comparing 113ced561e6cafe23d9058837cf3e3d52b4eff93 and hailey/s3-blobstore on hailey.at/cocoon

+1 -1

.env.example

···

       6
       6
        
       COCOON_RELAYS=https://bsky.network

     

       7
       7
        
       # Generate with `openssl rand -hex 16`

     

       8
       8
        
       COCOON_ADMIN_PASSWORD=

     

       9
       9
       -
       # Generate with `openssl rand -hex 32`

     

       9
       9
       +
       # openssl rand -hex 32

     

       10
       10
        
       COCOON_SESSION_SECRET=

+8 -66

.github/workflows/docker-image.yml

···

       3
       3
        
       on:

     

       4
       4
        
         workflow_dispatch:

     

       5
       5
        
         push:

     

       6
       6
       -
           branches:

     

       7
       7
       -
             - main

     

       8
       8
       -
           tags:

     

       9
       9
       -
             - 'v*'

     

       10
       6
        
       

     

       11
       7
        
       env:

     

       12
       8
        
         REGISTRY: ghcr.io

     
···

       14
       10
        
       

     

       15
       11
        
       jobs:

     

       16
       12
        
         build-and-push-image:

     

       17
       17
       -
           strategy:

     

       18
       18
       -
             matrix:

     

       19
       19
       -
               include:

     

       20
       20
       -
                 - arch: amd64

     

       21
       21
       -
                   runner: ubuntu-latest

     

       22
       22
       -
                 - arch: arm64

     

       23
       23
       -
                   runner: ubuntu-24.04-arm

     

       24
       24
       -
           runs-on: ${{ matrix.runner }}

     

       13
       13
       +
           runs-on: ubuntu-latest

     

       25
       14
        
           # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.

     

       26
       15
        
           permissions:

     

       27
       16
        
             contents: read

     

       28
       17
        
             packages: write

     

       29
       18
        
             attestations: write

     

       30
       19
        
             id-token: write

     

       31
       31
       -
           outputs:

     

       32
       32
       -
             digest-amd64: ${{ matrix.arch == 'amd64' && steps.push.outputs.digest || '' }}

     

       33
       33
       -
             digest-arm64: ${{ matrix.arch == 'arm64' && steps.push.outputs.digest || '' }}

     

       20
       20
       +
             #

     

       34
       21
        
           steps:

     

       35
       22
        
             - name: Checkout repository

     

       36
       23
        
               uses: actions/checkout@v4

     

       37
       37
       -
       

     

       38
       24
        
             # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.

     

       39
       25
        
             - name: Log in to the Container registry

     

       40
       40
       -
               uses: docker/login-action@v3

     

       26
       26
       +
               uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1

     

       41
       27
        
               with:

     

       42
       28
        
                 registry: ${{ env.REGISTRY }}

     

       43
       29
        
                 username: ${{ github.actor }}

     

       44
       30
        
                 password: ${{ secrets.GITHUB_TOKEN }}

     

       45
       45
       -
       

     

       46
       31
        
             # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.

     

       47
       32
        
             - name: Extract metadata (tags, labels) for Docker

     

       48
       33
        
               id: meta

     
···

       50
       35
        
               with:

     

       51
       36
        
                 images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

     

       52
       37
        
                 tags: |

     

       53
       53
       -
                   type=raw,value=latest,enable={{is_default_branch}},suffix=-${{ matrix.arch }}

     

       54
       54
       -
                   type=sha,suffix=-${{ matrix.arch }}

     

       55
       55
       -
                   type=sha,format=long,suffix=-${{ matrix.arch }}

     

       56
       56
       -
                   type=semver,pattern={{version}},suffix=-${{ matrix.arch }}

     

       57
       57
       -
                   type=semver,pattern={{major}}.{{minor}},suffix=-${{ matrix.arch }}

     

       58
       58
       -
       

     

       38
       38
       +
                   type=sha

     

       39
       39
       +
                   type=sha,format=long

     

       59
       40
        
             # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.

     

       60
       41
        
             # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.

     

       61
       42
        
             # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.

     

       62
       43
        
             - name: Build and push Docker image

     

       63
       44
        
               id: push

     

       64
       64
       -
               uses: docker/build-push-action@v6

     

       45
       45
       +
               uses: docker/build-push-action@v5

     

       65
       46
        
               with:

     

       66
       47
        
                 context: .

     

       67
       48
        
                 push: true

     

       68
       49
        
                 tags: ${{ steps.meta.outputs.tags }}

     

       69
       50
        
                 labels: ${{ steps.meta.outputs.labels }}

     

       70
       51
        
       

     

       71
       71
       -
         publish-manifest:

     

       72
       72
       -
           needs: build-and-push-image

     

       73
       73
       -
           runs-on: ubuntu-latest

     

       74
       74
       -
           permissions:

     

       75
       75
       -
             packages: write

     

       76
       76
       -
             attestations: write

     

       77
       77
       -
             id-token: write

     

       78
       78
       -
           steps:

     

       79
       79
       -
             - name: Log in to the Container registry

     

       80
       80
       -
               uses: docker/login-action@v3

     

       81
       81
       -
               with:

     

       82
       82
       -
                 registry: ${{ env.REGISTRY }}

     

       83
       83
       -
                 username: ${{ github.actor }}

     

       84
       84
       -
                 password: ${{ secrets.GITHUB_TOKEN }}

     

       85
       85
       -
       

     

       86
       86
       -
             - name: Extract metadata (tags, labels) for Docker

     

       87
       87
       -
               id: meta

     

       88
       88
       -
               uses: docker/metadata-action@v5

     

       89
       89
       -
               with:

     

       90
       90
       -
                 images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

     

       91
       91
       -
                 tags: |

     

       92
       92
       -
                   type=raw,value=latest,enable={{is_default_branch}}

     

       93
       93
       -
                   type=sha

     

       94
       94
       -
                   type=sha,format=long

     

       95
       95
       -
                   type=semver,pattern={{version}}

     

       96
       96
       -
                   type=semver,pattern={{major}}.{{minor}}

     

       97
       97
       -
       

     

       98
       98
       -
             - name: Create and push manifest

     

       99
       99
       -
               run: |

     

       100
       100
       -
                 # Split tags into an array

     

       101
       101
       -
                 readarray -t tags <<< "${{ steps.meta.outputs.tags }}"

     

       102
       102
       -
       

     

       103
       103
       -
                 # Create and push manifest for each tag

     

       104
       104
       -
                 for tag in "${tags[@]}"; do

     

       105
       105
       -
                   docker buildx imagetools create -t "$tag" \

     

       106
       106
       -
                     "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push-image.outputs.digest-amd64 }}" \

     

       107
       107
       -
                     "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push-image.outputs.digest-arm64 }}"

     

       108
       108
       -
                 done

     

       109
       109
       -
       

     

       110
       52
        
             # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."

     

       111
       53
        
             - name: Generate artifact attestation

     

       112
       54
        
               uses: actions/attest-build-provenance@v1

     

       113
       55
        
               with:

     

       114
       56
        
                 subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}

     

       115
       115
       -
                 subject-digest: ${{ needs.build-and-push-image.outputs.digest-amd64 }}

     

       116
       116
       -
                 push-to-registry: true

     

       57
       57
       +
                 subject-digest: ${{ steps.push.outputs.digest }}

     

       58
       58
       +
                 push-to-registry: true

-3

.gitignore

-10

Caddyfile

···

       1
       1
       -
       {$COCOON_HOSTNAME} {

     

       2
       2
       -
       	reverse_proxy localhost:8080

     

       3
       3
       -
       

     

       4
       4
       -
       	encode gzip

     

       5
       5
       -
       

     

       6
       6
       -
       	log {

     

       7
       7
       -
       		output file /data/access.log

     

       8
       8
       -
       		format json

     

       9
       9
       -
       	}

     

       10
       10
       -
       }

-10

Caddyfile.postgres

···

       1
       1
       -
       {$COCOON_HOSTNAME} {

     

       2
       2
       -
       	reverse_proxy cocoon:8080

     

       3
       3
       -
       

     

       4
       4
       -
       	encode gzip

     

       5
       5
       -
       

     

       6
       6
       -
       	log {

     

       7
       7
       -
       		output file /data/access.log

     

       8
       8
       -
       		format json

     

       9
       9
       -
       	}

     

       10
       10
       -
       }

+1 -1

Dockerfile

···

       11
       11
        
       ### Run stage

     

       12
       12
        
       FROM debian:bookworm-slim AS run

     

       13
       13
        
       

     

       14
       14
       -
       RUN apt-get update && apt-get install -y dumb-init runit ca-certificates curl && rm -rf /var/lib/apt/lists/*

     

       14
       14
       +
       RUN apt-get update && apt-get install -y dumb-init runit ca-certificates && rm -rf /var/lib/apt/lists/*

     

       15
       15
        
       ENTRYPOINT ["dumb-init", "--"]

     

       16
       16
        
       

     

       17
       17
        
       WORKDIR /

+1 -37

Makefile

···

       4
       4
        
       GIT_COMMIT := $(shell git rev-parse --short=9 HEAD)

     

       5
       5
        
       VERSION := $(if $(GIT_TAG),$(GIT_TAG),dev-$(GIT_COMMIT))

     

       6
       6
        
       

     

       7
       7
       -
       # Build output directory

     

       8
       8
       -
       BUILD_DIR := dist

     

       9
       9
       -
       

     

       10
       10
       -
       # Platforms to build for

     

       11
       11
       -
       PLATFORMS := \

     

       12
       12
       -
       	linux/amd64 \

     

       13
       13
       -
       	linux/arm64 \

     

       14
       14
       -
       	linux/arm \

     

       15
       15
       -
       	darwin/amd64 \

     

       16
       16
       -
       	darwin/arm64 \

     

       17
       17
       -
       	windows/amd64 \

     

       18
       18
       -
       	windows/arm64 \

     

       19
       19
       -
       	freebsd/amd64 \

     

       20
       20
       -
       	freebsd/arm64 \

     

       21
       21
       -
       	openbsd/amd64 \

     

       22
       22
       -
       	openbsd/arm64

     

       23
       23
       -
       

     

       24
       7
        
       .PHONY: help

     

       25
       8
        
       help: ## Print info about all commands

     

       26
       9
        
       	@echo "Commands:"

     
···

       31
       14
        
       build: ## Build all executables

     

       32
       15
        
       	go build -ldflags "-X main.Version=$(VERSION)" -o cocoon ./cmd/cocoon

     

       33
       16
        
       

     

       34
       34
       -
       .PHONY: build-release

     

       35
       35
       -
       build-all: ## Build binaries for all architectures

     

       36
       36
       -
       	@echo "Building for all architectures..."

     

       37
       37
       -
       	@mkdir -p $(BUILD_DIR)

     

       38
       38
       -
       	@$(foreach platform,$(PLATFORMS), \

     

       39
       39
       -
       		$(eval OS := $(word 1,$(subst /, ,$(platform)))) \

     

       40
       40
       -
       		$(eval ARCH := $(word 2,$(subst /, ,$(platform)))) \

     

       41
       41
       -
       		$(eval EXT := $(if $(filter windows,$(OS)),.exe,)) \

     

       42
       42
       -
       		$(eval OUTPUT := $(BUILD_DIR)/cocoon-$(VERSION)-$(OS)-$(ARCH)$(EXT)) \

     

       43
       43
       -
       		echo "Building $(OS)/$(ARCH)..."; \

     

       44
       44
       -
       		GOOS=$(OS) GOARCH=$(ARCH) go build -ldflags "-X main.Version=$(VERSION)" -o $(OUTPUT) ./cmd/cocoon && \

     

       45
       45
       -
       		echo "  ✓ $(OUTPUT)" || echo "  ✗ Failed: $(OS)/$(ARCH)"; \

     

       46
       46
       -
       	)

     

       47
       47
       -
       	@echo "Done! Binaries are in $(BUILD_DIR)/"

     

       48
       48
       -
       

     

       49
       49
       -
       .PHONY: clean-dist

     

       50
       50
       -
       clean-dist: ## Remove all built binaries

     

       51
       51
       -
       	rm -rf $(BUILD_DIR)

     

       52
       52
       -
       

     

       53
       17
        
       .PHONY: run

     

       54
       18
        
       run:

     

       55
       19
        
       	go build -ldflags "-X main.Version=dev-local" -o cocoon ./cmd/cocoon && ./cocoon run

     
···

       79
       43
        
       

     

       80
       44
        
       .PHONY: docker-build

     

       81
       45
        
       docker-build:

     

       82
       82
       -
       	docker build -t cocoon .

     

       46
       46
       +
       	docker build -t cocoon .

+7 -181

README.md

···

       1
       1
        
       # Cocoon

     

       2
       2
        
       

     

       3
       3
        
       > [!WARNING]

     

       4
       4
       -
       I migrated and have been running my main account on this PDS for months now without issue, however, I am still not responsible if things go awry, particularly during account migration. Please use caution.

     

       4
       4
       +
       You should not use this PDS. You should not rely on this code as a reference for a PDS implementation. You should not trust this code. Using this PDS implementation may result in data loss, corruption, etc.

     

       5
       5
        
       

     

       6
       6
        
       Cocoon is a PDS implementation in Go. It is highly experimental, and is not ready for any production use.

     

       7
       7
        
       

     

       8
       8
       -
       ## Quick Start with Docker Compose

     

       9
       9
       -
       

     

       10
       10
       -
       ### Prerequisites

     

       11
       11
       -
       

     

       12
       12
       -
       - Docker and Docker Compose installed

     

       13
       13
       -
       - A domain name pointing to your server (for automatic HTTPS)

     

       14
       14
       -
       - Ports 80 and 443 open in i.e. UFW

     

       15
       15
       -
       

     

       16
       16
       -
       ### Installation

     

       17
       17
       -
       

     

       18
       18
       -
       1. **Clone the repository**

     

       19
       19
       -
          ```bash

     

       20
       20
       -
          git clone https://github.com/haileyok/cocoon.git

     

       21
       21
       -
          cd cocoon

     

       22
       22
       -
          ```

     

       23
       23
       -
       

     

       24
       24
       -
       2. **Create your configuration file**

     

       25
       25
       -
          ```bash

     

       26
       26
       -
          cp .env.example .env

     

       27
       27
       -
          ```

     

       28
       28
       -
       

     

       29
       29
       -
       3. **Edit `.env` with your settings**

     

       30
       30
       -
       

     

       31
       31
       -
          Required settings:

     

       32
       32
       -
          ```bash

     

       33
       33
       -
          COCOON_DID="did:web:your-domain.com"

     

       34
       34
       -
          COCOON_HOSTNAME="your-domain.com"

     

       35
       35
       -
          COCOON_CONTACT_EMAIL="you@example.com"

     

       36
       36
       -
          COCOON_RELAYS="https://bsky.network"

     

       37
       37
       -
       

     

       38
       38
       -
          # Generate with: openssl rand -hex 16

     

       39
       39
       -
          COCOON_ADMIN_PASSWORD="your-secure-password"

     

       40
       40
       -
       

     

       41
       41
       -
          # Generate with: openssl rand -hex 32

     

       42
       42
       -
          COCOON_SESSION_SECRET="your-session-secret"

     

       43
       43
       -
          ```

     

       44
       44
       -
       

     

       45
       45
       -
       4. **Start the services**

     

       46
       46
       -
          ```bash

     

       47
       47
       -
          # Pull pre-built image from GitHub Container Registry

     

       48
       48
       -
          docker-compose pull

     

       49
       49
       -
          docker-compose up -d

     

       50
       50
       -
          ```

     

       51
       51
       -
       

     

       52
       52
       -
          Or build locally:

     

       53
       53
       -
          ```bash

     

       54
       54
       -
          docker-compose build

     

       55
       55
       -
          docker-compose up -d

     

       56
       56
       -
          ```

     

       57
       57
       -
       

     

       58
       58
       -
          **For PostgreSQL deployment:**

     

       59
       59
       -
          ```bash

     

       60
       60
       -
          # Add POSTGRES_PASSWORD to your .env file first!

