+userBToken)

     

       678
       678
       +
       		req.Header.Set("Authorization", "Bearer "+userBAPIToken)

     

       676
       679
        
       

     

       677
       680
        
       		resp, err := http.DefaultClient.Do(req)

     

       678
       681
        
       		require.NoError(t, err)

go.sum

···

       21
       21
        
       github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=

     

       22
       22
        
       github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=

     

       23
       23
        
       github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=

     

       24
       24
       +
       github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=

     

       25
       25
       +
       github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=

     

       24
       26
        
       github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=

     

       25
       27
        
       github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=

     

       26
       28
        
       github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=

     
···

       33
       35
        
       github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=

     

       34
       36
        
       github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=

     

       35
       37
        
       github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=

     

       38
       38
       +
       github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=

     

       36
       39
        
       github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=

     

       37
       40
        
       github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

     

       41
       41
       +
       github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=

     

       42
       42
       +
       github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=

     

       38
       43
        
       github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=

     

       39
       44
        
       github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=

     

       40
       45
        
       github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

.env.dev

···

       115
       115
        
       # Also supports base64: prefix for consistency

     

       116
       116
        
       OAUTH_COOKIE_SECRET=f1132c01b1a625a865c6c455a75ee793572cedb059cebe0c4c1ae4c446598f7d

     

       117
       117
        
       

     

       118
       118
       +
       # Seal secret for OAuth session tokens (AES-256-GCM encryption)

     

       119
       119
       +
       # Generate with: openssl rand -base64 32

     

       120
       120
       +
       # This must be 32 bytes when base64-decoded for AES-256

     

       121
       121
       +
       # OAUTH_SEAL_SECRET=ryW6xNVxYhP6hCDA90NGCmK58Q2ONnkYXbHL0oZN2no=

     

       122
       122
       +
       

     

       118
       123
        
       # AppView public URL (used for OAuth callback and client metadata)

     

       119
       124
        
       # Dev: http://127.0.0.1:8081 (use 127.0.0.1 instead of localhost per RFC 8252)

     

       120
       125
        
       # Prod: https://coves.social

-73

cmd/genjwks/main.go

···

       1
       1
       -
       package main

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"crypto/ecdsa"

     

       5
       5
       -
       	"crypto/elliptic"

     

       6
       6
       -
       	"crypto/rand"

     

       7
       7
       -
       	"encoding/json"

     

       8
       8
       -
       	"fmt"

     

       9
       9
       -
       	"log"

     

       10
       10
       -
       	"os"

     

       11
       11
       -
       

     

       12
       12
       -
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       // genjwks generates an ES256 keypair for OAuth client authentication

     

       16
       16
       -
       // The private key is stored in the config/env, public key is served at /oauth/jwks.json

     

       17
       17
       -
       //

     

       18
       18
       -
       // Usage:

     

       19
       19
       -
       //

     

       20
       20
       -
       //	go run cmd/genjwks/main.go

     

       21
       21
       -
       //

     

       22
       22
       -
       // This will output a JSON private key that should be stored in OAUTH_PRIVATE_JWK

     

       23
       23
       -
       func main() {

     

       24
       24
       -
       	fmt.Println("Generating ES256 keypair for OAuth client authentication...")

     

       25
       25
       -
       

     

       26
       26
       -
       	// Generate ES256 (NIST P-256) private key

     

       27
       27
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       28
       28
       -
       	if err != nil {

     

       29
       29
       -
       		log.Fatalf("Failed to generate private key: %v", err)

     

       30
       30
       -
       	}

     

       31
       31
       -
       

     

       32
       32
       -
       	// Convert to JWK

     

       33
       33
       -
       	jwkKey, err := jwk.FromRaw(privateKey)

     

       34
       34
       -
       	if err != nil {

     

       35
       35
       -
       		log.Fatalf("Failed to create JWK from private key: %v", err)

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	// Set key parameters

     

       39
       39
       -
       	if err = jwkKey.Set(jwk.KeyIDKey, "oauth-client-key"); err != nil {

     

       40
       40
       -
       		log.Fatalf("Failed to set kid: %v", err)

     

       41
       41
       -
       	}

     

       42
       42
       -
       	if err = jwkKey.Set(jwk.AlgorithmKey, "ES256"); err != nil {

     

       43
       43
       -
       		log.Fatalf("Failed to set alg: %v", err)

     

       44
       44
       -
       	}

     

       45
       45
       -
       	if err = jwkKey.Set(jwk.KeyUsageKey, "sig"); err != nil {

     

       46
       46
       -
       		log.Fatalf("Failed to set use: %v", err)

     

       47
       47
       -
       	}

     

       48
       48
       -
       

     

       49
       49
       -
       	// Marshal to JSON

     

       50
       50
       -
       	jsonData, err := json.MarshalIndent(jwkKey, "", "  ")

     

       51
       51
       -
       	if err != nil {

     

       52
       52
       -
       		log.Fatalf("Failed to marshal JWK: %v", err)

     

       53
       53
       -
       	}

     

       54
       54
       -
       

     

       55
       55
       -
       	// Output instructions

     

       56
       56
       -
       	fmt.Println("\n✅ ES256 keypair generated successfully!")

     

       57
       57
       -
       	fmt.Println("\n📝 Add this to your .env.dev file:")

     

       58
       58
       -
       	fmt.Println("\nOAUTH_PRIVATE_JWK='" + string(jsonData) + "'")

     

       59
       59
       -
       	fmt.Println("\n⚠️  IMPORTANT:")

     

       60
       60
       -
       	fmt.Println("   - Keep this private key SECRET")

     

       61
       61
       -
       	fmt.Println("   - Never commit it to version control")

     

       62
       62
       -
       	fmt.Println("   - Generate a new key for production")

     

       63
       63
       -
       	fmt.Println("   - The public key will be automatically derived and served at /oauth/jwks.json")

     

       64
       64
       -
       

     

       65
       65
       -
       	// Optionally write to a file (not committed)

     

       66
       66
       -
       	if len(os.Args) > 1 && os.Args[1] == "--save" {

     

       67
       67
       -
       		filename := "oauth-private-key.json"

     

       68
       68
       -
       		if err := os.WriteFile(filename, jsonData, 0o600); err != nil {

     

       69
       69
       -
       			log.Fatalf("Failed to write key file: %v", err)

     

       70
       70
       -
       		}

     

       71
       71
       -
       		fmt.Printf("\n💾 Private key saved to %s (remember to add to .gitignore!)\n", filename)

     

       72
       72
       -
       	}

     

       73
       73
       -
       }

-330

internal/atproto/auth/README.md

···

       1
       1
       -
       # atProto OAuth Authentication

     

       2
       2
       -
       

     

       3
       3
       -
       This package implements third-party OAuth authentication for Coves, validating DPoP-bound access tokens from mobile apps and other atProto clients.

     

       4
       4
       -
       

     

       5
       5
       -
       ## Architecture

     

       6
       6
       -
       

     

       7
       7
       -
       This is **third-party authentication** (validating incoming requests), not first-party authentication (logging users into Coves web frontend).

     

       8
       8
       -
       

     

       9
       9
       -
       ### Components

     

       10
       10
       -
       

     

       11
       11
       -
       1. **JWT Parser** (`jwt.go`) - Parses and validates JWT tokens

     

       12
       12
       -
       2. **JWKS Fetcher** (`jwks_fetcher.go`) - Fetches and caches public keys from PDS authorization servers

     

       13
       13
       -
       3. **Auth Middleware** (`internal/api/middleware/auth.go`) - HTTP middleware that protects endpoints

     

       14
       14
       -
       

     

       15
       15
       -
       ### Flow

     

       16
       16
       -
       

     

       17
       17
       -
       ```

     

       18
       18
       -
       Client Request

     

       19
       19
       -
           ↓

     

       20
       20
       -
       Authorization: DPoP <access_token>

     

       21
       21
       -
       DPoP: <proof-jwt>

     

       22
       22
       -
           ↓

     

       23
       23
       -
       Auth Middleware

     

       24
       24
       -
           ↓

     

       25
       25
       -
       Extract JWT → Parse Claims → Verify Signature (via JWKS) → Verify DPoP Proof

     

       26
       26
       -
           ↓

     

       27
       27
       -
       Inject DID into Context → Call Handler

     

       28
       28
       -
       ```

     

       29
       29
       -
       

     

       30
       30
       -
       ## Usage

     

       31
       31
       -
       

     

       32
       32
       -
       ### Phase 1: Parse-Only Mode (Testing)

     

       33
       33
       -
       

     

       34
       34
       -
       Set `AUTH_SKIP_VERIFY=true` to only parse JWTs without signature verification:

     

       35
       35
       -
       

     

       36
       36
       -
       ```bash

     

       37
       37
       -
       export AUTH_SKIP_VERIFY=true

     

       38
       38
       -
       ```

     

       39
       39
       -
       

     

       40
       40
       -
       This is useful for:

     

       41
       41
       -
       - Initial integration testing

     

       42
       42
       -
       - Testing with mock tokens

     

       43
       43
       -
       - Debugging JWT structure

     

       44
       44
       -
       

     

       45
       45
       -
       ### Phase 2: Full Verification (Production)

     

       46
       46
       -
       

     

       47
       47
       -
       Set `AUTH_SKIP_VERIFY=false` (or unset) to enable full JWT signature verification:

     

       48
       48
       -
       

     

       49
       49
       -
       ```bash

     

       50
       50
       -
       export AUTH_SKIP_VERIFY=false

     

       51
       51
       -
       # or just unset it

     

       52
       52
       -
       ```

     

       53
       53
       -
       

     

       54
       54
       -
       This is **required for production** and validates:

     

       55
       55
       -
       - JWT signature using PDS public key

     

       56
       56
       -
       - Token expiration

     

       57
       57
       -
       - Required claims (sub, iss)

     

       58
       58
       -
       - DID format

     

       59
       59
       -
       

     

       60
       60
       -
       ## Protected Endpoints

     

       61
       61
       -
       

     

       62
       62
       -
       The following endpoints require authentication:

     

       63
       63
       -
       

     

       64
       64
       -
       - `POST /xrpc/social.coves.community.create`

     

       65
       65
       -
       - `POST /xrpc/social.coves.community.update`

     

       66
       66
       -
       - `POST /xrpc/social.coves.community.subscribe`

     

       67
       67
       -
       - `POST /xrpc/social.coves.community.unsubscribe`

     

       68
       68
       -
       

     

       69
       69
       -
       ### Making Authenticated Requests

     

       70
       70
       -
       

     

       71
       71
       -
       Include the JWT in the `Authorization` header:

     

       72
       72
       -
       

     

       73
       73
       -
       ```bash

     

       74
       74
       -
       curl -X POST https://coves.social/xrpc/social.coves.community.create \

     

       75
       75
       -
         -H "Authorization: DPoP eyJhbGc..." \

     

       76
       76
       -
         -H "DPoP: eyJhbGc..." \

     

       77
       77
       -
         -H "Content-Type: application/json" \

     

       78
       78
       -
         -d '{"name":"Gaming","hostedByDid":"did:plc:..."}'

     

       79
       79
       -
       ```

     

       80
       80
       -
       

     

       81
       81
       -
       ### Getting User DID in Handlers

     

       82
       82
       -
       

     

       83
       83
       -
       The middleware injects the authenticated user's DID into the request context:

     

       84
       84
       -
       

     

       85
       85
       -
       ```go

     

       86
       86
       -
       import "Coves/internal/api/middleware"

     

       87
       87
       -
       

     

       88
       88
       -
       func (h *Handler) HandleCreate(w http.ResponseWriter, r *http.Request) {

     

       89
       89
       -
           // Extract authenticated user DID

     

       90
       90
       -
           userDID := middleware.GetUserDID(r)

     

       91
       91
       -
           if userDID == "" {

     

       92
       92
       -
               // Not authenticated (should never happen with RequireAuth middleware)

     

       93
       93
       -
               http.Error(w, "Unauthorized", http.StatusUnauthorized)

     

       94
       94
       -
               return

     

       95
       95
       -
           }

     

       96
       96
       -
       

     

       97
       97
       -
           // Use userDID for authorization checks

     

       98
       98
       -
           // ...

     

       99
       99
       -
       }

     

       100
       100
       -
       ```

     

       101
       101
       -
       

     

       102
       102
       -
       ## Key Caching

     

       103
       103
       -
       

     

       104
       104
       -
       Public keys are fetched from PDS authorization servers and cached for 1 hour. The cache is automatically cleaned up hourly to remove expired entries.

     

       105
       105
       -
       

     

       106
       106
       -
       ### JWKS Discovery Flow

     

       107
       107
       -
       

     

       108
       108
       -
       1. Extract `iss` claim from JWT (e.g., `https://pds.example.com`)

     

       109
       109
       -
       2. Fetch `https://pds.example.com/.well-known/oauth-authorization-server`

     

       110
       110
       -
       3. Extract `jwks_uri` from metadata

     

       111
       111
       -
       4. Fetch JWKS from `jwks_uri`

     

       112
       112
       -
       5. Find matching key by `kid` from JWT header

     

       113
       113
       -
       6. Cache the JWKS for 1 hour

     

       114
       114
       -
       

     

       115
       115
       -
       ## DPoP Token Binding

     

       116
       116
       -
       

     

       117
       117
       -
       DPoP (Demonstrating Proof-of-Possession) binds access tokens to client-controlled cryptographic keys, preventing token theft and replay attacks.

     

       118
       118
       -
       

     

       119
       119
       -
       ### What is DPoP?

     

       120
       120
       -
       

     

       121
       121
       -
       DPoP is an OAuth extension (RFC 9449) that adds proof-of-possession semantics to bearer tokens. When a PDS issues a DPoP-bound access token:

     

       122
       122
       -
       

     

       123
       123
       -
       1. Access token contains `cnf.jkt` claim (JWK thumbprint of client's public key)

     

       124
       124
       -
       2. Client creates a DPoP proof JWT signed with their private key

     

       125
       125
       -
       3. Server verifies the proof signature and checks it matches the token's `cnf.jkt`

     

       126
       126
       -
       

     

       127
       127
       -
       ### CRITICAL: DPoP Security Model

     

       128
       128
       -
       

     

       129
       129
       -
       > ⚠️ **DPoP is an ADDITIONAL security layer, NOT a replacement for token signature verification.**

     

       130
       130
       -
       

     

       131
       131
       -
       The correct verification order is:

     

       132
       132
       -
       1. **ALWAYS verify the access token signature first** (via JWKS, HS256 shared secret, or DID resolution)

     

       133
       133
       -
       2. **If the verified token has `cnf.jkt`, REQUIRE valid DPoP proof**

     

       134
       134
       -
       3. **NEVER use DPoP as a fallback when signature verification fails**

     

       135
       135
       -
       

     

       136
       136
       -
       **Why This Matters**: An attacker could create a fake token with `sub: "did:plc:victim"` and their own `cnf.jkt`, then present a valid DPoP proof signed with their key. If we accept DPoP as a fallback, the attacker can impersonate any user.

     

       137
       137
       -
       

     

       138
       138
       -
       ### How DPoP Works

     

       139
       139
       -
       

     

       140
       140
       -
       ```

     

       141
       141
       -
       ┌─────────────┐                          ┌─────────────┐

     

       142
       142
       -
       │   Client    │                          │   Server    │

     

       143
       143
       -
       │             │                          │  (Coves)    │

     

       144
       144
       -
       └─────────────┘                          └─────────────┘

     

       145
       145
       -
              │                                        │

     

       146
       146
       -
              │ 1. Authorization: DPoP <token>         │

     

       147
       147
       -
              │    DPoP: <proof-jwt>                  │

     

       148
       148
       -
              │───────────────────────────────────────>│

     

       149
       149
       -
              │                                        │

     

       150
       150
       -
              │                                        │ 2. VERIFY token signature

     

       151
       151
       -
              │                                        │    (REQUIRED - no fallback!)

     

       152
       152
       -
              │                                        │

     

       153
       153
       -
              │                                        │ 3. If token has cnf.jkt:

     

       154
       154
       -
              │                                        │    - Verify DPoP proof

     

       155
       155
       -
              │                                        │    - Check thumbprint match

     

       156
       156
       -
              │                                        │

     

       157
       157
       -
              │                              200 OK    │

     

       158
       158
       -
              │<───────────────────────────────────────│

     

       159
       159
       -
       ```

     

       160
       160
       -
       

     

       161
       161
       -
       ### When DPoP is Required

     

       162
       162
       -
       

     

       163
       163
       -
       DPoP verification is **REQUIRED** when:

     

       164
       164
       -
       - Access token signature has been verified AND

     

       165
       165
       -
       - Access token contains `cnf.jkt` claim (DPoP-bound)

     

       166
       166
       -
       

     

       167
       167
       -
       If the token has `cnf.jkt` but no DPoP header is present, the request is **REJECTED**.

     

       168
       168
       -
       

     

       169
       169
       -
       ### Replay Protection

     

       170
       170
       -
       

     

       171
       171
       -
       DPoP proofs include a unique `jti` (JWT ID) claim. The server tracks seen `jti` values to prevent replay attacks:

     

       172
       172
       -
       

     

       173
       173
       -
       ```go

     

       174
       174
       -
       // Create a verifier with replay protection (default)

     

       175
       175
       -
       verifier := auth.NewDPoPVerifier()

     

       176
       176
       -
       defer verifier.Stop() // Stop cleanup goroutine on shutdown

     

       177
       177
       -
       

     

       178
       178
       -
       // The verifier automatically rejects reused jti values within the proof validity window (5 minutes)

     

       179
       179
       -
       ```

     

       180
       180
       -
       

     

       181
       181
       -
       ### DPoP Implementation

     

       182
       182
       -
       

     

       183
       183
       -
       The `dpop.go` module provides:

     

       184
       184
       -
       

     

       185
       185
       -
       ```go

     

       186
       186
       -
       // Create a verifier with replay protection

     

       187
       187
       -
       verifier := auth.NewDPoPVerifier()

     

       188
       188
       -
       defer verifier.Stop()

     

       189
       189
       -
       

     

       190
       190
       -
       // Verify the DPoP proof

     

       191
       191
       -
       proof, err := verifier.VerifyDPoPProof(dpopHeader, "POST", "https://coves.social/xrpc/...")

     

       192
       192
       -
       if err != nil {

     

       193
       193
       -
           // Invalid proof (includes replay detection)

     

       194
       194
       -
       }

     

       195
       195
       -
       

     

       196
       196
       -
       // Verify it binds to the VERIFIED access token

     

       197
       197
       -
       expectedThumbprint, err := auth.ExtractCnfJkt(claims)

     

       198
       198
       -
       if err != nil {

     

       199
       199
       -
           // Token not DPoP-bound

     

       200
       200
       -
       }

     

       201
       201
       -
       

     

       202
       202
       -
       if err := verifier.VerifyTokenBinding(proof, expectedThumbprint); err != nil {

     

       203
       203
       -
           // Proof doesn't match token

     

       204
       204
       -
       }

     

       205
       205
       -
       ```

     

       206
       206
       -
       

     

       207
       207
       -
       ### DPoP Proof Format

     

       208
       208
       -
       

     

       209
       209
       -
       The DPoP header contains a JWT with:

     

       210
       210
       -
       

     

       211
       211
       -
       **Header**:

     

       212
       212
       -
       - `typ`: `"dpop+jwt"` (required)

     

       213
       213
       -
       - `alg`: `"ES256"` (or other supported algorithm)

     

       214
       214
       -
       - `jwk`: Client's public key (JWK format)

     

       215
       215
       -
       

     

       216
       216
       -
       **Claims**:

     

       217
       217
       -
       - `jti`: Unique proof identifier (tracked for replay protection)

     

       218
       218
       -
       - `htm`: HTTP method (e.g., `"POST"`)

     

       219
       219
       -
       - `htu`: HTTP URI (without query/fragment)

     

       220
       220
       -
       - `iat`: Timestamp (must be recent, within 5 minutes)

     

       221
       221
       -
       

     

       222
       222
       -
       **Example**:

     

       223
       223
       -
       ```json

     

       224
       224
       -
       {

     

       225
       225
       -
         "typ": "dpop+jwt",

     

       226
       226
       -
         "alg": "ES256",

     

       227
       227
       -
         "jwk": {

     

       228
       228
       -
           "kty": "EC",

     

       229
       229
       -
           "crv": "P-256",

     

       230
       230
       -
           "x": "...",

     

       231
       231
       -
           "y": "..."

