comparing 28876f4ef761606a6743531988c748f1d9837c20 and hailey/tidy on hailey.at/cocoon

+1 -1

.env.example

···

       6
       6
        
       COCOON_RELAYS=https://bsky.network

     

       7
       7
        
       # Generate with `openssl rand -hex 16`

     

       8
       8
        
       COCOON_ADMIN_PASSWORD=

     

       9
       9
       -
       # openssl rand -hex 32

     

       9
       9
       +
       # Generate with `openssl rand -hex 32`

     

       10
       10
        
       COCOON_SESSION_SECRET=

+3 -1

.github/workflows/docker-image.yml

···

       3
       3
        
       on:

     

       4
       4
        
         workflow_dispatch:

     

       5
       5
        
         push:

     

       6
       6
       +
           branches:

     

       7
       7
       +
             - main

     

       6
       8
        
       

     

       7
       9
        
       env:

     

       8
       10
        
         REGISTRY: ghcr.io

     
···

       55
       57
        
               with:

     

       56
       58
        
                 subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}

     

       57
       59
        
                 subject-digest: ${{ steps.push.outputs.digest }}

     

       58
       58
       -
                 push-to-registry: true
     

       60
       60
       +
                 push-to-registry: true

.gitignore

+10

Caddyfile

···

       1
       1
       +
       {$COCOON_HOSTNAME} {

     

       2
       2
       +
       	reverse_proxy localhost:8080

     

       3
       3
       +
       

     

       4
       4
       +
       	encode gzip

     

       5
       5
       +
       

     

       6
       6
       +
       	log {

     

       7
       7
       +
       		output file /data/access.log

     

       8
       8
       +
       		format json

     

       9
       9
       +
       	}

     

       10
       10
       +
       }

+137 -6

README.md

···

       1
       1
        
       # Cocoon

     

       2
       2
        
       

     

       3
       3
        
       > [!WARNING]

     

       4
       4
       -
       You should not use this PDS. You should not rely on this code as a reference for a PDS implementation. You should not trust this code. Using this PDS implementation may result in data loss, corruption, etc.

     

       4
       4
       +
       I migrated and have been running my main account on this PDS for months now without issue, however, I am still not responsible if things go awry, particularly during account migration. Please use caution.

     

       5
       5
        
       

     

       6
       6
        
       Cocoon is a PDS implementation in Go. It is highly experimental, and is not ready for any production use.

     

       7
       7
        
       

     

       8
       8
       +
       ## Quick Start with Docker Compose

     

       9
       9
       +
       

     

       10
       10
       +
       ### Prerequisites

     

       11
       11
       +
       

     

       12
       12
       +
       - Docker and Docker Compose installed

     

       13
       13
       +
       - A domain name pointing to your server (for automatic HTTPS)

     

       14
       14
       +
       - Ports 80 and 443 open in i.e. UFW

     

       15
       15
       +
       

     

       16
       16
       +
       ### Installation

     

       17
       17
       +
       

     

       18
       18
       +
       1. **Clone the repository**

     

       19
       19
       +
          ```bash

     

       20
       20
       +
          git clone https://github.com/haileyok/cocoon.git

     

       21
       21
       +
          cd cocoon

     

       22
       22
       +
          ```

     

       23
       23
       +
       

     

       24
       24
       +
       2. **Create your configuration file**

     

       25
       25
       +
          ```bash

     

       26
       26
       +
          cp .env.example .env

     

       27
       27
       +
          ```

     

       28
       28
       +
       

     

       29
       29
       +
       3. **Edit `.env` with your settings**

     

       30
       30
       +
       

     

       31
       31
       +
          Required settings:

     

       32
       32
       +
          ```bash

     

       33
       33
       +
          COCOON_DID="did:web:your-domain.com"

     

       34
       34
       +
          COCOON_HOSTNAME="your-domain.com"

     

       35
       35
       +
          COCOON_CONTACT_EMAIL="you@example.com"

     

       36
       36
       +
          COCOON_RELAYS="https://bsky.network"

     

       37
       37
       +
       

     

       38
       38
       +
          # Generate with: openssl rand -hex 16

     

       39
       39
       +
          COCOON_ADMIN_PASSWORD="your-secure-password"

     

       40
       40
       +
       

     

       41
       41
       +
          # Generate with: openssl rand -hex 32

     

       42
       42
       +
          COCOON_SESSION_SECRET="your-session-secret"

     

       43
       43
       +
          ```

     

       44
       44
       +
       

     

       45
       45
       +
       4. **Start the services**

     

       46
       46
       +
          ```bash

     

       47
       47
       +
          # Pull pre-built image from GitHub Container Registry

     

       48
       48
       +
          docker-compose pull

     

       49
       49
       +
          docker-compose up -d

     

       50
       50
       +
          ```

     

       51
       51
       +
       

     

       52
       52
       +
          Or build locally:

     

       53
       53
       +
          ```bash

     

       54
       54
       +
          docker-compose build

     

       55
       55
       +
          docker-compose up -d

     

       56
       56
       +
          ```

     

       57
       57
       +
       

     

       58
       58
       +
       5. **Get your invite code**

     

       59
       59
       +
       

     

       60
       60
       +
          On first run, an invite code is automatically created. View it with:

     

       61
       61
       +
          ```bash

     

       62
       62
       +
          docker-compose logs create-invite

     

       63
       63
       +
          ```

     

       64
       64
       +
       

     

       65
       65
       +
          Or check the saved file:

     

       66
       66
       +
          ```bash

     

       67
       67
       +
          cat keys/initial-invite-code.txt

     

       68
       68
       +
          ```

     

       69
       69
       +
       

     

       70
       70
       +
          **IMPORTANT**: Save this invite code! You'll need it to create your first account.

     

       71
       71
       +
       

     

       72
       72
       +
       6. **Monitor the services**

     

       73
       73
       +
          ```bash

     

       74
       74
       +
          docker-compose logs -f

     

       75
       75
       +
          ```

     

       76
       76
       +
       

     

       77
       77
       +
       ### What Gets Set Up

     

       78
       78
       +
       

     

       79
       79
       +
       The Docker Compose setup includes:

     

       80
       80
       +
       

     

       81
       81
       +
       - **init-keys**: Automatically generates cryptographic keys (rotation key and JWK) on first run

     

       82
       82
       +
       - **cocoon**: The main PDS service running on port 8080

     

       83
       83
       +
       - **create-invite**: Automatically creates an initial invite code after Cocoon starts (first run only)

     

       84
       84
       +
       - **caddy**: Reverse proxy with automatic HTTPS via Let's Encrypt

     

       85
       85
       +
       

     

       86
       86
       +
       ### Data Persistence

     

       87
       87
       +
       

     

       88
       88
       +
       The following directories will be created automatically:

     

       89
       89
       +
       

     

       90
       90
       +
       - `./keys/` - Cryptographic keys (generated automatically)

     

       91
       91
       +
         - `rotation.key` - PDS rotation key

     

       92
       92
       +
         - `jwk.key` - JWK private key

     

       93
       93
       +
         - `initial-invite-code.txt` - Your first invite code (first run only)

     

       94
       94
       +
       - `./data/` - SQLite database and blockstore

     

       95
       95
       +
       - Docker volumes for Caddy configuration and certificates

     

       96
       96
       +
       

     

       97
       97
       +
       ### Optional Configuration

     

       98
       98
       +
       

     

       99
       99
       +
       #### SMTP Email Settings

     

       100
       100
       +
       ```bash

     

       101
       101
       +
       COCOON_SMTP_USER="your-smtp-username"

     

       102
       102
       +
       COCOON_SMTP_PASS="your-smtp-password"

     

       103
       103
       +
       COCOON_SMTP_HOST="smtp.example.com"

     

       104
       104
       +
       COCOON_SMTP_PORT="587"

     

       105
       105
       +
       COCOON_SMTP_EMAIL="noreply@example.com"

     

       106
       106
       +
       COCOON_SMTP_NAME="Cocoon PDS"

     

       107
       107
       +
       ```

     

       108
       108
       +
       

     

       109
       109
       +
       #### S3 Storage

     

       110
       110
       +
       ```bash

     

       111
       111
       +
       COCOON_S3_BACKUPS_ENABLED=true

     

       112
       112
       +
       COCOON_S3_BLOBSTORE_ENABLED=true

     

       113
       113
       +
       COCOON_S3_REGION="us-east-1"

     

       114
       114
       +
       COCOON_S3_BUCKET="your-bucket"

     

       115
       115
       +
       COCOON_S3_ENDPOINT="https://s3.amazonaws.com"

     

       116
       116
       +
       COCOON_S3_ACCESS_KEY="your-access-key"

     

       117
       117
       +
       COCOON_S3_SECRET_KEY="your-secret-key"

     

       118
       118
       +
       ```

     

       119
       119
       +
       

     

       120
       120
       +
       ### Management Commands

     

       121
       121
       +
       

     

       122
       122
       +
       Create an invite code:

     

       123
       123
       +
       ```bash

     

       124
       124
       +
       docker exec cocoon-pds /cocoon create-invite-code --uses 1

     

       125
       125
       +
       ```

     

       126
       126
       +
       

     

       127
       127
       +
       Reset a user's password:

     

       128
       128
       +
       ```bash

     

       129
       129
       +
       docker exec cocoon-pds /cocoon reset-password --did "did:plc:xxx"

     

       130
       130
       +
       ```

     

       131
       131
       +
       

     

       132
       132
       +
       ### Updating

     

       133
       133
       +
       

     

       134
       134
       +
       ```bash

     

       135
       135
       +
       docker-compose pull

     

       136
       136
       +
       docker-compose up -d

     

       137
       137
       +
       ```

     

       138
       138
       +
       

     

       8
       139
        
       ## Implemented Endpoints

     

       9
       140
        
       

     

       10
       141
        
       > [!NOTE]

     
···

       12
       143
        
       

     

       13
       144
        
       ### Identity

     

       14
       145
        
       

     

       15
       15
       -
       - [ ] `com.atproto.identity.getRecommendedDidCredentials`

     

       16
       16
       -
       - [ ] `com.atproto.identity.requestPlcOperationSignature`

     

       146
       146
       +
       - [x] `com.atproto.identity.getRecommendedDidCredentials`

     

       147
       147
       +
       - [x] `com.atproto.identity.requestPlcOperationSignature`

     

       17
       148
        
       - [x] `com.atproto.identity.resolveHandle`

     

       18
       18
       -
       - [ ] `com.atproto.identity.signPlcOperation`

     

       19
       19
       -
       - [ ] `com.atproto.identity.submitPlcOperation`

     

       149
       149
       +
       - [x] `com.atproto.identity.signPlcOperation`

     

       150
       150
       +
       - [x] `com.atproto.identity.submitPlcOperation`

     

       20
       151
        
       - [x] `com.atproto.identity.updateHandle`

     

       21
       152
        
       

     

       22
       153
        
       ### Repo

     
···

       27
       158
        
       - [x] `com.atproto.repo.deleteRecord`

     

       28
       159
        
       - [x] `com.atproto.repo.describeRepo`

     

       29
       160
        
       - [x] `com.atproto.repo.getRecord`

     

       30
       30
       -
       - [x] `com.atproto.repo.importRepo` (Works "okay". You still have to handle PLC operations on your own when migrating. Use with extreme caution.)