     

       61
       61
       -
          docker-compose -f docker-compose.postgres.yaml up -d

     

       62
       62
       -
          ```

     

       63
       63
       -
       

     

       64
       64
       -
       5. **Get your invite code**

     

       65
       65
       -
       

     

       66
       66
       -
          On first run, an invite code is automatically created. View it with:

     

       67
       67
       -
          ```bash

     

       68
       68
       -
          docker-compose logs create-invite

     

       69
       69
       -
          ```

     

       70
       70
       -
       

     

       71
       71
       -
          Or check the saved file:

     

       72
       72
       -
          ```bash

     

       73
       73
       -
          cat keys/initial-invite-code.txt

     

       74
       74
       -
          ```

     

       75
       75
       -
       

     

       76
       76
       -
          **IMPORTANT**: Save this invite code! You'll need it to create your first account.

     

       77
       77
       -
       

     

       78
       78
       -
       6. **Monitor the services**

     

       79
       79
       -
          ```bash

     

       80
       80
       -
          docker-compose logs -f

     

       81
       81
       -
          ```

     

       82
       82
       -
       

     

       83
       83
       -
       ### What Gets Set Up

     

       84
       84
       -
       

     

       85
       85
       -
       The Docker Compose setup includes:

     

       86
       86
       -
       

     

       87
       87
       -
       - **init-keys**: Automatically generates cryptographic keys (rotation key and JWK) on first run

     

       88
       88
       -
       - **cocoon**: The main PDS service running on port 8080

     

       89
       89
       -
       - **create-invite**: Automatically creates an initial invite code after Cocoon starts (first run only)

     

       90
       90
       -
       - **caddy**: Reverse proxy with automatic HTTPS via Let's Encrypt

     

       91
       91
       -
       

     

       92
       92
       -
       ### Data Persistence

     

       93
       93
       -
       

     

       94
       94
       -
       The following directories will be created automatically:

     

       95
       95
       -
       

     

       96
       96
       -
       - `./keys/` - Cryptographic keys (generated automatically)

     

       97
       97
       -
         - `rotation.key` - PDS rotation key

     

       98
       98
       -
         - `jwk.key` - JWK private key

     

       99
       99
       -
         - `initial-invite-code.txt` - Your first invite code (first run only)

     

       100
       100
       -
       - `./data/` - SQLite database and blockstore

     

       101
       101
       -
       - Docker volumes for Caddy configuration and certificates

     

       102
       102
       -
       

     

       103
       103
       -
       ### Optional Configuration

     

       104
       104
       -
       

     

       105
       105
       -
       #### Database Configuration

     

       106
       106
       -
       

     

       107
       107
       -
       By default, Cocoon uses SQLite which requires no additional setup. For production deployments with higher traffic, you can use PostgreSQL:

     

       108
       108
       -
       

     

       109
       109
       -
       ```bash

     

       110
       110
       -
       # Database type: sqlite (default) or postgres

     

       111
       111
       -
       COCOON_DB_TYPE="postgres"

     

       112
       112
       -
       

     

       113
       113
       -
       # PostgreSQL connection string (required if db-type is postgres)

     

       114
       114
       -
       # Format: postgres://user:password@host:port/database?sslmode=disable

     

       115
       115
       -
       COCOON_DATABASE_URL="postgres://cocoon:password@localhost:5432/cocoon?sslmode=disable"

     

       116
       116
       -
       

     

       117
       117
       -
       # Or use the standard DATABASE_URL environment variable

     

       118
       118
       -
       DATABASE_URL="postgres://cocoon:password@localhost:5432/cocoon?sslmode=disable"

     

       119
       119
       -
       ```

     

       120
       120
       -
       

     

       121
       121
       -
       For SQLite (default):

     

       122
       122
       -
       ```bash

     

       123
       123
       -
       COCOON_DB_TYPE="sqlite"

     

       124
       124
       -
       COCOON_DB_NAME="/data/cocoon/cocoon.db"

     

       125
       125
       -
       ```

     

       126
       126
       -
       

     

       127
       127
       -
       > **Note**: When using PostgreSQL, database backups to S3 are not handled by Cocoon. Use `pg_dump` or your database provider's backup solution instead.

     

       128
       128
       -
       

     

       129
       129
       -
       #### SMTP Email Settings

     

       130
       130
       -
       ```bash

     

       131
       131
       -
       COCOON_SMTP_USER="your-smtp-username"

     

       132
       132
       -
       COCOON_SMTP_PASS="your-smtp-password"

     

       133
       133
       -
       COCOON_SMTP_HOST="smtp.example.com"

     

       134
       134
       -
       COCOON_SMTP_PORT="587"

     

       135
       135
       -
       COCOON_SMTP_EMAIL="noreply@example.com"

     

       136
       136
       -
       COCOON_SMTP_NAME="Cocoon PDS"

     

       137
       137
       -
       ```

     

       138
       138
       -
       

     

       139
       139
       -
       #### S3 Storage

     

       140
       140
       -
       

     

       141
       141
       -
       Cocoon supports S3-compatible storage for both database backups (SQLite only) and blob storage (images, videos, etc.):

     

       142
       142
       -
       

     

       143
       143
       -
       ```bash

     

       144
       144
       -
       # Enable S3 backups (SQLite databases only - hourly backups)

     

       145
       145
       -
       COCOON_S3_BACKUPS_ENABLED=true

     

       146
       146
       -
       

     

       147
       147
       -
       # Enable S3 for blob storage (images, videos, etc.)

     

       148
       148
       -
       # When enabled, blobs are stored in S3 instead of the database

     

       149
       149
       -
       COCOON_S3_BLOBSTORE_ENABLED=true

     

       150
       150
       -
       

     

       151
       151
       -
       # S3 configuration (works with AWS S3, MinIO, Cloudflare R2, etc.)

     

       152
       152
       -
       COCOON_S3_REGION="us-east-1"

     

       153
       153
       -
       COCOON_S3_BUCKET="your-bucket"

     

       154
       154
       -
       COCOON_S3_ENDPOINT="https://s3.amazonaws.com"

     

       155
       155
       -
       COCOON_S3_ACCESS_KEY="your-access-key"

     

       156
       156
       -
       COCOON_S3_SECRET_KEY="your-secret-key"

     

       157
       157
       -
       ```

     

       158
       158
       -
       

     

       159
       159
       -
       **Blob Storage Options:**

     

       160
       160
       -
       - `COCOON_S3_BLOBSTORE_ENABLED=false` (default): Blobs stored in the database

     

       161
       161
       -
       - `COCOON_S3_BLOBSTORE_ENABLED=true`: Blobs stored in S3 bucket under `blobs/{did}/{cid}`

     

       162
       162
       -
       

     

       163
       163
       -
       ### Management Commands

     

       164
       164
       -
       

     

       165
       165
       -
       Create an invite code:

     

       166
       166
       -
       ```bash

     

       167
       167
       -
       docker exec cocoon-pds /cocoon create-invite-code --uses 1

     

       168
       168
       -
       ```

     

       169
       169
       -
       

     

       170
       170
       -
       Reset a user's password:

     

       171
       171
       -
       ```bash

     

       172
       172
       -
       docker exec cocoon-pds /cocoon reset-password --did "did:plc:xxx"

     

       173
       173
       -
       ```

     

       174
       174
       -
       

     

       175
       175
       -
       ### Updating

     

       176
       176
       -
       

     

       177
       177
       -
       ```bash

     

       178
       178
       -
       docker-compose pull

     

       179
       179
       -
       docker-compose up -d

     

       180
       180
       -
       ```

     

       181
       181
       -
       

     

       182
       8
        
       ## Implemented Endpoints

     

       183
       9
        
       

     

       184
       10
        
       > [!NOTE]

     
···

       186
       12
        
       

     

       187
       13
        
       ### Identity

     

       188
       14
        
       

     

       189
       189
       -
       - [x] `com.atproto.identity.getRecommendedDidCredentials`

     

       190
       190
       -
       - [x] `com.atproto.identity.requestPlcOperationSignature`

     

       15
       15
       +
       - [ ] `com.atproto.identity.getRecommendedDidCredentials`

     

       16
       16
       +
       - [ ] `com.atproto.identity.requestPlcOperationSignature`

     

       191
       17
        
       - [x] `com.atproto.identity.resolveHandle`

     

       192
       192
       -
       - [x] `com.atproto.identity.signPlcOperation`

     

       193
       193
       -
       - [x] `com.atproto.identity.submitPlcOperation`

     

       18
       18
       +
       - [ ] `com.atproto.identity.signPlcOperation`

     

       19
       19
       +
       - [ ] `com.atproto.identity.submitPlcOperation`

     

       194
       20
        
       - [x] `com.atproto.identity.updateHandle`

     

       195
       21
        
       

     

       196
       22
        
       ### Repo

     
···

       201
       27
        
       - [x] `com.atproto.repo.deleteRecord`

     

       202
       28
        
       - [x] `com.atproto.repo.describeRepo`

     

       203
       29
        
       - [x] `com.atproto.repo.getRecord`

     

       204
       204
       -
       - [x] `com.atproto.repo.importRepo` (Works "okay". Use with extreme caution.)

     

       30
       30
       +
       - [x] `com.atproto.repo.importRepo` (Works "okay". You still have to handle PLC operations on your own when migrating. Use with extreme caution.)

     

       205
       31
        
       - [x] `com.atproto.repo.listRecords`

     

       206
       206
       -
       - [x] `com.atproto.repo.listMissingBlobs` (Not actually functional, but will return a response as if no blobs were missing)

     

       32
       32
       +
       - [ ] `com.atproto.repo.listMissingBlobs`

     

       207
       33
        
       

     

       208
       34
        
       ### Server

     

       209
       35

+43 -66

cmd/cocoon/main.go

···

       17
       17
        
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       18
       18
        
       	"github.com/urfave/cli/v2"

     

       19
       19
        
       	"golang.org/x/crypto/bcrypt"

     

       20
       20
       -
       	"gorm.io/driver/postgres"

     

       21
       20
        
       	"gorm.io/driver/sqlite"

     

       22
       21
        
       	"gorm.io/gorm"

     

       23
       22
        
       )

     
···

       40
       39
        
       				EnvVars: []string{"COCOON_DB_NAME"},

     

       41
       40
        
       			},

     

       42
       41
        
       			&cli.StringFlag{

     

       43
       43
       -
       				Name:    "db-type",

     

       44
       44
       -
       				Value:   "sqlite",

     

       45
       45
       -
       				Usage:   "Database type: sqlite or postgres",

     

       46
       46
       -
       				EnvVars: []string{"COCOON_DB_TYPE"},

     

       42
       42
       +
       				Name:     "did",

     

       43
       43
       +
       				Required: true,

     

       44
       44
       +
       				EnvVars:  []string{"COCOON_DID"},

     

       47
       45
        
       			},

     

       48
       46
        
       			&cli.StringFlag{

     

       49
       49
       -
       				Name:    "database-url",

     

       50
       50
       -
       				Aliases: []string{"db-url"},

     

       51
       51
       -
       				Usage:   "PostgreSQL connection string (required if db-type is postgres)",

     

       52
       52
       -
       				EnvVars: []string{"COCOON_DATABASE_URL", "DATABASE_URL"},

     

       47
       47
       +
       				Name:     "hostname",

     

       48
       48
       +
       				Required: true,

     

       49
       49
       +
       				EnvVars:  []string{"COCOON_HOSTNAME"},

     

       53
       50
        
       			},

     

       54
       51
        
       			&cli.StringFlag{

     

       55
       55
       -
       				Name:    "did",

     

       56
       56
       -
       				EnvVars: []string{"COCOON_DID"},

     

       52
       52
       +
       				Name:     "rotation-key-path",

     

       53
       53
       +
       				Required: true,

     

       54
       54
       +
       				EnvVars:  []string{"COCOON_ROTATION_KEY_PATH"},

     

       57
       55
        
       			},

     

       58
       56
        
       			&cli.StringFlag{

     

       59
       59
       -
       				Name:    "hostname",

     

       60
       60
       -
       				EnvVars: []string{"COCOON_HOSTNAME"},

     

       57
       57
       +
       				Name:     "jwk-path",

     

       58
       58
       +
       				Required: true,

     

       59
       59
       +
       				EnvVars:  []string{"COCOON_JWK_PATH"},

     

       61
       60
        
       			},

     

       62
       61
        
       			&cli.StringFlag{

     

       63
       63
       -
       				Name:    "rotation-key-path",

     

       64
       64
       -
       				EnvVars: []string{"COCOON_ROTATION_KEY_PATH"},

     

       65
       65
       -
       			},

     

       66
       66
       -
       			&cli.StringFlag{

     

       67
       67
       -
       				Name:    "jwk-path",

     

       68
       68
       -
       				EnvVars: []string{"COCOON_JWK_PATH"},

     

       69
       69
       -
       			},

     

       70
       70
       -
       			&cli.StringFlag{

     

       71
       71
       -
       				Name:    "contact-email",

     

       72
       72
       -
       				EnvVars: []string{"COCOON_CONTACT_EMAIL"},

     

       62
       62
       +
       				Name:     "contact-email",

     

       63
       63
       +
       				Required: true,

     

       64
       64
       +
       				EnvVars:  []string{"COCOON_CONTACT_EMAIL"},

     

       73
       65
        
       			},

     

       74
       66
        
       			&cli.StringSliceFlag{

     

       75
       75
       -
       				Name:    "relays",

     

       76
       76
       -
       				EnvVars: []string{"COCOON_RELAYS"},

     

       67
       67
       +
       				Name:     "relays",

     

       68
       68
       +
       				Required: true,

     

       69
       69
       +
       				EnvVars:  []string{"COCOON_RELAYS"},

     

       77
       70
        
       			},

     

       78
       71
        
       			&cli.StringFlag{

     

       79
       79
       -
       				Name:    "admin-password",

     

       80
       80
       -
       				EnvVars: []string{"COCOON_ADMIN_PASSWORD"},

     

       72
       72
       +
       				Name:     "admin-password",

     

       73
       73
       +
       				Required: true,

     

       74
       74
       +
       				EnvVars:  []string{"COCOON_ADMIN_PASSWORD"},

     

       81
       75
        
       			},

     

       82
       76
        
       			&cli.StringFlag{

     

       83
       83
       -
       				Name:    "smtp-user",

     

       84
       84
       -
       				EnvVars: []string{"COCOON_SMTP_USER"},

     

       77
       77
       +
       				Name:     "smtp-user",

     

       78
       78
       +
       				Required: false,

     

       79
       79
       +
       				EnvVars:  []string{"COCOON_SMTP_USER"},

     

       85
       80
        
       			},

     

       86
       81
        
       			&cli.StringFlag{

     

       87
       87
       -
       				Name:    "smtp-pass",

     

       88
       88
       -
       				EnvVars: []string{"COCOON_SMTP_PASS"},

     

       82
       82
       +
       				Name:     "smtp-pass",

     

       83
       83
       +
       				Required: false,

     

       84
       84
       +
       				EnvVars:  []string{"COCOON_SMTP_PASS"},

     

       89
       85
        
       			},

     

       90
       86
        
       			&cli.StringFlag{

     

       91
       91
       -
       				Name:    "smtp-host",

     

       92
       92
       -
       				EnvVars: []string{"COCOON_SMTP_HOST"},

     

       87
       87
       +
       				Name:     "smtp-host",

     

       88
       88
       +
       				Required: false,

     

       89
       89
       +
       				EnvVars:  []string{"COCOON_SMTP_HOST"},

     

       93
       90
        
       			},

     

       94
       91
        
       			&cli.StringFlag{

     