     

       232
       232
       -
         }

     

       233
       233
       -
       }

     

       234
       234
       -
       {

     

       235
       235
       -
         "jti": "unique-id-123",

     

       236
       236
       -
         "htm": "POST",

     

       237
       237
       -
         "htu": "https://coves.social/xrpc/social.coves.community.create",

     

       238
       238
       -
         "iat": 1700000000

     

       239
       239
       -
       }

     

       240
       240
       -
       ```

     

       241
       241
       -
       

     

       242
       242
       -
       ## Security Considerations

     

       243
       243
       -
       

     

       244
       244
       -
       ### ✅ Implemented

     

       245
       245
       -
       

     

       246
       246
       -
       - JWT signature verification with PDS public keys

     

       247
       247
       -
       - Token expiration validation

     

       248
       248
       -
       - DID format validation

     

       249
       249
       -
       - Required claims validation (sub, iss)

     

       250
       250
       -
       - Key caching with TTL

     

       251
       251
       -
       - Secure error messages (no internal details leaked)

     

       252
       252
       -
       - **DPoP proof verification** (proof-of-possession for token binding)

     

       253
       253
       -
       - **DPoP thumbprint validation** (prevents token theft attacks)

     

       254
       254
       -
       - **DPoP freshness checks** (5-minute proof validity window)

     

       255
       255
       -
       - **DPoP replay protection** (jti tracking with in-memory cache)

     

       256
       256
       -
       - **Secure DPoP model** (DPoP required AFTER signature verification, never as fallback)

     

       257
       257
       -
       

     

       258
       258
       -
       ### ⚠️ Not Yet Implemented

     

       259
       259
       -
       

     

       260
       260
       -
       - Server-issued DPoP nonces (additional replay protection)

     

       261
       261
       -
       - Scope validation (checking `scope` claim)

     

       262
       262
       -
       - Audience validation (checking `aud` claim)

     

       263
       263
       -
       - Rate limiting per DID

     

       264
       264
       -
       - Token revocation checking

     

       265
       265
       -
       

     

       266
       266
       -
       ## Testing

     

       267
       267
       -
       

     

       268
       268
       -
       Run the test suite:

     

       269
       269
       -
       

     

       270
       270
       -
       ```bash

     

       271
       271
       -
       go test ./internal/atproto/auth/... -v

     

       272
       272
       -
       ```

     

       273
       273
       -
       

     

       274
       274
       -
       ### Manual Testing

     

       275
       275
       -
       

     

       276
       276
       -
       1. **Phase 1 (Parse Only)**:

     

       277
       277
       -
          ```bash

     

       278
       278
       -
          # Create a test JWT (use jwt.io or a tool)

     

       279
       279
       -
          export AUTH_SKIP_VERIFY=true

     

       280
       280
       -
          curl -X POST http://localhost:8081/xrpc/social.coves.community.create \

     

       281
       281
       -
            -H "Authorization: DPoP <test-jwt>" \

     

       282
       282
       -
            -H "DPoP: <test-dpop-proof>" \

     

       283
       283
       -
            -d '{"name":"Test","hostedByDid":"did:plc:test"}'

     

       284
       284
       -
          ```

     

       285
       285
       -
       

     

       286
       286
       -
       2. **Phase 2 (Full Verification)**:

     

       287
       287
       -
          ```bash

     

       288
       288
       -
          # Use a real JWT from a PDS

     

       289
       289
       -
          export AUTH_SKIP_VERIFY=false

     

       290
       290
       -
          curl -X POST http://localhost:8081/xrpc/social.coves.community.create \

     

       291
       291
       -
            -H "Authorization: DPoP <real-jwt>" \

     

       292
       292
       -
            -H "DPoP: <real-dpop-proof>" \

     

       293
       293
       -
            -d '{"name":"Test","hostedByDid":"did:plc:test"}'

     

       294
       294
       -
          ```

     

       295
       295
       -
       

     

       296
       296
       -
       ## Error Responses

     

       297
       297
       -
       

     

       298
       298
       -
       ### 401 Unauthorized

     

       299
       299
       -
       

     

       300
       300
       -
       Missing or invalid token:

     

       301
       301
       -
       

     

       302
       302
       -
       ```json

     

       303
       303
       -
       {

     

       304
       304
       -
         "error": "AuthenticationRequired",

     

       305
       305
       -
         "message": "Missing Authorization header"

     

       306
       306
       -
       }

     

       307
       307
       -
       ```

     

       308
       308
       -
       

     

       309
       309
       -
       ```json

     

       310
       310
       -
       {

     

       311
       311
       -
         "error": "AuthenticationRequired",

     

       312
       312
       -
         "message": "Invalid or expired token"

     

       313
       313
       -
       }

     

       314
       314
       -
       ```

     

       315
       315
       -
       

     

       316
       316
       -
       ### Common Issues

     

       317
       317
       -
       

     

       318
       318
       -
       1. **Missing Authorization header** → Add `Authorization: DPoP <token>` and `DPoP: <proof>`

     

       319
       319
       -
       2. **Token expired** → Get a new token from PDS

     

       320
       320
       -
       3. **Invalid signature** → Ensure token is from a valid PDS

     

       321
       321
       -
       4. **JWKS fetch fails** → Check PDS availability and network connectivity

     

       322
       322
       -
       

     

       323
       323
       -
       ## Future Enhancements

     

       324
       324
       -
       

     

       325
       325
       -
       - [ ] DPoP nonce validation (server-managed nonce for additional replay protection)

     

       326
       326
       -
       - [ ] Scope-based authorization

     

       327
       327
       -
       - [ ] Audience claim validation

     

       328
       328
       -
       - [ ] Token revocation support

     

       329
       329
       -
       - [ ] Rate limiting per DID

     

       330
       330
       -
       - [ ] Metrics and monitoring

-122

internal/atproto/auth/did_key_fetcher.go

···

       1
       1
       -
       package auth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"crypto/ecdsa"

     

       6
       6
       -
       	"crypto/elliptic"

     

       7
       7
       -
       	"encoding/base64"

     

       8
       8
       -
       	"fmt"

     

       9
       9
       -
       	"math/big"

     

       10
       10
       -
       	"strings"

     

       11
       11
       -
       

     

       12
       12
       -
       	indigoCrypto "github.com/bluesky-social/indigo/atproto/atcrypto"

     

       13
       13
       -
       	indigoIdentity "github.com/bluesky-social/indigo/atproto/identity"

     

       14
       14
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       15
       15
       -
       )

     

       16
       16
       -
       

     

       17
       17
       -
       // DIDKeyFetcher fetches public keys from DID documents for JWT verification.

     

       18
       18
       -
       // This is the primary method for atproto service authentication, where:

     

       19
       19
       -
       // - The JWT issuer is the user's DID (e.g., did:plc:abc123)

     

       20
       20
       -
       // - The signing key is published in the user's DID document

     

       21
       21
       -
       // - Verification happens by resolving the DID and checking the signature

     

       22
       22
       -
       type DIDKeyFetcher struct {

     

       23
       23
       -
       	directory indigoIdentity.Directory

     

       24
       24
       -
       }

     

       25
       25
       -
       

     

       26
       26
       -
       // NewDIDKeyFetcher creates a new DID-based key fetcher.

     

       27
       27
       -
       func NewDIDKeyFetcher(directory indigoIdentity.Directory) *DIDKeyFetcher {

     

       28
       28
       -
       	return &DIDKeyFetcher{

     

       29
       29
       -
       		directory: directory,

     

       30
       30
       -
       	}

     

       31
       31
       -
       }

     

       32
       32
       -
       

     

       33
       33
       -
       // FetchPublicKey fetches the public key for verifying a JWT from the issuer's DID document.

     

       34
       34
       -
       // For DID issuers (did:plc: or did:web:), resolves the DID and extracts the signing key.

     

       35
       35
       -
       //

     

       36
       36
       -
       // Returns:

     

       37
       37
       -
       //   - indigoCrypto.PublicKey for secp256k1 (ES256K) keys - use indigo for verification

     

       38
       38
       -
       //   - *ecdsa.PublicKey for NIST curves (P-256, P-384, P-521) - compatible with golang-jwt

     

       39
       39
       -
       func (f *DIDKeyFetcher) FetchPublicKey(ctx context.Context, issuer, token string) (interface{}, error) {

     

       40
       40
       -
       	// Only handle DID issuers

     

       41
       41
       -
       	if !strings.HasPrefix(issuer, "did:") {

     

       42
       42
       -
       		return nil, fmt.Errorf("DIDKeyFetcher only handles DID issuers, got: %s", issuer)

     

       43
       43
       -
       	}

     

       44
       44
       -
       

     

       45
       45
       -
       	// Parse the DID

     

       46
       46
       -
       	did, err := syntax.ParseDID(issuer)

     

       47
       47
       -
       	if err != nil {

     

       48
       48
       -
       		return nil, fmt.Errorf("invalid DID format: %w", err)

     

       49
       49
       -
       	}

     

       50
       50
       -
       

     

       51
       51
       -
       	// Resolve the DID to get the identity (includes public keys)

     

       52
       52
       -
       	ident, err := f.directory.LookupDID(ctx, did)

     

       53
       53
       -
       	if err != nil {

     

       54
       54
       -
       		return nil, fmt.Errorf("failed to resolve DID %s: %w", issuer, err)

     

       55
       55
       -
       	}

     

       56
       56
       -
       

     

       57
       57
       -
       	// Get the atproto signing key from the DID document

     

       58
       58
       -
       	pubKey, err := ident.PublicKey()

     

       59
       59
       -
       	if err != nil {

     

       60
       60
       -
       		return nil, fmt.Errorf("failed to get public key from DID document: %w", err)

     

       61
       61
       -
       	}

     

       62
       62
       -
       

     

       63
       63
       -
       	// Convert to JWK format to check curve type

     

       64
       64
       -
       	jwk, err := pubKey.JWK()

     

       65
       65
       -
       	if err != nil {

     

       66
       66
       -
       		return nil, fmt.Errorf("failed to convert public key to JWK: %w", err)

     

       67
       67
       -
       	}

     

       68
       68
       -
       

     

       69
       69
       -
       	// For secp256k1 (ES256K), return indigo's PublicKey directly

     

       70
       70
       -
       	// since Go's crypto/ecdsa doesn't support this curve

     

       71
       71
       -
       	if jwk.Curve == "secp256k1" {

     

       72
       72
       -
       		return pubKey, nil

     

       73
       73
       -
       	}

     

       74
       74
       -
       

     

       75
       75
       -
       	// For NIST curves, convert to Go's ecdsa.PublicKey for golang-jwt compatibility

     

       76
       76
       -
       	return atcryptoJWKToECDSA(jwk)

     

       77
       77
       -
       }

     

       78
       78
       -
       

     

       79
       79
       -
       // atcryptoJWKToECDSA converts an indigoCrypto.JWK to a Go ecdsa.PublicKey.

     

       80
       80
       -
       // Note: secp256k1 is handled separately in FetchPublicKey by returning indigo's PublicKey directly.

     

       81
       81
       -
       func atcryptoJWKToECDSA(jwk *indigoCrypto.JWK) (*ecdsa.PublicKey, error) {

     

       82
       82
       -
       	if jwk.KeyType != "EC" {

     

       83
       83
       -
       		return nil, fmt.Errorf("unsupported JWK key type: %s (expected EC)", jwk.KeyType)

     

       84
       84
       -
       	}

     

       85
       85
       -
       

     

       86
       86
       -
       	// Decode X and Y coordinates (base64url, no padding)

     

       87
       87
       -
       	xBytes, err := base64.RawURLEncoding.DecodeString(jwk.X)

     

       88
       88
       -
       	if err != nil {

     

       89
       89
       -
       		return nil, fmt.Errorf("invalid JWK X coordinate encoding: %w", err)

     

       90
       90
       -
       	}

     

       91
       91
       -
       	yBytes, err := base64.RawURLEncoding.DecodeString(jwk.Y)

     

       92
       92
       -
       	if err != nil {

     

       93
       93
       -
       		return nil, fmt.Errorf("invalid JWK Y coordinate encoding: %w", err)

     

       94
       94
       -
       	}

     

       95
       95
       -
       

     

       96
       96
       -
       	var ecCurve elliptic.Curve

     

       97
       97
       -
       	switch jwk.Curve {

     

       98
       98
       -
       	case "P-256":

     

       99
       99
       -
       		ecCurve = elliptic.P256()

     

       100
       100
       -
       	case "P-384":

     

       101
       101
       -
       		ecCurve = elliptic.P384()

     

       102
       102
       -
       	case "P-521":

     

       103
       103
       -
       		ecCurve = elliptic.P521()

     

       104
       104
       -
       	default:

     

       105
       105
       -
       		// secp256k1 should be handled before calling this function

     

       106
       106
       -
       		return nil, fmt.Errorf("unsupported JWK curve for Go ecdsa: %s (secp256k1 uses indigo)", jwk.Curve)

     

       107
       107
       -
       	}

     

       108
       108
       -
       

     

       109
       109
       -
       	// Create the public key

     

       110
       110
       -
       	pubKey := &ecdsa.PublicKey{

     

       111
       111
       -
       		Curve: ecCurve,

     

       112
       112
       -
       		X:     new(big.Int).SetBytes(xBytes),

     

       113
       113
       -
       		Y:     new(big.Int).SetBytes(yBytes),

     

       114
       114
       -
       	}

     

       115
       115
       -
       

     

       116
       116
       -
       	// Validate point is on curve

     

       117
       117
       -
       	if !ecCurve.IsOnCurve(pubKey.X, pubKey.Y) {

     

       118
       118
       -
       		return nil, fmt.Errorf("invalid public key: point not on curve")

     

       119
       119
       -
       	}

     

       120
       120
       -
       

     

       121
       121
       -
       	return pubKey, nil

     

       122
       122
       -
       }

-1308

internal/atproto/auth/dpop_test.go

···

       1
       1
       -
       package auth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"crypto/ecdsa"

     

       5
       5
       -
       	"crypto/elliptic"

     

       6
       6
       -
       	"crypto/rand"

     

       7
       7
       -
       	"crypto/sha256"

     

       8
       8
       -
       	"encoding/base64"

     

       9
       9
       -
       	"encoding/json"

     

       10
       10
       -
       	"strings"

     

       11
       11
       -
       	"testing"

     

       12
       12
       -
       	"time"

     

       13
       13
       -
       

     

       14
       14
       -
       	indigoCrypto "github.com/bluesky-social/indigo/atproto/atcrypto"

     

       15
       15
       -
       	"github.com/golang-jwt/jwt/v5"

     

       16
       16
       -
       	"github.com/google/uuid"

     

       17
       17
       -
       )

     

       18
       18
       -
       

     

       19
       19
       -
       // === Test Helpers ===

     

       20
       20
       -
       

     

       21
       21
       -
       // testECKey holds a test ES256 key pair

     

       22
       22
       -
       type testECKey struct {

     

       23
       23
       -
       	privateKey *ecdsa.PrivateKey

     

       24
       24
       -
       	publicKey  *ecdsa.PublicKey

     

       25
       25
       -
       	jwk        map[string]interface{}

     

       26
       26
       -
       	thumbprint string

     

       27
       27
       -
       }

     

       28
       28
       -
       

     

       29
       29
       -
       // generateTestES256Key generates a test ES256 key pair and JWK

     

       30
       30
       -
       func generateTestES256Key(t *testing.T) *testECKey {

     

       31
       31
       -
       	t.Helper()

     

       32
       32
       -
       

     

       33
       33
       -
       	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

     

       34
       34
       -
       	if err != nil {

     

       35
       35
       -
       		t.Fatalf("Failed to generate test key: %v", err)

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	// Encode public key coordinates as base64url

     

       39
       39
       -
       	xBytes := privateKey.PublicKey.X.Bytes()

     

       40
       40
       -
       	yBytes := privateKey.PublicKey.Y.Bytes()

     

       41
       41
       -
       

     

       42
       42
       -
       	// P-256 coordinates must be 32 bytes (pad if needed)

     

       43
       43
       -
       	xBytes = padTo32Bytes(xBytes)

     

       44
       44
       -
       	yBytes = padTo32Bytes(yBytes)

     

       45
       45
       -
       

     

       46
       46
       -
       	x := base64.RawURLEncoding.EncodeToString(xBytes)

     

       47
       47
       -
       	y := base64.RawURLEncoding.EncodeToString(yBytes)

     

       48
       48
       -
       

     

       49
       49
       -
       	jwk := map[string]interface{}{

     

       50
       50
       -
       		"kty": "EC",

     

       51
       51
       -
       		"crv": "P-256",

     

       52
       52
       -
       		"x":   x,

     

       53
       53
       -
       		"y":   y,

     

       54
       54
       -
       	}

     

       55
       55
       -
       

     

       56
       56
       -
       	// Calculate thumbprint

     

       57
       57
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       58
       58
       -
       	if err != nil {

     

       59
       59
       -
       		t.Fatalf("Failed to calculate thumbprint: %v", err)

     

       60
       60
       -
       	}

     

       61
       61
       -
       

     

       62
       62
       -
       	return &testECKey{

     

       63
       63
       -
       		privateKey: privateKey,

     

       64
       64
       -
       		publicKey:  &privateKey.PublicKey,

     

       65
       65
       -
       		jwk:        jwk,

     

       66
       66
       -
       		thumbprint: thumbprint,

     

       67
       67
       -
       	}

     

       68
       68
       -
       }

     

       69
       69
       -
       

     

       70
       70
       -
       // padTo32Bytes pads a byte slice to 32 bytes (required for P-256 coordinates)

     

       71
       71
       -
       func padTo32Bytes(b []byte) []byte {

     

       72
       72
       -
       	if len(b) >= 32 {

     

       73
       73
       -
       		return b

     

       74
       74
       -
       	}

     

       75
       75
       -
       	padded := make([]byte, 32)

     

       76
       76
       -
       	copy(padded[32-len(b):], b)

     

       77
       77
       -
       	return padded

     

       78
       78
       -
       }

     

       79
       79
       -
       

     

       80
       80
       -
       // createDPoPProof creates a DPoP proof JWT for testing

     

       81
       81
       -
       func createDPoPProof(t *testing.T, key *testECKey, method, uri string, iat time.Time, jti string) string {

     

       82
       82
       -
       	t.Helper()

     

       83
       83
       -
       

     

       84
       84
       -
       	claims := &DPoPClaims{

     

       85
       85
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       86
       86
       -
       			ID:       jti,

     

       87
       87
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       88
       88
       -
       		},

     

       89
       89
       -
       		HTTPMethod: method,

     

       90
       90
       -
       		HTTPURI:    uri,

     

       91
       91
       -
       	}

     

       92
       92
       -
       

     

       93
       93
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       94
       94
       -
       	token.Header["typ"] = "dpop+jwt"

     

       95
       95
       -
       	token.Header["jwk"] = key.jwk

     

       96
       96
       -
       

     

       97
       97
       -
       	tokenString, err := token.SignedString(key.privateKey)

     

       98
       98
       -
       	if err != nil {

     

       99
       99
       -
       		t.Fatalf("Failed to create DPoP proof: %v", err)

     

       100
       100
       -
       	}

     

       101
       101
       -
       

     

       102
       102
       -
       	return tokenString

     

       103
       103
       -
       }

     

       104
       104
       -
       

     

       105
       105
       -
       // === JWK Thumbprint Tests (RFC 7638) ===

     

       106
       106
       -
       

     

       107
       107
       -
       func TestCalculateJWKThumbprint_EC_P256(t *testing.T) {

     

       108
       108
       -
       	// Test with known values from RFC 7638 Appendix A (adapted for P-256)

     

       109
       109
       -
       	jwk := map[string]interface{}{

     

       110
       110
       -
       		"kty": "EC",

     

       111
       111
       -
       		"crv": "P-256",

     

       112
       112
       -
       		"x":   "WKn-ZIGevcwGIyyrzFoZNBdaq9_TsqzGl96oc0CWuis",

     

       113
       113
       -
       		"y":   "y77t-RvAHRKTsSGdIYUfweuOvwrvDD-Q3Hv5J0fSKbE",

     

       114
       114
       -
       	}

     

       115
       115
       -
       

     

       116
       116
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       117
       117
       -
       	if err != nil {

     

       118
       118
       -
       		t.Fatalf("CalculateJWKThumbprint failed: %v", err)

     

       119
       119
       -
       	}

     

       120
       120
       -
       

     

       121
       121
       -
       	if thumbprint == "" {

     

       122
       122
       -
       		t.Error("Expected non-empty thumbprint")

     

       123
       123
       -
       	}

     

       124
       124
       -
       

     

       125
       125
       -
       	// Verify it's valid base64url

     

       126
       126
       -
       	_, err = base64.RawURLEncoding.DecodeString(thumbprint)

     

       127
       127
       -
       	if err != nil {

     

       128
       128
       -
       		t.Errorf("Thumbprint is not valid base64url: %v", err)

     

       129
       129
       -
       	}

     

       130
       130
       -
       

     

       131
       131
       -
       	// Verify length (SHA-256 produces 32 bytes = 43 base64url chars)

     

       132
       132
       -
       	if len(thumbprint) != 43 {

     

       133
       133
       -
       		t.Errorf("Expected thumbprint length 43, got %d", len(thumbprint))

     

       134
       134
       -
       	}

     

       135
       135
       -
       }

     

       136
       136
       -
       

     

       137
       137
       -
       func TestCalculateJWKThumbprint_Deterministic(t *testing.T) {

     

       138
       138
       -
       	// Same key should produce same thumbprint

     

       139
       139
       -
       	jwk := map[string]interface{}{

     

       140
       140
       -
       		"kty": "EC",

     

       141
       141
       -
       		"crv": "P-256",

     

       142
       142
       -
       		"x":   "test-x-coordinate",

     

       143
       143
       -
       		"y":   "test-y-coordinate",

     

       144
       144
       -
       	}

     

       145
       145
       -
       

     

       146
       146
       -
       	thumbprint1, err := CalculateJWKThumbprint(jwk)

     

       147
       147
       -
       	if err != nil {

     

       148
       148
       -
       		t.Fatalf("First CalculateJWKThumbprint failed: %v", err)

     

       149
       149
       -
       	}

     

       150
       150
       -
       

     

       151
       151
       -
       	thumbprint2, err := CalculateJWKThumbprint(jwk)

     

       152
       152
       -
       	if err != nil {

     

       153
       153
       -
       		t.Fatalf("Second CalculateJWKThumbprint failed: %v", err)

     

       154
       154
       -
       	}

     

       155
       155
       -
       

     

       156
       156
       -
       	if thumbprint1 != thumbprint2 {

     

       157
       157
       -
       		t.Errorf("Thumbprints are not deterministic: %s != %s", thumbprint1, thumbprint2)

     

       158
       158
       -
       	}

     

       159
       159
       -
       }

     

       160
       160
       -
       

     

       161
       161
       -
       func TestCalculateJWKThumbprint_DifferentKeys(t *testing.T) {

     

       162
       162
       -
       	// Different keys should produce different thumbprints

     

       163
       163
       -
       	jwk1 := map[string]interface{}{

     

       164
       164
       -
       		"kty": "EC",

     

       165
       165
       -
       		"crv": "P-256",

     

       166
       166
       -
       		"x":   "coordinate-x-1",

     

       167
       167
       -
       		"y":   "coordinate-y-1",

     

       168
       168
       -
       	}

     

       169
       169
       -
       

     

       170
       170
       -
       	jwk2 := map[string]interface{}{

     

       171
       171
       -
       		"kty": "EC",

     

       172
       172
       -
       		"crv": "P-256",

     

       173
       173
       -
       		"x":   "coordinate-x-2",

     

       174
       174
       -
       		"y":   "coordinate-y-2",

     

       175
       175
       -
       	}

     

       176
       176
       -
       

     

       177
       177
       -
       	thumbprint1, err := CalculateJWKThumbprint(jwk1)

     

       178
       178
       -
       	if err != nil {

     

       179
       179
       -
       		t.Fatalf("First CalculateJWKThumbprint failed: %v", err)

     

       180
       180
       -
       	}

     

       181
       181
       -
       

     

       182
       182
       -
       	thumbprint2, err := CalculateJWKThumbprint(jwk2)

     

       183
       183
       -
       	if err != nil {

     

       184
       184
       -
       		t.Fatalf("Second CalculateJWKThumbprint failed: %v", err)

     

       185
       185
       -
       	}

     

       186
       186
       -
       

     

       187
       187
       -
       	if thumbprint1 == thumbprint2 {

     

       188
       188
       -
       		t.Error("Different keys produced same thumbprint (collision)")

     

       189
       189
       -
       	}

     

       190
       190
       -
       }

     

       191
       191
       -
       

     

       192
       192
       -
       func TestCalculateJWKThumbprint_MissingKty(t *testing.T) {

     

       193
       193
       -
       	jwk := map[string]interface{}{

     

       194
       194
       -
       		"crv": "P-256",

     

       195
       195
       -
       		"x":   "test-x",

     

       196
       196
       -
       		"y":   "test-y",

     

       197
       197
       -
       	}

     

       198
       198
       -
       

     

       199
       199
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       200
       200
       -
       	if err == nil {

     

       201
       201
       -
       		t.Error("Expected error for missing kty, got nil")

     

       202
       202
       -
       	}

     

       203
       203
       -
       	if err != nil && !contains(err.Error(), "missing kty") {

     

       204
       204
       -
       		t.Errorf("Expected error about missing kty, got: %v", err)

     

       205
       205
       -
       	}

     

       206
       206
       -
       }

     

       207
       207
       -
       

     

       208
       208
       -
       func TestCalculateJWKThumbprint_EC_MissingCrv(t *testing.T) {

     

       209
       209
       -
       	jwk := map[string]interface{}{

     

       210
       210
       -
       		"kty": "EC",

     

       211
       211
       -
       		"x":   "test-x",

     

       212
       212
       -
       		"y":   "test-y",

     