     

       161
       161
       +
       - [x] `com.atproto.repo.importRepo` (Works "okay". Use with extreme caution.)

     

       31
       162
        
       - [x] `com.atproto.repo.listRecords`

     

       32
       163
        
       - [ ] `com.atproto.repo.listMissingBlobs`

     

       33
       164

+26 -39

cmd/cocoon/main.go

···

       39
       39
        
       				EnvVars: []string{"COCOON_DB_NAME"},

     

       40
       40
        
       			},

     

       41
       41
        
       			&cli.StringFlag{

     

       42
       42
       -
       				Name:     "did",

     

       43
       43
       -
       				Required: true,

     

       44
       44
       -
       				EnvVars:  []string{"COCOON_DID"},

     

       42
       42
       +
       				Name:    "did",

     

       43
       43
       +
       				EnvVars: []string{"COCOON_DID"},

     

       45
       44
        
       			},

     

       46
       45
        
       			&cli.StringFlag{

     

       47
       47
       -
       				Name:     "hostname",

     

       48
       48
       -
       				Required: true,

     

       49
       49
       -
       				EnvVars:  []string{"COCOON_HOSTNAME"},

     

       46
       46
       +
       				Name:    "hostname",

     

       47
       47
       +
       				EnvVars: []string{"COCOON_HOSTNAME"},

     

       50
       48
        
       			},

     

       51
       49
        
       			&cli.StringFlag{

     

       52
       52
       -
       				Name:     "rotation-key-path",

     

       53
       53
       -
       				Required: true,

     

       54
       54
       -
       				EnvVars:  []string{"COCOON_ROTATION_KEY_PATH"},

     

       50
       50
       +
       				Name:    "rotation-key-path",

     

       51
       51
       +
       				EnvVars: []string{"COCOON_ROTATION_KEY_PATH"},

     

       55
       52
        
       			},

     

       56
       53
        
       			&cli.StringFlag{

     

       57
       57
       -
       				Name:     "jwk-path",

     

       58
       58
       -
       				Required: true,

     

       59
       59
       -
       				EnvVars:  []string{"COCOON_JWK_PATH"},

     

       54
       54
       +
       				Name:    "jwk-path",

     

       55
       55
       +
       				EnvVars: []string{"COCOON_JWK_PATH"},

     

       60
       56
        
       			},

     

       61
       57
        
       			&cli.StringFlag{

     

       62
       62
       -
       				Name:     "contact-email",

     

       63
       63
       -
       				Required: true,

     

       64
       64
       -
       				EnvVars:  []string{"COCOON_CONTACT_EMAIL"},

     

       58
       58
       +
       				Name:    "contact-email",

     

       59
       59
       +
       				EnvVars: []string{"COCOON_CONTACT_EMAIL"},

     

       65
       60
        
       			},

     

       66
       61
        
       			&cli.StringSliceFlag{

     

       67
       67
       -
       				Name:     "relays",

     

       68
       68
       -
       				Required: true,

     

       69
       69
       -
       				EnvVars:  []string{"COCOON_RELAYS"},

     

       62
       62
       +
       				Name:    "relays",

     

       63
       63
       +
       				EnvVars: []string{"COCOON_RELAYS"},

     

       70
       64
        
       			},

     

       71
       65
        
       			&cli.StringFlag{

     

       72
       72
       -
       				Name:     "admin-password",

     

       73
       73
       -
       				Required: true,

     

       74
       74
       -
       				EnvVars:  []string{"COCOON_ADMIN_PASSWORD"},

     

       66
       66
       +
       				Name:    "admin-password",

     

       67
       67
       +
       				EnvVars: []string{"COCOON_ADMIN_PASSWORD"},

     

       75
       68
        
       			},

     

       76
       69
        
       			&cli.StringFlag{

     

       77
       77
       -
       				Name:     "smtp-user",

     

       78
       78
       -
       				Required: false,

     

       79
       79
       -
       				EnvVars:  []string{"COCOON_SMTP_USER"},

     

       70
       70
       +
       				Name:    "smtp-user",

     

       71
       71
       +
       				EnvVars: []string{"COCOON_SMTP_USER"},

     

       80
       72
        
       			},

     

       81
       73
        
       			&cli.StringFlag{

     

       82
       82
       -
       				Name:     "smtp-pass",

     

       83
       83
       -
       				Required: false,

     

       84
       84
       -
       				EnvVars:  []string{"COCOON_SMTP_PASS"},

     

       74
       74
       +
       				Name:    "smtp-pass",

     

       75
       75
       +
       				EnvVars: []string{"COCOON_SMTP_PASS"},

     

       85
       76
        
       			},

     

       86
       77
        
       			&cli.StringFlag{

     

       87
       87
       -
       				Name:     "smtp-host",

     

       88
       88
       -
       				Required: false,

     

       89
       89
       -
       				EnvVars:  []string{"COCOON_SMTP_HOST"},

     

       78
       78
       +
       				Name:    "smtp-host",

     

       79
       79
       +
       				EnvVars: []string{"COCOON_SMTP_HOST"},

     

       90
       80
        
       			},

     

       91
       81
        
       			&cli.StringFlag{

     

       92
       92
       -
       				Name:     "smtp-port",

     

       93
       93
       -
       				Required: false,

     

       94
       94
       -
       				EnvVars:  []string{"COCOON_SMTP_PORT"},

     

       82
       82
       +
       				Name:    "smtp-port",

     

       83
       83
       +
       				EnvVars: []string{"COCOON_SMTP_PORT"},

     

       95
       84
        
       			},

     

       96
       85
        
       			&cli.StringFlag{

     

       97
       97
       -
       				Name:     "smtp-email",

     

       98
       98
       -
       				Required: false,

     

       99
       99
       -
       				EnvVars:  []string{"COCOON_SMTP_EMAIL"},

     

       86
       86
       +
       				Name:    "smtp-email",

     

       87
       87
       +
       				EnvVars: []string{"COCOON_SMTP_EMAIL"},

     

       100
       88
        
       			},

     

       101
       89
        
       			&cli.StringFlag{

     

       102
       102
       -
       				Name:     "smtp-name",

     

       103
       103
       -
       				Required: false,

     

       104
       104
       -
       				EnvVars:  []string{"COCOON_SMTP_NAME"},

     

       90
       90
       +
       				Name:    "smtp-name",

     

       91
       91
       +
       				EnvVars: []string{"COCOON_SMTP_NAME"},

     

       105
       92
        
       			},

     

       106
       93
        
       			&cli.BoolFlag{

     

       107
       94
        
       				Name:    "s3-backups-enabled",

+56

create-initial-invite.sh

···

       1
       1
       +
       #!/bin/sh

     

       2
       2
       +
       

     

       3
       3
       +
       INVITE_FILE="/keys/initial-invite-code.txt"

     

       4
       4
       +
       MARKER="/keys/.invite_created"

     

       5
       5
       +
       

     

       6
       6
       +
       # Check if invite code was already created

     

       7
       7
       +
       if [ -f "$MARKER" ]; then

     

       8
       8
       +
           echo "✓ Initial invite code already created"

     

       9
       9
       +
           exit 0

     

       10
       10
       +
       fi

     

       11
       11
       +
       

     

       12
       12
       +
       echo "Waiting for database to be ready..."

     

       13
       13
       +
       sleep 10

     

       14
       14
       +
       

     

       15
       15
       +
       # Try to create invite code - retry until database is ready

     

       16
       16
       +
       MAX_ATTEMPTS=30

     

       17
       17
       +
       ATTEMPT=0

     

       18
       18
       +
       INVITE_CODE=""

     

       19
       19
       +
       

     

       20
       20
       +
       while [ $ATTEMPT -lt $MAX_ATTEMPTS ]; do

     

       21
       21
       +
           ATTEMPT=$((ATTEMPT + 1))

     

       22
       22
       +
           OUTPUT=$(/cocoon create-invite-code --uses 1 2>&1)

     

       23
       23
       +
           INVITE_CODE=$(echo "$OUTPUT" | grep -oE '[a-zA-Z0-9]{8}-[a-zA-Z0-9]{8}' || echo "")

     

       24
       24
       +
       

     

       25
       25
       +
           if [ -n "$INVITE_CODE" ]; then

     

       26
       26
       +
               break

     

       27
       27
       +
           fi

     

       28
       28
       +
       

     

       29
       29
       +
           if [ $((ATTEMPT % 5)) -eq 0 ]; then

     

       30
       30
       +
               echo "  Waiting for database... ($ATTEMPT/$MAX_ATTEMPTS)"

     

       31
       31
       +
           fi

     

       32
       32
       +
           sleep 2

     

       33
       33
       +
       done

     

       34
       34
       +
       

     

       35
       35
       +
       if [ -n "$INVITE_CODE" ]; then

     

       36
       36
       +
           echo ""

     

       37
       37
       +
           echo "╔════════════════════════════════════════╗"

     

       38
       38
       +
           echo "║   SAVE THIS INVITE CODE!               ║"

     

       39
       39
       +
           echo "║                                        ║"

     

       40
       40
       +
           echo "║   $INVITE_CODE                         ║"

     

       41
       41
       +
           echo "║                                        ║"

     

       42
       42
       +
           echo "║   Use this to create your first        ║"

     

       43
       43
       +
           echo "║   account on your PDS.                 ║"

     

       44
       44
       +
           echo "╚════════════════════════════════════════╝"

     

       45
       45
       +
           echo ""

     

       46
       46
       +
       

     

       47
       47
       +
           echo "$INVITE_CODE" > "$INVITE_FILE"

     

       48
       48
       +
           echo "✓ Invite code saved to: $INVITE_FILE"

     

       49
       49
       +
       

     

       50
       50
       +
           touch "$MARKER"

     

       51
       51
       +
           echo "✓ Initial setup complete!"