       95
       95
       -
       				Name:    "smtp-port",

     

       96
       96
       -
       				EnvVars: []string{"COCOON_SMTP_PORT"},

     

       92
       92
       +
       				Name:     "smtp-port",

     

       93
       93
       +
       				Required: false,

     

       94
       94
       +
       				EnvVars:  []string{"COCOON_SMTP_PORT"},

     

       97
       95
        
       			},

     

       98
       96
        
       			&cli.StringFlag{

     

       99
       99
       -
       				Name:    "smtp-email",

     

       100
       100
       -
       				EnvVars: []string{"COCOON_SMTP_EMAIL"},

     

       97
       97
       +
       				Name:     "smtp-email",

     

       98
       98
       +
       				Required: false,

     

       99
       99
       +
       				EnvVars:  []string{"COCOON_SMTP_EMAIL"},

     

       101
       100
        
       			},

     

       102
       101
        
       			&cli.StringFlag{

     

       103
       103
       -
       				Name:    "smtp-name",

     

       104
       104
       -
       				EnvVars: []string{"COCOON_SMTP_NAME"},

     

       102
       102
       +
       				Name:     "smtp-name",

     

       103
       103
       +
       				Required: false,

     

       104
       104
       +
       				EnvVars:  []string{"COCOON_SMTP_NAME"},

     

       105
       105
        
       			},

     

       106
       106
        
       			&cli.BoolFlag{

     

       107
       107
        
       				Name:    "s3-backups-enabled",

     
···

       170
       170
        
       		s, err := server.New(&server.Args{

     

       171
       171
        
       			Addr:            cmd.String("addr"),

     

       172
       172
        
       			DbName:          cmd.String("db-name"),

     

       173
       173
       -
       			DbType:          cmd.String("db-type"),

     

       174
       174
       -
       			DatabaseURL:     cmd.String("database-url"),

     

       175
       173
        
       			Did:             cmd.String("did"),

     

       176
       174
        
       			Hostname:        cmd.String("hostname"),

     

       177
       175
        
       			RotationKeyPath: cmd.String("rotation-key-path"),

     
···

       294
       292
        
       		},

     

       295
       293
        
       	},

     

       296
       294
        
       	Action: func(cmd *cli.Context) error {

     

       297
       297
       -
       		db, err := newDb(cmd)

     

       295
       295
       +
       		db, err := newDb()

     

       298
       296
        
       		if err != nil {

     

       299
       297
        
       			return err

     

       300
       298
        
       		}

     
···

       333
       331
        
       		},

     

       334
       332
        
       	},

     

       335
       333
        
       	Action: func(cmd *cli.Context) error {

     

       336
       336
       -
       		db, err := newDb(cmd)

     

       334
       334
       +
       		db, err := newDb()

     

       337
       335
        
       		if err != nil {

     

       338
       336
        
       			return err

     

       339
       337
        
       		}

     
···

       360
       358
        
       	},

     

       361
       359
        
       }

     

       362
       360
        
       

     

       363
       363
       -
       func newDb(cmd *cli.Context) (*gorm.DB, error) {

     

       364
       364
       -
       	dbType := cmd.String("db-type")

     

       365
       365
       -
       	if dbType == "" {

     

       366
       366
       -
       		dbType = "sqlite"

     

       367
       367
       -
       	}

     

       368
       368
       -
       

     

       369
       369
       -
       	switch dbType {

     

       370
       370
       -
       	case "postgres":

     

       371
       371
       -
       		databaseURL := cmd.String("database-url")

     

       372
       372
       -
       		if databaseURL == "" {

     

       373
       373
       -
       			databaseURL = cmd.String("database-url")

     

       374
       374
       -
       		}

     

       375
       375
       -
       		if databaseURL == "" {

     

       376
       376
       -
       			return nil, fmt.Errorf("COCOON_DATABASE_URL or DATABASE_URL must be set when using postgres")

     

       377
       377
       -
       		}

     

       378
       378
       -
       		return gorm.Open(postgres.Open(databaseURL), &gorm.Config{})

     

       379
       379
       -
       	default:

     

       380
       380
       -
       		dbName := cmd.String("db-name")

     

       381
       381
       -
       		if dbName == "" {

     

       382
       382
       -
       			dbName = "cocoon.db"

     

       383
       383
       -
       		}

     

       384
       384
       -
       		return gorm.Open(sqlite.Open(dbName), &gorm.Config{})

     

       385
       385
       -
       	}

     

       361
       361
       +
       func newDb() (*gorm.DB, error) {

     

       362
       362
       +
       	return gorm.Open(sqlite.Open("cocoon.db"), &gorm.Config{})

     

       386
       363
        
       }

-56

create-initial-invite.sh

···

       1
       1
       -
       #!/bin/sh

     

       2
       2
       -
       

     

       3
       3
       -
       INVITE_FILE="/keys/initial-invite-code.txt"

     

       4
       4
       -
       MARKER="/keys/.invite_created"

     

       5
       5
       -
       

     

       6
       6
       -
       # Check if invite code was already created

     

       7
       7
       -
       if [ -f "$MARKER" ]; then

     

       8
       8
       -
           echo "✓ Initial invite code already created"

     

       9
       9
       -
           exit 0

     

       10
       10
       -
       fi

     

       11
       11
       -
       

     

       12
       12
       -
       echo "Waiting for database to be ready..."

     

       13
       13
       -
       sleep 10

     

       14
       14
       -
       

     

       15
       15
       -
       # Try to create invite code - retry until database is ready

     

       16
       16
       -
       MAX_ATTEMPTS=30

     

       17
       17
       -
       ATTEMPT=0

     

       18
       18
       -
       INVITE_CODE=""

     

       19
       19
       -
       

     

       20
       20
       -
       while [ $ATTEMPT -lt $MAX_ATTEMPTS ]; do

     

       21
       21
       -
           ATTEMPT=$((ATTEMPT + 1))

     

       22
       22
       -
           OUTPUT=$(/cocoon create-invite-code --uses 1 2>&1)

     

       23
       23
       -
           INVITE_CODE=$(echo "$OUTPUT" | grep -oE '[a-zA-Z0-9]{8}-[a-zA-Z0-9]{8}' || echo "")

     

       24
       24
       -
       

     

       25
       25
       -
           if [ -n "$INVITE_CODE" ]; then

     

       26
       26
       -
               break

     

       27
       27
       -
           fi

     

       28
       28
       -
       

     

       29
       29
       -
           if [ $((ATTEMPT % 5)) -eq 0 ]; then

     

       30
       30
       -
               echo "  Waiting for database... ($ATTEMPT/$MAX_ATTEMPTS)"

     

       31
       31
       -
           fi

     

       32
       32
       -
           sleep 2

     

       33
       33
       -
       done

     

       34
       34
       -
       

     

       35
       35
       -
       if [ -n "$INVITE_CODE" ]; then

     

       36
       36
       -
           echo ""

     

       37
       37
       -
           echo "╔════════════════════════════════════════╗"

     

       38
       38
       -
           echo "║   SAVE THIS INVITE CODE!               ║"

     

       39
       39
       -
           echo "║                                        ║"

     

       40
       40
       -
           echo "║   $INVITE_CODE                         ║"

     

       41
       41
       -
           echo "║                                        ║"

     

       42
       42
       -
           echo "║   Use this to create your first        ║"

     

       43
       43
       -
           echo "║   account on your PDS.                 ║"

     

       44
       44
       -
           echo "╚════════════════════════════════════════╝"

     

       45
       45
       -
           echo ""

     

       46
       46
       -
       

     

       47
       47
       -
           echo "$INVITE_CODE" > "$INVITE_FILE"

     

       48
       48
       -
           echo "✓ Invite code saved to: $INVITE_FILE"

     

       49
       49
       -
       

     

       50
       50
       -
           touch "$MARKER"

     

       51
       51
       -
           echo "✓ Initial setup complete!"

     

       52
       52
       -
       else

     

       53
       53
       -
           echo "✗ Failed to create invite code"

     

       54
       54
       -
           echo "Output: $OUTPUT"

     

       55
       55
       -
           exit 1

     

       56
       56
       -
       fi

-158

docker-compose.postgres.yaml

···

       1
       1
       -
       # Docker Compose with PostgreSQL

     

       2
       2
       -
       # 

     

       3
       3
       -
       # Usage:

     

       4
       4
       -
       #   docker-compose -f docker-compose.postgres.yaml up -d

     

       5
       5
       -
       #

     

       6
       6
       -
       # This file extends the base docker-compose.yaml with a PostgreSQL database.

     

       7
       7
       -
       # Set the following in your .env file:

     

       8
       8
       -
       #   COCOON_DB_TYPE=postgres

     

       9
       9
       -
       #   POSTGRES_PASSWORD=your-secure-password

     

       10
       10
       -
       

     

       11
       11
       -
       version: '3.8'

     

       12
       12
       -
       

     

       13
       13
       -
       services:

     

       14
       14
       -
         postgres:

     

       15
       15
       -
           image: postgres:16-alpine

     

       16
       16
       -
           container_name: cocoon-postgres

     

       17
       17
       -
           environment:

     

       18
       18
       -
             POSTGRES_USER: cocoon

     

       19
       19
       -
             POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}

     

       20
       20
       -
             POSTGRES_DB: cocoon

     

       21
       21
       -
           volumes:

     

       22
       22
       -
             - postgres_data:/var/lib/postgresql/data

     

       23
       23
       -
           healthcheck:

     

       24
       24
       -
             test: ["CMD-SHELL", "pg_isready -U cocoon -d cocoon"]

     

       25
       25
       -
             interval: 10s

     

       26
       26
       -
             timeout: 5s

     

       27
       27
       -
             retries: 5

     

       28
       28
       -
           restart: unless-stopped

     

       29
       29
       -
       

     

       30
       30
       -
         init-keys:

     

       31
       31
       -
           build:

     

       32
       32
       -
             context: .

     

       33
       33
       -
             dockerfile: Dockerfile

     

       34
       34
       -
           image: ghcr.io/haileyok/cocoon:latest

     

       35
       35
       -
           container_name: cocoon-init-keys

     

       36
       36
       -
           volumes:

     

       37
       37
       -
             - ./keys:/keys

     

       38
       38
       -
             - ./data:/data/cocoon

     

       39
       39
       -
             - ./init-keys.sh:/init-keys.sh:ro

     

       40
       40
       -
           environment:

     

       41
       41
       -
             COCOON_DID: ${COCOON_DID}

     

       42
       42
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       43
       43
       -
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       44
       44
       -
             COCOON_JWK_PATH: /keys/jwk.key

     

       45
       45
       -
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       46
       46
       -
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       47
       47
       -
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       48
       48
       -
           entrypoint: ["/bin/sh", "/init-keys.sh"]

     

       49
       49
       -
           restart: "no"

     

       50
       50
       -
       

     

       51
       51
       -
         cocoon:

     

       52
       52
       -
           build:

     

       53
       53
       -
             context: .

     

       54
       54
       -
             dockerfile: Dockerfile

     

       55
       55
       -
           image: ghcr.io/haileyok/cocoon:latest

     

       56
       56
       -
           container_name: cocoon-pds

     

       57
       57
       -
           depends_on:

     

       58
       58
       -
             init-keys:

     

       59
       59
       -
               condition: service_completed_successfully

     

       60
       60
       -
             postgres:

     

       61
       61
       -
               condition: service_healthy

     

       62
       62
       -
           ports:

     

       63
       63
       -
             - "8080:8080"

     

       64
       64
       -
           volumes:

     

       65
       65
       -
             - ./data:/data/cocoon

     

       66
       66
       -
             - ./keys/rotation.key:/keys/rotation.key:ro

     

       67
       67
       -
             - ./keys/jwk.key:/keys/jwk.key:ro

     

       68
       68
       -
           environment:

     

       69
       69
       -
             # Required settings

     

       70
       70
       -
             COCOON_DID: ${COCOON_DID}

     

       71
       71
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       72
       72
       -
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       73
       73
       -
             COCOON_JWK_PATH: /keys/jwk.key

     

       74
       74
       -
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       75
       75
       -
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       76
       76
       -
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       77
       77
       -
             COCOON_SESSION_SECRET: ${COCOON_SESSION_SECRET}

     

       78
       78
       -
       

     

       79
       79
       -
             # Database configuration - PostgreSQL

     

       80
       80
       -
             COCOON_ADDR: ":8080"

     

       81
       81
       -
             COCOON_DB_TYPE: postgres

     

       82
       82
       -
             COCOON_DATABASE_URL: postgres://cocoon:${POSTGRES_PASSWORD}@postgres:5432/cocoon?sslmode=disable

     

       83
       83
       -
             COCOON_BLOCKSTORE_VARIANT: ${COCOON_BLOCKSTORE_VARIANT:-sqlite}

     

       84
       84
       -
       

     

       85
       85
       -
             # Optional: SMTP settings for email

     

       86
       86
       -
             COCOON_SMTP_USER: ${COCOON_SMTP_USER:-}

     

       87
       87
       -
             COCOON_SMTP_PASS: ${COCOON_SMTP_PASS:-}

     

       88
       88
       -
             COCOON_SMTP_HOST: ${COCOON_SMTP_HOST:-}

     

       89
       89
       -
             COCOON_SMTP_PORT: ${COCOON_SMTP_PORT:-}

     

       90
       90
       -
             COCOON_SMTP_EMAIL: ${COCOON_SMTP_EMAIL:-}

     

       91
       91
       -
             COCOON_SMTP_NAME: ${COCOON_SMTP_NAME:-}

     

       92
       92
       -
       

     

       93
       93
       -
             # Optional: S3 configuration

     

       94
       94
       -
             COCOON_S3_BACKUPS_ENABLED: ${COCOON_S3_BACKUPS_ENABLED:-false}

     

       95
       95
       -
             COCOON_S3_BLOBSTORE_ENABLED: ${COCOON_S3_BLOBSTORE_ENABLED:-false}

     

       96
       96
       -
             COCOON_S3_REGION: ${COCOON_S3_REGION:-}

     

       97
       97
       -
             COCOON_S3_BUCKET: ${COCOON_S3_BUCKET:-}

     

       98
       98
       -
             COCOON_S3_ENDPOINT: ${COCOON_S3_ENDPOINT:-}

     

       99
       99
       -
             COCOON_S3_ACCESS_KEY: ${COCOON_S3_ACCESS_KEY:-}

     

       100
       100
       -
             COCOON_S3_SECRET_KEY: ${COCOON_S3_SECRET_KEY:-}

     

       101
       101
       -
       

     

       102
       102
       -
             # Optional: Fallback proxy

     

       103
       103
       -
             COCOON_FALLBACK_PROXY: ${COCOON_FALLBACK_PROXY:-}

     

       104
       104
       -
           restart: unless-stopped

     

       105
       105
       -
           healthcheck:

     

       106
       106
       -
             test: ["CMD", "curl", "-f", "http://localhost:8080/xrpc/_health"]

     

       107
       107
       -
             interval: 30s

     

       108
       108
       -
             timeout: 10s

     

       109
       109
       -
             retries: 3

     

       110
       110
       -
             start_period: 40s

     

       111
       111
       -
       

     

       112
       112
       -
         create-invite:

     

       113
       113
       -
           build:

     

       114
       114
       -
             context: .