       213
       213
       -
       	}

     

       214
       214
       -
       

     

       215
       215
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       216
       216
       -
       	if err == nil {

     

       217
       217
       -
       		t.Error("Expected error for missing crv, got nil")

     

       218
       218
       -
       	}

     

       219
       219
       -
       	if err != nil && !contains(err.Error(), "missing crv") {

     

       220
       220
       -
       		t.Errorf("Expected error about missing crv, got: %v", err)

     

       221
       221
       -
       	}

     

       222
       222
       -
       }

     

       223
       223
       -
       

     

       224
       224
       -
       func TestCalculateJWKThumbprint_EC_MissingX(t *testing.T) {

     

       225
       225
       -
       	jwk := map[string]interface{}{

     

       226
       226
       -
       		"kty": "EC",

     

       227
       227
       -
       		"crv": "P-256",

     

       228
       228
       -
       		"y":   "test-y",

     

       229
       229
       -
       	}

     

       230
       230
       -
       

     

       231
       231
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       232
       232
       -
       	if err == nil {

     

       233
       233
       -
       		t.Error("Expected error for missing x, got nil")

     

       234
       234
       -
       	}

     

       235
       235
       -
       	if err != nil && !contains(err.Error(), "missing x") {

     

       236
       236
       -
       		t.Errorf("Expected error about missing x, got: %v", err)

     

       237
       237
       -
       	}

     

       238
       238
       -
       }

     

       239
       239
       -
       

     

       240
       240
       -
       func TestCalculateJWKThumbprint_EC_MissingY(t *testing.T) {

     

       241
       241
       -
       	jwk := map[string]interface{}{

     

       242
       242
       -
       		"kty": "EC",

     

       243
       243
       -
       		"crv": "P-256",

     

       244
       244
       -
       		"x":   "test-x",

     

       245
       245
       -
       	}

     

       246
       246
       -
       

     

       247
       247
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       248
       248
       -
       	if err == nil {

     

       249
       249
       -
       		t.Error("Expected error for missing y, got nil")

     

       250
       250
       -
       	}

     

       251
       251
       -
       	if err != nil && !contains(err.Error(), "missing y") {

     

       252
       252
       -
       		t.Errorf("Expected error about missing y, got: %v", err)

     

       253
       253
       -
       	}

     

       254
       254
       -
       }

     

       255
       255
       -
       

     

       256
       256
       -
       func TestCalculateJWKThumbprint_RSA(t *testing.T) {

     

       257
       257
       -
       	// Test RSA key thumbprint calculation

     

       258
       258
       -
       	jwk := map[string]interface{}{

     

       259
       259
       -
       		"kty": "RSA",

     

       260
       260
       -
       		"e":   "AQAB",

     

       261
       261
       -
       		"n":   "test-modulus",

     

       262
       262
       -
       	}

     

       263
       263
       -
       

     

       264
       264
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       265
       265
       -
       	if err != nil {

     

       266
       266
       -
       		t.Fatalf("CalculateJWKThumbprint failed for RSA: %v", err)

     

       267
       267
       -
       	}

     

       268
       268
       -
       

     

       269
       269
       -
       	if thumbprint == "" {

     

       270
       270
       -
       		t.Error("Expected non-empty thumbprint for RSA key")

     

       271
       271
       -
       	}

     

       272
       272
       -
       }

     

       273
       273
       -
       

     

       274
       274
       -
       func TestCalculateJWKThumbprint_OKP(t *testing.T) {

     

       275
       275
       -
       	// Test OKP (Octet Key Pair) thumbprint calculation

     

       276
       276
       -
       	jwk := map[string]interface{}{

     

       277
       277
       -
       		"kty": "OKP",

     

       278
       278
       -
       		"crv": "Ed25519",

     

       279
       279
       -
       		"x":   "test-x-coordinate",

     

       280
       280
       -
       	}

     

       281
       281
       -
       

     

       282
       282
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       283
       283
       -
       	if err != nil {

     

       284
       284
       -
       		t.Fatalf("CalculateJWKThumbprint failed for OKP: %v", err)

     

       285
       285
       -
       	}

     

       286
       286
       -
       

     

       287
       287
       -
       	if thumbprint == "" {

     

       288
       288
       -
       		t.Error("Expected non-empty thumbprint for OKP key")

     

       289
       289
       -
       	}

     

       290
       290
       -
       }

     

       291
       291
       -
       

     

       292
       292
       -
       func TestCalculateJWKThumbprint_UnsupportedKeyType(t *testing.T) {

     

       293
       293
       -
       	jwk := map[string]interface{}{

     

       294
       294
       -
       		"kty": "UNKNOWN",

     

       295
       295
       -
       	}

     

       296
       296
       -
       

     

       297
       297
       -
       	_, err := CalculateJWKThumbprint(jwk)

     

       298
       298
       -
       	if err == nil {

     

       299
       299
       -
       		t.Error("Expected error for unsupported key type, got nil")

     

       300
       300
       -
       	}

     

       301
       301
       -
       	if err != nil && !contains(err.Error(), "unsupported JWK key type") {

     

       302
       302
       -
       		t.Errorf("Expected error about unsupported key type, got: %v", err)

     

       303
       303
       -
       	}

     

       304
       304
       -
       }

     

       305
       305
       -
       

     

       306
       306
       -
       func TestCalculateJWKThumbprint_CanonicalJSON(t *testing.T) {

     

       307
       307
       -
       	// RFC 7638 requires lexicographic ordering of keys in canonical JSON

     

       308
       308
       -
       	// This test verifies that the canonical JSON is correctly ordered

     

       309
       309
       -
       

     

       310
       310
       -
       	jwk := map[string]interface{}{

     

       311
       311
       -
       		"kty": "EC",

     

       312
       312
       -
       		"crv": "P-256",

     

       313
       313
       -
       		"x":   "x-coord",

     

       314
       314
       -
       		"y":   "y-coord",

     

       315
       315
       -
       	}

     

       316
       316
       -
       

     

       317
       317
       -
       	// The canonical JSON should be: {"crv":"P-256","kty":"EC","x":"x-coord","y":"y-coord"}

     

       318
       318
       -
       	// (lexicographically ordered: crv, kty, x, y)

     

       319
       319
       -
       

     

       320
       320
       -
       	canonical := map[string]string{

     

       321
       321
       -
       		"crv": "P-256",

     

       322
       322
       -
       		"kty": "EC",

     

       323
       323
       -
       		"x":   "x-coord",

     

       324
       324
       -
       		"y":   "y-coord",

     

       325
       325
       -
       	}

     

       326
       326
       -
       

     

       327
       327
       -
       	canonicalJSON, err := json.Marshal(canonical)

     

       328
       328
       -
       	if err != nil {

     

       329
       329
       -
       		t.Fatalf("Failed to marshal canonical JSON: %v", err)

     

       330
       330
       -
       	}

     

       331
       331
       -
       

     

       332
       332
       -
       	expectedHash := sha256.Sum256(canonicalJSON)

     

       333
       333
       -
       	expectedThumbprint := base64.RawURLEncoding.EncodeToString(expectedHash[:])

     

       334
       334
       -
       

     

       335
       335
       -
       	actualThumbprint, err := CalculateJWKThumbprint(jwk)

     

       336
       336
       -
       	if err != nil {

     

       337
       337
       -
       		t.Fatalf("CalculateJWKThumbprint failed: %v", err)

     

       338
       338
       -
       	}

     

       339
       339
       -
       

     

       340
       340
       -
       	if actualThumbprint != expectedThumbprint {

     

       341
       341
       -
       		t.Errorf("Thumbprint doesn't match expected canonical JSON hash\nExpected: %s\nGot: %s",

     

       342
       342
       -
       			expectedThumbprint, actualThumbprint)

     

       343
       343
       -
       	}

     

       344
       344
       -
       }

     

       345
       345
       -
       

     

       346
       346
       -
       // === DPoP Proof Verification Tests ===

     

       347
       347
       -
       

     

       348
       348
       -
       func TestVerifyDPoPProof_Valid(t *testing.T) {

     

       349
       349
       -
       	verifier := NewDPoPVerifier()

     

       350
       350
       -
       	key := generateTestES256Key(t)

     

       351
       351
       -
       

     

       352
       352
       -
       	method := "POST"

     

       353
       353
       -
       	uri := "https://api.example.com/resource"

     

       354
       354
       -
       	iat := time.Now()

     

       355
       355
       -
       	jti := uuid.New().String()

     

       356
       356
       -
       

     

       357
       357
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       358
       358
       -
       

     

       359
       359
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       360
       360
       -
       	if err != nil {

     

       361
       361
       -
       		t.Fatalf("VerifyDPoPProof failed for valid proof: %v", err)

     

       362
       362
       -
       	}

     

       363
       363
       -
       

     

       364
       364
       -
       	if result == nil {

     

       365
       365
       -
       		t.Fatal("Expected non-nil proof result")

     

       366
       366
       -
       	}

     

       367
       367
       -
       

     

       368
       368
       -
       	if result.Claims.HTTPMethod != method {

     

       369
       369
       -
       		t.Errorf("Expected method %s, got %s", method, result.Claims.HTTPMethod)

     

       370
       370
       -
       	}

     

       371
       371
       -
       

     

       372
       372
       -
       	if result.Claims.HTTPURI != uri {

     

       373
       373
       -
       		t.Errorf("Expected URI %s, got %s", uri, result.Claims.HTTPURI)

     

       374
       374
       -
       	}

     

       375
       375
       -
       

     

       376
       376
       -
       	if result.Claims.ID != jti {

     

       377
       377
       -
       		t.Errorf("Expected jti %s, got %s", jti, result.Claims.ID)

     

       378
       378
       -
       	}

     

       379
       379
       -
       

     

       380
       380
       -
       	if result.Thumbprint != key.thumbprint {

     

       381
       381
       -
       		t.Errorf("Expected thumbprint %s, got %s", key.thumbprint, result.Thumbprint)

     

       382
       382
       -
       	}

     

       383
       383
       -
       }

     

       384
       384
       -
       

     

       385
       385
       -
       func TestVerifyDPoPProof_InvalidSignature(t *testing.T) {

     

       386
       386
       -
       	verifier := NewDPoPVerifier()

     

       387
       387
       -
       	key := generateTestES256Key(t)

     

       388
       388
       -
       	wrongKey := generateTestES256Key(t)

     

       389
       389
       -
       

     

       390
       390
       -
       	method := "POST"

     

       391
       391
       -
       	uri := "https://api.example.com/resource"

     

       392
       392
       -
       	iat := time.Now()

     

       393
       393
       -
       	jti := uuid.New().String()

     

       394
       394
       -
       

     

       395
       395
       -
       	// Create proof with one key

     

       396
       396
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       397
       397
       -
       

     

       398
       398
       -
       	// Parse and modify to use wrong key's JWK in header (signature won't match)

     

       399
       399
       -
       	parts := splitJWT(proof)

     

       400
       400
       -
       	header := parseJWTHeader(t, parts[0])

     

       401
       401
       -
       	header["jwk"] = wrongKey.jwk

     

       402
       402
       -
       	modifiedHeader := encodeJSON(t, header)

     

       403
       403
       -
       	tamperedProof := modifiedHeader + "." + parts[1] + "." + parts[2]

     

       404
       404
       -
       

     

       405
       405
       -
       	_, err := verifier.VerifyDPoPProof(tamperedProof, method, uri)

     

       406
       406
       -
       	if err == nil {

     

       407
       407
       -
       		t.Error("Expected error for invalid signature, got nil")

     

       408
       408
       -
       	}

     

       409
       409
       -
       	if err != nil && !contains(err.Error(), "signature verification failed") {

     

       410
       410
       -
       		t.Errorf("Expected signature verification error, got: %v", err)

     

       411
       411
       -
       	}

     

       412
       412
       -
       }

     

       413
       413
       -
       

     

       414
       414
       -
       func TestVerifyDPoPProof_WrongHTTPMethod(t *testing.T) {

     

       415
       415
       -
       	verifier := NewDPoPVerifier()

     

       416
       416
       -
       	key := generateTestES256Key(t)

     

       417
       417
       -
       

     

       418
       418
       -
       	method := "POST"

     

       419
       419
       -
       	wrongMethod := "GET"

     

       420
       420
       -
       	uri := "https://api.example.com/resource"

     

       421
       421
       -
       	iat := time.Now()

     

       422
       422
       -
       	jti := uuid.New().String()

     

       423
       423
       -
       

     

       424
       424
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       425
       425
       -
       

     

       426
       426
       -
       	_, err := verifier.VerifyDPoPProof(proof, wrongMethod, uri)

     

       427
       427
       -
       	if err == nil {

     

       428
       428
       -
       		t.Error("Expected error for HTTP method mismatch, got nil")

     

       429
       429
       -
       	}

     

       430
       430
       -
       	if err != nil && !contains(err.Error(), "htm mismatch") {

     

       431
       431
       -
       		t.Errorf("Expected htm mismatch error, got: %v", err)

     

       432
       432
       -
       	}

     

       433
       433
       -
       }

     

       434
       434
       -
       

     

       435
       435
       -
       func TestVerifyDPoPProof_WrongURI(t *testing.T) {

     

       436
       436
       -
       	verifier := NewDPoPVerifier()

     

       437
       437
       -
       	key := generateTestES256Key(t)

     

       438
       438
       -
       

     

       439
       439
       -
       	method := "POST"

     

       440
       440
       -
       	uri := "https://api.example.com/resource"

     

       441
       441
       -
       	wrongURI := "https://api.example.com/different"

     

       442
       442
       -
       	iat := time.Now()

     

       443
       443
       -
       	jti := uuid.New().String()

     

       444
       444
       -
       

     

       445
       445
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       446
       446
       -
       

     

       447
       447
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, wrongURI)

     

       448
       448
       -
       	if err == nil {

     

       449
       449
       -
       		t.Error("Expected error for URI mismatch, got nil")

     

       450
       450
       -
       	}

     

       451
       451
       -
       	if err != nil && !contains(err.Error(), "htu mismatch") {

     

       452
       452
       -
       		t.Errorf("Expected htu mismatch error, got: %v", err)

     

       453
       453
       -
       	}

     

       454
       454
       -
       }

     

       455
       455
       -
       

     

       456
       456
       -
       func TestVerifyDPoPProof_URIWithQuery(t *testing.T) {

     

       457
       457
       -
       	// URI comparison should strip query and fragment

     

       458
       458
       -
       	verifier := NewDPoPVerifier()

     

       459
       459
       -
       	key := generateTestES256Key(t)

     

       460
       460
       -
       

     

       461
       461
       -
       	method := "POST"

     

       462
       462
       -
       	baseURI := "https://api.example.com/resource"

     

       463
       463
       -
       	uriWithQuery := baseURI + "?param=value"

     

       464
       464
       -
       	iat := time.Now()

     

       465
       465
       -
       	jti := uuid.New().String()

     

       466
       466
       -
       

     

       467
       467
       -
       	proof := createDPoPProof(t, key, method, baseURI, iat, jti)

     

       468
       468
       -
       

     

       469
       469
       -
       	// Should succeed because query is stripped

     

       470
       470
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uriWithQuery)

     

       471
       471
       -
       	if err != nil {

     

       472
       472
       -
       		t.Fatalf("VerifyDPoPProof failed for URI with query: %v", err)

     

       473
       473
       -
       	}

     

       474
       474
       -
       }

     

       475
       475
       -
       

     

       476
       476
       -
       func TestVerifyDPoPProof_URIWithFragment(t *testing.T) {

     

       477
       477
       -
       	// URI comparison should strip query and fragment

     

       478
       478
       -
       	verifier := NewDPoPVerifier()

     

       479
       479
       -
       	key := generateTestES256Key(t)

     

       480
       480
       -
       

     

       481
       481
       -
       	method := "POST"

     

       482
       482
       -
       	baseURI := "https://api.example.com/resource"

     

       483
       483
       -
       	uriWithFragment := baseURI + "#section"

     

       484
       484
       -
       	iat := time.Now()

     

       485
       485
       -
       	jti := uuid.New().String()

     

       486
       486
       -
       

     

       487
       487
       -
       	proof := createDPoPProof(t, key, method, baseURI, iat, jti)

     

       488
       488
       -
       

     

       489
       489
       -
       	// Should succeed because fragment is stripped

     

       490
       490
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uriWithFragment)

     

       491
       491
       -
       	if err != nil {

     

       492
       492
       -
       		t.Fatalf("VerifyDPoPProof failed for URI with fragment: %v", err)

     

       493
       493
       -
       	}

     

       494
       494
       -
       }

     

       495
       495
       -
       

     

       496
       496
       -
       func TestVerifyDPoPProof_ExpiredProof(t *testing.T) {

     

       497
       497
       -
       	verifier := NewDPoPVerifier()

     

       498
       498
       -
       	key := generateTestES256Key(t)

     

       499
       499
       -
       

     

       500
       500
       -
       	method := "POST"

     

       501
       501
       -
       	uri := "https://api.example.com/resource"

     

       502
       502
       -
       	// Proof issued 10 minutes ago (exceeds default MaxProofAge of 5 minutes)

     

       503
       503
       -
       	iat := time.Now().Add(-10 * time.Minute)

     

       504
       504
       -
       	jti := uuid.New().String()

     

       505
       505
       -
       

     

       506
       506
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       507
       507
       -
       

     

       508
       508
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       509
       509
       -
       	if err == nil {

     

       510
       510
       -
       		t.Error("Expected error for expired proof, got nil")

     

       511
       511
       -
       	}

     

       512
       512
       -
       	if err != nil && !contains(err.Error(), "too old") {

     

       513
       513
       -
       		t.Errorf("Expected 'too old' error, got: %v", err)

     

       514
       514
       -
       	}

     

       515
       515
       -
       }

     

       516
       516
       -
       

     

       517
       517
       -
       func TestVerifyDPoPProof_FutureProof(t *testing.T) {

     

       518
       518
       -
       	verifier := NewDPoPVerifier()

     

       519
       519
       -
       	key := generateTestES256Key(t)

     

       520
       520
       -
       

     

       521
       521
       -
       	method := "POST"

     

       522
       522
       -
       	uri := "https://api.example.com/resource"

     

       523
       523
       -
       	// Proof issued 1 minute in the future (exceeds MaxClockSkew)

     

       524
       524
       -
       	iat := time.Now().Add(1 * time.Minute)

     

       525
       525
       -
       	jti := uuid.New().String()

     

       526
       526
       -
       

     

       527
       527
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       528
       528
       -
       

     

       529
       529
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       530
       530
       -
       	if err == nil {

     

       531
       531
       -
       		t.Error("Expected error for future proof, got nil")

     

       532
       532
       -
       	}

     

       533
       533
       -
       	if err != nil && !contains(err.Error(), "in the future") {

     

       534
       534
       -
       		t.Errorf("Expected 'in the future' error, got: %v", err)

     

       535
       535
       -
       	}

     

       536
       536
       -
       }

     

       537
       537
       -
       

     

       538
       538
       -
       func TestVerifyDPoPProof_WithinClockSkew(t *testing.T) {

     

       539
       539
       -
       	verifier := NewDPoPVerifier()

     

       540
       540
       -
       	key := generateTestES256Key(t)

     

       541
       541
       -
       

     

       542
       542
       -
       	method := "POST"

     

       543
       543
       -
       	uri := "https://api.example.com/resource"

     

       544
       544
       -
       	// Proof issued 15 seconds in the future (within MaxClockSkew of 30s)

     

       545
       545
       -
       	iat := time.Now().Add(15 * time.Second)

     

       546
       546
       -
       	jti := uuid.New().String()

     

       547
       547
       -
       

     

       548
       548
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       549
       549
       -
       

     

       550
       550
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       551
       551
       -
       	if err != nil {

     

       552
       552
       -
       		t.Fatalf("VerifyDPoPProof failed for proof within clock skew: %v", err)

     

       553
       553
       -
       	}

     

       554
       554
       -
       }

     

       555
       555
       -
       

     

       556
       556
       -
       func TestVerifyDPoPProof_MissingJti(t *testing.T) {

     

       557
       557
       -
       	verifier := NewDPoPVerifier()

     

       558
       558
       -
       	key := generateTestES256Key(t)

     

       559
       559
       -
       

     

       560
       560
       -
       	method := "POST"

     

       561
       561
       -
       	uri := "https://api.example.com/resource"

     

       562
       562
       -
       	iat := time.Now()

     

       563
       563
       -
       

     

       564
       564
       -
       	claims := &DPoPClaims{

     

       565
       565
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       566
       566
       -
       			// No ID (jti)

     

       567
       567
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       568
       568
       -
       		},

     

       569
       569
       -
       		HTTPMethod: method,

     

       570
       570
       -
       		HTTPURI:    uri,

     

       571
       571
       -
       	}

     

       572
       572
       -
       

     

       573
       573
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       574
       574
       -
       	token.Header["typ"] = "dpop+jwt"

     

       575
       575
       -
       	token.Header["jwk"] = key.jwk

     

       576
       576
       -
       

     

       577
       577
       -
       	proof, err := token.SignedString(key.privateKey)

     

       578
       578
       -
       	if err != nil {

     

       579
       579
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       580
       580
       -
       	}

     

       581
       581
       -
       

     

       582
       582
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       583
       583
       -
       	if err == nil {

     

       584
       584
       -
       		t.Error("Expected error for missing jti, got nil")

     

       585
       585
       -
       	}

     

       586
       586
       -
       	if err != nil && !contains(err.Error(), "missing jti") {

     

       587
       587
       -
       		t.Errorf("Expected missing jti error, got: %v", err)

     

       588
       588
       -
       	}

     

       589
       589
       -
       }

     

       590
       590
       -
       

     

       591
       591
       -
       func TestVerifyDPoPProof_MissingTypHeader(t *testing.T) {

     

       592
       592
       -
       	verifier := NewDPoPVerifier()

     

       593
       593
       -
       	key := generateTestES256Key(t)

     

       594
       594
       -
       

     

       595
       595
       -
       	method := "POST"

     

       596
       596
       -
       	uri := "https://api.example.com/resource"

     

       597
       597
       -
       	iat := time.Now()

     

       598
       598
       -
       	jti := uuid.New().String()

     

       599
       599
       -
       

     

       600
       600
       -
       	claims := &DPoPClaims{

     

       601
       601
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       602
       602
       -
       			ID:       jti,

     

       603
       603
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       604
       604
       -
       		},

     

       605
       605
       -
       		HTTPMethod: method,

     

       606
       606
       -
       		HTTPURI:    uri,

     

       607
       607
       -
       	}

     

       608
       608
       -
       

     

       609
       609
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       610
       610
       -
       	// Don't set typ header

     

       611
       611
       -
       	token.Header["jwk"] = key.jwk

     

       612
       612
       -
       

     

       613
       613
       -
       	proof, err := token.SignedString(key.privateKey)

     

       614
       614
       -
       	if err != nil {

     

       615
       615
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       616
       616
       -
       	}

     

       617
       617
       -
       

     

       618
       618
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       619
       619
       -
       	if err == nil {

     

       620
       620
       -
       		t.Error("Expected error for missing typ header, got nil")

     

       621
       621
       -
       	}

     