     

       52
       52
       +
       else

     

       53
       53
       +
           echo "✗ Failed to create invite code"

     

       54
       54
       +
           echo "Output: $OUTPUT"

     

       55
       55
       +
           exit 1

     

       56
       56
       +
       fi

+125

docker-compose.yaml

···

       1
       1
       +
       version: '3.8'

     

       2
       2
       +
       

     

       3
       3
       +
       services:

     

       4
       4
       +
         init-keys:

     

       5
       5
       +
           build:

     

       6
       6
       +
             context: .

     

       7
       7
       +
             dockerfile: Dockerfile

     

       8
       8
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       9
       9
       +
           container_name: cocoon-init-keys

     

       10
       10
       +
           volumes:

     

       11
       11
       +
             - ./keys:/keys

     

       12
       12
       +
             - ./data:/data/cocoon

     

       13
       13
       +
             - ./init-keys.sh:/init-keys.sh:ro

     

       14
       14
       +
           environment:

     

       15
       15
       +
             COCOON_DID: ${COCOON_DID}

     

       16
       16
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       17
       17
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       18
       18
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       19
       19
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       20
       20
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       21
       21
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       22
       22
       +
           entrypoint: ["/bin/sh", "/init-keys.sh"]

     

       23
       23
       +
           restart: "no"

     

       24
       24
       +
       

     

       25
       25
       +
         cocoon:

     

       26
       26
       +
           build:

     

       27
       27
       +
             context: .

     

       28
       28
       +
             dockerfile: Dockerfile

     

       29
       29
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       30
       30
       +
           container_name: cocoon-pds

     

       31
       31
       +
           network_mode: host

     

       32
       32
       +
           depends_on:

     

       33
       33
       +
             init-keys:

     

       34
       34
       +
               condition: service_completed_successfully

     

       35
       35
       +
           volumes:

     

       36
       36
       +
             - ./data:/data/cocoon

     

       37
       37
       +
             - ./keys/rotation.key:/keys/rotation.key:ro

     

       38
       38
       +
             - ./keys/jwk.key:/keys/jwk.key:ro

     

       39
       39
       +
           environment:

     

       40
       40
       +
             # Required settings

     

       41
       41
       +
             COCOON_DID: ${COCOON_DID}

     

       42
       42
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       43
       43
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       44
       44
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       45
       45
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       46
       46
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       47
       47
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       48
       48
       +
             COCOON_SESSION_SECRET: ${COCOON_SESSION_SECRET}

     

       49
       49
       +
       

     

       50
       50
       +
             # Server configuration

     

       51
       51
       +
             COCOON_ADDR: ":8080"

     

       52
       52
       +
             COCOON_DB_NAME: /data/cocoon/cocoon.db

     

       53
       53
       +
             COCOON_BLOCKSTORE_VARIANT: ${COCOON_BLOCKSTORE_VARIANT:-sqlite}

     

       54
       54
       +
       

     

       55
       55
       +
             # Optional: SMTP settings for email

     

       56
       56
       +
             COCOON_SMTP_USER: ${COCOON_SMTP_USER:-}

     

       57
       57
       +
             COCOON_SMTP_PASS: ${COCOON_SMTP_PASS:-}

     

       58
       58
       +
             COCOON_SMTP_HOST: ${COCOON_SMTP_HOST:-}

     

       59
       59
       +
             COCOON_SMTP_PORT: ${COCOON_SMTP_PORT:-}

     

       60
       60
       +
             COCOON_SMTP_EMAIL: ${COCOON_SMTP_EMAIL:-}

     

       61
       61
       +
             COCOON_SMTP_NAME: ${COCOON_SMTP_NAME:-}

     

       62
       62
       +
       

     

       63
       63
       +
             # Optional: S3 configuration

     

       64
       64
       +
             COCOON_S3_BACKUPS_ENABLED: ${COCOON_S3_BACKUPS_ENABLED:-false}

     

       65
       65
       +
             COCOON_S3_BLOBSTORE_ENABLED: ${COCOON_S3_BLOBSTORE_ENABLED:-false}

     

       66
       66
       +
             COCOON_S3_REGION: ${COCOON_S3_REGION:-}

     

       67
       67
       +
             COCOON_S3_BUCKET: ${COCOON_S3_BUCKET:-}

     

       68
       68
       +
             COCOON_S3_ENDPOINT: ${COCOON_S3_ENDPOINT:-}

     

       69
       69
       +
             COCOON_S3_ACCESS_KEY: ${COCOON_S3_ACCESS_KEY:-}

     

       70
       70
       +
             COCOON_S3_SECRET_KEY: ${COCOON_S3_SECRET_KEY:-}

     

       71
       71
       +
       

     

       72
       72
       +
             # Optional: Fallback proxy

     

       73
       73
       +
             COCOON_FALLBACK_PROXY: ${COCOON_FALLBACK_PROXY:-}

     

       74
       74
       +
           restart: unless-stopped

     

       75
       75
       +
           healthcheck:

     

       76
       76
       +
             test: ["CMD", "curl", "-f", "http://localhost:8080/xrpc/_health"]

     

       77
       77
       +
             interval: 30s

     

       78
       78
       +
             timeout: 10s

     

       79
       79
       +
             retries: 3

     

       80
       80
       +
             start_period: 40s

     

       81
       81
       +
       

     

       82
       82
       +
         create-invite:

     

       83
       83
       +
           build:

     

       84
       84
       +
             context: .

     

       85
       85
       +
             dockerfile: Dockerfile

     

       86
       86
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       87
       87
       +
           container_name: cocoon-create-invite

     

       88
       88
       +
           network_mode: host

     

       89
       89
       +
           volumes:

     

       90
       90
       +
             - ./keys:/keys

     

       91
       91
       +
             - ./create-initial-invite.sh:/create-initial-invite.sh:ro

     

       92
       92
       +
           environment:

     

       93
       93
       +
             COCOON_DID: ${COCOON_DID}

     

       94
       94
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       95
       95
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       96
       96
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       97
       97
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       98
       98
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       99
       99
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       100
       100
       +
             COCOON_DB_NAME: /data/cocoon/cocoon.db

     

       101
       101
       +
           depends_on:

     

       102
       102
       +
             - init-keys

     

       103
       103
       +
           entrypoint: ["/bin/sh", "/create-initial-invite.sh"]

     

       104
       104
       +
           restart: "no"

     

       105
       105
       +
       

     

       106
       106
       +
         caddy:

     

       107
       107
       +
           image: caddy:2-alpine

     

       108
       108
       +
           container_name: cocoon-caddy

     

       109
       109
       +
           network_mode: host

     

       110
       110
       +
           volumes:

     

       111
       111
       +
             - ./Caddyfile:/etc/caddy/Caddyfile:ro

     

       112
       112
       +
             - caddy_data:/data

     

       113
       113
       +
             - caddy_config:/config

     

       114
       114
       +
           restart: unless-stopped

     

       115
       115
       +
           environment:

     

       116
       116
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       117
       117
       +
             CADDY_ACME_EMAIL: ${COCOON_CONTACT_EMAIL:-}

     

       118
       118
       +
       

     

       119
       119
       +
       volumes:

     

       120
       120
       +
         data:

     

       121
       121
       +
           driver: local

     

       122
       122
       +
         caddy_data:

     

       123
       123
       +
           driver: local

     

       124
       124
       +
         caddy_config:

     

       125
       125
       +
           driver: local

+1 -1

identity/types.go

···

       4
       4
        
       	Context             []string                   `json:"@context"`

     

       5
       5
        
       	Id                  string                     `json:"id"`

     

       6
       6
        
       	AlsoKnownAs         []string                   `json:"alsoKnownAs"`

     

       7
       7
       -
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethods"`

     

       7
       7
       +
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethod"`

     

       8
       8
        
       	Service             []DidDocService            `json:"service"`

     

       9
       9
        
       }

     

       10
       10

+34

init-keys.sh

···

       1
       1
       +
       #!/bin/sh

     

       2
       2
       +
       set -e

     

       3
       3
       +
       

     

       4
       4
       +
       mkdir -p /keys

     

       5
       5
       +
       mkdir -p /data/cocoon

     

       6
       6
       +
       

     

       7
       7
       +
       if [ ! -f /keys/rotation.key ]; then

     

       8
       8
       +
           echo "Generating rotation key..."

     

       9
       9
       +
           /cocoon create-rotation-key --out /keys/rotation.key 2>/dev/null || true

     

       10
       10
       +
           if [ -f /keys/rotation.key ]; then

     

       11
       11
       +
               echo "✓ Rotation key generated at /keys/rotation.key"

     

       12
       12
       +
           else

     

       13
       13
       +
               echo "✗ Failed to generate rotation key"

     

       14
       14
       +
               exit 1

     

       15
       15
       +
           fi

     

       16
       16
       +
       else

     

       17
       17
       +
           echo "✓ Rotation key already exists"

     

       18
       18
       +
       fi

     

       19
       19
       +
       

     

       20
       20
       +
       if [ ! -f /keys/jwk.key ]; then

     

       21
       21
       +
           echo "Generating JWK..."