     

       115
       115
       -
             dockerfile: Dockerfile

     

       116
       116
       -
           image: ghcr.io/haileyok/cocoon:latest

     

       117
       117
       -
           container_name: cocoon-create-invite

     

       118
       118
       -
           volumes:

     

       119
       119
       -
             - ./keys:/keys

     

       120
       120
       -
             - ./create-initial-invite.sh:/create-initial-invite.sh:ro

     

       121
       121
       -
           environment:

     

       122
       122
       -
             COCOON_DID: ${COCOON_DID}

     

       123
       123
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       124
       124
       -
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       125
       125
       -
             COCOON_JWK_PATH: /keys/jwk.key

     

       126
       126
       -
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       127
       127
       -
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       128
       128
       -
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       129
       129
       -
             COCOON_DB_TYPE: postgres

     

       130
       130
       -
             COCOON_DATABASE_URL: postgres://cocoon:${POSTGRES_PASSWORD}@postgres:5432/cocoon?sslmode=disable

     

       131
       131
       -
           depends_on:

     

       132
       132
       -
             cocoon:

     

       133
       133
       -
               condition: service_healthy

     

       134
       134
       -
           entrypoint: ["/bin/sh", "/create-initial-invite.sh"]

     

       135
       135
       -
           restart: "no"

     

       136
       136
       -
       

     

       137
       137
       -
         caddy:

     

       138
       138
       -
           image: caddy:2-alpine

     

       139
       139
       -
           container_name: cocoon-caddy

     

       140
       140
       -
           ports:

     

       141
       141
       -
             - "80:80"

     

       142
       142
       -
             - "443:443"

     

       143
       143
       -
           volumes:

     

       144
       144
       -
             - ./Caddyfile.postgres:/etc/caddy/Caddyfile:ro

     

       145
       145
       -
             - caddy_data:/data

     

       146
       146
       -
             - caddy_config:/config

     

       147
       147
       -
           restart: unless-stopped

     

       148
       148
       -
           environment:

     

       149
       149
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       150
       150
       -
             CADDY_ACME_EMAIL: ${COCOON_CONTACT_EMAIL:-}

     

       151
       151
       -
       

     

       152
       152
       -
       volumes:

     

       153
       153
       -
         postgres_data:

     

       154
       154
       -
           driver: local

     

       155
       155
       -
         caddy_data:

     

       156
       156
       -
           driver: local

     

       157
       157
       -
         caddy_config:

     

       158
       158
       -
           driver: local

-129

docker-compose.yaml

···

       1
       1
       -
       version: '3.8'

     

       2
       2
       -
       

     

       3
       3
       -
       services:

     

       4
       4
       -
         init-keys:

     

       5
       5
       -
           build:

     

       6
       6
       -
             context: .

     

       7
       7
       -
             dockerfile: Dockerfile

     

       8
       8
       -
           image: ghcr.io/haileyok/cocoon:latest

     

       9
       9
       -
           container_name: cocoon-init-keys

     

       10
       10
       -
           volumes:

     

       11
       11
       -
             - ./keys:/keys

     

       12
       12
       -
             - ./data:/data/cocoon

     

       13
       13
       -
             - ./init-keys.sh:/init-keys.sh:ro

     

       14
       14
       -
           environment:

     

       15
       15
       -
             COCOON_DID: ${COCOON_DID}

     

       16
       16
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       17
       17
       -
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       18
       18
       -
             COCOON_JWK_PATH: /keys/jwk.key

     

       19
       19
       -
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       20
       20
       -
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       21
       21
       -
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       22
       22
       -
           entrypoint: ["/bin/sh", "/init-keys.sh"]

     

       23
       23
       -
           restart: "no"

     

       24
       24
       -
       

     

       25
       25
       -
         cocoon:

     

       26
       26
       -
           build:

     

       27
       27
       -
             context: .

     

       28
       28
       -
             dockerfile: Dockerfile

     

       29
       29
       -
           image: ghcr.io/haileyok/cocoon:latest

     

       30
       30
       -
           container_name: cocoon-pds

     

       31
       31
       -
           network_mode: host

     

       32
       32
       -
           depends_on:

     

       33
       33
       -
             init-keys:

     

       34
       34
       -
               condition: service_completed_successfully

     

       35
       35
       -
           volumes:

     

       36
       36
       -
             - ./data:/data/cocoon

     

       37
       37
       -
             - ./keys/rotation.key:/keys/rotation.key:ro

     

       38
       38
       -
             - ./keys/jwk.key:/keys/jwk.key:ro

     

       39
       39
       -
           environment:

     

       40
       40
       -
             # Required settings

     

       41
       41
       -
             COCOON_DID: ${COCOON_DID}

     

       42
       42
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       43
       43
       -
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       44
       44
       -
             COCOON_JWK_PATH: /keys/jwk.key

     

       45
       45
       -
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       46
       46
       -
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       47
       47
       -
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       48
       48
       -
             COCOON_SESSION_SECRET: ${COCOON_SESSION_SECRET}

     

       49
       49
       -
       

     

       50
       50
       -
             # Server configuration

     

       51
       51
       -
             COCOON_ADDR: ":8080"

     

       52
       52
       -
             COCOON_DB_TYPE: ${COCOON_DB_TYPE:-sqlite}

     

       53
       53
       -
             COCOON_DB_NAME: ${COCOON_DB_NAME:-/data/cocoon/cocoon.db}

     

       54
       54
       -
             COCOON_DATABASE_URL: ${COCOON_DATABASE_URL:-}

     

       55
       55
       -
             COCOON_BLOCKSTORE_VARIANT: ${COCOON_BLOCKSTORE_VARIANT:-sqlite}

     

       56
       56
       -
       

     

       57
       57
       -
             # Optional: SMTP settings for email

     

       58
       58
       -
             COCOON_SMTP_USER: ${COCOON_SMTP_USER:-}

     

       59
       59
       -
             COCOON_SMTP_PASS: ${COCOON_SMTP_PASS:-}

     

       60
       60
       -
             COCOON_SMTP_HOST: ${COCOON_SMTP_HOST:-}

     

       61
       61
       -
             COCOON_SMTP_PORT: ${COCOON_SMTP_PORT:-}

     

       62
       62
       -
             COCOON_SMTP_EMAIL: ${COCOON_SMTP_EMAIL:-}

     

       63
       63
       -
             COCOON_SMTP_NAME: ${COCOON_SMTP_NAME:-}

     

       64
       64
       -
       

     

       65
       65
       -
             # Optional: S3 configuration

     

       66
       66
       -
             COCOON_S3_BACKUPS_ENABLED: ${COCOON_S3_BACKUPS_ENABLED:-false}

     

       67
       67
       -
             COCOON_S3_BLOBSTORE_ENABLED: ${COCOON_S3_BLOBSTORE_ENABLED:-false}

     

       68
       68
       -
             COCOON_S3_REGION: ${COCOON_S3_REGION:-}

     

       69
       69
       -
             COCOON_S3_BUCKET: ${COCOON_S3_BUCKET:-}

     

       70
       70
       -
             COCOON_S3_ENDPOINT: ${COCOON_S3_ENDPOINT:-}

     

       71
       71
       -
             COCOON_S3_ACCESS_KEY: ${COCOON_S3_ACCESS_KEY:-}

     

       72
       72
       -
             COCOON_S3_SECRET_KEY: ${COCOON_S3_SECRET_KEY:-}

     

       73
       73
       -
       

     

       74
       74
       -
             # Optional: Fallback proxy

     

       75
       75
       -
             COCOON_FALLBACK_PROXY: ${COCOON_FALLBACK_PROXY:-}

     

       76
       76
       -
           restart: unless-stopped

     

       77
       77
       -
           healthcheck:

     

       78
       78
       -
             test: ["CMD", "curl", "-f", "http://localhost:8080/xrpc/_health"]

     

       79
       79
       -
             interval: 30s

     

       80
       80
       -
             timeout: 10s

     

       81
       81
       -
             retries: 3

     

       82
       82
       -
             start_period: 40s

     

       83
       83
       -
       

     

       84
       84
       -
         create-invite:

     

       85
       85
       -
           build:

     

       86
       86
       -
             context: .

     

       87
       87
       -
             dockerfile: Dockerfile

     

       88
       88
       -
           image: ghcr.io/haileyok/cocoon:latest

     

       89
       89
       -
           container_name: cocoon-create-invite

     

       90
       90
       -
           network_mode: host

     

       91
       91
       -
           volumes:

     

       92
       92
       -
             - ./keys:/keys

     

       93
       93
       -
             - ./create-initial-invite.sh:/create-initial-invite.sh:ro

     

       94
       94
       -
           environment:

     

       95
       95
       -
             COCOON_DID: ${COCOON_DID}

     

       96
       96
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       97
       97
       -
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       98
       98
       -
             COCOON_JWK_PATH: /keys/jwk.key

     

       99
       99
       -
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       100
       100
       -
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       101
       101
       -
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       102
       102
       -
             COCOON_DB_TYPE: ${COCOON_DB_TYPE:-sqlite}

     

       103
       103
       -
             COCOON_DB_NAME: ${COCOON_DB_NAME:-/data/cocoon/cocoon.db}

     

       104
       104
       -
             COCOON_DATABASE_URL: ${COCOON_DATABASE_URL:-}

     

       105
       105
       -
           depends_on:

     

       106
       106
       -
             - init-keys

     

       107
       107
       -
           entrypoint: ["/bin/sh", "/create-initial-invite.sh"]

     

       108
       108
       -
           restart: "no"

     

       109
       109
       -
       

     

       110
       110
       -
         caddy:

     

       111
       111
       -
           image: caddy:2-alpine

     

       112
       112
       -
           container_name: cocoon-caddy

     

       113
       113
       -
           network_mode: host

     

       114
       114
       -
           volumes:

     

       115
       115
       -
             - ./Caddyfile:/etc/caddy/Caddyfile:ro

     

       116
       116
       -
             - caddy_data:/data

     

       117
       117
       -
             - caddy_config:/config

     

       118
       118
       -
           restart: unless-stopped

     

       119
       119
       -
           environment:

     

       120
       120
       -
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       121
       121
       -
             CADDY_ACME_EMAIL: ${COCOON_CONTACT_EMAIL:-}

     

       122
       122
       -
       

     

       123
       123
       -
       volumes:

     

       124
       124
       -
         data:

     

       125
       125
       -
           driver: local

     

       126
       126
       -
         caddy_data:

     

       127
       127
       -
           driver: local

     

       128
       128
       -
         caddy_config:

     

       129
       129
       -
           driver: local

+1 -1

identity/types.go

···

       4
       4
        
       	Context             []string                   `json:"@context"`

     

       5
       5
        
       	Id                  string                     `json:"id"`

     

       6
       6
        
       	AlsoKnownAs         []string                   `json:"alsoKnownAs"`

     

       7
       7
       -
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethod"`

     

       7
       7
       +
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethods"`

     

       8
       8
        
       	Service             []DidDocService            `json:"service"`

     

       9
       9
        
       }

     

       10
       10

-34

init-keys.sh

···

       1
       1
       -
       #!/bin/sh

     

       2
       2
       -
       set -e

     

       3
       3
       -
       

     

       4
       4
       -
       mkdir -p /keys

     

       5
       5
       -
       mkdir -p /data/cocoon

     

       6
       6
       -
       

     

       7
       7
       -
       if [ ! -f /keys/rotation.key ]; then

     

       8
       8
       -
           echo "Generating rotation key..."

     

       9
       9
       -
           /cocoon create-rotation-key --out /keys/rotation.key 2>/dev/null || true

     

       10
       10
       -
           if [ -f /keys/rotation.key ]; then

     

       11
       11
       -
               echo "✓ Rotation key generated at /keys/rotation.key"

     

       12
       12
       -
           else

     

       13
       13
       -
               echo "✗ Failed to generate rotation key"

     

       14
       14
       -
               exit 1

     

       15
       15
       -
           fi

     

       16
       16
       -
       else

     

       17
       17
       -
           echo "✓ Rotation key already exists"

     

       18
       18
       -
       fi

     

       19
       19
       -
       

     

       20
       20
       -
       if [ ! -f /keys/jwk.key ]; then

     

       21
       21
       -
           echo "Generating JWK..."

     

       22
       22
       -
           /cocoon create-private-jwk --out /keys/jwk.key 2>/dev/null || true

     

       23
       23
       -
           if [ -f /keys/jwk.key ]; then

     

       24
       24
       -
               echo "✓ JWK generated at /keys/jwk.key"

     

       25
       25
       -
           else

     

       26
       26
       -
               echo "✗ Failed to generate JWK"

     

       27
       27
       -
               exit 1

     

       28
       28
       -
           fi

     

       29
       29
       -
       else

     

       30
       30
       -
           echo "✓ JWK already exists"

     

       31
       31
       -
       fi

     

       32
       32
       -
       

     

       33
       33
       -
       echo ""

     

       34
       34
       -
       echo "✓ Key initialization complete!"

-6

internal/db/db.go

···

       25
       25
        
       	return db.cli.Clauses(clauses...).Create(value)

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
       -
       func (db *DB) Save(value any, clauses []clause.Expression) *gorm.DB {

     

       29
       29
       -
       	db.mu.Lock()

     

       30
       30
       -
       	defer db.mu.Unlock()

     

       31
       31
       -
       	return db.cli.Clauses(clauses...).Save(value)

     

       32
       32
       -
       }

     

       33
       33
       -
       

     

       34
       28
        
       func (db *DB) Exec(sql string, clauses []clause.Expression, values ...any) *gorm.DB {

     

       35
       29
        
       	db.mu.Lock()

     

       36
       30
        
       	defer db.mu.Unlock()

-16

internal/helpers/helpers.go

···

       32
       32
        
       	return genericError(e, 400, msg)

     

       33
       33
        
       }

     

       34
       34
        
       

     

       35
       35
       -
       func UnauthorizedError(e echo.Context, suffix *string) error {

     

       36
       36
       -
       	msg := "Unauthorized"

     

       37
       37
       -
       	if suffix != nil {

     

       38
       38
       -
       		msg += ". " + *suffix

     

       39
       39
       -
       	}

     

       40
       40
       -
       	return genericError(e, 401, msg)

     

       41
       41
       -
       }

     

       42
       42
       -
       

     

       43
       43
       -
       func ForbiddenError(e echo.Context, suffix *string) error {

     

       44
       44
       -
       	msg := "Forbidden"

     

       45
       45
       -
       	if suffix != nil {

     

       46
       46
       -
       		msg += ". " + *suffix

     

       47
       47
       -
       	}

     

       48
       48
       -
       	return genericError(e, 403, msg)

     

       49
       49
       -
       }

     

       50
       50
       -
       

     

       51
       35
        
       func InvalidTokenError(e echo.Context) error {

     

       52
       36
        
       	return InputError(e, to.StringPtr("InvalidToken"))

     

       53
       37
        
       }

+1 -3

models/models.go

···

       19
       19
        
       	EmailUpdateCodeExpiresAt       *time.Time

     

       20
       20
        
       	PasswordResetCode              *string

     

       21
       21
        
       	PasswordResetCodeExpiresAt     *time.Time

     

       22
       22
       -
       	PlcOperationCode               *string

     

       23
       23
       -
       	PlcOperationCodeExpiresAt      *time.Time

     

       24
       22
        
       	Password                       string

     

       25
       23
        
       	SigningKey                     []byte

     

       26
       24
        
       	Rev                            string

     
···

       108
       106
        
       	Did       string `gorm:"index;index:idx_blob_did_cid"`

     

       109
       107
        
       	Cid       []byte `gorm:"index;index:idx_blob_did_cid"`

     

       110
       108
        
       	RefCount  int

     

       111
       111
       -
       	Storage   string `gorm:"default:sqlite"`

     

       109
       109
       +
       	Storage   string `gorm:"default:sqlite;check:storage in ('sqlite', 's3')"`

     

       112
       110
        
       }

     

       113
       111
        
       

     

       114
       112
        
       type BlobPart struct {

+28 -44

oauth/client/manager.go

···

       22
       22
        
       	cli           *http.Client

     

       23
       23
        
       	logger        *slog.Logger

     

       24
       24
        
       	jwksCache     cache.Cache[string, jwk.Key]

     

       25
       25
       -
       	metadataCache cache.Cache[string, *Metadata]

     