       622
       622
       -
       	if err != nil && !contains(err.Error(), "typ must be 'dpop+jwt'") {

     

       623
       623
       -
       		t.Errorf("Expected typ header error, got: %v", err)

     

       624
       624
       -
       	}

     

       625
       625
       -
       }

     

       626
       626
       -
       

     

       627
       627
       -
       func TestVerifyDPoPProof_WrongTypHeader(t *testing.T) {

     

       628
       628
       -
       	verifier := NewDPoPVerifier()

     

       629
       629
       -
       	key := generateTestES256Key(t)

     

       630
       630
       -
       

     

       631
       631
       -
       	method := "POST"

     

       632
       632
       -
       	uri := "https://api.example.com/resource"

     

       633
       633
       -
       	iat := time.Now()

     

       634
       634
       -
       	jti := uuid.New().String()

     

       635
       635
       -
       

     

       636
       636
       -
       	claims := &DPoPClaims{

     

       637
       637
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       638
       638
       -
       			ID:       jti,

     

       639
       639
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       640
       640
       -
       		},

     

       641
       641
       -
       		HTTPMethod: method,

     

       642
       642
       -
       		HTTPURI:    uri,

     

       643
       643
       -
       	}

     

       644
       644
       -
       

     

       645
       645
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       646
       646
       -
       	token.Header["typ"] = "JWT" // Wrong typ

     

       647
       647
       -
       	token.Header["jwk"] = key.jwk

     

       648
       648
       -
       

     

       649
       649
       -
       	proof, err := token.SignedString(key.privateKey)

     

       650
       650
       -
       	if err != nil {

     

       651
       651
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       652
       652
       -
       	}

     

       653
       653
       -
       

     

       654
       654
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       655
       655
       -
       	if err == nil {

     

       656
       656
       -
       		t.Error("Expected error for wrong typ header, got nil")

     

       657
       657
       -
       	}

     

       658
       658
       -
       	if err != nil && !contains(err.Error(), "typ must be 'dpop+jwt'") {

     

       659
       659
       -
       		t.Errorf("Expected typ header error, got: %v", err)

     

       660
       660
       -
       	}

     

       661
       661
       -
       }

     

       662
       662
       -
       

     

       663
       663
       -
       func TestVerifyDPoPProof_MissingJWK(t *testing.T) {

     

       664
       664
       -
       	verifier := NewDPoPVerifier()

     

       665
       665
       -
       	key := generateTestES256Key(t)

     

       666
       666
       -
       

     

       667
       667
       -
       	method := "POST"

     

       668
       668
       -
       	uri := "https://api.example.com/resource"

     

       669
       669
       -
       	iat := time.Now()

     

       670
       670
       -
       	jti := uuid.New().String()

     

       671
       671
       -
       

     

       672
       672
       -
       	claims := &DPoPClaims{

     

       673
       673
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       674
       674
       -
       			ID:       jti,

     

       675
       675
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       676
       676
       -
       		},

     

       677
       677
       -
       		HTTPMethod: method,

     

       678
       678
       -
       		HTTPURI:    uri,

     

       679
       679
       -
       	}

     

       680
       680
       -
       

     

       681
       681
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       682
       682
       -
       	token.Header["typ"] = "dpop+jwt"

     

       683
       683
       -
       	// Don't include JWK

     

       684
       684
       -
       

     

       685
       685
       -
       	proof, err := token.SignedString(key.privateKey)

     

       686
       686
       -
       	if err != nil {

     

       687
       687
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       688
       688
       -
       	}

     

       689
       689
       -
       

     

       690
       690
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       691
       691
       -
       	if err == nil {

     

       692
       692
       -
       		t.Error("Expected error for missing jwk header, got nil")

     

       693
       693
       -
       	}

     

       694
       694
       -
       	if err != nil && !contains(err.Error(), "missing jwk") {

     

       695
       695
       -
       		t.Errorf("Expected missing jwk error, got: %v", err)

     

       696
       696
       -
       	}

     

       697
       697
       -
       }

     

       698
       698
       -
       

     

       699
       699
       -
       func TestVerifyDPoPProof_CustomTimeSettings(t *testing.T) {

     

       700
       700
       -
       	verifier := &DPoPVerifier{

     

       701
       701
       -
       		MaxClockSkew: 1 * time.Minute,

     

       702
       702
       -
       		MaxProofAge:  10 * time.Minute,

     

       703
       703
       -
       	}

     

       704
       704
       -
       	key := generateTestES256Key(t)

     

       705
       705
       -
       

     

       706
       706
       -
       	method := "POST"

     

       707
       707
       -
       	uri := "https://api.example.com/resource"

     

       708
       708
       -
       	// Proof issued 50 seconds in the future (within custom MaxClockSkew)

     

       709
       709
       -
       	iat := time.Now().Add(50 * time.Second)

     

       710
       710
       -
       	jti := uuid.New().String()

     

       711
       711
       -
       

     

       712
       712
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       713
       713
       -
       

     

       714
       714
       -
       	_, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       715
       715
       -
       	if err != nil {

     

       716
       716
       -
       		t.Fatalf("VerifyDPoPProof failed with custom time settings: %v", err)

     

       717
       717
       -
       	}

     

       718
       718
       -
       }

     

       719
       719
       -
       

     

       720
       720
       -
       func TestVerifyDPoPProof_HTTPMethodCaseInsensitive(t *testing.T) {

     

       721
       721
       -
       	// HTTP method comparison should be case-insensitive per spec

     

       722
       722
       -
       	verifier := NewDPoPVerifier()

     

       723
       723
       -
       	key := generateTestES256Key(t)

     

       724
       724
       -
       

     

       725
       725
       -
       	method := "post"

     

       726
       726
       -
       	uri := "https://api.example.com/resource"

     

       727
       727
       -
       	iat := time.Now()

     

       728
       728
       -
       	jti := uuid.New().String()

     

       729
       729
       -
       

     

       730
       730
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       731
       731
       -
       

     

       732
       732
       -
       	// Verify with uppercase method

     

       733
       733
       -
       	_, err := verifier.VerifyDPoPProof(proof, "POST", uri)

     

       734
       734
       -
       	if err != nil {

     

       735
       735
       -
       		t.Fatalf("VerifyDPoPProof failed for case-insensitive method: %v", err)

     

       736
       736
       -
       	}

     

       737
       737
       -
       }

     

       738
       738
       -
       

     

       739
       739
       -
       // === Token Binding Verification Tests ===

     

       740
       740
       -
       

     

       741
       741
       -
       func TestVerifyTokenBinding_Matching(t *testing.T) {

     

       742
       742
       -
       	verifier := NewDPoPVerifier()

     

       743
       743
       -
       	key := generateTestES256Key(t)

     

       744
       744
       -
       

     

       745
       745
       -
       	method := "POST"

     

       746
       746
       -
       	uri := "https://api.example.com/resource"

     

       747
       747
       -
       	iat := time.Now()

     

       748
       748
       -
       	jti := uuid.New().String()

     

       749
       749
       -
       

     

       750
       750
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       751
       751
       -
       

     

       752
       752
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       753
       753
       -
       	if err != nil {

     

       754
       754
       -
       		t.Fatalf("VerifyDPoPProof failed: %v", err)

     

       755
       755
       -
       	}

     

       756
       756
       -
       

     

       757
       757
       -
       	// Verify token binding with matching thumbprint

     

       758
       758
       -
       	err = verifier.VerifyTokenBinding(result, key.thumbprint)

     

       759
       759
       -
       	if err != nil {

     

       760
       760
       -
       		t.Fatalf("VerifyTokenBinding failed for matching thumbprint: %v", err)

     

       761
       761
       -
       	}

     

       762
       762
       -
       }

     

       763
       763
       -
       

     

       764
       764
       -
       func TestVerifyTokenBinding_Mismatch(t *testing.T) {

     

       765
       765
       -
       	verifier := NewDPoPVerifier()

     

       766
       766
       -
       	key := generateTestES256Key(t)

     

       767
       767
       -
       	wrongKey := generateTestES256Key(t)

     

       768
       768
       -
       

     

       769
       769
       -
       	method := "POST"

     

       770
       770
       -
       	uri := "https://api.example.com/resource"

     

       771
       771
       -
       	iat := time.Now()

     

       772
       772
       -
       	jti := uuid.New().String()

     

       773
       773
       -
       

     

       774
       774
       -
       	proof := createDPoPProof(t, key, method, uri, iat, jti)

     

       775
       775
       -
       

     

       776
       776
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       777
       777
       -
       	if err != nil {

     

       778
       778
       -
       		t.Fatalf("VerifyDPoPProof failed: %v", err)

     

       779
       779
       -
       	}

     

       780
       780
       -
       

     

       781
       781
       -
       	// Verify token binding with wrong thumbprint

     

       782
       782
       -
       	err = verifier.VerifyTokenBinding(result, wrongKey.thumbprint)

     

       783
       783
       -
       	if err == nil {

     

       784
       784
       -
       		t.Error("Expected error for thumbprint mismatch, got nil")

     

       785
       785
       -
       	}

     

       786
       786
       -
       	if err != nil && !contains(err.Error(), "thumbprint mismatch") {

     

       787
       787
       -
       		t.Errorf("Expected thumbprint mismatch error, got: %v", err)

     

       788
       788
       -
       	}

     

       789
       789
       -
       }

     

       790
       790
       -
       

     

       791
       791
       -
       // === ExtractCnfJkt Tests ===

     

       792
       792
       -
       

     

       793
       793
       -
       func TestExtractCnfJkt_Valid(t *testing.T) {

     

       794
       794
       -
       	expectedJkt := "test-thumbprint-123"

     

       795
       795
       -
       	claims := &Claims{

     

       796
       796
       -
       		Confirmation: map[string]interface{}{

     

       797
       797
       -
       			"jkt": expectedJkt,

     

       798
       798
       -
       		},

     

       799
       799
       -
       	}

     

       800
       800
       -
       

     

       801
       801
       -
       	jkt, err := ExtractCnfJkt(claims)

     

       802
       802
       -
       	if err != nil {

     

       803
       803
       -
       		t.Fatalf("ExtractCnfJkt failed for valid claims: %v", err)

     

       804
       804
       -
       	}

     

       805
       805
       -
       

     

       806
       806
       -
       	if jkt != expectedJkt {

     

       807
       807
       -
       		t.Errorf("Expected jkt %s, got %s", expectedJkt, jkt)

     

       808
       808
       -
       	}

     

       809
       809
       -
       }

     

       810
       810
       -
       

     

       811
       811
       -
       func TestExtractCnfJkt_MissingCnf(t *testing.T) {

     

       812
       812
       -
       	claims := &Claims{

     

       813
       813
       -
       		// No Confirmation

     

       814
       814
       -
       	}

     

       815
       815
       -
       

     

       816
       816
       -
       	_, err := ExtractCnfJkt(claims)

     

       817
       817
       -
       	if err == nil {

     

       818
       818
       -
       		t.Error("Expected error for missing cnf, got nil")

     

       819
       819
       -
       	}

     

       820
       820
       -
       	if err != nil && !contains(err.Error(), "missing cnf claim") {

     

       821
       821
       -
       		t.Errorf("Expected missing cnf error, got: %v", err)

     

       822
       822
       -
       	}

     

       823
       823
       -
       }

     

       824
       824
       -
       

     

       825
       825
       -
       func TestExtractCnfJkt_NilCnf(t *testing.T) {

     

       826
       826
       -
       	claims := &Claims{

     

       827
       827
       -
       		Confirmation: nil,

     

       828
       828
       -
       	}

     

       829
       829
       -
       

     

       830
       830
       -
       	_, err := ExtractCnfJkt(claims)

     

       831
       831
       -
       	if err == nil {

     

       832
       832
       -
       		t.Error("Expected error for nil cnf, got nil")

     

       833
       833
       -
       	}

     

       834
       834
       -
       	if err != nil && !contains(err.Error(), "missing cnf claim") {

     

       835
       835
       -
       		t.Errorf("Expected missing cnf error, got: %v", err)

     

       836
       836
       -
       	}

     

       837
       837
       -
       }

     

       838
       838
       -
       

     

       839
       839
       -
       func TestExtractCnfJkt_MissingJkt(t *testing.T) {

     

       840
       840
       -
       	claims := &Claims{

     

       841
       841
       -
       		Confirmation: map[string]interface{}{

     

       842
       842
       -
       			"other": "value",

     

       843
       843
       -
       		},

     

       844
       844
       -
       	}

     

       845
       845
       -
       

     

       846
       846
       -
       	_, err := ExtractCnfJkt(claims)

     

       847
       847
       -
       	if err == nil {

     

       848
       848
       -
       		t.Error("Expected error for missing jkt, got nil")

     

       849
       849
       -
       	}

     

       850
       850
       -
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       851
       851
       -
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       852
       852
       -
       	}

     

       853
       853
       -
       }

     

       854
       854
       -
       

     

       855
       855
       -
       func TestExtractCnfJkt_EmptyJkt(t *testing.T) {

     

       856
       856
       -
       	claims := &Claims{

     

       857
       857
       -
       		Confirmation: map[string]interface{}{

     

       858
       858
       -
       			"jkt": "",

     

       859
       859
       -
       		},

     

       860
       860
       -
       	}

     

       861
       861
       -
       

     

       862
       862
       -
       	_, err := ExtractCnfJkt(claims)

     

       863
       863
       -
       	if err == nil {

     

       864
       864
       -
       		t.Error("Expected error for empty jkt, got nil")

     

       865
       865
       -
       	}

     

       866
       866
       -
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       867
       867
       -
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       868
       868
       -
       	}

     

       869
       869
       -
       }

     

       870
       870
       -
       

     

       871
       871
       -
       func TestExtractCnfJkt_WrongType(t *testing.T) {

     

       872
       872
       -
       	claims := &Claims{

     

       873
       873
       -
       		Confirmation: map[string]interface{}{

     

       874
       874
       -
       			"jkt": 123, // Not a string

     

       875
       875
       -
       		},

     

       876
       876
       -
       	}

     

       877
       877
       -
       

     

       878
       878
       -
       	_, err := ExtractCnfJkt(claims)

     

       879
       879
       -
       	if err == nil {

     

       880
       880
       -
       		t.Error("Expected error for wrong type jkt, got nil")

     

       881
       881
       -
       	}

     

       882
       882
       -
       	if err != nil && !contains(err.Error(), "missing jkt") {

     

       883
       883
       -
       		t.Errorf("Expected missing jkt error, got: %v", err)

     

       884
       884
       -
       	}

     

       885
       885
       -
       }

     

       886
       886
       -
       

     

       887
       887
       -
       // === Helper Functions for Tests ===

     

       888
       888
       -
       

     

       889
       889
       -
       // splitJWT splits a JWT into its three parts

     

       890
       890
       -
       func splitJWT(token string) []string {

     

       891
       891
       -
       	return []string{

     

       892
       892
       -
       		token[:strings.IndexByte(token, '.')],

     

       893
       893
       -
       		token[strings.IndexByte(token, '.')+1 : strings.LastIndexByte(token, '.')],

     

       894
       894
       -
       		token[strings.LastIndexByte(token, '.')+1:],

     

       895
       895
       -
       	}

     

       896
       896
       -
       }

     

       897
       897
       -
       

     

       898
       898
       -
       // parseJWTHeader parses a base64url-encoded JWT header

     

       899
       899
       -
       func parseJWTHeader(t *testing.T, encoded string) map[string]interface{} {

     

       900
       900
       -
       	t.Helper()

     

       901
       901
       -
       	decoded, err := base64.RawURLEncoding.DecodeString(encoded)

     

       902
       902
       -
       	if err != nil {

     

       903
       903
       -
       		t.Fatalf("Failed to decode header: %v", err)

     

       904
       904
       -
       	}

     

       905
       905
       -
       

     

       906
       906
       -
       	var header map[string]interface{}

     

       907
       907
       -
       	if err := json.Unmarshal(decoded, &header); err != nil {

     

       908
       908
       -
       		t.Fatalf("Failed to unmarshal header: %v", err)

     

       909
       909
       -
       	}

     

       910
       910
       -
       

     

       911
       911
       -
       	return header

     

       912
       912
       -
       }

     

       913
       913
       -
       

     

       914
       914
       -
       // encodeJSON encodes a value to base64url-encoded JSON

     

       915
       915
       -
       func encodeJSON(t *testing.T, v interface{}) string {

     

       916
       916
       -
       	t.Helper()

     

       917
       917
       -
       	data, err := json.Marshal(v)

     

       918
       918
       -
       	if err != nil {

     

       919
       919
       -
       		t.Fatalf("Failed to marshal JSON: %v", err)

     

       920
       920
       -
       	}

     

       921
       921
       -
       	return base64.RawURLEncoding.EncodeToString(data)

     

       922
       922
       -
       }

     

       923
       923
       -
       

     

       924
       924
       -
       // === ES256K (secp256k1) Test Helpers ===

     

       925
       925
       -
       

     

       926
       926
       -
       // testES256KKey holds a test ES256K key pair using indigo

     

       927
       927
       -
       type testES256KKey struct {

     

       928
       928
       -
       	privateKey indigoCrypto.PrivateKey

     

       929
       929
       -
       	publicKey  indigoCrypto.PublicKey

     

       930
       930
       -
       	jwk        map[string]interface{}

     

       931
       931
       -
       	thumbprint string

     

       932
       932
       -
       }

     

       933
       933
       -
       

     

       934
       934
       -
       // generateTestES256KKey generates a test ES256K (secp256k1) key pair and JWK

     

       935
       935
       -
       func generateTestES256KKey(t *testing.T) *testES256KKey {

     

       936
       936
       -
       	t.Helper()

     

       937
       937
       -
       

     

       938
       938
       -
       	privateKey, err := indigoCrypto.GeneratePrivateKeyK256()

     

       939
       939
       -
       	if err != nil {

     

       940
       940
       -
       		t.Fatalf("Failed to generate ES256K test key: %v", err)

     

       941
       941
       -
       	}

     

       942
       942
       -
       

     

       943
       943
       -
       	publicKey, err := privateKey.PublicKey()

     

       944
       944
       -
       	if err != nil {

     

       945
       945
       -
       		t.Fatalf("Failed to get public key from ES256K private key: %v", err)

     

       946
       946
       -
       	}

     

       947
       947
       -
       

     

       948
       948
       -
       	// Get the JWK representation

     

       949
       949
       -
       	jwkStruct, err := publicKey.JWK()

     

       950
       950
       -
       	if err != nil {

     

       951
       951
       -
       		t.Fatalf("Failed to get JWK from ES256K public key: %v", err)

     

       952
       952
       -
       	}

     

       953
       953
       -
       	jwk := map[string]interface{}{

     

       954
       954
       -
       		"kty": jwkStruct.KeyType,

     

       955
       955
       -
       		"crv": jwkStruct.Curve,

     

       956
       956
       -
       		"x":   jwkStruct.X,

     

       957
       957
       -
       		"y":   jwkStruct.Y,

     

       958
       958
       -
       	}

     

       959
       959
       -
       

     

       960
       960
       -
       	// Calculate thumbprint

     

       961
       961
       -
       	thumbprint, err := CalculateJWKThumbprint(jwk)

     

       962
       962
       -
       	if err != nil {

     

       963
       963
       -
       		t.Fatalf("Failed to calculate ES256K thumbprint: %v", err)

     

       964
       964
       -
       	}

     

       965
       965
       -
       

     

       966
       966
       -
       	return &testES256KKey{

     

       967
       967
       -
       		privateKey: privateKey,

     

       968
       968
       -
       		publicKey:  publicKey,

     

       969
       969
       -
       		jwk:        jwk,

     

       970
       970
       -
       		thumbprint: thumbprint,

     

       971
       971
       -
       	}

     

       972
       972
       -
       }

     

       973
       973
       -
       

     

       974
       974
       -
       // createES256KDPoPProof creates a DPoP proof JWT using ES256K for testing

     

       975
       975
       -
       func createES256KDPoPProof(t *testing.T, key *testES256KKey, method, uri string, iat time.Time, jti string) string {

     

       976
       976
       -
       	t.Helper()

     

       977
       977
       -
       

     

       978
       978
       -
       	// Build claims

     

       979
       979
       -
       	claims := map[string]interface{}{

     

       980
       980
       -
       		"jti": jti,

     

       981
       981
       -
       		"iat": iat.Unix(),

     

       982
       982
       -
       		"htm": method,

     

       983
       983
       -
       		"htu": uri,

     

       984
       984
       -
       	}

     

       985
       985
       -
       

     

       986
       986
       -
       	// Build header

     

       987
       987
       -
       	header := map[string]interface{}{

     

       988
       988
       -
       		"typ": "dpop+jwt",

     

       989
       989
       -
       		"alg": "ES256K",

     

       990
       990
       -
       		"jwk": key.jwk,

     

       991
       991
       -
       	}

     

       992
       992
       -
       

     

       993
       993
       -
       	// Encode header and claims

     

       994
       994
       -
       	headerJSON, err := json.Marshal(header)

     

       995
       995
       -
       	if err != nil {

     

       996
       996
       -
       		t.Fatalf("Failed to marshal header: %v", err)

     

       997
       997
       -
       	}

     

       998
       998
       -
       	claimsJSON, err := json.Marshal(claims)

     

       999
       999
       -
       	if err != nil {

     

       1000
       1000
       -
       		t.Fatalf("Failed to marshal claims: %v", err)

     

       1001
       1001
       -
       	}

     

       1002
       1002
       -
       

     

       1003
       1003
       -
       	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)

     

       1004
       1004
       -
       	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)

     

       1005
       1005
       -
       

     

       1006
       1006
       -
       	// Sign with indigo

     

       1007
       1007
       -
       	signingInput := headerB64 + "." + claimsB64

     

       1008
       1008
       -
       	signature, err := key.privateKey.HashAndSign([]byte(signingInput))

     

       1009
       1009
       -
       	if err != nil {

     

       1010
       1010
       -
       		t.Fatalf("Failed to sign ES256K proof: %v", err)

     

       1011
       1011
       -
       	}

     

       1012
       1012
       -
       

     

       1013
       1013
       -
       	signatureB64 := base64.RawURLEncoding.EncodeToString(signature)

     

       1014
       1014
       -
       	return signingInput + "." + signatureB64

     

       1015
       1015
       -
       }

     

       1016
       1016
       -
       

     

       1017
       1017
       -
       // === ES256K Tests ===

     

       1018
       1018
       -
       

     

       1019
       1019
       -
       func TestVerifyDPoPProof_ES256K_Valid(t *testing.T) {

     

       1020
       1020
       -
       	verifier := NewDPoPVerifier()

     

       1021
       1021
       -
       	key := generateTestES256KKey(t)

     

       1022
       1022
       -
       

     

       1023
       1023
       -
       	method := "POST"

     

       1024
       1024
       -
       	uri := "https://api.example.com/resource"

     

       1025
       1025
       -
       	iat := time.Now()

     

       1026
       1026
       -
       	jti := uuid.New().String()

     

       1027
       1027
       -
       

     

       1028
       1028
       -
       	proof := createES256KDPoPProof(t, key, method, uri, iat, jti)

     

       1029
       1029
       -
       

     