     

       22
       22
       +
           /cocoon create-private-jwk --out /keys/jwk.key 2>/dev/null || true

     

       23
       23
       +
           if [ -f /keys/jwk.key ]; then

     

       24
       24
       +
               echo "✓ JWK generated at /keys/jwk.key"

     

       25
       25
       +
           else

     

       26
       26
       +
               echo "✗ Failed to generate JWK"

     

       27
       27
       +
               exit 1

     

       28
       28
       +
           fi

     

       29
       29
       +
       else

     

       30
       30
       +
           echo "✓ JWK already exists"

     

       31
       31
       +
       fi

     

       32
       32
       +
       

     

       33
       33
       +
       echo ""

     

       34
       34
       +
       echo "✓ Key initialization complete!"

internal/db/db.go

···

       25
       25
        
       	return db.cli.Clauses(clauses...).Create(value)

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
       +
       func (db *DB) Save(value any, clauses []clause.Expression) *gorm.DB {

     

       29
       29
       +
       	db.mu.Lock()

     

       30
       30
       +
       	defer db.mu.Unlock()

     

       31
       31
       +
       	return db.cli.Clauses(clauses...).Save(value)

     

       32
       32
       +
       }

     

       33
       33
       +
       

     

       28
       34
        
       func (db *DB) Exec(sql string, clauses []clause.Expression, values ...any) *gorm.DB {

     

       29
       35
        
       	db.mu.Lock()

     

       30
       36
        
       	defer db.mu.Unlock()

+16

internal/helpers/helpers.go

···

       32
       32
        
       	return genericError(e, 400, msg)

     

       33
       33
        
       }

     

       34
       34
        
       

     

       35
       35
       +
       func UnauthorizedError(e echo.Context, suffix *string) error {

     

       36
       36
       +
       	msg := "Unauthorized"

     

       37
       37
       +
       	if suffix != nil {

     

       38
       38
       +
       		msg += ". " + *suffix

     

       39
       39
       +
       	}

     

       40
       40
       +
       	return genericError(e, 401, msg)

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       func ForbiddenError(e echo.Context, suffix *string) error {

     

       44
       44
       +
       	msg := "Forbidden"

     

       45
       45
       +
       	if suffix != nil {

     

       46
       46
       +
       		msg += ". " + *suffix

     

       47
       47
       +
       	}

     

       48
       48
       +
       	return genericError(e, 403, msg)

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       35
       51
        
       func InvalidTokenError(e echo.Context) error {

     

       36
       52
        
       	return InputError(e, to.StringPtr("InvalidToken"))

     

       37
       53
        
       }

models/models.go

···

       19
       19
        
       	EmailUpdateCodeExpiresAt       *time.Time

     

       20
       20
        
       	PasswordResetCode              *string

     

       21
       21
        
       	PasswordResetCodeExpiresAt     *time.Time

     

       22
       22
       +
       	PlcOperationCode               *string

     

       23
       23
       +
       	PlcOperationCodeExpiresAt      *time.Time

     

       22
       24
        
       	Password                       string

     

       23
       25
        
       	SigningKey                     []byte

     

       24
       26
        
       	Rev                            string

+44 -28

oauth/client/manager.go

···

       22
       22
        
       	cli           *http.Client

     

       23
       23
        
       	logger        *slog.Logger

     

       24
       24
        
       	jwksCache     cache.Cache[string, jwk.Key]

     

       25
       25
       -
       	metadataCache cache.Cache[string, Metadata]

     

       25
       25
       +
       	metadataCache cache.Cache[string, *Metadata]

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
        
       type ManagerArgs struct {

     
···

       40
       40
        
       	}

     

       41
       41
        
       

     

       42
       42
        
       	jwksCache := cache.NewCache[string, jwk.Key]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       43
       43
       -
       	metadataCache := cache.NewCache[string, Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       43
       43
       +
       	metadataCache := cache.NewCache[string, *Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       44
       44
        
       

     

       45
       45
        
       	return &Manager{

     

       46
       46
        
       		cli:           args.Cli,

     
···

       57
       57
        
       	}

     

       58
       58
        
       

     

       59
       59
        
       	var jwks jwk.Key

     

       60
       60
       -
       	if metadata.JWKS != nil && len(metadata.JWKS.Keys) > 0 {

     

       61
       61
       -
       		// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to

     

       62
       62
       -
       		// make sure we use the right one

     

       63
       63
       -
       		b, err := json.Marshal(metadata.JWKS.Keys[0])

     

       64
       64
       -
       		if err != nil {

     

       65
       65
       -
       			return nil, err

     

       66
       66
       -
       		}

     

       60
       60
       +
       	if metadata.TokenEndpointAuthMethod == "private_key_jwt" {

     

       61
       61
       +
       		if metadata.JWKS != nil && len(metadata.JWKS.Keys) > 0 {

     

       62
       62
       +
       			// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to

     

       63
       63
       +
       			// make sure we use the right one

     

       64
       64
       +
       			b, err := json.Marshal(metadata.JWKS.Keys[0])

     

       65
       65
       +
       			if err != nil {

     

       66
       66
       +
       				return nil, err

     

       67
       67
       +
       			}

     

       67
       68
        
       

     

       68
       68
       -
       		k, err := helpers.ParseJWKFromBytes(b)

     

       69
       69
       -
       		if err != nil {

     

       70
       70
       -
       			return nil, err

     

       71
       71
       -
       		}

     

       69
       69
       +
       			k, err := helpers.ParseJWKFromBytes(b)

     

       70
       70
       +
       			if err != nil {

     

       71
       71
       +
       				return nil, err

     

       72
       72
       +
       			}

     

       72
       73
        
       

     

       73
       73
       -
       		jwks = k

     

       74
       74
       -
       	} else if metadata.JWKSURI != nil {

     

       75
       75
       -
       		maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)

     

       76
       76
       -
       		if err != nil {

     

       77
       77
       -
       			return nil, err

     

       78
       78
       -
       		}

     

       74
       74
       +
       			jwks = k

     

       75
       75
       +
       		} else if metadata.JWKS != nil {

     

       76
       76
       +
       		} else if metadata.JWKSURI != nil {

     

       77
       77
       +
       			maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)

     

       78
       78
       +
       			if err != nil {

     

       79
       79
       +
       				return nil, err

     

       80
       80
       +
       			}

     

       79
       81
        
       

     

       80
       80
       -
       		jwks = maybeJwks

     

       81
       81
       -
       	} else {

     

       82
       82
       -
       		return nil, fmt.Errorf("no valid jwks found in oauth client metadata")

     

       82
       82
       +
       			jwks = maybeJwks

     

       83
       83
       +
       		} else {

     

       84
       84
       +
       			return nil, fmt.Errorf("no valid jwks found in oauth client metadata")

     

       85
       85
       +
       		}

     

       83
       86
        
       	}

     

       84
       87
        
       

     

       85
       88
        
       	return &Client{

     
···

       89
       92
        
       }

     

       90
       93
        
       

     

       91
       94
        
       func (cm *Manager) getClientMetadata(ctx context.Context, clientId string) (*Metadata, error) {

     

       92
       92
       -
       	metadataCached, ok := cm.metadataCache.Get(clientId)

     

       95
       95
       +
       	cached, ok := cm.metadataCache.Get(clientId)

     

       93
       96
        
       	if !ok {

     

       94
       97
        
       		req, err := http.NewRequestWithContext(ctx, "GET", clientId, nil)

     

       95
       98
        
       		if err != nil {

     
···

       117
       120
        
       			return nil, err

     

       118
       121
        
       		}

     

       119
       122
        
       

     

       123
       123
       +
       		cm.metadataCache.Set(clientId, validated, 10*time.Minute)

     

       124
       124
       +
       

     

       120
       125
        
       		return validated, nil

     

       121
       126
        
       	} else {

     

       122
       122
       -
       		return &metadataCached, nil

     

       127
       127
       +
       		return cached, nil

     

       123
       128
        
       	}

     

       124
       129
        
       }

     

       125
       130
        
       

     
···

       204
       209
        
       		return nil, fmt.Errorf("error unmarshaling metadata: %w", err)

     

       205
       210
        
       	}

     

       206
       211
        
       

     

       212
       212
       +
       	if metadata.ClientURI == "" {

     

       213
       213
       +
       		u, err := url.Parse(metadata.ClientID)

     

       214
       214
       +
       		if err != nil {

     

       215
       215
       +
       			return nil, fmt.Errorf("unable to parse client id: %w", err)

     

       216
       216
       +
       		}

     

       217
       217
       +
       		u.RawPath = ""

     

       218
       218
       +
       		u.RawQuery = ""

     

       219
       219
       +
       		metadata.ClientURI = u.String()

     

       220
       220
       +
       	}

     

       221
       221
       +
       

     

       207
       222
        
       	u, err := url.Parse(metadata.ClientURI)

     

       208
       223
        
       	if err != nil {

     

       209
       224
        
       		return nil, fmt.Errorf("unable to parse client uri: %w", err)

     

       210
       225
        
       	}

     

       211
       226
        
       

     

       227
       227
       +
       	if metadata.ClientName == "" {

     

       228
       228
       +
       		metadata.ClientName = metadata.ClientURI

     

       229
       229
       +
       	}

     

       230
       230
       +
       

     

       212
       231
        
       	if isLocalHostname(u.Hostname()) {

     

       213
       213
       -
       		return nil, errors.New("`client_uri` hostname is invalid")

     

       232
       232
       +
       		return nil, fmt.Errorf("`client_uri` hostname is invalid: %s", u.Hostname())

     

       214
       233
        
       	}

     

       215
       234
        
       

     

       216
       235
        
       	if metadata.Scope == "" {

     
···

       349
       368
        
       			if u.Scheme != "http" {

     

       350
       369
        
       				return nil, fmt.Errorf("loopback redirect uri %s must use http", ruri)

     

       351
       370
        
       			}

     

       352
       352
       -
       

     

       353
       353
       -
       			break

     

       354
       371
        
       		case u.Scheme == "http":

     

       355
       372
        
       			return nil, errors.New("only loopbvack redirect uris are allowed to use the `http` scheme")

     

       356
       373
        
       		case u.Scheme == "https":

     

       357
       374
        
       			if isLocalHostname(u.Hostname()) {

     

       358
       375
        
       				return nil, fmt.Errorf("redirect uri %s's domain must not be a local hostname", ruri)

     

       359
       376
        
       			}

     

       360
       360
       -
       			break

     

       361
       377
        
       		case strings.Contains(u.Scheme, "."):

     

       362
       378
        
       			if metadata.ApplicationType != "native" {

     

       363
       379
        
       				return nil, errors.New("private-use uri scheme redirect uris are only allowed for native apps")

+31 -15

plc/client.go

···

       55
       55
        
       }

     

       56
       56
        
       

     

       57
       57
        
       func (c *Client) CreateDID(sigkey *atcrypto.PrivateKeyK256, recovery string, handle string) (string, *Operation, error) {

     

       58
       58
       -
       	pubsigkey, err := sigkey.PublicKey()

     

       58
       58
       +
       	creds, err := c.CreateDidCredentials(sigkey, recovery, handle)

     

       59
       59
        
       	if err != nil {

     

       60
       60
        
       		return "", nil, err

     

       61
       61
        
       	}

     

       62
       62
        
       

     

       63
       63
       -
       	pubrotkey, err := c.rotationKey.PublicKey()

     

       63
       63
       +
       	op := Operation{

     