       25
       25
       +
       	metadataCache cache.Cache[string, Metadata]

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
        
       type ManagerArgs struct {

     
···

       40
       40
        
       	}

     

       41
       41
        
       

     

       42
       42
        
       	jwksCache := cache.NewCache[string, jwk.Key]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       43
       43
       -
       	metadataCache := cache.NewCache[string, *Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       43
       43
       +
       	metadataCache := cache.NewCache[string, Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       44
       44
        
       

     

       45
       45
        
       	return &Manager{

     

       46
       46
        
       		cli:           args.Cli,

     
···

       57
       57
        
       	}

     

       58
       58
        
       

     

       59
       59
        
       	var jwks jwk.Key

     

       60
       60
       -
       	if metadata.TokenEndpointAuthMethod == "private_key_jwt" {

     

       61
       61
       -
       		if metadata.JWKS != nil && len(metadata.JWKS.Keys) > 0 {

     

       62
       62
       -
       			// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to

     

       63
       63
       -
       			// make sure we use the right one

     

       64
       64
       -
       			b, err := json.Marshal(metadata.JWKS.Keys[0])

     

       65
       65
       -
       			if err != nil {

     

       66
       66
       -
       				return nil, err

     

       67
       67
       -
       			}

     

       68
       68
       -
       

     

       69
       69
       -
       			k, err := helpers.ParseJWKFromBytes(b)

     

       70
       70
       -
       			if err != nil {

     

       71
       71
       -
       				return nil, err

     

       72
       72
       -
       			}

     

       60
       60
       +
       	if metadata.JWKS != nil && len(metadata.JWKS.Keys) > 0 {

     

       61
       61
       +
       		// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to

     

       62
       62
       +
       		// make sure we use the right one

     

       63
       63
       +
       		b, err := json.Marshal(metadata.JWKS.Keys[0])

     

       64
       64
       +
       		if err != nil {

     

       65
       65
       +
       			return nil, err

     

       66
       66
       +
       		}

     

       73
       67
        
       

     

       74
       74
       -
       			jwks = k

     

       75
       75
       -
       		} else if metadata.JWKS != nil {

     

       76
       76
       -
       		} else if metadata.JWKSURI != nil {

     

       77
       77
       -
       			maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)

     

       78
       78
       -
       			if err != nil {

     

       79
       79
       -
       				return nil, err

     

       80
       80
       -
       			}

     

       68
       68
       +
       		k, err := helpers.ParseJWKFromBytes(b)

     

       69
       69
       +
       		if err != nil {

     

       70
       70
       +
       			return nil, err

     

       71
       71
       +
       		}

     

       81
       72
        
       

     

       82
       82
       -
       			jwks = maybeJwks

     

       83
       83
       -
       		} else {

     

       84
       84
       -
       			return nil, fmt.Errorf("no valid jwks found in oauth client metadata")

     

       73
       73
       +
       		jwks = k

     

       74
       74
       +
       	} else if metadata.JWKSURI != nil {

     

       75
       75
       +
       		maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)

     

       76
       76
       +
       		if err != nil {

     

       77
       77
       +
       			return nil, err

     

       85
       78
        
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		jwks = maybeJwks

     

       81
       81
       +
       	} else {

     

       82
       82
       +
       		return nil, fmt.Errorf("no valid jwks found in oauth client metadata")

     

       86
       83
        
       	}

     

       87
       84
        
       

     

       88
       85
        
       	return &Client{

     
···

       92
       89
        
       }

     

       93
       90
        
       

     

       94
       91
        
       func (cm *Manager) getClientMetadata(ctx context.Context, clientId string) (*Metadata, error) {

     

       95
       95
       -
       	cached, ok := cm.metadataCache.Get(clientId)

     

       92
       92
       +
       	metadataCached, ok := cm.metadataCache.Get(clientId)

     

       96
       93
        
       	if !ok {

     

       97
       94
        
       		req, err := http.NewRequestWithContext(ctx, "GET", clientId, nil)

     

       98
       95
        
       		if err != nil {

     
···

       120
       117
        
       			return nil, err

     

       121
       118
        
       		}

     

       122
       119
        
       

     

       123
       123
       -
       		cm.metadataCache.Set(clientId, validated, 10*time.Minute)

     

       124
       124
       -
       

     

       125
       120
        
       		return validated, nil

     

       126
       121
        
       	} else {

     

       127
       127
       -
       		return cached, nil

     

       122
       122
       +
       		return &metadataCached, nil

     

       128
       123
        
       	}

     

       129
       124
        
       }

     

       130
       125
        
       

     
···

       209
       204
        
       		return nil, fmt.Errorf("error unmarshaling metadata: %w", err)

     

       210
       205
        
       	}

     

       211
       206
        
       

     

       212
       212
       -
       	if metadata.ClientURI == "" {

     

       213
       213
       -
       		u, err := url.Parse(metadata.ClientID)

     

       214
       214
       -
       		if err != nil {

     

       215
       215
       -
       			return nil, fmt.Errorf("unable to parse client id: %w", err)

     

       216
       216
       -
       		}

     

       217
       217
       -
       		u.RawPath = ""

     

       218
       218
       -
       		u.RawQuery = ""

     

       219
       219
       -
       		metadata.ClientURI = u.String()

     

       220
       220
       -
       	}

     

       221
       221
       -
       

     

       222
       207
        
       	u, err := url.Parse(metadata.ClientURI)

     

       223
       208
        
       	if err != nil {

     

       224
       209
        
       		return nil, fmt.Errorf("unable to parse client uri: %w", err)

     

       225
       210
        
       	}

     

       226
       211
        
       

     

       227
       227
       -
       	if metadata.ClientName == "" {

     

       228
       228
       -
       		metadata.ClientName = metadata.ClientURI

     

       229
       229
       -
       	}

     

       230
       230
       -
       

     

       231
       212
        
       	if isLocalHostname(u.Hostname()) {

     

       232
       232
       -
       		return nil, fmt.Errorf("`client_uri` hostname is invalid: %s", u.Hostname())

     

       213
       213
       +
       		return nil, errors.New("`client_uri` hostname is invalid")

     

       233
       214
        
       	}

     

       234
       215
        
       

     

       235
       216
        
       	if metadata.Scope == "" {

     
···

       368
       349
        
       			if u.Scheme != "http" {

     

       369
       350
        
       				return nil, fmt.Errorf("loopback redirect uri %s must use http", ruri)

     

       370
       351
        
       			}

     

       352
       352
       +
       

     

       353
       353
       +
       			break

     

       371
       354
        
       		case u.Scheme == "http":

     

       372
       355
        
       			return nil, errors.New("only loopbvack redirect uris are allowed to use the `http` scheme")

     

       373
       356
        
       		case u.Scheme == "https":

     

       374
       357
        
       			if isLocalHostname(u.Hostname()) {

     

       375
       358
        
       				return nil, fmt.Errorf("redirect uri %s's domain must not be a local hostname", ruri)

     

       376
       359
        
       			}

     

       360
       360
       +
       			break

     

       377
       361
        
       		case strings.Contains(u.Scheme, "."):

     

       378
       362
        
       			if metadata.ApplicationType != "native" {

     

       379
       363
        
       				return nil, errors.New("private-use uri scheme redirect uris are only allowed for native apps")

+15 -31

plc/client.go

···

       55
       55
        
       }

     

       56
       56
        
       

     

       57
       57
        
       func (c *Client) CreateDID(sigkey *atcrypto.PrivateKeyK256, recovery string, handle string) (string, *Operation, error) {

     

       58
       58
       -
       	creds, err := c.CreateDidCredentials(sigkey, recovery, handle)

     

       59
       59
       -
       	if err != nil {

     

       60
       60
       -
       		return "", nil, err

     

       61
       61
       -
       	}

     

       62
       62
       -
       

     

       63
       63
       -
       	op := Operation{

     

       64
       64
       -
       		Type: "plc_operation",

     

       65
       65
       -
       		VerificationMethods: creds.VerificationMethods,

     

       66
       66
       -
       		RotationKeys: creds.RotationKeys,

     

       67
       67
       -
       		AlsoKnownAs: creds.AlsoKnownAs,

     

       68
       68
       -
       		Services: creds.Services,

     

       69
       69
       -
       		Prev: nil,

     

       70
       70
       -
       	}

     

       71
       71
       -
       

     

       72
       72
       -
       	if err := c.SignOp(sigkey, &op); err != nil {

     

       73
       73
       -
       		return "", nil, err

     

       74
       74
       -
       	}

     

       75
       75
       -
       

     

       76
       76
       -
       	did, err := DidFromOp(&op)

     

       77
       77
       -
       	if err != nil {

     

       78
       78
       -
       		return "", nil, err

     

       79
       79
       -
       	}

     

       80
       80
       -
       

     

       81
       81
       -
       	return did, &op, nil

     

       82
       82
       -
       }

     

       83
       83
       -
       

     

       84
       84
       -
       func (c *Client) CreateDidCredentials(sigkey *atcrypto.PrivateKeyK256, recovery string, handle string) (*DidCredentials, error) {

     

       85
       58
        
       	pubsigkey, err := sigkey.PublicKey()

     

       86
       59
        
       	if err != nil {

     

       87
       87
       -
       		return nil, err

     

       60
       60
       +
       		return "", nil, err

     

       88
       61
        
       	}

     

       89
       62
        
       

     

       90
       63
        
       	pubrotkey, err := c.rotationKey.PublicKey()

     

       91
       64
        
       	if err != nil {

     

       92
       92
       -
       		return nil, err

     

       65
       65
       +
       		return "", nil, err

     

       93
       66
        
       	}

     

       94
       67
        
       

     

       95
       68
        
       	// todo

     
···

       104
       77
        
       		}(recovery)

     

       105
       78
        
       	}

     

       106
       79
        
       

     

       107
       107
       -
       	creds := DidCredentials{

     

       80
       80
       +
       	op := Operation{

     

       81
       81
       +
       		Type: "plc_operation",

     

       108
       82
        
       		VerificationMethods: map[string]string{

     

       109
       83
        
       			"atproto": pubsigkey.DIDKey(),

     

       110
       84
        
       		},

     
···

       118
       92
        
       				Endpoint: "https://" + c.pdsHostname,

     

       119
       93
        
       			},

     

       120
       94
        
       		},

     

       95
       95
       +
       		Prev: nil,

     

       121
       96
        
       	}

     

       122
       97
        
       

     

       123
       123
       -
       	return &creds, nil

     

       98
       98
       +
       	if err := c.SignOp(sigkey, &op); err != nil {

     

       99
       99
       +
       		return "", nil, err

     

       100
       100
       +
       	}

     

       101
       101
       +
       

     

       102
       102
       +
       	did, err := DidFromOp(&op)

     

       103
       103
       +
       	if err != nil {

     

       104
       104
       +
       		return "", nil, err

     

       105
       105
       +
       	}

     

       106
       106
       +
       

     

       107
       107
       +
       	return did, &op, nil

     

       124
       108
        
       }

     

       125
       109
        
       

     

       126
       110
        
       func (c *Client) SignOp(sigkey *atcrypto.PrivateKeyK256, op *Operation) error {

-8

plc/types.go

···

       8
       8
        
       	cbg "github.com/whyrusleeping/cbor-gen"

     

       9
       9
        
       )

     

       10
       10
        
       

     

       11
       11
       -
       

     

       12
       12
       -
       type DidCredentials struct {

     

       13
       13
       -
       	VerificationMethods map[string]string                    `json:"verificationMethods"`

     

       14
       14
       -
       	RotationKeys        []string                             `json:"rotationKeys"`

     

       15
       15
       -
       	AlsoKnownAs         []string                             `json:"alsoKnownAs"`

     

       16
       16
       -
       	Services            map[string]identity.OperationService `json:"services"`

     

       17
       17
       -
       }

     

       18
       18
       -
       

     

       19
       11
        
       type Operation struct {

     

       20
       12
        
       	Type                string                               `json:"type"`

     

       21
       13
        
       	VerificationMethods map[string]string                    `json:"verificationMethods"`

-24

server/handle_identity_get_recommended_did_credentials.go

···

       1
       1
       -
       package server

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       5
       5
       -
       	"github.com/haileyok/cocoon/internal/helpers"

     

       6
       6
       -
       	"github.com/haileyok/cocoon/models"

     

       7
       7
       -
       	"github.com/labstack/echo/v4"

     

       8
       8
       -
       )

     

       9
       9
       -
       

     

       10
       10
       -
       func (s *Server) handleGetRecommendedDidCredentials(e echo.Context) error {

     

       11
       11
       -
       	repo := e.Get("repo").(*models.RepoActor)

     

       12
       12
       -
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       13
       13
       -
       	if err != nil {

     

       14
       14
       -
       		s.logger.Error("error parsing key", "error", err)

     

       15
       15
       -
       		return helpers.ServerError(e, nil)

     

       16
       16
       -
       	}

     

       17
       17
       -
       	creds, err := s.plcClient.CreateDidCredentials(k, "", repo.Actor.Handle)

     

       18
       18
       -
       	if err != nil {

     

       19
       19
       -
       		s.logger.Error("error crating did credentials", "error", err)

     

       20
       20
       -
       		return helpers.ServerError(e, nil)

     

       21
       21
       -
       	}

     

       22
       22
       -
       

     

       23
       23
       -
       	return e.JSON(200, creds)

     

       24
       24
       -
       }

-29

server/handle_identity_request_plc_operation.go

···

       1
       1
       -
       package server

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"fmt"

     

       5
       5
       -
       	"time"

     

       6
       6
       -
       

     

       7
       7
       -
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       8
       -
       	"github.com/haileyok/cocoon/models"

     

       9
       9
       -
       	"github.com/labstack/echo/v4"

     

       10
       10
       -
       )

     

       11
       11
       -
       

     

       12
       12
       -
       func (s *Server) handleIdentityRequestPlcOperationSignature(e echo.Context) error {

     

       13
       13
       -
       	urepo := e.Get("repo").(*models.RepoActor)

     

       14
       14
       -
       

     

       15
       15
       -
       	code := fmt.Sprintf("%s-%s", helpers.RandomVarchar(5), helpers.RandomVarchar(5))

     

       16
       16
       -
       	eat := time.Now().Add(10 * time.Minute).UTC()

     

       17
       17
       -
       

     

       18
       18
       -
       	if err := s.db.Exec("UPDATE repos SET plc_operation_code = ?, plc_operation_code_expires_at = ? WHERE did = ?", nil, code, eat, urepo.Repo.Did).Error; err != nil {

     

       19
       19
       -
       		s.logger.Error("error updating user", "error", err)

     

       20
       20
       -
       		return helpers.ServerError(e, nil)

     

       21
       21
       -
       	}

     

       22
       22
       -
       

     

       23
       23
       -
       	if err := s.sendPlcTokenReset(urepo.Email, urepo.Handle, code); err != nil {

     

       24
       24
       -
       		s.logger.Error("error sending mail", "error", err)

     

       25
       25
       -
       		return helpers.ServerError(e, nil)

     

       26
       26
       -
       	}

     

       27
       27
       -
       

     

       28
       28
       -
       	return e.NoContent(200)

     

       29
       29
       -
       }

-103

server/handle_identity_sign_plc_operation.go

···

       1
       1
       -
       package server

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"strings"

     

       6
       6
       -
       	"time"

     

       7
       7
       -
       

     

       8
       8
       -
       	"github.com/Azure/go-autorest/autorest/to"

     

       9
       9
       -
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       10
       10
       -
       	"github.com/haileyok/cocoon/identity"

     

       11
       11
       -
       	"github.com/haileyok/cocoon/internal/helpers"

     

       12
       12
       -
       	"github.com/haileyok/cocoon/models"

     

       13
       13
       -
       	"github.com/haileyok/cocoon/plc"

     

       14
       14
       -
       	"github.com/labstack/echo/v4"