       1030
       1030
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       1031
       1031
       -
       	if err != nil {

     

       1032
       1032
       -
       		t.Fatalf("VerifyDPoPProof failed for valid ES256K proof: %v", err)

     

       1033
       1033
       -
       	}

     

       1034
       1034
       -
       

     

       1035
       1035
       -
       	if result == nil {

     

       1036
       1036
       -
       		t.Fatal("Expected non-nil proof result")

     

       1037
       1037
       -
       	}

     

       1038
       1038
       -
       

     

       1039
       1039
       -
       	if result.Claims.HTTPMethod != method {

     

       1040
       1040
       -
       		t.Errorf("Expected method %s, got %s", method, result.Claims.HTTPMethod)

     

       1041
       1041
       -
       	}

     

       1042
       1042
       -
       

     

       1043
       1043
       -
       	if result.Claims.HTTPURI != uri {

     

       1044
       1044
       -
       		t.Errorf("Expected URI %s, got %s", uri, result.Claims.HTTPURI)

     

       1045
       1045
       -
       	}

     

       1046
       1046
       -
       

     

       1047
       1047
       -
       	if result.Thumbprint != key.thumbprint {

     

       1048
       1048
       -
       		t.Errorf("Expected thumbprint %s, got %s", key.thumbprint, result.Thumbprint)

     

       1049
       1049
       -
       	}

     

       1050
       1050
       -
       }

     

       1051
       1051
       -
       

     

       1052
       1052
       -
       func TestVerifyDPoPProof_ES256K_InvalidSignature(t *testing.T) {

     

       1053
       1053
       -
       	verifier := NewDPoPVerifier()

     

       1054
       1054
       -
       	key := generateTestES256KKey(t)

     

       1055
       1055
       -
       	wrongKey := generateTestES256KKey(t)

     

       1056
       1056
       -
       

     

       1057
       1057
       -
       	method := "POST"

     

       1058
       1058
       -
       	uri := "https://api.example.com/resource"

     

       1059
       1059
       -
       	iat := time.Now()

     

       1060
       1060
       -
       	jti := uuid.New().String()

     

       1061
       1061
       -
       

     

       1062
       1062
       -
       	// Create proof with one key

     

       1063
       1063
       -
       	proof := createES256KDPoPProof(t, key, method, uri, iat, jti)

     

       1064
       1064
       -
       

     

       1065
       1065
       -
       	// Tamper by replacing JWK with wrong key

     

       1066
       1066
       -
       	parts := splitJWT(proof)

     

       1067
       1067
       -
       	header := parseJWTHeader(t, parts[0])

     

       1068
       1068
       -
       	header["jwk"] = wrongKey.jwk

     

       1069
       1069
       -
       	modifiedHeader := encodeJSON(t, header)

     

       1070
       1070
       -
       	tamperedProof := modifiedHeader + "." + parts[1] + "." + parts[2]

     

       1071
       1071
       -
       

     

       1072
       1072
       -
       	_, err := verifier.VerifyDPoPProof(tamperedProof, method, uri)

     

       1073
       1073
       -
       	if err == nil {

     

       1074
       1074
       -
       		t.Error("Expected error for invalid ES256K signature, got nil")

     

       1075
       1075
       -
       	}

     

       1076
       1076
       -
       	if err != nil && !contains(err.Error(), "signature verification failed") {

     

       1077
       1077
       -
       		t.Errorf("Expected signature verification error, got: %v", err)

     

       1078
       1078
       -
       	}

     

       1079
       1079
       -
       }

     

       1080
       1080
       -
       

     

       1081
       1081
       -
       func TestCalculateJWKThumbprint_ES256K(t *testing.T) {

     

       1082
       1082
       -
       	// Test thumbprint calculation for secp256k1 keys

     

       1083
       1083
       -
       	key := generateTestES256KKey(t)

     

       1084
       1084
       -
       

     

       1085
       1085
       -
       	thumbprint, err := CalculateJWKThumbprint(key.jwk)

     

       1086
       1086
       -
       	if err != nil {

     

       1087
       1087
       -
       		t.Fatalf("CalculateJWKThumbprint failed for ES256K: %v", err)

     

       1088
       1088
       -
       	}

     

       1089
       1089
       -
       

     

       1090
       1090
       -
       	if thumbprint == "" {

     

       1091
       1091
       -
       		t.Error("Expected non-empty thumbprint for ES256K key")

     

       1092
       1092
       -
       	}

     

       1093
       1093
       -
       

     

       1094
       1094
       -
       	// Verify it's valid base64url

     

       1095
       1095
       -
       	_, err = base64.RawURLEncoding.DecodeString(thumbprint)

     

       1096
       1096
       -
       	if err != nil {

     

       1097
       1097
       -
       		t.Errorf("ES256K thumbprint is not valid base64url: %v", err)

     

       1098
       1098
       -
       	}

     

       1099
       1099
       -
       

     

       1100
       1100
       -
       	// Verify length (SHA-256 produces 32 bytes = 43 base64url chars)

     

       1101
       1101
       -
       	if len(thumbprint) != 43 {

     

       1102
       1102
       -
       		t.Errorf("Expected ES256K thumbprint length 43, got %d", len(thumbprint))

     

       1103
       1103
       -
       	}

     

       1104
       1104
       -
       }

     

       1105
       1105
       -
       

     

       1106
       1106
       -
       // === Algorithm-Curve Binding Tests ===

     

       1107
       1107
       -
       

     

       1108
       1108
       -
       func TestVerifyDPoPProof_AlgorithmCurveMismatch_ES256KWithP256Key(t *testing.T) {

     

       1109
       1109
       -
       	verifier := NewDPoPVerifier()

     

       1110
       1110
       -
       	key := generateTestES256Key(t) // P-256 key

     

       1111
       1111
       -
       

     

       1112
       1112
       -
       	method := "POST"

     

       1113
       1113
       -
       	uri := "https://api.example.com/resource"

     

       1114
       1114
       -
       	iat := time.Now()

     

       1115
       1115
       -
       	jti := uuid.New().String()

     

       1116
       1116
       -
       

     

       1117
       1117
       -
       	// Create a proof claiming ES256K but using P-256 key

     

       1118
       1118
       -
       	claims := &DPoPClaims{

     

       1119
       1119
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1120
       1120
       -
       			ID:       jti,

     

       1121
       1121
       -
       			IssuedAt: jwt.NewNumericDate(iat),

     

       1122
       1122
       -
       		},

     

       1123
       1123
       -
       		HTTPMethod: method,

     

       1124
       1124
       -
       		HTTPURI:    uri,

     

       1125
       1125
       -
       	}

     

       1126
       1126
       -
       

     

       1127
       1127
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1128
       1128
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1129
       1129
       -
       	token.Header["alg"] = "ES256K" // Claim ES256K

     

       1130
       1130
       -
       	token.Header["jwk"] = key.jwk  // But use P-256 key

     

       1131
       1131
       -
       

     

       1132
       1132
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1133
       1133
       -
       	if err != nil {

     

       1134
       1134
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1135
       1135
       -
       	}

     

       1136
       1136
       -
       

     

       1137
       1137
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1138
       1138
       -
       	if err == nil {

     

       1139
       1139
       -
       		t.Error("Expected error for ES256K algorithm with P-256 curve, got nil")

     

       1140
       1140
       -
       	}

     

       1141
       1141
       -
       	if err != nil && !contains(err.Error(), "requires curve secp256k1") {

     

       1142
       1142
       -
       		t.Errorf("Expected curve mismatch error, got: %v", err)

     

       1143
       1143
       -
       	}

     

       1144
       1144
       -
       }

     

       1145
       1145
       -
       

     

       1146
       1146
       -
       func TestVerifyDPoPProof_AlgorithmCurveMismatch_ES256WithSecp256k1Key(t *testing.T) {

     

       1147
       1147
       -
       	verifier := NewDPoPVerifier()

     

       1148
       1148
       -
       	key := generateTestES256KKey(t) // secp256k1 key

     

       1149
       1149
       -
       

     

       1150
       1150
       -
       	method := "POST"

     

       1151
       1151
       -
       	uri := "https://api.example.com/resource"

     

       1152
       1152
       -
       	iat := time.Now()

     

       1153
       1153
       -
       	jti := uuid.New().String()

     

       1154
       1154
       -
       

     

       1155
       1155
       -
       	// Build claims

     

       1156
       1156
       -
       	claims := map[string]interface{}{

     

       1157
       1157
       -
       		"jti": jti,

     

       1158
       1158
       -
       		"iat": iat.Unix(),

     

       1159
       1159
       -
       		"htm": method,

     

       1160
       1160
       -
       		"htu": uri,

     

       1161
       1161
       -
       	}

     

       1162
       1162
       -
       

     

       1163
       1163
       -
       	// Build header claiming ES256 but using secp256k1 key

     

       1164
       1164
       -
       	header := map[string]interface{}{

     

       1165
       1165
       -
       		"typ": "dpop+jwt",

     

       1166
       1166
       -
       		"alg": "ES256", // Claim ES256

     

       1167
       1167
       -
       		"jwk": key.jwk, // But use secp256k1 key

     

       1168
       1168
       -
       	}

     

       1169
       1169
       -
       

     

       1170
       1170
       -
       	headerJSON, _ := json.Marshal(header)

     

       1171
       1171
       -
       	claimsJSON, _ := json.Marshal(claims)

     

       1172
       1172
       -
       

     

       1173
       1173
       -
       	headerB64 := base64.RawURLEncoding.EncodeToString(headerJSON)

     

       1174
       1174
       -
       	claimsB64 := base64.RawURLEncoding.EncodeToString(claimsJSON)

     

       1175
       1175
       -
       

     

       1176
       1176
       -
       	signingInput := headerB64 + "." + claimsB64

     

       1177
       1177
       -
       	signature, err := key.privateKey.HashAndSign([]byte(signingInput))

     

       1178
       1178
       -
       	if err != nil {

     

       1179
       1179
       -
       		t.Fatalf("Failed to sign: %v", err)

     

       1180
       1180
       -
       	}

     

       1181
       1181
       -
       

     

       1182
       1182
       -
       	proof := signingInput + "." + base64.RawURLEncoding.EncodeToString(signature)

     

       1183
       1183
       -
       

     

       1184
       1184
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1185
       1185
       -
       	if err == nil {

     

       1186
       1186
       -
       		t.Error("Expected error for ES256 algorithm with secp256k1 curve, got nil")

     

       1187
       1187
       -
       	}

     

       1188
       1188
       -
       	if err != nil && !contains(err.Error(), "requires curve P-256") {

     

       1189
       1189
       -
       		t.Errorf("Expected curve mismatch error, got: %v", err)

     

       1190
       1190
       -
       	}

     

       1191
       1191
       -
       }

     

       1192
       1192
       -
       

     

       1193
       1193
       -
       // === exp/nbf Validation Tests ===

     

       1194
       1194
       -
       

     

       1195
       1195
       -
       func TestVerifyDPoPProof_ExpiredWithExpClaim(t *testing.T) {

     

       1196
       1196
       -
       	verifier := NewDPoPVerifier()

     

       1197
       1197
       -
       	key := generateTestES256Key(t)

     

       1198
       1198
       -
       

     

       1199
       1199
       -
       	method := "POST"

     

       1200
       1200
       -
       	uri := "https://api.example.com/resource"

     

       1201
       1201
       -
       	iat := time.Now().Add(-2 * time.Minute)

     

       1202
       1202
       -
       	exp := time.Now().Add(-1 * time.Minute) // Expired 1 minute ago

     

       1203
       1203
       -
       	jti := uuid.New().String()

     

       1204
       1204
       -
       

     

       1205
       1205
       -
       	claims := &DPoPClaims{

     

       1206
       1206
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1207
       1207
       -
       			ID:        jti,

     

       1208
       1208
       -
       			IssuedAt:  jwt.NewNumericDate(iat),

     

       1209
       1209
       -
       			ExpiresAt: jwt.NewNumericDate(exp),

     

       1210
       1210
       -
       		},

     

       1211
       1211
       -
       		HTTPMethod: method,

     

       1212
       1212
       -
       		HTTPURI:    uri,

     

       1213
       1213
       -
       	}

     

       1214
       1214
       -
       

     

       1215
       1215
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1216
       1216
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1217
       1217
       -
       	token.Header["jwk"] = key.jwk

     

       1218
       1218
       -
       

     

       1219
       1219
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1220
       1220
       -
       	if err != nil {

     

       1221
       1221
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1222
       1222
       -
       	}

     

       1223
       1223
       -
       

     

       1224
       1224
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1225
       1225
       -
       	if err == nil {

     

       1226
       1226
       -
       		t.Error("Expected error for expired proof with exp claim, got nil")

     

       1227
       1227
       -
       	}

     

       1228
       1228
       -
       	if err != nil && !contains(err.Error(), "expired") {

     

       1229
       1229
       -
       		t.Errorf("Expected expiration error, got: %v", err)

     

       1230
       1230
       -
       	}

     

       1231
       1231
       -
       }

     

       1232
       1232
       -
       

     

       1233
       1233
       -
       func TestVerifyDPoPProof_NotYetValidWithNbfClaim(t *testing.T) {

     

       1234
       1234
       -
       	verifier := NewDPoPVerifier()

     

       1235
       1235
       -
       	key := generateTestES256Key(t)

     

       1236
       1236
       -
       

     

       1237
       1237
       -
       	method := "POST"

     

       1238
       1238
       -
       	uri := "https://api.example.com/resource"

     

       1239
       1239
       -
       	iat := time.Now()

     

       1240
       1240
       -
       	nbf := time.Now().Add(5 * time.Minute) // Not valid for another 5 minutes

     

       1241
       1241
       -
       	jti := uuid.New().String()

     

       1242
       1242
       -
       

     

       1243
       1243
       -
       	claims := &DPoPClaims{

     

       1244
       1244
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1245
       1245
       -
       			ID:        jti,

     

       1246
       1246
       -
       			IssuedAt:  jwt.NewNumericDate(iat),

     

       1247
       1247
       -
       			NotBefore: jwt.NewNumericDate(nbf),

     

       1248
       1248
       -
       		},

     

       1249
       1249
       -
       		HTTPMethod: method,

     

       1250
       1250
       -
       		HTTPURI:    uri,

     

       1251
       1251
       -
       	}

     

       1252
       1252
       -
       

     

       1253
       1253
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1254
       1254
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1255
       1255
       -
       	token.Header["jwk"] = key.jwk

     

       1256
       1256
       -
       

     

       1257
       1257
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1258
       1258
       -
       	if err != nil {

     

       1259
       1259
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1260
       1260
       -
       	}

     

       1261
       1261
       -
       

     

       1262
       1262
       -
       	_, err = verifier.VerifyDPoPProof(proof, method, uri)

     

       1263
       1263
       -
       	if err == nil {

     

       1264
       1264
       -
       		t.Error("Expected error for not-yet-valid proof with nbf claim, got nil")

     

       1265
       1265
       -
       	}

     

       1266
       1266
       -
       	if err != nil && !contains(err.Error(), "not valid before") {

     

       1267
       1267
       -
       		t.Errorf("Expected not-before error, got: %v", err)

     

       1268
       1268
       -
       	}

     

       1269
       1269
       -
       }

     

       1270
       1270
       -
       

     

       1271
       1271
       -
       func TestVerifyDPoPProof_ValidWithExpClaimInFuture(t *testing.T) {

     

       1272
       1272
       -
       	verifier := NewDPoPVerifier()

     

       1273
       1273
       -
       	key := generateTestES256Key(t)

     

       1274
       1274
       -
       

     

       1275
       1275
       -
       	method := "POST"

     

       1276
       1276
       -
       	uri := "https://api.example.com/resource"

     

       1277
       1277
       -
       	iat := time.Now()

     

       1278
       1278
       -
       	exp := time.Now().Add(5 * time.Minute) // Valid for 5 more minutes

     

       1279
       1279
       -
       	jti := uuid.New().String()

     

       1280
       1280
       -
       

     

       1281
       1281
       -
       	claims := &DPoPClaims{

     

       1282
       1282
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       1283
       1283
       -
       			ID:        jti,

     

       1284
       1284
       -
       			IssuedAt:  jwt.NewNumericDate(iat),

     

       1285
       1285
       -
       			ExpiresAt: jwt.NewNumericDate(exp),

     

       1286
       1286
       -
       		},

     

       1287
       1287
       -
       		HTTPMethod: method,

     

       1288
       1288
       -
       		HTTPURI:    uri,

     

       1289
       1289
       -
       	}

     

       1290
       1290
       -
       

     

       1291
       1291
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodES256, claims)

     

       1292
       1292
       -
       	token.Header["typ"] = "dpop+jwt"

     

       1293
       1293
       -
       	token.Header["jwk"] = key.jwk

     

       1294
       1294
       -
       

     

       1295
       1295
       -
       	proof, err := token.SignedString(key.privateKey)

     

       1296
       1296
       -
       	if err != nil {

     

       1297
       1297
       -
       		t.Fatalf("Failed to create test proof: %v", err)

     

       1298
       1298
       -
       	}

     

       1299
       1299
       -
       

     

       1300
       1300
       -
       	result, err := verifier.VerifyDPoPProof(proof, method, uri)

     

       1301
       1301
       -
       	if err != nil {

     

       1302
       1302
       -
       		t.Fatalf("VerifyDPoPProof failed for valid proof with exp in future: %v", err)

     

       1303
       1303
       -
       	}

     

       1304
       1304
       -
       

     

       1305
       1305
       -
       	if result == nil {

     

       1306
       1306
       -
       		t.Error("Expected non-nil result for valid proof")

     

       1307
       1307
       -
       	}

     

       1308
       1308
       -
       }

-189

internal/atproto/auth/jwks_fetcher.go

···

       1
       1
       -
       package auth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"encoding/json"

     

       6
       6
       -
       	"fmt"

     

       7
       7
       -
       	"net/http"

     

       8
       8
       -
       	"strings"

     

       9
       9
       -
       	"sync"

     

       10
       10
       -
       	"time"

     

       11
       11
       -
       )

     

       12
       12
       -
       

     

       13
       13
       -
       // CachedJWKSFetcher fetches and caches JWKS from authorization servers

     

       14
       14
       -
       type CachedJWKSFetcher struct {

     

       15
       15
       -
       	cache      map[string]*cachedJWKS

     

       16
       16
       -
       	httpClient *http.Client

     

       17
       17
       -
       	cacheMutex sync.RWMutex

     

       18
       18
       -
       	cacheTTL   time.Duration

     

       19
       19
       -
       }

     

       20
       20
       -
       

     

       21
       21
       -
       type cachedJWKS struct {

     

       22
       22
       -
       	jwks      *JWKS

     

       23
       23
       -
       	expiresAt time.Time

     

       24
       24
       -
       }

     

       25
       25
       -
       

     

       26
       26
       -
       // NewCachedJWKSFetcher creates a new JWKS fetcher with caching

     

       27
       27
       -
       func NewCachedJWKSFetcher(cacheTTL time.Duration) *CachedJWKSFetcher {

     

       28
       28
       -
       	return &CachedJWKSFetcher{

     

       29
       29
       -
       		cache: make(map[string]*cachedJWKS),

     

       30
       30
       -
       		httpClient: &http.Client{

     

       31
       31
       -
       			Timeout: 10 * time.Second,

     

       32
       32
       -
       		},

     

       33
       33
       -
       		cacheTTL: cacheTTL,

     

       34
       34
       -
       	}

     

       35
       35
       -
       }

     

       36
       36
       -
       

     

       37
       37
       -
       // FetchPublicKey fetches the public key for verifying a JWT from the issuer

     

       38
       38
       -
       // Implements JWKSFetcher interface

     

       39
       39
       -
       // Returns interface{} to support both RSA and ECDSA keys

     

       40
       40
       -
       func (f *CachedJWKSFetcher) FetchPublicKey(ctx context.Context, issuer, token string) (interface{}, error) {

     

       41
       41
       -
       	// Extract key ID from token

     

       42
       42
       -
       	kid, err := ExtractKeyID(token)

     

       43
       43
       -
       	if err != nil {

     

       44
       44
       -
       		return nil, fmt.Errorf("failed to extract key ID: %w", err)

     

       45
       45
       -
       	}

     

       46
       46
       -
       

     

       47
       47
       -
       	// Get JWKS from cache or fetch

     

       48
       48
       -
       	jwks, err := f.getJWKS(ctx, issuer)

     

       49
       49
       -
       	if err != nil {

     

       50
       50
       -
       		return nil, err

     

       51
       51
       -
       	}

     

       52
       52
       -
       

     

       53
       53
       -
       	// Find the key by ID

     

       54
       54
       -
       	jwk, err := jwks.FindKeyByID(kid)

     

       55
       55
       -
       	if err != nil {

     

       56
       56
       -
       		// Key not found in cache - try refreshing

     

       57
       57
       -
       		jwks, err = f.fetchJWKS(ctx, issuer)

     

       58
       58
       -
       		if err != nil {

     

       59
       59
       -
       			return nil, fmt.Errorf("failed to refresh JWKS: %w", err)

     

       60
       60
       -
       		}

     

       61
       61
       -
       		f.cacheJWKS(issuer, jwks)

     

       62
       62
       -
       

     

       63
       63
       -
       		// Try again with fresh JWKS

     

       64
       64
       -
       		jwk, err = jwks.FindKeyByID(kid)

     

       65
       65
       -
       		if err != nil {

     

       66
       66
       -
       			return nil, err

     

       67
       67
       -
       		}

     

       68
       68
       -
       	}

     

       69
       69
       -
       

     

       70
       70
       -
       	// Convert JWK to public key (RSA or ECDSA)

     

       71
       71
       -
       	return jwk.ToPublicKey()

     

       72
       72
       -
       }

     

       73
       73
       -
       

     

       74
       74
       -
       // getJWKS gets JWKS from cache or fetches if not cached/expired

     

       75
       75
       -
       func (f *CachedJWKSFetcher) getJWKS(ctx context.Context, issuer string) (*JWKS, error) {

     

       76
       76
       -
       	// Check cache first

     

       77
       77
       -
       	f.cacheMutex.RLock()

     

       78
       78
       -
       	cached, exists := f.cache[issuer]

     

       79
       79
       -
       	f.cacheMutex.RUnlock()

     

       80
       80
       -
       

     

       81
       81
       -
       	if exists && time.Now().Before(cached.expiresAt) {

     

       82
       82
       -
       		return cached.jwks, nil

     

       83
       83
       -
       	}

     

       84
       84
       -
       

     

       85
       85
       -
       	// Not in cache or expired - fetch from issuer

     

       86
       86
       -
       	jwks, err := f.fetchJWKS(ctx, issuer)

     

       87
       87
       -
       	if err != nil {

     

       88
       88
       -
       		return nil, err

     

       89
       89
       -
       	}

     

       90
       90
       -
       

     

       91
       91
       -
       	// Cache it

     

       92
       92
       -
       	f.cacheJWKS(issuer, jwks)

     

       93
       93
       -
       

     

       94
       94
       -
       	return jwks, nil

     

       95
       95
       -
       }

     

       96
       96
       -
       

     

       97
       97
       -
       // fetchJWKS fetches JWKS from the authorization server