       64
       64
       +
       		Type: "plc_operation",

     

       65
       65
       +
       		VerificationMethods: creds.VerificationMethods,

     

       66
       66
       +
       		RotationKeys: creds.RotationKeys,

     

       67
       67
       +
       		AlsoKnownAs: creds.AlsoKnownAs,

     

       68
       68
       +
       		Services: creds.Services,

     

       69
       69
       +
       		Prev: nil,

     

       70
       70
       +
       	}

     

       71
       71
       +
       

     

       72
       72
       +
       	if err := c.SignOp(sigkey, &op); err != nil {

     

       73
       73
       +
       		return "", nil, err

     

       74
       74
       +
       	}

     

       75
       75
       +
       

     

       76
       76
       +
       	did, err := DidFromOp(&op)

     

       64
       77
        
       	if err != nil {

     

       65
       78
        
       		return "", nil, err

     

       66
       79
        
       	}

     

       67
       80
        
       

     

       81
       81
       +
       	return did, &op, nil

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       func (c *Client) CreateDidCredentials(sigkey *atcrypto.PrivateKeyK256, recovery string, handle string) (*DidCredentials, error) {

     

       85
       85
       +
       	pubsigkey, err := sigkey.PublicKey()

     

       86
       86
       +
       	if err != nil {

     

       87
       87
       +
       		return nil, err

     

       88
       88
       +
       	}

     

       89
       89
       +
       

     

       90
       90
       +
       	pubrotkey, err := c.rotationKey.PublicKey()

     

       91
       91
       +
       	if err != nil {

     

       92
       92
       +
       		return nil, err

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       68
       95
        
       	// todo

     

       69
       96
        
       	rotationKeys := []string{pubrotkey.DIDKey()}

     

       70
       97
        
       	if recovery != "" {

     
···

       77
       104
        
       		}(recovery)

     

       78
       105
        
       	}

     

       79
       106
        
       

     

       80
       80
       -
       	op := Operation{

     

       81
       81
       -
       		Type: "plc_operation",

     

       107
       107
       +
       	creds := DidCredentials{

     

       82
       108
        
       		VerificationMethods: map[string]string{

     

       83
       109
        
       			"atproto": pubsigkey.DIDKey(),

     

       84
       110
        
       		},

     
···

       92
       118
        
       				Endpoint: "https://" + c.pdsHostname,

     

       93
       119
        
       			},

     

       94
       120
        
       		},

     

       95
       95
       -
       		Prev: nil,

     

       96
       121
        
       	}

     

       97
       122
        
       

     

       98
       98
       -
       	if err := c.SignOp(sigkey, &op); err != nil {

     

       99
       99
       -
       		return "", nil, err

     

       100
       100
       -
       	}

     

       101
       101
       -
       

     

       102
       102
       -
       	did, err := DidFromOp(&op)

     

       103
       103
       -
       	if err != nil {

     

       104
       104
       -
       		return "", nil, err

     

       105
       105
       -
       	}

     

       106
       106
       -
       

     

       107
       107
       -
       	return did, &op, nil

     

       123
       123
       +
       	return &creds, nil

     

       108
       124
        
       }

     

       109
       125
        
       

     

       110
       126
        
       func (c *Client) SignOp(sigkey *atcrypto.PrivateKeyK256, op *Operation) error {

plc/types.go

···

       8
       8
        
       	cbg "github.com/whyrusleeping/cbor-gen"

     

       9
       9
        
       )

     

       10
       10
        
       

     

       11
       11
       +
       

     

       12
       12
       +
       type DidCredentials struct {

     

       13
       13
       +
       	VerificationMethods map[string]string                    `json:"verificationMethods"`

     

       14
       14
       +
       	RotationKeys        []string                             `json:"rotationKeys"`

     

       15
       15
       +
       	AlsoKnownAs         []string                             `json:"alsoKnownAs"`

     

       16
       16
       +
       	Services            map[string]identity.OperationService `json:"services"`

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       11
       19
        
       type Operation struct {

     

       12
       20
        
       	Type                string                               `json:"type"`

     

       13
       21
        
       	VerificationMethods map[string]string                    `json:"verificationMethods"`

server/handle_account.go

···

       12
       12
        
       

     

       13
       13
        
       func (s *Server) handleAccount(e echo.Context) error {

     

       14
       14
        
       	ctx := e.Request().Context()

     

       15
       15
       +
       

     

       15
       16
        
       	repo, sess, err := s.getSessionRepoOrErr(e)

     

       16
       17
        
       	if err != nil {

     

       17
       18
        
       		return e.Redirect(303, "/account/signin")

+26

server/handle_identity_get_recommended_did_credentials.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       5
       5
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       6
       6
       +
       	"github.com/haileyok/cocoon/models"

     

       7
       7
       +
       	"github.com/labstack/echo/v4"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       func (s *Server) handleGetRecommendedDidCredentials(e echo.Context) error {

     

       11
       11
       +
       	repo := e.Get("repo").(*models.RepoActor)

     

       12
       12
       +
       

     

       13
       13
       +
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       14
       14
       +
       	if err != nil {

     

       15
       15
       +
       		s.logger.Error("error parsing key", "error", err)

     

       16
       16
       +
       		return helpers.ServerError(e, nil)

     

       17
       17
       +
       	}

     

       18
       18
       +
       

     

       19
       19
       +
       	creds, err := s.plcClient.CreateDidCredentials(k, "", repo.Actor.Handle)

     

       20
       20
       +
       	if err != nil {

     

       21
       21
       +
       		s.logger.Error("error crating did credentials", "error", err)

     

       22
       22
       +
       		return helpers.ServerError(e, nil)

     

       23
       23
       +
       	}

     

       24
       24
       +
       

     

       25
       25
       +
       	return e.JSON(200, creds)

     

       26
       26
       +
       }

+29

server/handle_identity_request_plc_operation.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       8
       +
       	"github.com/haileyok/cocoon/models"

     

       9
       9
       +
       	"github.com/labstack/echo/v4"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       func (s *Server) handleIdentityRequestPlcOperationSignature(e echo.Context) error {

     

       13
       13
       +
       	urepo := e.Get("repo").(*models.RepoActor)

     

       14
       14
       +
       

     

       15
       15
       +
       	code := fmt.Sprintf("%s-%s", helpers.RandomVarchar(5), helpers.RandomVarchar(5))

     

       16
       16
       +
       	eat := time.Now().Add(10 * time.Minute).UTC()

     

       17
       17
       +
       

     

       18
       18
       +
       	if err := s.db.Exec("UPDATE repos SET plc_operation_code = ?, plc_operation_code_expires_at = ? WHERE did = ?", nil, code, eat, urepo.Repo.Did).Error; err != nil {

     

       19
       19
       +
       		s.logger.Error("error updating user", "error", err)

     

       20
       20
       +
       		return helpers.ServerError(e, nil)

     

       21
       21
       +
       	}

     

       22
       22
       +
       

     

       23
       23
       +
       	if err := s.sendPlcTokenReset(urepo.Email, urepo.Handle, code); err != nil {

     

       24
       24
       +
       		s.logger.Error("error sending mail", "error", err)

     

       25
       25
       +
       		return helpers.ServerError(e, nil)

     

       26
       26
       +
       	}

     

       27
       27
       +
       

     

       28
       28
       +
       	return e.NoContent(200)

     

       29
       29
       +
       }

+103

server/handle_identity_sign_plc_operation.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"strings"

     

       6
       6
       +
       	"time"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       10
       10
       +
       	"github.com/haileyok/cocoon/identity"

     

       11
       11
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       12
       12
       +
       	"github.com/haileyok/cocoon/models"

     

       13
       13
       +
       	"github.com/haileyok/cocoon/plc"

     

       14
       14
       +
       	"github.com/labstack/echo/v4"

     

       15
       15
       +
       )

     

       16
       16
       +
       

     

       17
       17
       +
       type ComAtprotoSignPlcOperationRequest struct {

     

       18
       18
       +
       	Token               string                                `json:"token"`

     

       19
       19
       +
       	VerificationMethods *map[string]string                    `json:"verificationMethods"`

     

       20
       20
       +
       	RotationKeys        *[]string                             `json:"rotationKeys"`

     

       21
       21
       +
       	AlsoKnownAs         *[]string                             `json:"alsoKnownAs"`

     

       22
       22
       +
       	Services            *map[string]identity.OperationService `json:"services"`

     

       23
       23
       +
       }

     

       24
       24
       +
       

     

       25
       25
       +
       type ComAtprotoSignPlcOperationResponse struct {

     

       26
       26
       +
       	Operation plc.Operation `json:"operation"`

     

       27
       27
       +
       }

     

       28
       28
       +
       

     

       29
       29
       +
       func (s *Server) handleSignPlcOperation(e echo.Context) error {

     

       30
       30
       +
       	repo := e.Get("repo").(*models.RepoActor)

     

       31
       31
       +
       

     

       32
       32
       +
       	var req ComAtprotoSignPlcOperationRequest

     

       33
       33
       +
       	if err := e.Bind(&req); err != nil {

     

       34
       34
       +
       		s.logger.Error("error binding", "error", err)

     

       35
       35
       +
       		return helpers.ServerError(e, nil)

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	if !strings.HasPrefix(repo.Repo.Did, "did:plc:") {

     

       39
       39
       +
       		return helpers.InputError(e, nil)

     

       40
       40
       +
       	}

     

       41
       41
       +
       

     

       42
       42
       +
       	if repo.PlcOperationCode == nil || repo.PlcOperationCodeExpiresAt == nil {

     

       43
       43
       +
       		return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	if *repo.PlcOperationCode != req.Token {

     

       47
       47
       +
       		return helpers.InvalidTokenError(e)

     

       48
       48
       +
       	}

     

       49
       49
       +
       

     

       50
       50
       +
       	if time.Now().UTC().After(*repo.PlcOperationCodeExpiresAt) {

     

       51
       51
       +
       		return helpers.ExpiredTokenError(e)

     

       52
       52
       +
       	}

     

       53
       53
       +
       

     

       54
       54
       +
       	ctx := context.WithValue(e.Request().Context(), "skip-cache", true)

     

       55
       55
       +
       	log, err := identity.FetchDidAuditLog(ctx, nil, repo.Repo.Did)

     

       56
       56
       +
       	if err != nil {

     

       57
       57
       +
       		s.logger.Error("error fetching doc", "error", err)

     

       58
       58
       +
       		return helpers.ServerError(e, nil)