     

       15
       15
       -
       )

     

       16
       16
       -
       

     

       17
       17
       -
       type ComAtprotoSignPlcOperationRequest struct {

     

       18
       18
       -
       	Token               string                                `json:"token"`

     

       19
       19
       -
       	VerificationMethods *map[string]string                    `json:"verificationMethods"`

     

       20
       20
       -
       	RotationKeys        *[]string                             `json:"rotationKeys"`

     

       21
       21
       -
       	AlsoKnownAs         *[]string                             `json:"alsoKnownAs"`

     

       22
       22
       -
       	Services            *map[string]identity.OperationService `json:"services"`

     

       23
       23
       -
       }

     

       24
       24
       -
       

     

       25
       25
       -
       type ComAtprotoSignPlcOperationResponse struct {

     

       26
       26
       -
       	Operation plc.Operation `json:"operation"`

     

       27
       27
       -
       }

     

       28
       28
       -
       

     

       29
       29
       -
       func (s *Server) handleSignPlcOperation(e echo.Context) error {

     

       30
       30
       -
       	repo := e.Get("repo").(*models.RepoActor)

     

       31
       31
       -
       

     

       32
       32
       -
       	var req ComAtprotoSignPlcOperationRequest

     

       33
       33
       -
       	if err := e.Bind(&req); err != nil {

     

       34
       34
       -
       		s.logger.Error("error binding", "error", err)

     

       35
       35
       -
       		return helpers.ServerError(e, nil)

     

       36
       36
       -
       	}

     

       37
       37
       -
       

     

       38
       38
       -
       	if !strings.HasPrefix(repo.Repo.Did, "did:plc:") {

     

       39
       39
       -
       		return helpers.InputError(e, nil)

     

       40
       40
       -
       	}

     

       41
       41
       -
       

     

       42
       42
       -
       	if repo.PlcOperationCode == nil || repo.PlcOperationCodeExpiresAt == nil {

     

       43
       43
       -
       		return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       44
       44
       -
       	}

     

       45
       45
       -
       

     

       46
       46
       -
       	if *repo.PlcOperationCode != req.Token {

     

       47
       47
       -
       		return helpers.InvalidTokenError(e)

     

       48
       48
       -
       	}

     

       49
       49
       -
       

     

       50
       50
       -
       	if time.Now().UTC().After(*repo.PlcOperationCodeExpiresAt) {

     

       51
       51
       -
       		return helpers.ExpiredTokenError(e)

     

       52
       52
       -
       	}

     

       53
       53
       -
       

     

       54
       54
       -
       	ctx := context.WithValue(e.Request().Context(), "skip-cache", true)

     

       55
       55
       -
       	log, err := identity.FetchDidAuditLog(ctx, nil, repo.Repo.Did)

     

       56
       56
       -
       	if err != nil {

     

       57
       57
       -
       		s.logger.Error("error fetching doc", "error", err)

     

       58
       58
       -
       		return helpers.ServerError(e, nil)

     

       59
       59
       -
       	}

     

       60
       60
       -
       

     

       61
       61
       -
       	latest := log[len(log)-1]

     

       62
       62
       -
       

     

       63
       63
       -
       	op := plc.Operation{

     

       64
       64
       -
       		Type:                "plc_operation",

     

       65
       65
       -
       		VerificationMethods: latest.Operation.VerificationMethods,

     

       66
       66
       -
       		RotationKeys:        latest.Operation.RotationKeys,

     

       67
       67
       -
       		AlsoKnownAs:         latest.Operation.AlsoKnownAs,

     

       68
       68
       -
       		Services:            latest.Operation.Services,

     

       69
       69
       -
       		Prev:                &latest.Cid,

     

       70
       70
       -
       	}

     

       71
       71
       -
       	if req.VerificationMethods != nil {

     

       72
       72
       -
       		op.VerificationMethods = *req.VerificationMethods

     

       73
       73
       -
       	}

     

       74
       74
       -
       	if req.RotationKeys != nil {

     

       75
       75
       -
       		op.RotationKeys = *req.RotationKeys

     

       76
       76
       -
       	}

     

       77
       77
       -
       	if req.AlsoKnownAs != nil {

     

       78
       78
       -
       		op.AlsoKnownAs = *req.AlsoKnownAs

     

       79
       79
       -
       	}

     

       80
       80
       -
       	if req.Services != nil {

     

       81
       81
       -
       		op.Services = *req.Services

     

       82
       82
       -
       	}

     

       83
       83
       -
       

     

       84
       84
       -
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       85
       85
       -
       	if err != nil {

     

       86
       86
       -
       		s.logger.Error("error parsing signing key", "error", err)

     

       87
       87
       -
       		return helpers.ServerError(e, nil)

     

       88
       88
       -
       	}

     

       89
       89
       -
       

     

       90
       90
       -
       	if err := s.plcClient.SignOp(k, &op); err != nil {

     

       91
       91
       -
       		s.logger.Error("error signing plc operation", "error", err)

     

       92
       92
       -
       		return helpers.ServerError(e, nil)

     

       93
       93
       -
       	}

     

       94
       94
       -
       

     

       95
       95
       -
       	if err := s.db.Exec("UPDATE repos SET plc_operation_code = NULL, plc_operation_code_expires_at = NULL WHERE did = ?", nil, repo.Repo.Did).Error; err != nil {

     

       96
       96
       -
       		s.logger.Error("error updating repo", "error", err)

     

       97
       97
       -
       		return helpers.ServerError(e, nil)

     

       98
       98
       -
       	}

     

       99
       99
       -
       

     

       100
       100
       -
       	return e.JSON(200, ComAtprotoSignPlcOperationResponse{

     

       101
       101
       -
       		Operation: op,

     

       102
       102
       -
       	})

     

       103
       103
       -
       }

-87

server/handle_identity_submit_plc_operation.go

···

       1
       1
       -
       package server

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"slices"

     

       6
       6
       -
       	"strings"

     

       7
       7
       -
       	"time"

     

       8
       8
       -
       

     

       9
       9
       -
       	"github.com/bluesky-social/indigo/api/atproto"

     

       10
       10
       -
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       11
       11
       -
       	"github.com/bluesky-social/indigo/events"

     

       12
       12
       -
       	"github.com/bluesky-social/indigo/util"

     

       13
       13
       -
       	"github.com/haileyok/cocoon/internal/helpers"

     

       14
       14
       -
       	"github.com/haileyok/cocoon/models"

     

       15
       15
       -
       	"github.com/haileyok/cocoon/plc"

     

       16
       16
       -
       	"github.com/labstack/echo/v4"

     

       17
       17
       -
       )

     

       18
       18
       -
       

     

       19
       19
       -
       type ComAtprotoSubmitPlcOperationRequest struct {

     

       20
       20
       -
       	Operation plc.Operation `json:"operation"`

     

       21
       21
       -
       }

     

       22
       22
       -
       

     

       23
       23
       -
       func (s *Server) handleSubmitPlcOperation(e echo.Context) error {

     

       24
       24
       -
       	repo := e.Get("repo").(*models.RepoActor)

     

       25
       25
       -
       

     

       26
       26
       -
       	var req ComAtprotoSubmitPlcOperationRequest

     

       27
       27
       -
       	if err := e.Bind(&req); err != nil {

     

       28
       28
       -
       		s.logger.Error("error binding", "error", err)

     

       29
       29
       -
       		return helpers.ServerError(e, nil)

     

       30
       30
       -
       	}

     

       31
       31
       -
       

     

       32
       32
       -
       	if err := e.Validate(req); err != nil {

     

       33
       33
       -
       		return helpers.InputError(e, nil)

     

       34
       34
       -
       	}

     

       35
       35
       -
       	if !strings.HasPrefix(repo.Repo.Did, "did:plc:") {

     

       36
       36
       -
       		return helpers.InputError(e, nil)

     

       37
       37
       -
       	}

     

       38
       38
       -
       

     

       39
       39
       -
       	op := req.Operation

     

       40
       40
       -
       

     

       41
       41
       -
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       42
       42
       -
       	if err != nil {

     

       43
       43
       -
       		s.logger.Error("error parsing key", "error", err)

     

       44
       44
       -
       		return helpers.ServerError(e, nil)

     

       45
       45
       -
       	}

     

       46
       46
       -
       	required, err := s.plcClient.CreateDidCredentials(k, "", repo.Actor.Handle)

     

       47
       47
       -
       	if err != nil {

     

       48
       48
       -
       		s.logger.Error("error crating did credentials", "error", err)

     

       49
       49
       -
       		return helpers.ServerError(e, nil)

     

       50
       50
       -
       	}

     

       51
       51
       -
       

     

       52
       52
       -
       	for _, expectedKey := range required.RotationKeys {

     

       53
       53
       -
       		if !slices.Contains(op.RotationKeys, expectedKey) {

     

       54
       54
       -
       			return helpers.InputError(e, nil)

     

       55
       55
       -
       		}

     

       56
       56
       -
       	}

     

       57
       57
       -
       	if op.Services["atproto_pds"].Type != "AtprotoPersonalDataServer" {

     

       58
       58
       -
       		return helpers.InputError(e, nil)

     

       59
       59
       -
       	}

     

       60
       60
       -
       	if op.Services["atproto_pds"].Endpoint != required.Services["atproto_pds"].Endpoint {

     

       61
       61
       -
       		return helpers.InputError(e, nil)

     

       62
       62
       -
       	}

     

       63
       63
       -
       	if op.VerificationMethods["atproto"] != required.VerificationMethods["atproto"] {

     

       64
       64
       -
       		return helpers.InputError(e, nil)

     

       65
       65
       -
       	}

     

       66
       66
       -
       	if op.AlsoKnownAs[0] != required.AlsoKnownAs[0] {

     

       67
       67
       -
       		return helpers.InputError(e, nil)

     

       68
       68
       -
       	}

     

       69
       69
       -
       

     

       70
       70
       -
       	if err := s.plcClient.SendOperation(e.Request().Context(), repo.Repo.Did, &op); err != nil {

     

       71
       71
       -
       		return err

     

       72
       72
       -
       	}

     

       73
       73
       -
       

     

       74
       74
       -
       	if err := s.passport.BustDoc(context.TODO(), repo.Repo.Did); err != nil {

     

       75
       75
       -
       		s.logger.Warn("error busting did doc", "error", err)

     

       76
       76
       -
       	}

     

       77
       77
       -
       

     

       78
       78
       -
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       79
       79
       -
       		RepoIdentity: &atproto.SyncSubscribeRepos_Identity{

     

       80
       80
       -
       			Did:  repo.Repo.Did,

     

       81
       81
       -
       			Seq:  time.Now().UnixMicro(), // TODO: no

     

       82
       82
       -
       			Time: time.Now().Format(util.ISO8601),

     

       83
       83
       -
       		},

     

       84
       84
       -
       	})

     

       85
       85
       -
       

     

       86
       86
       -
       	return nil

     

       87
       87
       -
       }

+1 -1

server/handle_import_repo.go

···

       87
       87
        
       			Value:     b.RawData(),

     

       88
       88
        
       		}

     

       89
       89
        
       

     

       90
       90
       -
       		if err := tx.Save(rec).Error; err != nil {

     

       90
       90
       +
       		if err := tx.Create(rec).Error; err != nil {

     

       91
       91
        
       			return err

     

       92
       92
        
       		}

     

       93
       93

+2 -15

server/handle_proxy.go

···

       96
       96
        
       

     

       97
       97
        
       		encheader := strings.TrimRight(base64.RawURLEncoding.EncodeToString(hj), "=")

     

       98
       98
        
       

     

       99
       99
       -
       		// When proxying app.bsky.feed.getFeed the token is actually issued for the

     

       100
       100
       -
       		// underlying feed generator and the app view passes it on. This allows the

     

       101
       101
       -
       		// getFeed implementation to pass in the desired lxm and aud for the token

     

       102
       102
       -
       		// and then just delegate to the general proxying logic

     

       103
       103
       -
       		lxm, proxyTokenLxmExists := e.Get("proxyTokenLxm").(string)

     

       104
       104
       -
       		if !proxyTokenLxmExists || lxm == "" {

     

       105
       105
       -
       			lxm = pts[2]

     

       106
       106
       -
       		}

     

       107
       107
       -
       		aud, proxyTokenAudExists := e.Get("proxyTokenAud").(string)

     

       108
       108
       -
       		if !proxyTokenAudExists || aud == "" {

     

       109
       109
       -
       			aud = svcDid

     

       110
       110
       -
       		}

     

       111
       111
       -
       

     

       112
       99
        
       		payload := map[string]any{

     

       113
       100
        
       			"iss": repo.Repo.Did,

     

       114
       114
       -
       			"aud": aud,

     

       115
       115
       -
       			"lxm": lxm,

     

       101
       101
       +
       			"aud": svcDid,

     

       102
       102
       +
       			"lxm": pts[2],

     

       116
       103
        
       			"jti": uuid.NewString(),

     

       117
       104
        
       			"exp": time.Now().Add(1 * time.Minute).UTC().Unix(),

     

       118
       105
        
       		}

-35

server/handle_proxy_get_feed.go

···

       1
       1
       -
       package server

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"github.com/Azure/go-autorest/autorest/to"

     

       5
       5
       -
       	"github.com/bluesky-social/indigo/api/atproto"

     

       6
       6
       -
       	"github.com/bluesky-social/indigo/api/bsky"

     

       7
       7
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       8
       8
       -
       	"github.com/bluesky-social/indigo/xrpc"

     

       9
       9
       -
       	"github.com/haileyok/cocoon/internal/helpers"

     

       10
       10
       -
       	"github.com/labstack/echo/v4"

     

       11
       11
       -
       )

     

       12
       12
       -
       

     

       13
       13
       -
       func (s *Server) handleProxyBskyFeedGetFeed(e echo.Context) error {

     

       14
       14
       -
       	feedUri, err := syntax.ParseATURI(e.QueryParam("feed"))

     

       15
       15
       -
       	if err != nil {

     

       16
       16
       -
       		return helpers.InputError(e, to.StringPtr("invalid feed uri"))

     

       17
       17
       -
       	}

     

       18
       18
       -
       

     

       19
       19
       -
       	appViewEndpoint, _, err := s.getAtprotoProxyEndpointFromRequest(e)

     

       20
       20
       -
       	if err != nil {

     

       21
       21
       -
       		e.Logger().Error("could not get atproto proxy", "error", err)

     

       22
       22
       -
       		return helpers.ServerError(e, nil)

     

       23
       23
       -
       	}

     

       24
       24
       -
       

     

       25
       25
       -
       	appViewClient := xrpc.Client{

     

       26
       26
       -
       		Host: appViewEndpoint,

     

       27
       27
       -
       	}

     

       28
       28
       -
       	feedRecord, err := atproto.RepoGetRecord(e.Request().Context(), &appViewClient, "", feedUri.Collection().String(), feedUri.Authority().String(), feedUri.RecordKey().String())

     

       29
       29
       -
       	feedGeneratorDid := feedRecord.Value.Val.(*bsky.FeedGenerator).Did

     

       30
       30
       -
       

     

       31
       31
       -
       	e.Set("proxyTokenLxm", "app.bsky.feed.getFeedSkeleton")

     

       32
       32
       -
       	e.Set("proxyTokenAud", feedGeneratorDid)

     

       33
       33
       -
       

     

       34
       34
       -
       	return s.handleProxy(e)

     

       35
       35
       -
       }

-21

server/handle_repo_list_missing_blobs.go

···

       1
       1
       -
       package server

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"github.com/labstack/echo/v4"

     

       5
       5
       -
       )

     

       6
       6
       -
       

     

       7
       7
       -
       type ComAtprotoRepoListMissingBlobsResponse struct {

     

       8
       8
       -
       	Cursor *string                                    `json:"cursor,omitempty"`

     