     

       98
       98
       -
       func (f *CachedJWKSFetcher) fetchJWKS(ctx context.Context, issuer string) (*JWKS, error) {

     

       99
       99
       -
       	// Step 1: Fetch OAuth server metadata to get JWKS URI

     

       100
       100
       -
       	metadataURL := strings.TrimSuffix(issuer, "/") + "/.well-known/oauth-authorization-server"

     

       101
       101
       -
       

     

       102
       102
       -
       	req, err := http.NewRequestWithContext(ctx, "GET", metadataURL, nil)

     

       103
       103
       -
       	if err != nil {

     

       104
       104
       -
       		return nil, fmt.Errorf("failed to create metadata request: %w", err)

     

       105
       105
       -
       	}

     

       106
       106
       -
       

     

       107
       107
       -
       	resp, err := f.httpClient.Do(req)

     

       108
       108
       -
       	if err != nil {

     

       109
       109
       -
       		return nil, fmt.Errorf("failed to fetch metadata: %w", err)

     

       110
       110
       -
       	}

     

       111
       111
       -
       	defer func() {

     

       112
       112
       -
       		_ = resp.Body.Close()

     

       113
       113
       -
       	}()

     

       114
       114
       -
       

     

       115
       115
       -
       	if resp.StatusCode != http.StatusOK {

     

       116
       116
       -
       		return nil, fmt.Errorf("metadata endpoint returned status %d", resp.StatusCode)

     

       117
       117
       -
       	}

     

       118
       118
       -
       

     

       119
       119
       -
       	var metadata struct {

     

       120
       120
       -
       		JWKSURI string `json:"jwks_uri"`

     

       121
       121
       -
       	}

     

       122
       122
       -
       	if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil {

     

       123
       123
       -
       		return nil, fmt.Errorf("failed to decode metadata: %w", err)

     

       124
       124
       -
       	}

     

       125
       125
       -
       

     

       126
       126
       -
       	if metadata.JWKSURI == "" {

     

       127
       127
       -
       		return nil, fmt.Errorf("jwks_uri not found in metadata")

     

       128
       128
       -
       	}

     

       129
       129
       -
       

     

       130
       130
       -
       	// Step 2: Fetch JWKS from the JWKS URI

     

       131
       131
       -
       	jwksReq, err := http.NewRequestWithContext(ctx, "GET", metadata.JWKSURI, nil)

     

       132
       132
       -
       	if err != nil {

     

       133
       133
       -
       		return nil, fmt.Errorf("failed to create JWKS request: %w", err)

     

       134
       134
       -
       	}

     

       135
       135
       -
       

     

       136
       136
       -
       	jwksResp, err := f.httpClient.Do(jwksReq)

     

       137
       137
       -
       	if err != nil {

     

       138
       138
       -
       		return nil, fmt.Errorf("failed to fetch JWKS: %w", err)

     

       139
       139
       -
       	}

     

       140
       140
       -
       	defer func() {

     

       141
       141
       -
       		_ = jwksResp.Body.Close()

     

       142
       142
       -
       	}()

     

       143
       143
       -
       

     

       144
       144
       -
       	if jwksResp.StatusCode != http.StatusOK {

     

       145
       145
       -
       		return nil, fmt.Errorf("JWKS endpoint returned status %d", jwksResp.StatusCode)

     

       146
       146
       -
       	}

     

       147
       147
       -
       

     

       148
       148
       -
       	var jwks JWKS

     

       149
       149
       -
       	if err := json.NewDecoder(jwksResp.Body).Decode(&jwks); err != nil {

     

       150
       150
       -
       		return nil, fmt.Errorf("failed to decode JWKS: %w", err)

     

       151
       151
       -
       	}

     

       152
       152
       -
       

     

       153
       153
       -
       	if len(jwks.Keys) == 0 {

     

       154
       154
       -
       		return nil, fmt.Errorf("no keys found in JWKS")

     

       155
       155
       -
       	}

     

       156
       156
       -
       

     

       157
       157
       -
       	return &jwks, nil

     

       158
       158
       -
       }

     

       159
       159
       -
       

     

       160
       160
       -
       // cacheJWKS stores JWKS in the cache

     

       161
       161
       -
       func (f *CachedJWKSFetcher) cacheJWKS(issuer string, jwks *JWKS) {

     

       162
       162
       -
       	f.cacheMutex.Lock()

     

       163
       163
       -
       	defer f.cacheMutex.Unlock()

     

       164
       164
       -
       

     

       165
       165
       -
       	f.cache[issuer] = &cachedJWKS{

     

       166
       166
       -
       		jwks:      jwks,

     

       167
       167
       -
       		expiresAt: time.Now().Add(f.cacheTTL),

     

       168
       168
       -
       	}

     

       169
       169
       -
       }

     

       170
       170
       -
       

     

       171
       171
       -
       // ClearCache clears the entire JWKS cache

     

       172
       172
       -
       func (f *CachedJWKSFetcher) ClearCache() {

     

       173
       173
       -
       	f.cacheMutex.Lock()

     

       174
       174
       -
       	defer f.cacheMutex.Unlock()

     

       175
       175
       -
       	f.cache = make(map[string]*cachedJWKS)

     

       176
       176
       -
       }

     

       177
       177
       -
       

     

       178
       178
       -
       // CleanupExpiredCache removes expired entries from the cache

     

       179
       179
       -
       func (f *CachedJWKSFetcher) CleanupExpiredCache() {

     

       180
       180
       -
       	f.cacheMutex.Lock()

     

       181
       181
       -
       	defer f.cacheMutex.Unlock()

     

       182
       182
       -
       

     

       183
       183
       -
       	now := time.Now()

     

       184
       184
       -
       	for issuer, cached := range f.cache {

     

       185
       185
       -
       		if now.After(cached.expiresAt) {

     

       186
       186
       -
       			delete(f.cache, issuer)

     

       187
       187
       -
       		}

     

       188
       188
       -
       	}

     

       189
       189
       -
       }

-496

internal/atproto/auth/jwt_test.go

···

       1
       1
       -
       package auth

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"testing"

     

       6
       6
       -
       	"time"

     

       7
       7
       -
       

     

       8
       8
       -
       	"github.com/golang-jwt/jwt/v5"

     

       9
       9
       -
       )

     

       10
       10
       -
       

     

       11
       11
       -
       func TestParseJWT(t *testing.T) {

     

       12
       12
       -
       	// Create a test JWT token

     

       13
       13
       -
       	claims := &Claims{

     

       14
       14
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       15
       15
       -
       			Subject:   "did:plc:test123",

     

       16
       16
       -
       			Issuer:    "https://test-pds.example.com",

     

       17
       17
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       18
       18
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       19
       19
       -
       		},

     

       20
       20
       -
       		Scope: "atproto transition:generic",

     

       21
       21
       -
       	}

     

       22
       22
       -
       

     

       23
       23
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

     

       24
       24
       -
       	tokenString, err := token.SignedString([]byte("test-secret"))

     

       25
       25
       -
       	if err != nil {

     

       26
       26
       -
       		t.Fatalf("Failed to create test token: %v", err)

     

       27
       27
       -
       	}

     

       28
       28
       -
       

     

       29
       29
       -
       	// Test parsing

     

       30
       30
       -
       	parsedClaims, err := ParseJWT(tokenString)

     

       31
       31
       -
       	if err != nil {

     

       32
       32
       -
       		t.Fatalf("ParseJWT failed: %v", err)

     

       33
       33
       -
       	}

     

       34
       34
       -
       

     

       35
       35
       -
       	if parsedClaims.Subject != "did:plc:test123" {

     

       36
       36
       -
       		t.Errorf("Expected subject 'did:plc:test123', got '%s'", parsedClaims.Subject)

     

       37
       37
       -
       	}

     

       38
       38
       -
       

     

       39
       39
       -
       	if parsedClaims.Issuer != "https://test-pds.example.com" {

     

       40
       40
       -
       		t.Errorf("Expected issuer 'https://test-pds.example.com', got '%s'", parsedClaims.Issuer)

     

       41
       41
       -
       	}

     

       42
       42
       -
       

     

       43
       43
       -
       	if parsedClaims.Scope != "atproto transition:generic" {

     

       44
       44
       -
       		t.Errorf("Expected scope 'atproto transition:generic', got '%s'", parsedClaims.Scope)

     

       45
       45
       -
       	}

     

       46
       46
       -
       }

     

       47
       47
       -
       

     

       48
       48
       -
       func TestParseJWT_MissingSubject(t *testing.T) {

     

       49
       49
       -
       	// Create a token without subject

     

       50
       50
       -
       	claims := &Claims{

     

       51
       51
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       52
       52
       -
       			Issuer:    "https://test-pds.example.com",

     

       53
       53
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       54
       54
       -
       		},

     

       55
       55
       -
       	}

     

       56
       56
       -
       

     

       57
       57
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

     

       58
       58
       -
       	tokenString, err := token.SignedString([]byte("test-secret"))

     

       59
       59
       -
       	if err != nil {

     

       60
       60
       -
       		t.Fatalf("Failed to create test token: %v", err)

     

       61
       61
       -
       	}

     

       62
       62
       -
       

     

       63
       63
       -
       	// Test parsing - should fail

     

       64
       64
       -
       	_, err = ParseJWT(tokenString)

     

       65
       65
       -
       	if err == nil {

     

       66
       66
       -
       		t.Error("Expected error for missing subject, got nil")

     

       67
       67
       -
       	}

     

       68
       68
       -
       }

     

       69
       69
       -
       

     

       70
       70
       -
       func TestParseJWT_MissingIssuer(t *testing.T) {

     

       71
       71
       -
       	// Create a token without issuer

     

       72
       72
       -
       	claims := &Claims{

     

       73
       73
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       74
       74
       -
       			Subject:   "did:plc:test123",

     

       75
       75
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       76
       76
       -
       		},

     

       77
       77
       -
       	}

     

       78
       78
       -
       

     

       79
       79
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

     

       80
       80
       -
       	tokenString, err := token.SignedString([]byte("test-secret"))

     

       81
       81
       -
       	if err != nil {

     

       82
       82
       -
       		t.Fatalf("Failed to create test token: %v", err)

     

       83
       83
       -
       	}

     

       84
       84
       -
       

     

       85
       85
       -
       	// Test parsing - should fail

     

       86
       86
       -
       	_, err = ParseJWT(tokenString)

     

       87
       87
       -
       	if err == nil {

     

       88
       88
       -
       		t.Error("Expected error for missing issuer, got nil")

     

       89
       89
       -
       	}

     

       90
       90
       -
       }

     

       91
       91
       -
       

     

       92
       92
       -
       func TestParseJWT_WithBearerPrefix(t *testing.T) {

     

       93
       93
       -
       	// Create a test JWT token

     

       94
       94
       -
       	claims := &Claims{

     

       95
       95
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       96
       96
       -
       			Subject:   "did:plc:test123",

     

       97
       97
       -
       			Issuer:    "https://test-pds.example.com",

     

       98
       98
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       99
       99
       -
       		},

     

       100
       100
       -
       	}

     

       101
       101
       -
       

     

       102
       102
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

     

       103
       103
       -
       	tokenString, err := token.SignedString([]byte("test-secret"))

     

       104
       104
       -
       	if err != nil {

     

       105
       105
       -
       		t.Fatalf("Failed to create test token: %v", err)

     

       106
       106
       -
       	}

     

       107
       107
       -
       

     

       108
       108
       -
       	// Test parsing with Bearer prefix

     

       109
       109
       -
       	parsedClaims, err := ParseJWT("Bearer " + tokenString)

     

       110
       110
       -
       	if err != nil {

     

       111
       111
       -
       		t.Fatalf("ParseJWT failed with Bearer prefix: %v", err)

     

       112
       112
       -
       	}

     

       113
       113
       -
       

     

       114
       114
       -
       	if parsedClaims.Subject != "did:plc:test123" {

     

       115
       115
       -
       		t.Errorf("Expected subject 'did:plc:test123', got '%s'", parsedClaims.Subject)

     

       116
       116
       -
       	}

     

       117
       117
       -
       }

     

       118
       118
       -
       

     

       119
       119
       -
       func TestValidateClaims_Expired(t *testing.T) {

     

       120
       120
       -
       	claims := &Claims{

     

       121
       121
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       122
       122
       -
       			Subject:   "did:plc:test123",

     

       123
       123
       -
       			Issuer:    "https://test-pds.example.com",

     

       124
       124
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(-1 * time.Hour)), // Expired

     

       125
       125
       -
       		},

     

       126
       126
       -
       	}

     

       127
       127
       -
       

     

       128
       128
       -
       	err := validateClaims(claims)

     

       129
       129
       -
       	if err == nil {

     

       130
       130
       -
       		t.Error("Expected error for expired token, got nil")

     

       131
       131
       -
       	}

     

       132
       132
       -
       }

     

       133
       133
       -
       

     

       134
       134
       -
       func TestValidateClaims_InvalidDID(t *testing.T) {

     

       135
       135
       -
       	claims := &Claims{

     

       136
       136
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       137
       137
       -
       			Subject:   "invalid-did-format",

     

       138
       138
       -
       			Issuer:    "https://test-pds.example.com",

     

       139
       139
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       140
       140
       -
       		},

     

       141
       141
       -
       	}

     

       142
       142
       -
       

     

       143
       143
       -
       	err := validateClaims(claims)

     

       144
       144
       -
       	if err == nil {

     

       145
       145
       -
       		t.Error("Expected error for invalid DID format, got nil")

     

       146
       146
       -
       	}

     

       147
       147
       -
       }

     

       148
       148
       -
       

     

       149
       149
       -
       func TestExtractKeyID(t *testing.T) {

     

       150
       150
       -
       	// Create a test JWT token with kid in header

     

       151
       151
       -
       	token := jwt.New(jwt.SigningMethodRS256)

     

       152
       152
       -
       	token.Header["kid"] = "test-key-id"

     

       153
       153
       -
       	token.Claims = &Claims{

     

       154
       154
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       155
       155
       -
       			Subject: "did:plc:test123",

     

       156
       156
       -
       			Issuer:  "https://test-pds.example.com",

     

       157
       157
       -
       		},

     

       158
       158
       -
       	}

     

       159
       159
       -
       

     

       160
       160
       -
       	// Sign with a dummy RSA key (we just need a valid token structure)

     

       161
       161
       -
       	tokenString, err := token.SignedString([]byte("dummy"))

     

       162
       162
       -
       	if err == nil {

     

       163
       163
       -
       		// If it succeeds (shouldn't with wrong key type, but let's handle it)

     

       164
       164
       -
       		kid, err := ExtractKeyID(tokenString)

     

       165
       165
       -
       		if err != nil {

     

       166
       166
       -
       			t.Logf("ExtractKeyID failed (expected if signing fails): %v", err)

     

       167
       167
       -
       		} else if kid != "test-key-id" {

     

       168
       168
       -
       			t.Errorf("Expected kid 'test-key-id', got '%s'", kid)

     

       169
       169
       -
       		}

     

       170
       170
       -
       	}

     

       171
       171
       -
       }

     

       172
       172
       -
       

     

       173
       173
       -
       // === HS256 Verification Tests ===

     

       174
       174
       -
       

     

       175
       175
       -
       // mockJWKSFetcher is a mock implementation of JWKSFetcher for testing

     

       176
       176
       -
       type mockJWKSFetcher struct {

     

       177
       177
       -
       	publicKey interface{}

     

       178
       178
       -
       	err       error

     

       179
       179
       -
       }

     

       180
       180
       -
       

     

       181
       181
       -
       func (m *mockJWKSFetcher) FetchPublicKey(ctx context.Context, issuer, token string) (interface{}, error) {

     

       182
       182
       -
       	return m.publicKey, m.err

     

       183
       183
       -
       }

     

       184
       184
       -
       

     

       185
       185
       -
       func createHS256Token(t *testing.T, subject, issuer, secret string, expiry time.Duration) string {

     

       186
       186
       -
       	t.Helper()

     

       187
       187
       -
       	claims := &Claims{

     

       188
       188
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       189
       189
       -
       			Subject:   subject,

     

       190
       190
       -
       			Issuer:    issuer,

     

       191
       191
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(expiry)),

     

       192
       192
       -
       			IssuedAt:  jwt.NewNumericDate(time.Now()),

     

       193
       193
       -
       		},

     

       194
       194
       -
       		Scope: "atproto transition:generic",

     

       195
       195
       -
       	}

     

       196
       196
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)

     

       197
       197
       -
       	tokenString, err := token.SignedString([]byte(secret))

     

       198
       198
       -
       	if err != nil {

     

       199
       199
       -
       		t.Fatalf("Failed to create test token: %v", err)

     

       200
       200
       -
       	}

     

       201
       201
       -
       	return tokenString

     

       202
       202
       -
       }

     

       203
       203
       -
       

     

       204
       204
       -
       func TestVerifyJWT_HS256_Valid(t *testing.T) {

     

       205
       205
       -
       	// Setup: Configure environment for HS256 verification

     

       206
       206
       -
       	secret := "test-jwt-secret-key-12345"

     

       207
       207
       -
       	issuer := "https://pds.coves.social"

     

       208
       208
       -
       

     

       209
       209
       -
       	ResetJWTConfigForTesting()

     

       210
       210
       -
       	t.Setenv("PDS_JWT_SECRET", secret)

     

       211
       211
       -
       	t.Setenv("HS256_ISSUERS", issuer)

     

       212
       212
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       213
       213
       -
       

     

       214
       214
       -
       	tokenString := createHS256Token(t, "did:plc:test123", issuer, secret, 1*time.Hour)

     

       215
       215
       -
       

     

       216
       216
       -
       	// Verify token

     

       217
       217
       -
       	claims, err := VerifyJWT(context.Background(), tokenString, &mockJWKSFetcher{})

     

       218
       218
       -
       	if err != nil {

     

       219
       219
       -
       		t.Fatalf("VerifyJWT failed for valid HS256 token: %v", err)

     

       220
       220
       -
       	}

     

       221
       221
       -
       

     

       222
       222
       -
       	if claims.Subject != "did:plc:test123" {

     

       223
       223
       -
       		t.Errorf("Expected subject 'did:plc:test123', got '%s'", claims.Subject)

     

       224
       224
       -
       	}

     

       225
       225
       -
       	if claims.Issuer != issuer {

     

       226
       226
       -
       		t.Errorf("Expected issuer '%s', got '%s'", issuer, claims.Issuer)

     

       227
       227
       -
       	}

     

       228
       228
       -
       }

     

       229
       229
       -
       

     

       230
       230
       -
       func TestVerifyJWT_HS256_WrongSecret(t *testing.T) {

     

       231
       231
       -
       	// Setup: Configure environment with one secret, sign with another

     

       232
       232
       -
       	issuer := "https://pds.coves.social"

     

       233
       233
       -
       

     

       234
       234
       -
       	ResetJWTConfigForTesting()

     

       235
       235
       -
       	t.Setenv("PDS_JWT_SECRET", "correct-secret")

     

       236
       236
       -
       	t.Setenv("HS256_ISSUERS", issuer)

     

       237
       237
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       238
       238
       -
       

     

       239
       239
       -
       	// Create token with wrong secret

     

       240
       240
       -
       	tokenString := createHS256Token(t, "did:plc:test123", issuer, "wrong-secret", 1*time.Hour)

     

       241
       241
       -
       

     

       242
       242
       -
       	// Verify should fail

     

       243
       243
       -
       	_, err := VerifyJWT(context.Background(), tokenString, &mockJWKSFetcher{})

     

       244
       244
       -
       	if err == nil {

     

       245
       245
       -
       		t.Error("Expected error for HS256 token with wrong secret, got nil")

     

       246
       246
       -
       	}

     

       247
       247
       -
       }

     

       248
       248
       -
       

     

       249
       249
       -
       func TestVerifyJWT_HS256_SecretNotConfigured(t *testing.T) {

     

       250
       250
       -
       	// Setup: Whitelist issuer but don't configure secret

     

       251
       251
       -
       	issuer := "https://pds.coves.social"

     

       252
       252
       -
       

     

       253
       253
       -
       	ResetJWTConfigForTesting()

     

       254
       254
       -
       	t.Setenv("PDS_JWT_SECRET", "") // Ensure secret is not set (empty = not configured)

     

       255
       255
       -
       	t.Setenv("HS256_ISSUERS", issuer)

     

       256
       256
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       257
       257
       -
       

     

       258
       258
       -
       	tokenString := createHS256Token(t, "did:plc:test123", issuer, "any-secret", 1*time.Hour)

     

       259
       259
       -
       

     

       260
       260
       -
       	// Verify should fail with descriptive error

     

       261
       261
       -
       	_, err := VerifyJWT(context.Background(), tokenString, &mockJWKSFetcher{})

     

       262
       262
       -
       	if err == nil {

     

       263
       263
       -
       		t.Error("Expected error when PDS_JWT_SECRET not configured, got nil")

     

       264
       264
       -
       	}

     

       265
       265
       -
       	if err != nil && !contains(err.Error(), "PDS_JWT_SECRET not configured") {

     

       266
       266
       -
       		t.Errorf("Expected error about PDS_JWT_SECRET not configured, got: %v", err)

     

       267
       267
       -
       	}

     

       268
       268
       -
       }

     

       269
       269
       -
       

     

       270
       270
       -
       // === Algorithm Confusion Attack Prevention Tests ===

     

       271
       271
       -
       

     

       272
       272
       -
       func TestVerifyJWT_AlgorithmConfusionAttack_HS256WithNonWhitelistedIssuer(t *testing.T) {

     

       273
       273
       -
       	// SECURITY TEST: This tests the algorithm confusion attack prevention

     

       274
       274
       -
       	// An attacker tries to use HS256 with an issuer that should use RS256/ES256

     

       275
       275
       -
       

     

       276
       276
       -
       	ResetJWTConfigForTesting()

     

       277
       277
       -
       	t.Setenv("PDS_JWT_SECRET", "some-secret")

     

       278
       278
       -
       	t.Setenv("HS256_ISSUERS", "https://trusted.example.com") // Different from token issuer

     

       279
       279
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       280
       280
       -
       

     

       281
       281
       -
       	// Create HS256 token with non-whitelisted issuer (simulating attack)

     

       282
       282
       -
       	tokenString := createHS256Token(t, "did:plc:attacker", "https://victim-pds.example.com", "some-secret", 1*time.Hour)

     

       283
       283
       -
       

     

       284
       284
       -
       	// Verify should fail because issuer is not in HS256 whitelist

     

       285
       285
       -
       	_, err := VerifyJWT(context.Background(), tokenString, &mockJWKSFetcher{})

     

       286
       286
       -
       	if err == nil {

     

       287
       287
       -
       		t.Error("SECURITY VULNERABILITY: HS256 token accepted for non-whitelisted issuer")

     

       288
       288
       -
       	}

     

       289
       289
       -
       	if err != nil && !contains(err.Error(), "not in HS256_ISSUERS whitelist") {

     

       290
       290
       -
       		t.Errorf("Expected error about HS256 not allowed for issuer, got: %v", err)

     

       291
       291
       -
       	}

     

       292
       292
       -
       }

     

       293
       293
       -
       

     