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	latest := log[len(log)-1]

     

       62
       62
       +
       

     

       63
       63
       +
       	op := plc.Operation{

     

       64
       64
       +
       		Type:                "plc_operation",

     

       65
       65
       +
       		VerificationMethods: latest.Operation.VerificationMethods,

     

       66
       66
       +
       		RotationKeys:        latest.Operation.RotationKeys,

     

       67
       67
       +
       		AlsoKnownAs:         latest.Operation.AlsoKnownAs,

     

       68
       68
       +
       		Services:            latest.Operation.Services,

     

       69
       69
       +
       		Prev:                &latest.Cid,

     

       70
       70
       +
       	}

     

       71
       71
       +
       	if req.VerificationMethods != nil {

     

       72
       72
       +
       		op.VerificationMethods = *req.VerificationMethods

     

       73
       73
       +
       	}

     

       74
       74
       +
       	if req.RotationKeys != nil {

     

       75
       75
       +
       		op.RotationKeys = *req.RotationKeys

     

       76
       76
       +
       	}

     

       77
       77
       +
       	if req.AlsoKnownAs != nil {

     

       78
       78
       +
       		op.AlsoKnownAs = *req.AlsoKnownAs

     

       79
       79
       +
       	}

     

       80
       80
       +
       	if req.Services != nil {

     

       81
       81
       +
       		op.Services = *req.Services

     

       82
       82
       +
       	}

     

       83
       83
       +
       

     

       84
       84
       +
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       85
       85
       +
       	if err != nil {

     

       86
       86
       +
       		s.logger.Error("error parsing signing key", "error", err)

     

       87
       87
       +
       		return helpers.ServerError(e, nil)

     

       88
       88
       +
       	}

     

       89
       89
       +
       

     

       90
       90
       +
       	if err := s.plcClient.SignOp(k, &op); err != nil {

     

       91
       91
       +
       		s.logger.Error("error signing plc operation", "error", err)

     

       92
       92
       +
       		return helpers.ServerError(e, nil)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	if err := s.db.Exec("UPDATE repos SET plc_operation_code = NULL, plc_operation_code_expires_at = NULL WHERE did = ?", nil, repo.Repo.Did).Error; err != nil {

     

       96
       96
       +
       		s.logger.Error("error updating repo", "error", err)

     

       97
       97
       +
       		return helpers.ServerError(e, nil)

     

       98
       98
       +
       	}

     

       99
       99
       +
       

     

       100
       100
       +
       	return e.JSON(200, ComAtprotoSignPlcOperationResponse{

     

       101
       101
       +
       		Operation: op,

     

       102
       102
       +
       	})

     

       103
       103
       +
       }

+87

server/handle_identity_submit_plc_operation.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"slices"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       11
       11
       +
       	"github.com/bluesky-social/indigo/events"

     

       12
       12
       +
       	"github.com/bluesky-social/indigo/util"

     

       13
       13
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       14
       14
       +
       	"github.com/haileyok/cocoon/models"

     

       15
       15
       +
       	"github.com/haileyok/cocoon/plc"

     

       16
       16
       +
       	"github.com/labstack/echo/v4"

     

       17
       17
       +
       )

     

       18
       18
       +
       

     

       19
       19
       +
       type ComAtprotoSubmitPlcOperationRequest struct {

     

       20
       20
       +
       	Operation plc.Operation `json:"operation"`

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func (s *Server) handleSubmitPlcOperation(e echo.Context) error {

     

       24
       24
       +
       	repo := e.Get("repo").(*models.RepoActor)

     

       25
       25
       +
       

     

       26
       26
       +
       	var req ComAtprotoSubmitPlcOperationRequest

     

       27
       27
       +
       	if err := e.Bind(&req); err != nil {

     

       28
       28
       +
       		s.logger.Error("error binding", "error", err)

     

       29
       29
       +
       		return helpers.ServerError(e, nil)

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	if err := e.Validate(req); err != nil {

     

       33
       33
       +
       		return helpers.InputError(e, nil)

     

       34
       34
       +
       	}

     

       35
       35
       +
       	if !strings.HasPrefix(repo.Repo.Did, "did:plc:") {

     

       36
       36
       +
       		return helpers.InputError(e, nil)

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	op := req.Operation

     

       40
       40
       +
       

     

       41
       41
       +
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       42
       42
       +
       	if err != nil {

     

       43
       43
       +
       		s.logger.Error("error parsing key", "error", err)

     

       44
       44
       +
       		return helpers.ServerError(e, nil)

     

       45
       45
       +
       	}

     

       46
       46
       +
       	required, err := s.plcClient.CreateDidCredentials(k, "", repo.Actor.Handle)

     

       47
       47
       +
       	if err != nil {

     

       48
       48
       +
       		s.logger.Error("error crating did credentials", "error", err)

     

       49
       49
       +
       		return helpers.ServerError(e, nil)

     

       50
       50
       +
       	}

     

       51
       51
       +
       

     

       52
       52
       +
       	for _, expectedKey := range required.RotationKeys {

     

       53
       53
       +
       		if !slices.Contains(op.RotationKeys, expectedKey) {

     

       54
       54
       +
       			return helpers.InputError(e, nil)

     

       55
       55
       +
       		}

     

       56
       56
       +
       	}

     

       57
       57
       +
       	if op.Services["atproto_pds"].Type != "AtprotoPersonalDataServer" {

     

       58
       58
       +
       		return helpers.InputError(e, nil)

     

       59
       59
       +
       	}

     

       60
       60
       +
       	if op.Services["atproto_pds"].Endpoint != required.Services["atproto_pds"].Endpoint {

     

       61
       61
       +
       		return helpers.InputError(e, nil)

     

       62
       62
       +
       	}

     

       63
       63
       +
       	if op.VerificationMethods["atproto"] != required.VerificationMethods["atproto"] {

     

       64
       64
       +
       		return helpers.InputError(e, nil)

     

       65
       65
       +
       	}

     

       66
       66
       +
       	if op.AlsoKnownAs[0] != required.AlsoKnownAs[0] {

     

       67
       67
       +
       		return helpers.InputError(e, nil)

     

       68
       68
       +
       	}

     

       69
       69
       +
       

     

       70
       70
       +
       	if err := s.plcClient.SendOperation(e.Request().Context(), repo.Repo.Did, &op); err != nil {

     

       71
       71
       +
       		return err

     

       72
       72
       +
       	}

     

       73
       73
       +
       

     

       74
       74
       +
       	if err := s.passport.BustDoc(context.TODO(), repo.Repo.Did); err != nil {

     

       75
       75
       +
       		s.logger.Warn("error busting did doc", "error", err)

     

       76
       76
       +
       	}

     

       77
       77
       +
       

     

       78
       78
       +
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       79
       79
       +
       		RepoIdentity: &atproto.SyncSubscribeRepos_Identity{

     

       80
       80
       +
       			Did:  repo.Repo.Did,

     

       81
       81
       +
       			Seq:  time.Now().UnixMicro(), // TODO: no

     

       82
       82
       +
       			Time: time.Now().Format(util.ISO8601),

     

       83
       83
       +
       		},

     

       84
       84
       +
       	})

     

       85
       85
       +
       

     

       86
       86
       +
       	return nil

     

       87
       87
       +
       }

+9 -8

server/handle_import_repo.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"bytes"

     

       5
       5
       -
       	"context"

     

       6
       5
        
       	"io"

     

       7
       6
        
       	"slices"

     

       8
       7
        
       	"strings"

     
···

       18
       17
        
       )

     

       19
       18
        
       

     

       20
       19
        
       func (s *Server) handleRepoImportRepo(e echo.Context) error {

     

       20
       20
       +
       	ctx := e.Request().Context()

     

       21
       21
       +
       

     

       21
       22
        
       	urepo := e.Get("repo").(*models.RepoActor)

     

       22
       23
        
       

     

       23
       24
        
       	b, err := io.ReadAll(e.Request().Body)

     
···

       52
       53
        
       

     

       53
       54
        
       	slices.Reverse(orderedBlocks)

     

       54
       55
        
       

     

       55
       55
       -
       	if err := bs.PutMany(context.TODO(), orderedBlocks); err != nil {

     

       56
       56
       +
       	if err := bs.PutMany(ctx, orderedBlocks); err != nil {

     

       56
       57
        
       		s.logger.Error("could not insert blocks", "error", err)

     

       57
       58
        
       		return helpers.ServerError(e, nil)

     

       58
       59
        
       	}

     

       59
       60
        
       

     

       60
       60
       -
       	r, err := repo.OpenRepo(context.TODO(), bs, cs.Header.Roots[0])

     

       61
       61
       +
       	r, err := repo.OpenRepo(ctx, bs, cs.Header.Roots[0])

     

       61
       62
        
       	if err != nil {

     

       62
       63
        
       		s.logger.Error("could not open repo", "error", err)

     

       63
       64
        
       		return helpers.ServerError(e, nil)

     
···

       67
       68
        
       

     

       68
       69
        
       	clock := syntax.NewTIDClock(0)

     

       69
       70
        
       

     

       70
       70
       -
       	if err := r.ForEach(context.TODO(), "", func(key string, cid cid.Cid) error {

     

       71
       71
       +
       	if err := r.ForEach(ctx, "", func(key string, cid cid.Cid) error {

     

       71
       72
        
       		pts := strings.Split(key, "/")

     

       72
       73
        
       		nsid := pts[0]

     

       73
       74
        
       		rkey := pts[1]

     

       74
       75
        
       		cidStr := cid.String()

     

       75
       75
       -
       		b, err := bs.Get(context.TODO(), cid)

     

       76
       76
       +
       		b, err := bs.Get(ctx, cid)

     

       76
       77
        
       		if err != nil {

     

       77
       78
        
       			s.logger.Error("record bytes don't exist in blockstore", "error", err)

     

       78
       79
        
       			return helpers.ServerError(e, nil)

     
···

       87
       88
        
       			Value:     b.RawData(),

     

       88
       89
        
       		}

     

       89
       90
        
       

     

       90
       90
       -
       		if err := tx.Create(rec).Error; err != nil {

     

       91
       91
       +
       		if err := tx.Save(rec).Error; err != nil {

     

       91
       92
        
       			return err

     

       92
       93
        
       		}

     

       93
       94
        
       

     
···

       100
       101
        
       

     

       101
       102
        
       	tx.Commit()

     

       102
       103
        
       

     