       9
       9
       -
       	Blobs  []ComAtprotoRepoListMissingBlobsRecordBlob `json:"blobs"`

     

       10
       10
       -
       }

     

       11
       11
       -
       

     

       12
       12
       -
       type ComAtprotoRepoListMissingBlobsRecordBlob struct {

     

       13
       13
       -
       	Cid        string `json:"cid"`

     

       14
       14
       -
       	RecordUri  string `json:"recordUri"`

     

       15
       15
       -
       }

     

       16
       16
       -
       

     

       17
       17
       -
       func (s *Server) handleListMissingBlobs(e echo.Context) error {

     

       18
       18
       -
       	return e.JSON(200, ComAtprotoRepoListMissingBlobsResponse{

     

       19
       19
       -
       		Blobs: []ComAtprotoRepoListMissingBlobsRecordBlob{},

     

       20
       20
       -
       	})

     

       21
       21
       -
       }

+35 -45

server/handle_server_create_account.go

···

       10
       10
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       11
       11
        
       	"github.com/bluesky-social/indigo/api/atproto"

     

       12
       12
        
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       13
       13
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       13
       14
        
       	"github.com/bluesky-social/indigo/events"

     

       14
       15
        
       	"github.com/bluesky-social/indigo/repo"

     

       15
       16
        
       	"github.com/bluesky-social/indigo/util"

     
···

       38
       39
        
       func (s *Server) handleCreateAccount(e echo.Context) error {

     

       39
       40
        
       	var request ComAtprotoServerCreateAccountRequest

     

       40
       41
        
       

     

       42
       42
       +
       	var signupDid string

     

       43
       43
       +
       	customDidHeader := e.Request().Header.Get("authorization")

     

       44
       44
       +
       	if customDidHeader != "" {

     

       45
       45
       +
       		pts := strings.Split(customDidHeader, " ")

     

       46
       46
       +
       		if len(pts) != 2 {

     

       47
       47
       +
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       48
       48
       +
       		}

     

       49
       49
       +
       

     

       50
       50
       +
       		_, err := syntax.ParseDID(pts[1])

     

       51
       51
       +
       		if err != nil {

     

       52
       52
       +
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       53
       53
       +
       		}

     

       54
       54
       +
       

     

       55
       55
       +
       		signupDid = pts[1]

     

       56
       56
       +
       	}

     

       57
       57
       +
       

     

       41
       58
        
       	if err := e.Bind(&request); err != nil {

     

       42
       59
        
       		s.logger.Error("error receiving request", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       43
       60
        
       		return helpers.ServerError(e, nil)

     
···

       68
       85
        
       			}

     

       69
       86
        
       		}

     

       70
       87
        
       	}

     

       71
       71
       -
       	

     

       72
       72
       -
       	var signupDid string

     

       73
       73
       -
       	if request.Did != nil {

     

       74
       74
       -
       		signupDid = *request.Did;

     

       75
       75
       -
       		

     

       76
       76
       -
       		token := strings.TrimSpace(strings.Replace(e.Request().Header.Get("authorization"), "Bearer ", "", 1))

     

       77
       77
       -
       		if token == "" {

     

       78
       78
       -
       			return helpers.UnauthorizedError(e, to.StringPtr("must authenticate to use an existing did"))

     

       79
       79
       -
       		}

     

       80
       80
       -
       		authDid, err := s.validateServiceAuth(e.Request().Context(), token, "com.atproto.server.createAccount")

     

       81
       81
       -
       

     

       82
       82
       -
       		if err != nil {

     

       83
       83
       -
       			s.logger.Warn("error validating authorization token", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       84
       84
       -
       			return helpers.UnauthorizedError(e, to.StringPtr("invalid authorization token"))

     

       85
       85
       -
       		}

     

       86
       86
       -
       

     

       87
       87
       -
       		if authDid != signupDid {

     

       88
       88
       -
       			return helpers.ForbiddenError(e, to.StringPtr("auth did did not match signup did"))

     

       89
       89
       -
       		}

     

       90
       90
       -
       	}

     

       91
       88
        
       

     

       92
       89
        
       	// see if the handle is already taken

     

       93
       93
       -
       	actor, err := s.getActorByHandle(request.Handle)

     

       90
       90
       +
       	_, err := s.getActorByHandle(request.Handle)

     

       94
       91
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       95
       92
        
       		s.logger.Error("error looking up handle in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       96
       93
        
       		return helpers.ServerError(e, nil)

     

       97
       94
        
       	}

     

       98
       98
       -
       	if err == nil && actor.Did != signupDid {

     

       95
       95
       +
       	if err == nil {

     

       99
       96
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       100
       97
        
       	}

     

       101
       98
        
       

     

       102
       102
       -
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != signupDid {

     

       99
       99
       +
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != "" {

     

       103
       100
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       104
       101
        
       	}

     

       105
       102
        
       

     
···

       117
       114
        
       	}

     

       118
       115
        
       

     

       119
       116
        
       	// see if the email is already taken

     

       120
       120
       -
       	existingRepo, err := s.getRepoByEmail(request.Email)

     

       117
       117
       +
       	_, err = s.getRepoByEmail(request.Email)

     

       121
       118
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       122
       119
        
       		s.logger.Error("error looking up email in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       123
       120
        
       		return helpers.ServerError(e, nil)

     

       124
       121
        
       	}

     

       125
       125
       -
       	if err == nil && existingRepo.Did != signupDid {

     

       122
       122
       +
       	if err == nil {

     

       126
       123
        
       		return helpers.InputError(e, to.StringPtr("EmailNotAvailable"))

     

       127
       124
        
       	}

     

       128
       125
        
       

     
···

       163
       160
        
       		SigningKey:            k.Bytes(),

     

       164
       161
        
       	}

     

       165
       162
        
       

     

       166
       166
       -
       	if actor == nil {

     

       167
       167
       -
       		actor = &models.Actor{

     

       168
       168
       -
       			Did:    signupDid,

     

       169
       169
       -
       			Handle: request.Handle,

     

       170
       170
       -
       		}

     

       163
       163
       +
       	actor := models.Actor{

     

       164
       164
       +
       		Did:    signupDid,

     

       165
       165
       +
       		Handle: request.Handle,

     

       166
       166
       +
       	}

     

       171
       167
        
       

     

       172
       172
       -
       		if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       173
       173
       -
       			s.logger.Error("error inserting new repo", "error", err)

     

       174
       174
       -
       			return helpers.ServerError(e, nil)

     

       175
       175
       -
       		}

     

       176
       176
       -
       	

     

       177
       177
       -
       		if err := s.db.Create(&actor, nil).Error; err != nil {

     

       178
       178
       -
       			s.logger.Error("error inserting new actor", "error", err)

     

       179
       179
       -
       			return helpers.ServerError(e, nil)

     

       180
       180
       -
       		}

     

       181
       181
       -
       	} else {

     

       182
       182
       -
       		if err := s.db.Save(&actor, nil).Error; err != nil {

     

       183
       183
       -
       			s.logger.Error("error inserting new actor", "error", err)

     

       184
       184
       -
       			return helpers.ServerError(e, nil)

     

       185
       185
       -
       		}

     

       168
       168
       +
       	if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       169
       169
       +
       		s.logger.Error("error inserting new repo", "error", err)

     

       170
       170
       +
       		return helpers.ServerError(e, nil)

     

       186
       171
        
       	}

     

       187
       172
        
       

     

       188
       188
       -
       	if request.Did == nil || *request.Did == "" {

     

       173
       173
       +
       	if err := s.db.Create(&actor, nil).Error; err != nil {

     

       174
       174
       +
       		s.logger.Error("error inserting new actor", "error", err)

     

       175
       175
       +
       		return helpers.ServerError(e, nil)

     

       176
       176
       +
       	}

     

       177
       177
       +
       

     

       178
       178
       +
       	if customDidHeader == "" {

     

       189
       179
        
       		bs := s.getBlockstore(signupDid)

     

       190
       180
        
       		r := repo.NewRepo(context.TODO(), signupDid, bs)

     

       191
       181

+1 -6

server/handle_sync_get_blob.go

···

       64
       64
        
       		for _, p := range parts {

     

       65
       65
        
       			buf.Write(p.Data)

     

       66
       66
        
       		}

     

       67
       67
       -
       	} else if blob.Storage == "s3" {

     

       68
       68
       -
       		if  !(s.s3Config != nil && s.s3Config.BlobstoreEnabled) {

     

       69
       69
       -
       			s.logger.Error("s3 storage disabled")

     

       70
       70
       -
       			return helpers.ServerError(e, nil)

     

       71
       71
       -
       		}

     

       72
       72
       -
       

     

       67
       67
       +
       	} else if blob.Storage == "s3" && s.s3Config != nil && s.s3Config.BlobstoreEnabled {

     

       73
       68
        
       		config := &aws.Config{

     

       74
       69
        
       			Region:      aws.String(s.s3Config.Region),

     

       75
       70
        
       			Credentials: credentials.NewStaticCredentials(s.s3Config.AccessKey, s.s3Config.SecretKey, ""),

+11 -31

server/handle_sync_subscribe_repos.go

···

       1
       1
        
       package server

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"time"

     

       4
       4
       +
       	"fmt"

     

       6
       5
        
       

     

       7
       6
        
       	"github.com/bluesky-social/indigo/events"

     

       8
       7
        
       	"github.com/bluesky-social/indigo/lex/util"

     
···

       11
       10
        
       )

     

       12
       11
        
       

     

       13
       12
        
       func (s *Server) handleSyncSubscribeRepos(e echo.Context) error {

     

       14
       14
       -
       	ctx := e.Request().Context()

     

       15
       15
       -
       	logger := s.logger.With("component", "subscribe-repos-websocket")

     

       16
       16
       -
       

     

       17
       13
        
       	conn, err := websocket.Upgrade(e.Response().Writer, e.Request(), e.Response().Header(), 1<<10, 1<<10)

     

       18
       14
        
       	if err != nil {

     

       19
       19
       -
       		logger.Error("unable to establish websocket with relay", "err", err)

     

       20
       15
        
       		return err

     

       21
       16
        
       	}

     

       17
       17
       +
       

     

       18
       18
       +
       	s.logger.Info("new connection", "ua", e.Request().UserAgent())

     

       19
       19
       +
       

     

       20
       20
       +
       	ctx := e.Request().Context()

     

       22
       21
        
       

     

       23
       22
        
       	ident := e.RealIP() + "-" + e.Request().UserAgent()

     

       24
       24
       -
       	logger = logger.With("ident", ident)

     

       25
       25
       -
       	logger.Info("new connection established")

     

       26
       23
        
       

     

       27
       24
        
       	evts, cancel, err := s.evtman.Subscribe(ctx, ident, func(evt *events.XRPCStreamEvent) bool {

     

       28
       25
        
       		return true

     
···

       36
       33
        
       	for evt := range evts {

     

       37
       34
        
       		wc, err := conn.NextWriter(websocket.BinaryMessage)

     

       38
       35
        
       		if err != nil {

     

       39
       39
       -
       			logger.Error("error writing message to relay", "err", err)

     

       40
       40
       -
       			break

     

       41
       41
       -
       		}

     

       42
       42
       -
       

     

       43
       43
       -
       		if ctx.Err() != nil {

     

       44
       44
       -
       			logger.Error("context error", "err", err)

     

       45
       45
       -
       			break

     

       36
       36
       +
       			return err

     

       46
       37
        
       		}

     

       47
       38
        
       

     

       48
       39
        
       		var obj util.CBOR

     

       40
       40
       +
       

     

       49
       41
        
       		switch {

     

       50
       42
        
       		case evt.Error != nil:

     

       51
       43
        
       			header.Op = events.EvtKindErrorFrame

     
···

       63
       55
        
       			header.MsgType = "#info"

     

       64
       56
        
       			obj = evt.RepoInfo

     

       65
       57
        
       		default:

     

       66
       66
       -
       			logger.Warn("unrecognized event kind")

     

       67
       67
       -
       			return nil

     

       58
       58
       +
       			return fmt.Errorf("unrecognized event kind")

     

       68
       59
        
       		}

     

       69
       60
        
       

     

       70
       61
        
       		if err := header.MarshalCBOR(wc); err != nil {

     

       71
       71
       -
       			logger.Error("failed to write header to relay", "err", err)

     

       72
       72
       -
       			break

     

       62
       62
       +
       			return fmt.Errorf("failed to write header: %w", err)

     

       73
       63
        
       		}

     

       74
       64
        
       

     

       75
       65
        
       		if err := obj.MarshalCBOR(wc); err != nil {

     

       76
       76
       -
       			logger.Error("failed to write event to relay", "err", err)

     

       77
       77
       -
       			break

     

       66
       66
       +
       			return fmt.Errorf("failed to write event: %w", err)

     

       78
       67
        
       		}

     

       79
       68
        
       

     

       80
       69
        
       		if err := wc.Close(); err != nil {

     

       81
       81
       -
       			logger.Error("failed to flush-close our event write", "err", err)

     

       82
       82
       -
       			break

     

       70
       70
       +
       			return fmt.Errorf("failed to flush-close our event write: %w", err)

     

       83
       71
        
       		}

     

       84
       84
       -
       	}

     

       85
       85
       -
       

     

       86
       86
       -
       	// we should tell the relay to request a new crawl at this point if we got disconnected

     

       87
       87
       -
       	// use a new context since the old one might be cancelled at this point

     

       88
       88
       -
       	ctx, cancel = context.WithTimeout(context.Background(), 10*time.Second)

     

       89
       89
       -
       	defer cancel()

     

       90
       90
       -
       	if err := s.requestCrawl(ctx); err != nil {

     

       91
       91
       -
       		logger.Error("error requesting crawls", "err", err)

     

       92
       72
        
       	}

     

       93
       73
        
       

     

       94
       74
        
       	return nil

-19

server/mail.go

···

       40
       40
        
       	return nil

     

       41
       41
        
       }

     

       42
       42
        
       

     

       43
       43
       -
       func (s *Server) sendPlcTokenReset(email, handle, code string) error {

     

       44
       44
       -
       	if s.mail == nil {

     

       45
       45
       -
       		return nil

     

       46
       46
       -
       	}

     

       47
       47
       -
       

     

       48
       48
       -
       	s.mailLk.Lock()

     

       49
       49
       -
       	defer s.mailLk.Unlock()

     

       50
       50
       -
       

     

       51
       51
       -
       	s.mail.To(email)

     

       52
       52
       -
       	s.mail.Subject("PLC token for " + s.config.Hostname)

     

       53
       53
       -
       	s.mail.Plain().Set(fmt.Sprintf("Hello %s. Your PLC operation code is %s. This code will expire in ten minutes.", handle, code))

     

       54
       54
       -
       

     

       55
       55
       -
       	if err := s.mail.Send(); err != nil {

     

       56
       56
       -
       		return err

     

       57
       57
       -
       	}

     

       58
       58
       -
       

     

       59
       59
       -
       	return nil

     

       60
       60
       -
       }

     

       61
       61
       -
       

     

       62
       43
        
       func (s *Server) sendEmailUpdate(email, handle, code string) error {

     

       63
       44
        
       	if s.mail == nil {

     

       64
       45
        
       		return nil

+9 -75

server/server.go

···

       43
       43
        
       	"github.com/labstack/echo/v4"

     

       44
       44
        
       	"github.com/labstack/echo/v4/middleware"

     

       45
       45
        
       	slogecho "github.com/samber/slog-echo"

     

       46
       46
       -
       	"gorm.io/driver/postgres"

     

       47
       46
        
       	"gorm.io/driver/sqlite"

     

       48
       47
        
       	"gorm.io/gorm"

     

       49
       48
        
       )

     
···

       79
       78
        
       	passport      *identity.Passport

     

       80
       79
        
       	fallbackProxy string

     

       81
       80
        
       