       294
       294
       -
       func TestVerifyJWT_AlgorithmConfusionAttack_EmptyWhitelist(t *testing.T) {

     

       295
       295
       -
       	// SECURITY TEST: When no issuers are whitelisted for HS256, all HS256 tokens should be rejected

     

       296
       296
       -
       

     

       297
       297
       -
       	ResetJWTConfigForTesting()

     

       298
       298
       -
       	t.Setenv("PDS_JWT_SECRET", "some-secret")

     

       299
       299
       -
       	t.Setenv("HS256_ISSUERS", "") // Empty whitelist

     

       300
       300
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       301
       301
       -
       

     

       302
       302
       -
       	tokenString := createHS256Token(t, "did:plc:test123", "https://any-pds.example.com", "some-secret", 1*time.Hour)

     

       303
       303
       -
       

     

       304
       304
       -
       	// Verify should fail because no issuers are whitelisted for HS256

     

       305
       305
       -
       	_, err := VerifyJWT(context.Background(), tokenString, &mockJWKSFetcher{})

     

       306
       306
       -
       	if err == nil {

     

       307
       307
       -
       		t.Error("SECURITY VULNERABILITY: HS256 token accepted with empty issuer whitelist")

     

       308
       308
       -
       	}

     

       309
       309
       -
       }

     

       310
       310
       -
       

     

       311
       311
       -
       func TestVerifyJWT_IssuerRequiresHS256ButTokenUsesRS256(t *testing.T) {

     

       312
       312
       -
       	// Test that issuer whitelisted for HS256 rejects tokens claiming to use RS256

     

       313
       313
       -
       	issuer := "https://pds.coves.social"

     

       314
       314
       -
       

     

       315
       315
       -
       	ResetJWTConfigForTesting()

     

       316
       316
       -
       	t.Setenv("PDS_JWT_SECRET", "test-secret")

     

       317
       317
       -
       	t.Setenv("HS256_ISSUERS", issuer)

     

       318
       318
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       319
       319
       -
       

     

       320
       320
       -
       	// Create RS256-signed token (can't actually sign without RSA key, but we can test the header check)

     

       321
       321
       -
       	claims := &Claims{

     

       322
       322
       -
       		RegisteredClaims: jwt.RegisteredClaims{

     

       323
       323
       -
       			Subject:   "did:plc:test123",

     

       324
       324
       -
       			Issuer:    issuer,

     

       325
       325
       -
       			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),

     

       326
       326
       -
       		},

     

       327
       327
       -
       	}

     

       328
       328
       -
       	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)

     

       329
       329
       -
       	// This will create an invalid signature but valid header structure

     

       330
       330
       -
       	// The test should fail at algorithm check, not signature verification

     

       331
       331
       -
       	tokenString, _ := token.SignedString([]byte("dummy-key"))

     

       332
       332
       -
       

     

       333
       333
       -
       	if tokenString != "" {

     

       334
       334
       -
       		_, err := VerifyJWT(context.Background(), tokenString, &mockJWKSFetcher{})

     

       335
       335
       -
       		if err == nil {

     

       336
       336
       -
       			t.Error("Expected error when HS256 issuer receives non-HS256 token")

     

       337
       337
       -
       		}

     

       338
       338
       -
       	}

     

       339
       339
       -
       }

     

       340
       340
       -
       

     

       341
       341
       -
       // === ParseJWTHeader Tests ===

     

       342
       342
       -
       

     

       343
       343
       -
       func TestParseJWTHeader_Valid(t *testing.T) {

     

       344
       344
       -
       	tokenString := createHS256Token(t, "did:plc:test123", "https://test.example.com", "secret", 1*time.Hour)

     

       345
       345
       -
       

     

       346
       346
       -
       	header, err := ParseJWTHeader(tokenString)

     

       347
       347
       -
       	if err != nil {

     

       348
       348
       -
       		t.Fatalf("ParseJWTHeader failed: %v", err)

     

       349
       349
       -
       	}

     

       350
       350
       -
       

     

       351
       351
       -
       	if header.Alg != AlgorithmHS256 {

     

       352
       352
       -
       		t.Errorf("Expected alg '%s', got '%s'", AlgorithmHS256, header.Alg)

     

       353
       353
       -
       	}

     

       354
       354
       -
       }

     

       355
       355
       -
       

     

       356
       356
       -
       func TestParseJWTHeader_WithBearerPrefix(t *testing.T) {

     

       357
       357
       -
       	tokenString := createHS256Token(t, "did:plc:test123", "https://test.example.com", "secret", 1*time.Hour)

     

       358
       358
       -
       

     

       359
       359
       -
       	header, err := ParseJWTHeader("Bearer " + tokenString)

     

       360
       360
       -
       	if err != nil {

     

       361
       361
       -
       		t.Fatalf("ParseJWTHeader failed with Bearer prefix: %v", err)

     

       362
       362
       -
       	}

     

       363
       363
       -
       

     

       364
       364
       -
       	if header.Alg != AlgorithmHS256 {

     

       365
       365
       -
       		t.Errorf("Expected alg '%s', got '%s'", AlgorithmHS256, header.Alg)

     

       366
       366
       -
       	}

     

       367
       367
       -
       }

     

       368
       368
       -
       

     

       369
       369
       -
       func TestParseJWTHeader_InvalidFormat(t *testing.T) {

     

       370
       370
       -
       	testCases := []struct {

     

       371
       371
       -
       		name  string

     

       372
       372
       -
       		input string

     

       373
       373
       -
       	}{

     

       374
       374
       -
       		{"empty string", ""},

     

       375
       375
       -
       		{"single part", "abc"},

     

       376
       376
       -
       		{"two parts", "abc.def"},

     

       377
       377
       -
       		{"too many parts", "a.b.c.d"},

     

       378
       378
       -
       	}

     

       379
       379
       -
       

     

       380
       380
       -
       	for _, tc := range testCases {

     

       381
       381
       -
       		t.Run(tc.name, func(t *testing.T) {

     

       382
       382
       -
       			_, err := ParseJWTHeader(tc.input)

     

       383
       383
       -
       			if err == nil {

     

       384
       384
       -
       				t.Errorf("Expected error for invalid JWT format '%s', got nil", tc.input)

     

       385
       385
       -
       			}

     

       386
       386
       -
       		})

     

       387
       387
       -
       	}

     

       388
       388
       -
       }

     

       389
       389
       -
       

     

       390
       390
       -
       // === shouldUseHS256 and isHS256IssuerWhitelisted Tests ===

     

       391
       391
       -
       

     

       392
       392
       -
       func TestIsHS256IssuerWhitelisted_Whitelisted(t *testing.T) {

     

       393
       393
       -
       	ResetJWTConfigForTesting()

     

       394
       394
       -
       	t.Setenv("HS256_ISSUERS", "https://pds1.example.com,https://pds2.example.com")

     

       395
       395
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       396
       396
       -
       

     

       397
       397
       -
       	if !isHS256IssuerWhitelisted("https://pds1.example.com") {

     

       398
       398
       -
       		t.Error("Expected pds1 to be whitelisted")

     

       399
       399
       -
       	}

     

       400
       400
       -
       	if !isHS256IssuerWhitelisted("https://pds2.example.com") {

     

       401
       401
       -
       		t.Error("Expected pds2 to be whitelisted")

     

       402
       402
       -
       	}

     

       403
       403
       -
       }

     

       404
       404
       -
       

     

       405
       405
       -
       func TestIsHS256IssuerWhitelisted_NotWhitelisted(t *testing.T) {

     

       406
       406
       -
       	ResetJWTConfigForTesting()

     

       407
       407
       -
       	t.Setenv("HS256_ISSUERS", "https://pds1.example.com")

     

       408
       408
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       409
       409
       -
       

     

       410
       410
       -
       	if isHS256IssuerWhitelisted("https://attacker.example.com") {

     

       411
       411
       -
       		t.Error("Expected non-whitelisted issuer to return false")

     

       412
       412
       -
       	}

     

       413
       413
       -
       }

     

       414
       414
       -
       

     

       415
       415
       -
       func TestIsHS256IssuerWhitelisted_EmptyWhitelist(t *testing.T) {

     

       416
       416
       -
       	ResetJWTConfigForTesting()

     

       417
       417
       -
       	t.Setenv("HS256_ISSUERS", "") // Empty whitelist

     

       418
       418
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       419
       419
       -
       

     

       420
       420
       -
       	if isHS256IssuerWhitelisted("https://any.example.com") {

     

       421
       421
       -
       		t.Error("Expected false when whitelist is empty (safe default)")

     

       422
       422
       -
       	}

     

       423
       423
       -
       }

     

       424
       424
       -
       

     

       425
       425
       -
       func TestIsHS256IssuerWhitelisted_WhitespaceHandling(t *testing.T) {

     

       426
       426
       -
       	ResetJWTConfigForTesting()

     

       427
       427
       -
       	t.Setenv("HS256_ISSUERS", "  https://pds1.example.com  ,  https://pds2.example.com  ")

     

       428
       428
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       429
       429
       -
       

     

       430
       430
       -
       	if !isHS256IssuerWhitelisted("https://pds1.example.com") {

     

       431
       431
       -
       		t.Error("Expected whitespace-trimmed issuer to be whitelisted")

     

       432
       432
       -
       	}

     

       433
       433
       -
       }

     

       434
       434
       -
       

     

       435
       435
       -
       // === shouldUseHS256 Tests (kid-based logic) ===

     

       436
       436
       -
       

     

       437
       437
       -
       func TestShouldUseHS256_WithKid_AlwaysFalse(t *testing.T) {

     

       438
       438
       -
       	// Tokens with kid should NEVER use HS256, regardless of issuer whitelist

     

       439
       439
       -
       	ResetJWTConfigForTesting()

     

       440
       440
       -
       	t.Setenv("HS256_ISSUERS", "https://whitelisted.example.com")

     

       441
       441
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       442
       442
       -
       

     

       443
       443
       -
       	header := &JWTHeader{

     

       444
       444
       -
       		Alg: AlgorithmHS256,

     

       445
       445
       -
       		Kid: "some-key-id", // Has kid

     

       446
       446
       -
       	}

     

       447
       447
       -
       

     

       448
       448
       -
       	// Even whitelisted issuer should not use HS256 if token has kid

     

       449
       449
       -
       	if shouldUseHS256(header, "https://whitelisted.example.com") {

     

       450
       450
       -
       		t.Error("Tokens with kid should never use HS256 (supports federation)")

     

       451
       451
       -
       	}

     

       452
       452
       -
       }

     

       453
       453
       -
       

     

       454
       454
       -
       func TestShouldUseHS256_WithoutKid_WhitelistedIssuer(t *testing.T) {

     

       455
       455
       -
       	ResetJWTConfigForTesting()

     

       456
       456
       -
       	t.Setenv("HS256_ISSUERS", "https://my-pds.example.com")

     

       457
       457
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       458
       458
       -
       

     

       459
       459
       -
       	header := &JWTHeader{

     

       460
       460
       -
       		Alg: AlgorithmHS256,

     

       461
       461
       -
       		Kid: "", // No kid

     

       462
       462
       -
       	}

     

       463
       463
       -
       

     

       464
       464
       -
       	if !shouldUseHS256(header, "https://my-pds.example.com") {

     

       465
       465
       -
       		t.Error("Token without kid from whitelisted issuer should use HS256")

     

       466
       466
       -
       	}

     

       467
       467
       -
       }

     

       468
       468
       -
       

     

       469
       469
       -
       func TestShouldUseHS256_WithoutKid_NotWhitelisted(t *testing.T) {

     

       470
       470
       -
       	ResetJWTConfigForTesting()

     

       471
       471
       -
       	t.Setenv("HS256_ISSUERS", "https://my-pds.example.com")

     

       472
       472
       -
       	t.Cleanup(ResetJWTConfigForTesting)

     

       473
       473
       -
       

     

       474
       474
       -
       	header := &JWTHeader{

     

       475
       475
       -
       		Alg: AlgorithmHS256,

     

       476
       476
       -
       		Kid: "", // No kid

     

       477
       477
       -
       	}

     

       478
       478
       -
       

     

       479
       479
       -
       	if shouldUseHS256(header, "https://external-pds.example.com") {

     

       480
       480
       -
       		t.Error("Token without kid from non-whitelisted issuer should NOT use HS256")

     

       481
       481
       -
       	}

     

       482
       482
       -
       }

     

       483
       483
       -
       

     

       484
       484
       -
       // Helper function

     

       485
       485
       -
       func contains(s, substr string) bool {

     

       486
       486
       -
       	return len(s) >= len(substr) && (s == substr || len(s) > 0 && containsHelper(s, substr))

     

       487
       487
       -
       }

     

       488
       488
       -
       

     

       489
       489
       -
       func containsHelper(s, substr string) bool {

     

       490
       490
       -
       	for i := 0; i <= len(s)-len(substr); i++ {

     

       491
       491
       -
       		if s[i:i+len(substr)] == substr {

     

       492
       492
       -
       			return true

     

       493
       493
       -
       		}

     

       494
       494
       -
       	}

     

       495
       495
       -
       	return false

     

       496
       496
       -
       }

docker-compose.prod.yml

···

       62
       62
        
             # Instance identity

     

       63
       63
        
             INSTANCE_DID: did:web:coves.social

     

       64
       64
        
             INSTANCE_DOMAIN: coves.social

     

       65
       65
       +
             APPVIEW_PUBLIC_URL: https://coves.social

     

       65
       66
        
       

     

       66
       67
        
             # PDS connection (separate domain!)

     

       67
       68
        
             PDS_URL: https://coves.me

+3 -1

internal/atproto/oauth/client.go

···

       82
       82
        
       		clientConfig = oauth.NewLocalhostConfig(callbackURL, config.Scopes)

     

       83
       83
        
       	} else {

     

       84
       84
        
       		// Production mode: public OAuth client with HTTPS

     

       85
       85
       +
       		// client_id must be the URL of the client metadata document per atproto OAuth spec

     

       86
       86
       +
       		clientID := config.PublicURL + "/oauth/client-metadata.json"

     

       85
       87
        
       		callbackURL := config.PublicURL + "/oauth/callback"

     

       86
       86
       -
       		clientConfig = oauth.NewPublicConfig(config.PublicURL, callbackURL, config.Scopes)

     

       88
       88
       +
       		clientConfig = oauth.NewPublicConfig(clientID, callbackURL, config.Scopes)

     

       87
       89
        
       	}

     

       88
       90
        
       

     

       89
       91
        
       	// Set user agent

+6 -5

internal/api/routes/oauth.go

···

       38
       38
        
       	// Use login limiter since callback completes the authentication flow

     

       39
       39
        
       	r.With(corsMiddleware(allowedOrigins), loginLimiter.Middleware).Get("/oauth/callback", handler.HandleCallback)

     

       40
       40
        
       

     

       41
       41
       -
       	// Mobile Universal Link callback route

     

       42
       42
       -
       	// This route is used for iOS Universal Links and Android App Links

     

       43
       43
       -
       	// Path must match the path in .well-known/apple-app-site-association

     

       44
       44
       -
       	// Uses the same handler as web callback - the system routes it to the mobile app

     

       45
       45
       -
       	r.With(loginLimiter.Middleware).Get("/app/oauth/callback", handler.HandleCallback)

     

       41
       41
       +
       	// Mobile Universal Link callback route (fallback when app doesn't intercept)

     

       42
       42
       +
       	// This route exists for iOS Universal Links and Android App Links.

     

       43
       43
       +
       	// When properly configured, the mobile OS intercepts this URL and opens the app

     

       44
       44
       +
       	// BEFORE the request reaches the server. If this handler is reached, it means

     

       45
       45
       +
       	// Universal Links failed to intercept.

     

       46
       46
       +
       	r.With(loginLimiter.Middleware).Get("/app/oauth/callback", handler.HandleMobileDeepLinkFallback)

     

       46
       47
        
       

     

       47
       48
        
       	// Session management - dedicated rate limits

     

       48
       49
        
       	r.With(logoutLimiter.Middleware).Post("/oauth/logout", handler.HandleLogout)

+11

static/.well-known/apple-app-site-association

···

       1
       1
       +
       {

     

       2
       2
       +
         "applinks": {

     

       3
       3
       +
           "apps": [],

     

       4
       4
       +
           "details": [

     

       5
       5
       +
             {

     

       6
       6
       +
               "appID": "TEAM_ID.social.coves",

     

       7
       7
       +
               "paths": ["/app/oauth/callback"]

     

       8
       8
       +
             }

     

       9
       9
       +
           ]

     

       10
       10
       +
         }

     

       11
       11
       +
       }

+10

static/.well-known/assetlinks.json

···

       1
       1
       +
       [{

     

       2
       2
       +
         "relation": ["delegate_permission/common.handle_all_urls"],

     

       3
       3
       +
         "target": {

     

       4
       4
       +
           "namespace": "android_app",

     

       5
       5
       +
           "package_name": "social.coves",

     

       6
       6
       +
           "sha256_cert_fingerprints": [

     

       7
       7
       +
             "0B:D8:8C:99:66:25:E5:CD:06:54:80:88:01:6F:B7:38:B9:F4:5B:41:71:F7:95:C8:68:94:87:AD:EA:9F:D9:ED"

     

       8
       8
       +
           ]

     

       9
       9
       +
         }

     

       10
       10
       +
       }]

+16 -9

internal/atproto/oauth/handlers_test.go

···

       171
       171
        
       }

     

       172
       172
        
       

     

       173
       173
        
       // TestIsMobileRedirectURI tests mobile redirect URI validation with EXACT URI matching

     

       174
       174
       -
       // Only Universal Links (HTTPS) are allowed - custom schemes are blocked for security

     

       174
       174
       +
       // Per atproto spec, custom schemes must match client_id hostname in reverse-domain order

     

       175
       175
        
       func TestIsMobileRedirectURI(t *testing.T) {

     

       176
       176
        
       	tests := []struct {

     

       177
       177
        
       		uri      string

     

       178
       178
        
       		expected bool

     

       179
       179
        
       	}{

     

       180
       180
       -
       		{"https://coves.social/app/oauth/callback", true}, // Universal Link - allowed

     

       181
       181
       -
       		{"coves-app://oauth/callback", false},             // Custom scheme - blocked (insecure)

     

       182
       182
       -
       		{"coves://oauth/callback", false},                 // Custom scheme - blocked (insecure)

     

       183
       183
       -
       		{"coves-app://callback", false},                   // Custom scheme - blocked

     

       184
       184
       -
       		{"coves://oauth", false},                          // Custom scheme - blocked

     

       185
       185
       -
       		{"myapp://oauth", false},                          // Not in allowlist

     

       186
       186
       -
       		{"https://example.com", false},                    // Wrong domain

     

       187
       187
       -
       		{"http://localhost", false},                       // HTTP not allowed

     

       180
       180
       +
       		// Custom scheme per atproto spec (reverse domain of coves.social)

     

       181
       181
       +
       		{"social.coves:/callback", true},

     

       182
       182
       +
       		{"social.coves://callback", true},

     

       183
       183
       +
       		{"social.coves:/oauth/callback", true},

     

       184
       184
       +
       		{"social.coves://oauth/callback", true},

     

       185
       185
       +
       		// Universal Link - allowed (strongest security)

     

       186
       186
       +
       		{"https://coves.social/app/oauth/callback", true},

     

       187
       187
       +
       		// Wrong custom schemes - not reverse-domain of coves.social

     

       188
       188
       +
       		{"coves-app://oauth/callback", false},

     

       189
       189
       +
       		{"coves://oauth/callback", false},

     

       190
       190
       +
       		{"coves.social://callback", false}, // Not reversed

     

       191
       191
       +
       		{"myapp://oauth", false},

     

       192
       192
       +
       		// Wrong domain/scheme

     

       193
       193
       +
       		{"https://example.com", false},

     

       194
       194
       +
       		{"http://localhost", false},

     

       188
       195
        
       		{"", false},

     

       189
       196
        
       		{"not-a-uri", false},

     

       190
       197
        
       	}

+115

internal/api/handlers/vote/create_vote.go

···

       1
       1
       +
       package vote

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/votes"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // CreateVoteHandler handles vote creation

     

       12
       12
       +
       type CreateVoteHandler struct {

     

       13
       13
       +
       	service votes.Service

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // NewCreateVoteHandler creates a new create vote handler

     

       17
       17
       +
       func NewCreateVoteHandler(service votes.Service) *CreateVoteHandler {

     

       18
       18
       +
       	return &CreateVoteHandler{

     

       19
       19
       +
       		service: service,

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // CreateVoteInput represents the request body for creating a vote

     

       24
       24
       +
       type CreateVoteInput struct {

     

       25
       25
       +
       	Subject struct {

     

       26
       26
       +
       		URI string `json:"uri"`

     

       27
       27
       +
       		CID string `json:"cid"`

     

       28
       28
       +
       	} `json:"subject"`

     

       29
       29
       +
       	Direction string `json:"direction"`

     

       30
       30
       +
       }

     

       31
       31
       +
       

     

       32
       32
       +
       // CreateVoteOutput represents the response body for creating a vote

     

       33
       33
       +
       type CreateVoteOutput struct {

     

       34
       34
       +
       	URI string `json:"uri"`

     

       35
       35
       +
       	CID string `json:"cid"`

     

       36
       36
       +
       }

     

       37
       37
       +
       

     

       38
       38
       +
       // HandleCreateVote creates a vote on a post or comment

     

       39
       39
       +
       // POST /xrpc/social.coves.vote.create

     

       40
       40
       +
       //

     

       41
       41
       +
       // Request body: { "subject": { "uri": "at://...", "cid": "..." }, "direction": "up" }

     

       42
       42
       +
       // Response: { "uri": "at://...", "cid": "..." }

     

       43
       43
       +
       //

     

       44
       44
       +
       // Behavior:

     

       45
       45
       +
       // - If no vote exists: creates new vote with given direction

     

       46
       46
       +
       // - If vote exists with same direction: deletes vote (toggle off)

     

       47
       47
       +
       // - If vote exists with different direction: updates to new direction

     

       48
       48
       +
       func (h *CreateVoteHandler) HandleCreateVote(w http.ResponseWriter, r *http.Request) {

     

       49
       49
       +
       	if r.Method != http.MethodPost {

     

       50
       50
       +
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       51
       51
       +
       		return

     

       52
       52
       +
       	}

     

       53
       53
       +
       

     

       54
       54
       +
       	// Parse request body

     

       55
       55
       +
       	var input CreateVoteInput

     

       56
       56
       +
       	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {

     

       57
       57
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       58
       58
       +
       		return

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	// Validate required fields

     

       62
       62
       +
       	if input.Subject.URI == "" {

     

       63
       63
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.uri is required")

     

       64
       64
       +
       		return

     

       65
       65
       +
       	}

     

       66
       66
       +
       	if input.Subject.CID == "" {

     

       67
       67
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.cid is required")

     

       68
       68
       +
       		return

     

       69
       69
       +
       	}

     

       70
       70
       +
       	if input.Direction == "" {

     

       71
       71
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "direction is required")

     

       72
       72
       +
       		return

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	// Validate direction

     

       76
       76
       +
       	if input.Direction != "up" && input.Direction != "down" {