       103
       103
       -
       	root, rev, err := r.Commit(context.TODO(), urepo.SignFor)

     

       104
       104
       +
       	root, rev, err := r.Commit(ctx, urepo.SignFor)

     

       104
       105
        
       	if err != nil {

     

       105
       106
        
       		s.logger.Error("error committing", "error", err)

     

       106
       107
        
       		return helpers.ServerError(e, nil)

     

       107
       108
        
       	}

     

       108
       109
        
       

     

       109
       109
       -
       	if err := s.UpdateRepo(context.TODO(), urepo.Repo.Did, root, rev); err != nil {

     

       110
       110
       +
       	if err := s.UpdateRepo(ctx, urepo.Repo.Did, root, rev); err != nil {

     

       110
       111
        
       		s.logger.Error("error updating repo after commit", "error", err)

     

       111
       112
        
       		return helpers.ServerError(e, nil)

     

       112
       113
        
       	}

+15 -2

server/handle_proxy.go

···

       96
       96
        
       

     

       97
       97
        
       		encheader := strings.TrimRight(base64.RawURLEncoding.EncodeToString(hj), "=")

     

       98
       98
        
       

     

       99
       99
       +
       		// When proxying app.bsky.feed.getFeed the token is actually issued for the

     

       100
       100
       +
       		// underlying feed generator and the app view passes it on. This allows the

     

       101
       101
       +
       		// getFeed implementation to pass in the desired lxm and aud for the token

     

       102
       102
       +
       		// and then just delegate to the general proxying logic

     

       103
       103
       +
       		lxm, proxyTokenLxmExists := e.Get("proxyTokenLxm").(string)

     

       104
       104
       +
       		if !proxyTokenLxmExists || lxm == "" {

     

       105
       105
       +
       			lxm = pts[2]

     

       106
       106
       +
       		}

     

       107
       107
       +
       		aud, proxyTokenAudExists := e.Get("proxyTokenAud").(string)

     

       108
       108
       +
       		if !proxyTokenAudExists || aud == "" {

     

       109
       109
       +
       			aud = svcDid

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       99
       112
        
       		payload := map[string]any{

     

       100
       113
        
       			"iss": repo.Repo.Did,

     

       101
       101
       -
       			"aud": svcDid,

     

       102
       102
       -
       			"lxm": pts[2],

     

       114
       114
       +
       			"aud": aud,

     

       115
       115
       +
       			"lxm": lxm,

     

       103
       116
        
       			"jti": uuid.NewString(),

     

       104
       117
        
       			"exp": time.Now().Add(1 * time.Minute).UTC().Unix(),

     

       105
       118
        
       		}

+35

server/handle_proxy_get_feed.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       5
       5
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       6
       6
       +
       	"github.com/bluesky-social/indigo/api/bsky"

     

       7
       7
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/xrpc"

     

       9
       9
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       10
       10
       +
       	"github.com/labstack/echo/v4"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       func (s *Server) handleProxyBskyFeedGetFeed(e echo.Context) error {

     

       14
       14
       +
       	feedUri, err := syntax.ParseATURI(e.QueryParam("feed"))

     

       15
       15
       +
       	if err != nil {

     

       16
       16
       +
       		return helpers.InputError(e, to.StringPtr("invalid feed uri"))

     

       17
       17
       +
       	}

     

       18
       18
       +
       

     

       19
       19
       +
       	appViewEndpoint, _, err := s.getAtprotoProxyEndpointFromRequest(e)

     

       20
       20
       +
       	if err != nil {

     

       21
       21
       +
       		e.Logger().Error("could not get atproto proxy", "error", err)

     

       22
       22
       +
       		return helpers.ServerError(e, nil)

     

       23
       23
       +
       	}

     

       24
       24
       +
       

     

       25
       25
       +
       	appViewClient := xrpc.Client{

     

       26
       26
       +
       		Host: appViewEndpoint,

     

       27
       27
       +
       	}

     

       28
       28
       +
       	feedRecord, err := atproto.RepoGetRecord(e.Request().Context(), &appViewClient, "", feedUri.Collection().String(), feedUri.Authority().String(), feedUri.RecordKey().String())

     

       29
       29
       +
       	feedGeneratorDid := feedRecord.Value.Val.(*bsky.FeedGenerator).Did

     

       30
       30
       +
       

     

       31
       31
       +
       	e.Set("proxyTokenLxm", "app.bsky.feed.getFeedSkeleton")

     

       32
       32
       +
       	e.Set("proxyTokenAud", feedGeneratorDid)

     

       33
       33
       +
       

     

       34
       34
       +
       	return s.handleProxy(e)

     

       35
       35
       +
       }

+3 -1

server/handle_repo_apply_writes.go

···

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
        
       func (s *Server) handleApplyWrites(e echo.Context) error {

     

       29
       29
       +
       	ctx := e.Request().Context()

     

       30
       30
       +
       

     

       29
       31
        
       	repo := e.Get("repo").(*models.RepoActor)

     

       30
       32
        
       

     

       31
       33
        
       	var req ComAtprotoRepoApplyWritesRequest

     
···

       54
       56
        
       		})

     

       55
       57
        
       	}

     

       56
       58
        
       

     

       57
       57
       -
       	results, err := s.repoman.applyWrites(repo.Repo, ops, req.SwapCommit)

     

       59
       59
       +
       	results, err := s.repoman.applyWrites(ctx, repo.Repo, ops, req.SwapCommit)

     

       58
       60
        
       	if err != nil {

     

       59
       61
        
       		s.logger.Error("error applying writes", "error", err)

     

       60
       62
        
       		return helpers.ServerError(e, nil)

+3 -1

server/handle_repo_create_record.go

···

       17
       17
        
       }

     

       18
       18
        
       

     

       19
       19
        
       func (s *Server) handleCreateRecord(e echo.Context) error {

     

       20
       20
       +
       	ctx := e.Request().Context()

     

       21
       21
       +
       

     

       20
       22
        
       	repo := e.Get("repo").(*models.RepoActor)

     

       21
       23
        
       

     

       22
       24
        
       	var req ComAtprotoRepoCreateRecordRequest

     
···

       40
       42
        
       		optype = OpTypeUpdate

     

       41
       43
        
       	}

     

       42
       44
        
       

     

       43
       43
       -
       	results, err := s.repoman.applyWrites(repo.Repo, []Op{

     

       45
       45
       +
       	results, err := s.repoman.applyWrites(ctx, repo.Repo, []Op{

     

       44
       46
        
       		{

     

       45
       47
        
       			Type:       optype,

     

       46
       48
        
       			Collection: req.Collection,

+3 -1

server/handle_repo_delete_record.go

···

       15
       15
        
       }

     

       16
       16
        
       

     

       17
       17
        
       func (s *Server) handleDeleteRecord(e echo.Context) error {

     

       18
       18
       +
       	ctx := e.Request().Context()

     

       19
       19
       +
       

     

       18
       20
        
       	repo := e.Get("repo").(*models.RepoActor)

     

       19
       21
        
       

     

       20
       22
        
       	var req ComAtprotoRepoDeleteRecordRequest

     
···

       33
       35
        
       		return helpers.InputError(e, nil)

     

       34
       36
        
       	}

     

       35
       37
        
       

     

       36
       36
       -
       	results, err := s.repoman.applyWrites(repo.Repo, []Op{

     

       38
       38
       +
       	results, err := s.repoman.applyWrites(ctx, repo.Repo, []Op{

     

       37
       39
        
       		{

     

       38
       40
        
       			Type:       OpTypeDelete,

     

       39
       41
        
       			Collection: req.Collection,

+3 -1

server/handle_repo_put_record.go

···

       17
       17
        
       }

     

       18
       18
        
       

     

       19
       19
        
       func (s *Server) handlePutRecord(e echo.Context) error {

     

       20
       20
       +
       	ctx := e.Request().Context()

     

       21
       21
       +
       

     

       20
       22
        
       	repo := e.Get("repo").(*models.RepoActor)

     

       21
       23
        
       

     

       22
       24
        
       	var req ComAtprotoRepoPutRecordRequest

     
···

       40
       42
        
       		optype = OpTypeUpdate

     

       41
       43
        
       	}

     

       42
       44
        
       

     

       43
       43
       -
       	results, err := s.repoman.applyWrites(repo.Repo, []Op{

     

       45
       45
       +
       	results, err := s.repoman.applyWrites(ctx, repo.Repo, []Op{

     

       44
       46
        
       		{

     

       45
       47
        
       			Type:       optype,

     

       46
       48
        
       			Collection: req.Collection,

+46 -15

server/handle_server_check_account_status.go

···

       1
       1
        
       package server

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"errors"

     

       5
       5
       +
       	"sync"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       4
       8
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       5
       9
        
       	"github.com/haileyok/cocoon/models"

     

       6
       10
        
       	"github.com/ipfs/go-cid"

     
···

       22
       26
        
       func (s *Server) handleServerCheckAccountStatus(e echo.Context) error {

     

       23
       27
        
       	urepo := e.Get("repo").(*models.RepoActor)

     

       24
       28
        
       

     

       29
       29
       +
       	_, didErr := syntax.ParseDID(urepo.Repo.Did)

     

       30
       30
       +
       	if didErr != nil {

     

       31
       31
       +
       		s.logger.Error("error validating did", "err", didErr)

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       25
       34
        
       	resp := ComAtprotoServerCheckAccountStatusResponse{

     

       26
       35
        
       		Activated:     true, // TODO: should allow for deactivation etc.

     

       27
       27
       -
       		ValidDid:      true, // TODO: should probably verify?

     

       36
       36
       +
       		ValidDid:      didErr == nil,

     

       28
       37
        
       		RepoRev:       urepo.Rev,

     

       29
       38
        
       		ImportedBlobs: 0, // TODO: ???