     

       82
       82
       -
       	lastRequestCrawl time.Time

     

       83
       83
       -
       	requestCrawlMu   sync.Mutex

     

       84
       84
       -
       

     

       85
       81
        
       	dbName   string

     

       86
       86
       -
       	dbType   string

     

       87
       82
        
       	s3Config *S3Config

     

       88
       83
        
       }

     

       89
       84
        
       

     

       90
       85
        
       type Args struct {

     

       91
       86
        
       	Addr            string

     

       92
       87
        
       	DbName          string

     

       93
       93
       -
       	DbType          string

     

       94
       94
       -
       	DatabaseURL     string

     

       95
       88
        
       	Logger          *slog.Logger

     

       96
       89
        
       	Version         string

     

       97
       90
        
       	Did             string

     
···

       292
       285
        
       		IdleTimeout:  5 * time.Minute,

     

       293
       286
        
       	}

     

       294
       287
        
       

     

       295
       295
       -
       	dbType := args.DbType

     

       296
       296
       -
       	if dbType == "" {

     

       297
       297
       -
       		dbType = "sqlite"

     

       298
       298
       -
       	}

     

       299
       299
       -
       

     

       300
       300
       -
       	var gdb *gorm.DB

     

       301
       301
       -
       	var err error

     

       302
       302
       -
       	switch dbType {

     

       303
       303
       -
       	case "postgres":

     

       304
       304
       -
       		if args.DatabaseURL == "" {

     

       305
       305
       -
       			return nil, fmt.Errorf("database-url must be set when using postgres")

     

       306
       306
       -
       		}

     

       307
       307
       -
       		gdb, err = gorm.Open(postgres.Open(args.DatabaseURL), &gorm.Config{})

     

       308
       308
       -
       		if err != nil {

     

       309
       309
       -
       			return nil, fmt.Errorf("failed to connect to postgres: %w", err)

     

       310
       310
       -
       		}

     

       311
       311
       -
       		args.Logger.Info("connected to PostgreSQL database")

     

       312
       312
       -
       	default:

     

       313
       313
       -
       		gdb, err = gorm.Open(sqlite.Open(args.DbName), &gorm.Config{})

     

       314
       314
       -
       		if err != nil {

     

       315
       315
       -
       			return nil, fmt.Errorf("failed to open sqlite database: %w", err)

     

       316
       316
       -
       		}

     

       317
       317
       -
       		args.Logger.Info("connected to SQLite database", "path", args.DbName)

     

       288
       288
       +
       	gdb, err := gorm.Open(sqlite.Open(args.DbName), &gorm.Config{})

     

       289
       289
       +
       	if err != nil {

     

       290
       290
       +
       		return nil, err

     

       318
       291
        
       	}

     

       319
       292
        
       	dbw := db.NewDB(gdb)

     

       320
       293
        
       

     
···

       387
       360
        
       		passport: identity.NewPassport(h, identity.NewMemCache(10_000)),

     

       388
       361
        
       

     

       389
       362
        
       		dbName:   args.DbName,

     

       390
       390
       -
       		dbType:   dbType,

     

       391
       363
        
       		s3Config: args.S3Config,

     

       392
       364
        
       

     

       393
       365
        
       		oauthProvider: provider.NewProvider(provider.Args{

     
···

       447
       419
        
       

     

       448
       420
        
       	// public

     

       449
       421
        
       	s.echo.GET("/xrpc/com.atproto.identity.resolveHandle", s.handleResolveHandle)

     

       422
       422
       +
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       450
       423
        
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       451
       424
        
       	s.echo.POST("/xrpc/com.atproto.server.createSession", s.handleCreateSession)

     

       452
       425
        
       	s.echo.GET("/xrpc/com.atproto.server.describeServer", s.handleDescribeServer)

     
···

       454
       427
        
       	s.echo.GET("/xrpc/com.atproto.repo.describeRepo", s.handleDescribeRepo)

     

       455
       428
        
       	s.echo.GET("/xrpc/com.atproto.sync.listRepos", s.handleListRepos)

     

       456
       429
        
       	s.echo.GET("/xrpc/com.atproto.repo.listRecords", s.handleListRecords)

     

       457
       457
       -
       	s.echo.GET("/xrpc/com.atproto.repo.listMissingBlobs", s.handleListMissingBlobs)

     

       458
       430
        
       	s.echo.GET("/xrpc/com.atproto.repo.getRecord", s.handleRepoGetRecord)

     

       459
       431
        
       	s.echo.GET("/xrpc/com.atproto.sync.getRecord", s.handleSyncGetRecord)

     

       460
       432
        
       	s.echo.GET("/xrpc/com.atproto.sync.getBlocks", s.handleGetBlocks)

     
···

       485
       457
        
       	s.echo.GET("/xrpc/com.atproto.server.getSession", s.handleGetSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       486
       458
        
       	s.echo.POST("/xrpc/com.atproto.server.refreshSession", s.handleRefreshSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       487
       459
        
       	s.echo.POST("/xrpc/com.atproto.server.deleteSession", s.handleDeleteSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       488
       488
       -
       	s.echo.GET("/xrpc/com.atproto.identity.getRecommendedDidCredentials", s.handleGetRecommendedDidCredentials, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       489
       460
        
       	s.echo.POST("/xrpc/com.atproto.identity.updateHandle", s.handleIdentityUpdateHandle, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       490
       490
       -
       	s.echo.POST("/xrpc/com.atproto.identity.requestPlcOperationSignature", s.handleIdentityRequestPlcOperationSignature, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       491
       491
       -
       	s.echo.POST("/xrpc/com.atproto.identity.signPlcOperation", s.handleSignPlcOperation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       492
       492
       -
       	s.echo.POST("/xrpc/com.atproto.identity.submitPlcOperation", s.handleSubmitPlcOperation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       493
       461
        
       	s.echo.POST("/xrpc/com.atproto.server.confirmEmail", s.handleServerConfirmEmail, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       494
       462
        
       	s.echo.POST("/xrpc/com.atproto.server.requestEmailConfirmation", s.handleServerRequestEmailConfirmation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       495
       463
        
       	s.echo.POST("/xrpc/com.atproto.server.requestPasswordReset", s.handleServerRequestPasswordReset) // AUTH NOT REQUIRED FOR THIS ONE

     
···

       512
       480
        
       	// stupid silly endpoints

     

       513
       481
        
       	s.echo.GET("/xrpc/app.bsky.actor.getPreferences", s.handleActorGetPreferences, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       514
       482
        
       	s.echo.POST("/xrpc/app.bsky.actor.putPreferences", s.handleActorPutPreferences, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       515
       515
       -
       	s.echo.GET("/xrpc/app.bsky.feed.getFeed", s.handleProxyBskyFeedGetFeed, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       516
       483
        
       

     

       517
       484
        
       	// admin routes

     

       518
       485
        
       	s.echo.POST("/xrpc/com.atproto.server.createInviteCode", s.handleCreateInviteCode, s.handleAdminMiddleware)

     
···

       552
       519
        
       

     

       553
       520
        
       	go s.backupRoutine()

     

       554
       521
        
       

     

       555
       555
       -
       	go func() {

     

       556
       556
       -
       		if err := s.requestCrawl(ctx); err != nil {

     

       557
       557
       -
       			s.logger.Error("error requesting crawls", "err", err)

     

       558
       558
       -
       		}

     

       559
       559
       -
       	}()

     

       560
       560
       -
       

     

       561
       561
       -
       	<-ctx.Done()

     

       562
       562
       -
       

     

       563
       563
       -
       	fmt.Println("shut down")

     

       564
       564
       -
       

     

       565
       565
       -
       	return nil

     

       566
       566
       -
       }

     

       567
       567
       -
       

     

       568
       568
       -
       func (s *Server) requestCrawl(ctx context.Context) error {

     

       569
       569
       -
       	logger := s.logger.With("component", "request-crawl")

     

       570
       570
       -
       	s.requestCrawlMu.Lock()

     

       571
       571
       -
       	defer s.requestCrawlMu.Unlock()

     

       572
       572
       -
       

     

       573
       573
       -
       	logger.Info("requesting crawl with configured relays")

     

       574
       574
       -
       

     

       575
       575
       -
       	if time.Now().Sub(s.lastRequestCrawl) <= 1*time.Minute {

     

       576
       576
       -
       		return fmt.Errorf("a crawl request has already been made within the last minute")

     

       577
       577
       -
       	}

     

       578
       578
       -
       

     

       579
       522
        
       	for _, relay := range s.config.Relays {

     

       580
       580
       -
       		logger := logger.With("relay", relay)

     

       581
       581
       -
       		logger.Info("requesting crawl from relay")

     

       582
       523
        
       		cli := xrpc.Client{Host: relay}

     

       583
       583
       -
       		if err := atproto.SyncRequestCrawl(ctx, &cli, &atproto.SyncRequestCrawl_Input{

     

       524
       524
       +
       		atproto.SyncRequestCrawl(ctx, &cli, &atproto.SyncRequestCrawl_Input{

     

       584
       525
        
       			Hostname: s.config.Hostname,

     

       585
       585
       -
       		}); err != nil {

     

       586
       586
       -
       			logger.Error("error requesting crawl", "err", err)

     

       587
       587
       -
       		} else {

     

       588
       588
       -
       			logger.Info("crawl requested successfully")

     

       589
       589
       -
       		}

     

       526
       526
       +
       		})

     

       590
       527
        
       	}

     

       591
       528
        
       

     

       592
       592
       -
       	s.lastRequestCrawl = time.Now()

     

       529
       529
       +
       	<-ctx.Done()

     

       530
       530
       +
       

     

       531
       531
       +
       	fmt.Println("shut down")

     

       593
       532
        
       

     

       594
       533
        
       	return nil

     

       595
       534
        
       }

     

       596
       535
        
       

     

       597
       536
        
       func (s *Server) doBackup() {

     

       598
       598
       -
       	if s.dbType == "postgres" {

     

       599
       599
       -
       		s.logger.Info("skipping S3 backup - PostgreSQL backups should be handled externally (pg_dump, managed database backups, etc.)")

     

       600
       600
       -
       		return

     

       601
       601
       -
       	}

     

       602
       602
       -
       

     

       603
       537
        
       	start := time.Now()

     

       604
       538
        
       

     

       605
       539
        
       	s.logger.Info("beginning backup to s3...")

-91

server/service_auth.go

···

       1
       1
       -
       package server

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       	"strings"

     

       7
       7
       -
       

     

       8
       8
       -
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       9
       9
       -
       	"github.com/bluesky-social/indigo/atproto/identity"

     

       10
       10
       -
       	atproto_identity "github.com/bluesky-social/indigo/atproto/identity"

     

       11
       11
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       12
       12
       -
       	"github.com/golang-jwt/jwt/v4"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       type ES256KSigningMethod struct {

     

       16
       16
       -
       	alg string

     

       17
       17
       -
       }

     

       18
       18
       -
       

     

       19
       19
       -
       func (m *ES256KSigningMethod) Alg() string {

     

       20
       20
       -
       	return m.alg

     

       21
       21
       -
       }

     

       22
       22
       -
       

     

       23
       23
       -
       func (m *ES256KSigningMethod) Verify(signingString string, signature string, key interface{}) error {

     

       24
       24
       -
       	signatureBytes, err := jwt.DecodeSegment(signature)

     

       25
       25
       -
       	if err != nil {

     

       26
       26
       -
       		return err

     

       27
       27
       -
       	}

     

       28
       28
       -
       	return key.(atcrypto.PublicKey).HashAndVerifyLenient([]byte(signingString), signatureBytes)

     

       29
       29
       -
       }

     

       30
       30
       -
       

     

       31
       31
       -
       func (m *ES256KSigningMethod) Sign(signingString string, key interface{}) (string, error) {

     

       32
       32
       -
       	return "", fmt.Errorf("unimplemented")

     

       33
       33
       -
       }

     

       34
       34
       -
       

     

       35
       35
       -
       func init() {

     

       36
       36
       -
       	ES256K := ES256KSigningMethod{alg: "ES256K"}

     

       37
       37
       -
       	jwt.RegisterSigningMethod(ES256K.Alg(), func() jwt.SigningMethod {

     

       38
       38
       -
       		return &ES256K

     

       39
       39
       -
       	})

     

       40
       40
       -
       }

     

       41
       41
       -
       

     

       42
       42
       -
       func (s *Server) validateServiceAuth(ctx context.Context, rawToken string, nsid string) (string, error) {

     

       43
       43
       -
       	token := strings.TrimSpace(rawToken)

     

       44
       44
       -
       

     

       45
       45
       -
       	parsedToken, err := jwt.ParseWithClaims(token, jwt.MapClaims{}, func(token *jwt.Token) (interface{}, error) {

     

       46
       46
       -
       		did := syntax.DID(token.Claims.(jwt.MapClaims)["iss"].(string))

     

       47
       47
       -
       		didDoc, err := s.passport.FetchDoc(ctx, did.String());

     

       48
       48
       -
       		if err != nil {

     

       49
       49
       -
       			return nil, fmt.Errorf("unable to resolve did %s: %s", did, err)

     

       50
       50
       -
       		}

     

       51
       51
       -
       

     

       52
       52
       -
       		verificationMethods := make([]atproto_identity.DocVerificationMethod, len(didDoc.VerificationMethods))

     

       53
       53
       -
       		for i, verificationMethod := range didDoc.VerificationMethods {

     

       54
       54
       -
       			verificationMethods[i] = atproto_identity.DocVerificationMethod{

     

       55
       55
       -
       				ID: verificationMethod.Id,

     

       56
       56
       -
       				Type: verificationMethod.Type,

     

       57
       57
       -
       				PublicKeyMultibase: verificationMethod.PublicKeyMultibase,

     

       58
       58
       -
       				Controller: verificationMethod.Controller,

     

       59
       59
       -
       			}

     

       60
       60
       -
       		}

     

       61
       61
       -
       		services := make([]atproto_identity.DocService, len(didDoc.Service))

     

       62
       62
       -
       		for i, service := range didDoc.Service {

     

       63
       63
       -
       			services[i] = atproto_identity.DocService{

     

       64
       64
       -
       				ID: service.Id,

     

       65
       65
       -
       				Type: service.Type,

     

       66
       66
       -
       				ServiceEndpoint: service.ServiceEndpoint,

     

       67
       67
       -
       			}

     

       68
       68
       -
       		}

     

       69
       69
       -
       		parsedIdentity := atproto_identity.ParseIdentity(&identity.DIDDocument{

     

       70
       70
       -
       			DID: did,

     

       71
       71
       -
       			AlsoKnownAs: didDoc.AlsoKnownAs,

     

       72
       72
       -
       			VerificationMethod: verificationMethods,

     

       73
       73
       -
       			Service: services,

     

       74
       74
       -
       		})

     

       75
       75
       -
       

     

       76
       76
       -
       		key, err := parsedIdentity.PublicKey()

     

       77
       77
       -
       		if err != nil {

     

       78
       78
       -
       			return nil, fmt.Errorf("signing key not found for did %s: %s", did, err)

     

       79
       79
       -
       		}

     

       80
       80
       -
       		return key, nil

     

       81
       81
       -
       	})

     

       82
       82
       -
       	if err != nil {

     

       83
       83
       -
       		return "", fmt.Errorf("invalid token: %s", err)

     

       84
       84
       -
       	}

     

       85
       85
       -
       

     

       86
       86
       -
       	claims := parsedToken.Claims.(jwt.MapClaims)

     

       87
       87
       -
       	if claims["lxm"] != nsid {

     

       88
       88
       -
       		return "", fmt.Errorf("bad jwt lexicon method (\"lxm\"). must match: %s", nsid)

     

       89
       89
       -
       	}

     

       90
       90
       -
       	return claims["iss"].(string), nil

     

       91
       91
       -
       }

Compare changes