     

       77
       77
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "direction must be 'up' or 'down'")

     

       78
       78
       +
       		return

     

       79
       79
       +
       	}

     

       80
       80
       +
       

     

       81
       81
       +
       	// Get OAuth session from context (injected by auth middleware)

     

       82
       82
       +
       	session := middleware.GetOAuthSession(r)

     

       83
       83
       +
       	if session == nil {

     

       84
       84
       +
       		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       85
       85
       +
       		return

     

       86
       86
       +
       	}

     

       87
       87
       +
       

     

       88
       88
       +
       	// Create vote request

     

       89
       89
       +
       	req := votes.CreateVoteRequest{

     

       90
       90
       +
       		Subject: votes.StrongRef{

     

       91
       91
       +
       			URI: input.Subject.URI,

     

       92
       92
       +
       			CID: input.Subject.CID,

     

       93
       93
       +
       		},

     

       94
       94
       +
       		Direction: input.Direction,

     

       95
       95
       +
       	}

     

       96
       96
       +
       

     

       97
       97
       +
       	// Call service to create vote

     

       98
       98
       +
       	response, err := h.service.CreateVote(r.Context(), session, req)

     

       99
       99
       +
       	if err != nil {

     

       100
       100
       +
       		handleServiceError(w, err)

     

       101
       101
       +
       		return

     

       102
       102
       +
       	}

     

       103
       103
       +
       

     

       104
       104
       +
       	// Return success response

     

       105
       105
       +
       	output := CreateVoteOutput{

     

       106
       106
       +
       		URI: response.URI,

     

       107
       107
       +
       		CID: response.CID,

     

       108
       108
       +
       	}

     

       109
       109
       +
       

     

       110
       110
       +
       	w.Header().Set("Content-Type", "application/json")

     

       111
       111
       +
       	w.WriteHeader(http.StatusOK)

     

       112
       112
       +
       	if err := json.NewEncoder(w).Encode(output); err != nil {

     

       113
       113
       +
       		log.Printf("Failed to encode response: %v", err)

     

       114
       114
       +
       	}

     

       115
       115
       +
       }

+93

internal/api/handlers/vote/delete_vote.go

···

       1
       1
       +
       package vote

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/middleware"

     

       5
       5
       +
       	"Coves/internal/core/votes"

     

       6
       6
       +
       	"encoding/json"

     

       7
       7
       +
       	"log"

     

       8
       8
       +
       	"net/http"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // DeleteVoteHandler handles vote deletion

     

       12
       12
       +
       type DeleteVoteHandler struct {

     

       13
       13
       +
       	service votes.Service

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       // NewDeleteVoteHandler creates a new delete vote handler

     

       17
       17
       +
       func NewDeleteVoteHandler(service votes.Service) *DeleteVoteHandler {

     

       18
       18
       +
       	return &DeleteVoteHandler{

     

       19
       19
       +
       		service: service,

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       // DeleteVoteInput represents the request body for deleting a vote

     

       24
       24
       +
       type DeleteVoteInput struct {

     

       25
       25
       +
       	Subject struct {

     

       26
       26
       +
       		URI string `json:"uri"`

     

       27
       27
       +
       		CID string `json:"cid"`

     

       28
       28
       +
       	} `json:"subject"`

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       // DeleteVoteOutput represents the response body for deleting a vote

     

       32
       32
       +
       // Per lexicon: output is an empty object

     

       33
       33
       +
       type DeleteVoteOutput struct{}

     

       34
       34
       +
       

     

       35
       35
       +
       // HandleDeleteVote removes a vote from a post or comment

     

       36
       36
       +
       // POST /xrpc/social.coves.vote.delete

     

       37
       37
       +
       //

     

       38
       38
       +
       // Request body: { "subject": { "uri": "at://...", "cid": "..." } }

     

       39
       39
       +
       // Response: { "success": true }

     

       40
       40
       +
       func (h *DeleteVoteHandler) HandleDeleteVote(w http.ResponseWriter, r *http.Request) {

     

       41
       41
       +
       	if r.Method != http.MethodPost {

     

       42
       42
       +
       		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)

     

       43
       43
       +
       		return

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	// Parse request body

     

       47
       47
       +
       	var input DeleteVoteInput

     

       48
       48
       +
       	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {

     

       49
       49
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Invalid request body")

     

       50
       50
       +
       		return

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	// Validate required fields

     

       54
       54
       +
       	if input.Subject.URI == "" {

     

       55
       55
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.uri is required")

     

       56
       56
       +
       		return

     

       57
       57
       +
       	}

     

       58
       58
       +
       	if input.Subject.CID == "" {

     

       59
       59
       +
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "subject.cid is required")

     

       60
       60
       +
       		return

     

       61
       61
       +
       	}

     

       62
       62
       +
       

     

       63
       63
       +
       	// Get OAuth session from context (injected by auth middleware)

     

       64
       64
       +
       	session := middleware.GetOAuthSession(r)

     

       65
       65
       +
       	if session == nil {

     

       66
       66
       +
       		writeError(w, http.StatusUnauthorized, "AuthRequired", "Authentication required")

     

       67
       67
       +
       		return

     

       68
       68
       +
       	}

     

       69
       69
       +
       

     

       70
       70
       +
       	// Create delete vote request

     

       71
       71
       +
       	req := votes.DeleteVoteRequest{

     

       72
       72
       +
       		Subject: votes.StrongRef{

     

       73
       73
       +
       			URI: input.Subject.URI,

     

       74
       74
       +
       			CID: input.Subject.CID,

     

       75
       75
       +
       		},

     

       76
       76
       +
       	}

     

       77
       77
       +
       

     

       78
       78
       +
       	// Call service to delete vote

     

       79
       79
       +
       	err := h.service.DeleteVote(r.Context(), session, req)

     

       80
       80
       +
       	if err != nil {

     

       81
       81
       +
       		handleServiceError(w, err)

     

       82
       82
       +
       		return

     

       83
       83
       +
       	}

     

       84
       84
       +
       

     

       85
       85
       +
       	// Return success response (empty object per lexicon)

     

       86
       86
       +
       	output := DeleteVoteOutput{}

     

       87
       87
       +
       

     

       88
       88
       +
       	w.Header().Set("Content-Type", "application/json")

     

       89
       89
       +
       	w.WriteHeader(http.StatusOK)

     

       90
       90
       +
       	if err := json.NewEncoder(w).Encode(output); err != nil {

     

       91
       91
       +
       		log.Printf("Failed to encode response: %v", err)

     

       92
       92
       +
       	}

     

       93
       93
       +
       }

+24

internal/api/routes/vote.go

···

       1
       1
       +
       package routes

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"Coves/internal/api/handlers/vote"

     

       5
       5
       +
       	"Coves/internal/api/middleware"

     

       6
       6
       +
       	"Coves/internal/core/votes"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/go-chi/chi/v5"

     

       9
       9
       +
       )

     

       10
       10
       +
       

     

       11
       11
       +
       // RegisterVoteRoutes registers vote-related XRPC endpoints on the router

     

       12
       12
       +
       // Implements social.coves.feed.vote.* lexicon endpoints

     

       13
       13
       +
       func RegisterVoteRoutes(r chi.Router, voteService votes.Service, authMiddleware *middleware.OAuthAuthMiddleware) {

     

       14
       14
       +
       	// Initialize handlers

     

       15
       15
       +
       	createHandler := vote.NewCreateVoteHandler(voteService)

     

       16
       16
       +
       	deleteHandler := vote.NewDeleteVoteHandler(voteService)

     

       17
       17
       +
       

     

       18
       18
       +
       	// Procedure endpoints (POST) - require authentication

     

       19
       19
       +
       	// social.coves.feed.vote.create - create or update a vote on a post/comment

     

       20
       20
       +
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.feed.vote.create", createHandler.HandleCreateVote)

     

       21
       21
       +
       

     

       22
       22
       +
       	// social.coves.feed.vote.delete - delete a vote from a post/comment

     

       23
       23
       +
       	r.With(authMiddleware.RequireAuth).Post("/xrpc/social.coves.feed.vote.delete", deleteHandler.HandleDeleteVote)

     

       24
       24
       +
       }

+16

tests/integration/helpers.go

···

       322
       322
        
       

     

       323
       323
        
       // AddSession adds a session to the store

     

       324
       324
        
       func (m *MockOAuthStore) AddSession(did, sessionID, accessToken string) {

     

       325
       325
       +
       	m.AddSessionWithPDS(did, sessionID, accessToken, getTestPDSURL())

     

       326
       326
       +
       }

     

       327
       327
       +
       

     

       328
       328
       +
       // AddSessionWithPDS adds a session to the store with a specific PDS URL

     

       329
       329
       +
       func (m *MockOAuthStore) AddSessionWithPDS(did, sessionID, accessToken, pdsURL string) {

     

       325
       330
        
       	key := did + ":" + sessionID

     

       326
       331
        
       	parsedDID, _ := syntax.ParseDID(did)

     

       327
       332
        
       	m.sessions[key] = &oauthlib.ClientSessionData{

     

       328
       333
        
       		AccountDID:  parsedDID,

     

       329
       334
        
       		SessionID:   sessionID,

     

       330
       335
        
       		AccessToken: accessToken,

     

       336
       336
       +
       		HostURL:     pdsURL,

     

       331
       337
        
       	}

     

       332
       338
        
       }

     

       333
       339
        
       

     
···

       409
       415
        
       	e.store.AddSession(did, sessionID, "access-token-"+did)

     

       410
       416
        
       	return token

     

       411
       417
        
       }

     

       418
       418
       +
       

     

       419
       419
       +
       // AddUserWithPDSToken registers a user with their real PDS access token

     

       420
       420
       +
       // Use this for E2E tests that need to write to the real PDS

     

       421
       421
       +
       func (e *E2EOAuthMiddleware) AddUserWithPDSToken(did, pdsAccessToken, pdsURL string) string {

     

       422
       422
       +
       	token := "test-token-" + did

     

       423
       423
       +
       	sessionID := "session-" + did

     

       424
       424
       +
       	e.unsealer.AddSession(token, did, sessionID)

     

       425
       425
       +
       	e.store.AddSessionWithPDS(did, sessionID, pdsAccessToken, pdsURL)

     

       426
       426
       +
       	return token

     

       427
       427
       +
       }

.beads/beads.left.jsonl

···

       1
       1
       +
       {"id":"Coves-95q","content_hash":"8ec99d598f067780436b985f9ad57f0fa19632026981038df4f65f192186620b","title":"Add comprehensive API documentation","description":"","status":"open","priority":2,"issue_type":"task","created_at":"2025-11-17T20:30:34.835721854-08:00","updated_at":"2025-11-17T20:30:34.835721854-08:00","source_repo":".","dependencies":[{"issue_id":"Coves-95q","depends_on_id":"Coves-e16","type":"blocks","created_at":"2025-11-17T20:30:46.273899399-08:00","created_by":"daemon"}]}

     

       2
       2
       +
       {"id":"Coves-e16","content_hash":"7c5d0fc8f0e7f626be3dad62af0e8412467330bad01a244e5a7e52ac5afff1c1","title":"Complete post creation and moderation features","description":"","status":"open","priority":1,"issue_type":"feature","created_at":"2025-11-17T20:30:12.885991306-08:00","updated_at":"2025-11-17T20:30:12.885991306-08:00","source_repo":"."}

     

       3
       3
       +
       {"id":"Coves-fce","content_hash":"26b3e16b99f827316ee0d741cc959464bd0c813446c95aef8105c7fd1e6b09ff","title":"Implement aggregator feed federation","description":"","status":"open","priority":1,"issue_type":"feature","created_at":"2025-11-17T20:30:21.453326012-08:00","updated_at":"2025-11-17T20:30:21.453326012-08:00","source_repo":"."}

.beads/beads.left.meta.json

···

       1
       1
       +
       {"version":"0.23.1","timestamp":"2025-12-02T18:25:24.009187871-08:00","commit":"00d7d8d"}

+5 -28

cmd/server/main.go

···

       393
       393
        
       	commentRepo := postgresRepo.NewCommentRepository(db)

     

       394
       394
        
       	log.Println("✅ Comment repository initialized (Jetstream indexing only)")

     

       395
       395
        
       

     

       396
       396
       -
       	// Initialize subject validator for votes (checks posts and comments exist)

     

       397
       397
       -
       	subjectValidator := votes.NewCompositeSubjectValidator(

     

       398
       398
       -
       		// Post existence checker

     

       399
       399
       -
       		func(ctx context.Context, uri string) (bool, error) {

     

       400
       400
       -
       			_, err := postRepo.GetByURI(ctx, uri)

     

       401
       401
       -
       			if err != nil {

     

       402
       402
       -
       				if err == posts.ErrNotFound {

     

       403
       403
       -
       					return false, nil

     

       404
       404
       -
       				}

     

       405
       405
       -
       				return false, err

     

       406
       406
       -
       			}

     

       407
       407
       -
       			return true, nil

     

       408
       408
       -
       		},

     

       409
       409
       -
       		// Comment existence checker

     

       410
       410
       -
       		func(ctx context.Context, uri string) (bool, error) {

     

       411
       411
       -
       			_, err := commentRepo.GetByURI(ctx, uri)

     

       412
       412
       -
       			if err != nil {

     

       413
       413
       -
       				if err == comments.ErrCommentNotFound {

     

       414
       414
       -
       					return false, nil

     

       415
       415
       -
       				}

     

       416
       416
       -
       				return false, err

     

       417
       417
       -
       			}

     

       418
       418
       -
       			return true, nil

     

       419
       419
       -
       		},

     

       420
       420
       -
       	)

     

       421
       421
       -
       

     

       422
       396
        
       	// Initialize vote service (for XRPC API endpoints)

     

       423
       423
       -
       	voteService := votes.NewService(voteRepo, subjectValidator, oauthClient, oauthStore, nil)

     

       424
       424
       -
       	log.Println("✅ Vote service initialized (with OAuth authentication and subject validation)")

     

       397
       397
       +
       	// Note: We don't validate subject existence - the vote goes to the user's PDS regardless.

     

       398
       398
       +
       	// The Jetstream consumer handles orphaned votes correctly by only updating counts for

     

       399
       399
       +
       	// non-deleted subjects. This avoids race conditions and eventual consistency issues.

     

       400
       400
       +
       	voteService := votes.NewService(voteRepo, oauthClient, oauthStore, nil)

     

       401
       401
       +
       	log.Println("✅ Vote service initialized (with OAuth authentication)")

     

       425
       402
        
       

     

       426
       403
        
       	// Initialize comment service (for query API)

     

       427
       404
        
       	// Requires user and community repos for proper author/community hydration per lexicon

-3

internal/api/handlers/vote/errors.go

···

       34
       34
        
       	case errors.Is(err, votes.ErrVoteNotFound):

     

       35
       35
        
       		// Matches: social.coves.feed.vote.delete#VoteNotFound

     

       36
       36
        
       		writeError(w, http.StatusNotFound, "VoteNotFound", "No vote found for this subject")

     

       37
       37
       -
       	case errors.Is(err, votes.ErrSubjectNotFound):

     

       38
       38
       -
       		// Matches: social.coves.feed.vote.create#SubjectNotFound

     

       39
       39
       -
       		writeError(w, http.StatusNotFound, "SubjectNotFound", "The subject post or comment was not found")

     

       40
       37
        
       	case errors.Is(err, votes.ErrInvalidDirection):

     

       41
       38
        
       		writeError(w, http.StatusBadRequest, "InvalidRequest", "Vote direction must be 'up' or 'down'")

     

       42
       39
        
       	case errors.Is(err, votes.ErrInvalidSubject):

+4 -4

internal/atproto/oauth/handlers_security.go

···

       25
       25
        
       // - Android: Verified via /.well-known/assetlinks.json

     

       26
       26
        
       var allowedMobileRedirectURIs = map[string]bool{

     

       27
       27
        
       	// Custom scheme per atproto spec (reverse-domain of coves.social)

     

       28
       28
       -
       	"social.coves:/callback":                  true,

     

       29
       29
       -
       	"social.coves://callback":                 true, // Some platforms add double slash

     

       30
       30
       -
       	"social.coves:/oauth/callback":            true, // Alternative path

     

       31
       31
       -
       	"social.coves://oauth/callback":           true,

     

       28
       28
       +
       	"social.coves:/callback":        true,

     

       29
       29
       +
       	"social.coves://callback":       true, // Some platforms add double slash

     

       30
       30
       +
       	"social.coves:/oauth/callback":  true, // Alternative path

     

       31
       31
       +
       	"social.coves://oauth/callback": true,

     

       32
       32
        
       	// Universal Links - cryptographically bound to app (preferred for security)

     

       33
       33
        
       	"https://coves.social/app/oauth/callback": true,

     

       34
       34
        
       }

-3

internal/core/votes/errors.go

···

       6
       6
        
       	// ErrVoteNotFound indicates the requested vote doesn't exist

     

       7
       7
        
       	ErrVoteNotFound = errors.New("vote not found")

     

       8
       8
        
       

     

       9
       9
       -
       	// ErrSubjectNotFound indicates the post/comment being voted on doesn't exist

     

       10
       10
       -
       	ErrSubjectNotFound = errors.New("subject not found")

     

       11
       11
       -
       

     

       12
       9
        
       	// ErrInvalidDirection indicates the vote direction is not "up" or "down"

     

       13
       10
        
       	ErrInvalidDirection = errors.New("invalid vote direction: must be 'up' or 'down'")

     

       14
       11

+14 -27

internal/core/votes/service_impl.go

···

       19
       19
        
       

     

       20
       20
        
       // voteService implements the Service interface for vote operations

     

       21
       21
        
       type voteService struct {

     

       22
       22
       -
       	repo             Repository

     

       23
       23
       -
       	subjectValidator SubjectValidator

     

       24
       24
       -
       	oauthClient      *oauthclient.OAuthClient

     

       25
       25
       -
       	oauthStore       oauth.ClientAuthStore

     

       26
       26
       -
       	logger           *slog.Logger

     

       22
       22
       +
       	repo        Repository

     

       23
       23
       +
       	oauthClient *oauthclient.OAuthClient

     

       24
       24
       +
       	oauthStore  oauth.ClientAuthStore

     

       25
       25
       +
       	logger      *slog.Logger

     

       27
       26
        
       }

     

       28
       27
        
       

     

       29
       28
        
       // NewService creates a new vote service instance

     

       30
       30
       -
       // subjectValidator can be nil to skip subject existence checks (not recommended for production)

     

       31
       31
       -
       func NewService(repo Repository, subjectValidator SubjectValidator, oauthClient *oauthclient.OAuthClient, oauthStore oauth.ClientAuthStore, logger *slog.Logger) Service {

     

       29
       29
       +
       func NewService(repo Repository, oauthClient *oauthclient.OAuthClient, oauthStore oauth.ClientAuthStore, logger *slog.Logger) Service {

     

       32
       30
        
       	if logger == nil {

     

       33
       31
        
       		logger = slog.Default()

     

       34
       32
        
       	}

     

       35
       33
        
       	return &voteService{

     

       36
       36
       -
       		repo:             repo,

     

       37
       37
       -
       		subjectValidator: subjectValidator,

     

       38
       38
       -
       		oauthClient:      oauthClient,

     

       39
       39
       -
       		oauthStore:       oauthStore,

     

       40
       40
       -
       		logger:           logger,

     

       34
       34
       +
       		repo:        repo,

     

       35
       35
       +
       		oauthClient: oauthClient,

     

       36
       36
       +
       		oauthStore:  oauthStore,

     

       37
       37
       +
       		logger:      logger,

     

       41
       38
        
       	}

     

       42
       39
        
       }

     

       43
       40
        
       

     
···

       65
       62
        
       		return nil, ErrInvalidSubject

     

       66
       63
        
       	}

     

       67
       64
        
       

     

       68
       68
       -
       	// Validate subject exists in AppView (post or comment)

     

       69
       69
       -
       	// This prevents creating votes on non-existent content

     

       70
       70
       -
       	if s.subjectValidator != nil {

     

       71
       71
       -
       		exists, err := s.subjectValidator.SubjectExists(ctx, req.Subject.URI)

     

       72
       72
       -
       		if err != nil {

     

       73
       73
       -
       			s.logger.Error("failed to validate subject existence",

     

       74
       74
       -
       				"error", err,

     

       75
       75
       -
       				"subject", req.Subject.URI)

     

       76
       76
       -
       			return nil, fmt.Errorf("failed to validate subject: %w", err)

     

       77
       77
       -
       		}

     

       78
       78
       -
       		if !exists {

     

       79
       79
       -
       			return nil, ErrSubjectNotFound

     

       80
       80
       -
       		}

     

       81
       81
       -
       	}

     

       65
       65
       +
       	// Note: We intentionally don't validate subject existence here.

     

       66
       66
       +
       	// The vote record goes to the user's PDS regardless. The Jetstream consumer

     

       67
       67
       +
       	// handles orphaned votes correctly by only updating counts for non-deleted subjects.

     

       68
       68
       +
       	// This avoids race conditions and eventual consistency issues.

     

       82
       69
        
       

     

       83
       70
        
       	// Check for existing vote by querying PDS directly (source of truth)

     

       84
       71
        
       	// This avoids eventual consistency issues with the AppView database

     
···

       284
       271
        
       

     

       285
       272
        
       		// Parse the listRecords response

     

       286
       273
        
       		var result struct {

     

       274
       274
       +
       			Cursor  string `json:"cursor"`

     

       287
       275
        
       			Records []struct {

     

       288
       276
        
       				URI   string `json:"uri"`

     

       289
       277
        
       				CID   string `json:"cid"`

     
···

       297
       285
        
       					CreatedAt string `json:"createdAt"`

     

       298
       286
        
       				} `json:"value"`

     

       299
       287
        
       			} `json:"records"`

     

       300
       300
       -
       			Cursor string `json:"cursor"`

     

       301
       288
        
       		}

     

       302
       289
        
       

     

       303
       290
        
       		if err := json.Unmarshal(body, &result); err != nil {

+3 -2

internal/db/postgres/vote_repo.go

···

       64
       64
        
       	return nil

     

       65
       65
        
       }

     

       66
       66
        
       

     

       67
       67
       -
       // GetByURI retrieves a vote by its AT-URI

     

       67
       67
       +
       // GetByURI retrieves an active vote by its AT-URI

     

       68
       68
        
       // Used by Jetstream consumer for DELETE operations

     

       69
       69
       +
       // Returns ErrVoteNotFound for soft-deleted votes

     

       69
       70
        
       func (r *postgresVoteRepo) GetByURI(ctx context.Context, uri string) (*votes.Vote, error) {

     

       70
       71
        
       	query := `

     

       71
       72
        
       		SELECT

     
···

       73
       74
        
       			subject_uri, subject_cid, direction,

     

       74
       75
        
       			created_at, indexed_at, deleted_at

     

       75
       76
        
       		FROM votes

     

       76
       76
       -
       		WHERE uri = $1

     

       77
       77
       +
       		WHERE uri = $1 AND deleted_at IS NULL

     

       77
       78
        
       	`

     

       78
       79
        
       

     

       79
       80
        
       	var vote votes.Vote

Compare changes