     

       30
       39
        
       	}

     
···

       34
       43
        
       		s.logger.Error("error casting cid", "error", err)

     

       35
       44
        
       		return helpers.ServerError(e, nil)

     

       36
       45
        
       	}

     

       46
       46
       +
       

     

       37
       47
        
       	resp.RepoCommit = rootcid.String()

     

       38
       48
        
       

     

       39
       49
        
       	type CountResp struct {

     
···

       41
       51
        
       	}

     

       42
       52
        
       

     

       43
       53
        
       	var blockCtResp CountResp

     

       44
       44
       -
       	if err := s.db.Raw("SELECT COUNT(*) AS ct FROM blocks WHERE did = ?", nil, urepo.Repo.Did).Scan(&blockCtResp).Error; err != nil {

     

       45
       45
       -
       		s.logger.Error("error getting block count", "error", err)

     

       46
       46
       -
       		return helpers.ServerError(e, nil)

     

       47
       47
       -
       	}

     

       48
       48
       -
       	resp.RepoBlocks = blockCtResp.Ct

     

       54
       54
       +
       	var recCtResp CountResp

     

       55
       55
       +
       	var blobCtResp CountResp

     

       56
       56
       +
       

     

       57
       57
       +
       	var wg sync.WaitGroup

     

       58
       58
       +
       	var procErr error

     

       59
       59
       +
       

     

       60
       60
       +
       	wg.Add(1)

     

       61
       61
       +
       	go func() {

     

       62
       62
       +
       		defer wg.Done()

     

       63
       63
       +
       		if err := s.db.Raw("SELECT COUNT(*) AS ct FROM blocks WHERE did = ?", nil, urepo.Repo.Did).Scan(&blockCtResp).Error; err != nil {

     

       64
       64
       +
       			s.logger.Error("error getting block count", "error", err)

     

       65
       65
       +
       			procErr = errors.Join(procErr, err)

     

       66
       66
       +
       		}

     

       67
       67
       +
       	}()

     

       68
       68
       +
       

     

       69
       69
       +
       	wg.Add(1)

     

       70
       70
       +
       	go func() {

     

       71
       71
       +
       		defer wg.Done()

     

       72
       72
       +
       		if err := s.db.Raw("SELECT COUNT(*) AS ct FROM records WHERE did = ?", nil, urepo.Repo.Did).Scan(&recCtResp).Error; err != nil {

     

       73
       73
       +
       			s.logger.Error("error getting record count", "error", err)

     

       74
       74
       +
       			procErr = errors.Join(procErr, err)

     

       75
       75
       +
       		}

     

       76
       76
       +
       	}()

     

       49
       77
        
       

     

       50
       50
       -
       	var recCtResp CountResp

     

       51
       51
       -
       	if err := s.db.Raw("SELECT COUNT(*) AS ct FROM records WHERE did = ?", nil, urepo.Repo.Did).Scan(&recCtResp).Error; err != nil {

     

       52
       52
       -
       		s.logger.Error("error getting record count", "error", err)

     

       53
       53
       -
       		return helpers.ServerError(e, nil)

     

       54
       54
       -
       	}

     

       55
       55
       -
       	resp.IndexedRecords = recCtResp.Ct

     

       78
       78
       +
       	wg.Add(1)

     

       79
       79
       +
       	go func() {

     

       80
       80
       +
       		if err := s.db.Raw("SELECT COUNT(*) AS ct FROM blobs WHERE did = ?", nil, urepo.Repo.Did).Scan(&blobCtResp).Error; err != nil {

     

       81
       81
       +
       			s.logger.Error("error getting expected blobs count", "error", err)

     

       82
       82
       +
       			procErr = errors.Join(procErr, err)

     

       83
       83
       +
       		}

     

       84
       84
       +
       	}()

     

       56
       85
        
       

     

       57
       57
       -
       	var blobCtResp CountResp

     

       58
       58
       -
       	if err := s.db.Raw("SELECT COUNT(*) AS ct FROM blobs WHERE did = ?", nil, urepo.Repo.Did).Scan(&blobCtResp).Error; err != nil {

     

       59
       59
       -
       		s.logger.Error("error getting record count", "error", err)

     

       86
       86
       +
       	wg.Wait()

     

       87
       87
       +
       	if procErr != nil {

     

       60
       88
        
       		return helpers.ServerError(e, nil)

     

       61
       89
        
       	}

     

       90
       90
       +
       

     

       91
       91
       +
       	resp.RepoBlocks = blockCtResp.Ct

     

       92
       92
       +
       	resp.IndexedRecords = recCtResp.Ct

     

       62
       93
        
       	resp.ExpectedBlobs = blobCtResp.Ct

     

       63
       94
        
       

     

       64
       95
        
       	return e.JSON(200, resp)

+45 -35

server/handle_server_create_account.go

···

       10
       10
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       11
       11
        
       	"github.com/bluesky-social/indigo/api/atproto"

     

       12
       12
        
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       13
       13
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       14
       13
        
       	"github.com/bluesky-social/indigo/events"

     

       15
       14
        
       	"github.com/bluesky-social/indigo/repo"

     

       16
       15
        
       	"github.com/bluesky-social/indigo/util"

     
···

       39
       38
        
       func (s *Server) handleCreateAccount(e echo.Context) error {

     

       40
       39
        
       	var request ComAtprotoServerCreateAccountRequest

     

       41
       40
        
       

     

       42
       42
       -
       	var signupDid string

     

       43
       43
       -
       	customDidHeader := e.Request().Header.Get("authorization")

     

       44
       44
       -
       	if customDidHeader != "" {

     

       45
       45
       -
       		pts := strings.Split(customDidHeader, " ")

     

       46
       46
       -
       		if len(pts) != 2 {

     

       47
       47
       -
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       48
       48
       -
       		}

     

       49
       49
       -
       

     

       50
       50
       -
       		_, err := syntax.ParseDID(pts[1])

     

       51
       51
       -
       		if err != nil {

     

       52
       52
       -
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       53
       53
       -
       		}

     

       54
       54
       -
       

     

       55
       55
       -
       		signupDid = pts[1]

     

       56
       56
       -
       	}

     

       57
       57
       -
       

     

       58
       41
        
       	if err := e.Bind(&request); err != nil {

     

       59
       42
        
       		s.logger.Error("error receiving request", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       60
       43
        
       		return helpers.ServerError(e, nil)

     
···

       85
       68
        
       			}

     

       86
       69
        
       		}

     

       87
       70
        
       	}

     

       71
       71
       +
       	

     

       72
       72
       +
       	var signupDid string

     

       73
       73
       +
       	if request.Did != nil {

     

       74
       74
       +
       		signupDid = *request.Did;

     

       75
       75
       +
       		

     

       76
       76
       +
       		token := strings.TrimSpace(strings.Replace(e.Request().Header.Get("authorization"), "Bearer ", "", 1))

     

       77
       77
       +
       		if token == "" {

     

       78
       78
       +
       			return helpers.UnauthorizedError(e, to.StringPtr("must authenticate to use an existing did"))

     

       79
       79
       +
       		}

     

       80
       80
       +
       		authDid, err := s.validateServiceAuth(e.Request().Context(), token, "com.atproto.server.createAccount")

     

       81
       81
       +
       

     

       82
       82
       +
       		if err != nil {

     

       83
       83
       +
       			s.logger.Warn("error validating authorization token", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       84
       84
       +
       			return helpers.UnauthorizedError(e, to.StringPtr("invalid authorization token"))

     

       85
       85
       +
       		}

     

       86
       86
       +
       

     

       87
       87
       +
       		if authDid != signupDid {

     

       88
       88
       +
       			return helpers.ForbiddenError(e, to.StringPtr("auth did did not match signup did"))

     

       89
       89
       +
       		}

     

       90
       90
       +
       	}

     

       88
       91
        
       

     

       89
       92
        
       	// see if the handle is already taken

     

       90
       90
       -
       	_, err := s.getActorByHandle(request.Handle)

     

       93
       93
       +
       	actor, err := s.getActorByHandle(request.Handle)

     

       91
       94
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       92
       95
        
       		s.logger.Error("error looking up handle in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       93
       96
        
       		return helpers.ServerError(e, nil)

     

       94
       97
        
       	}

     

       95
       95
       -
       	if err == nil {

     

       98
       98
       +
       	if err == nil && actor.Did != signupDid {

     

       96
       99
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       97
       100
        
       	}

     

       98
       101
        
       

     

       99
       99
       -
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != "" {

     

       102
       102
       +
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != signupDid {

     

       100
       103
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       101
       104
        
       	}

     

       102
       105
        
       

     
···

       114
       117
        
       	}

     

       115
       118
        
       

     

       116
       119
        
       	// see if the email is already taken

     

       117
       117
       -
       	_, err = s.getRepoByEmail(request.Email)

     

       120
       120
       +
       	existingRepo, err := s.getRepoByEmail(request.Email)

     

       118
       121
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       119
       122
        
       		s.logger.Error("error looking up email in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       120
       123
        
       		return helpers.ServerError(e, nil)

     

       121
       124
        
       	}

     

       122
       122
       -
       	if err == nil {

     

       125
       125
       +
       	if err == nil && existingRepo.Did != signupDid {

     

       123
       126
        
       		return helpers.InputError(e, to.StringPtr("EmailNotAvailable"))

     

       124
       127
        
       	}

     

       125
       128
        
       

     
···

       160
       163
        
       		SigningKey:            k.Bytes(),

     

       161
       164
        
       	}

     

       162
       165
        
       

     

       163
       163
       -
       	actor := models.Actor{

     

       164
       164
       -
       		Did:    signupDid,

     

       165
       165
       -
       		Handle: request.Handle,

     

       166
       166
       -
       	}

     

       167
       167
       -
       

     

       168
       168
       -
       	if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       169
       169
       -
       		s.logger.Error("error inserting new repo", "error", err)

     

       170
       170
       -
       		return helpers.ServerError(e, nil)

     

       171
       171
       -
       	}

     

       166
       166
       +
       	if actor == nil {

     

       167
       167
       +
       		actor = &models.Actor{

     

       168
       168
       +
       			Did:    signupDid,

     

       169
       169
       +
       			Handle: request.Handle,

     

       170
       170
       +
       		}

     

       172
       171
        
       

     

       173
       173
       -
       	if err := s.db.Create(&actor, nil).Error; err != nil {

     

       174
       174
       -
       		s.logger.Error("error inserting new actor", "error", err)

     

       175
       175
       -
       		return helpers.ServerError(e, nil)

     

       172
       172
       +
       		if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       173
       173
       +
       			s.logger.Error("error inserting new repo", "error", err)

     

       174
       174
       +
       			return helpers.ServerError(e, nil)

     

       175
       175
       +
       		}

     

       176
       176
       +
       	

     

       177
       177
       +
       		if err := s.db.Create(&actor, nil).Error; err != nil {

     

       178
       178
       +
       			s.logger.Error("error inserting new actor", "error", err)

     

       179
       179
       +
       			return helpers.ServerError(e, nil)

     

       180
       180
       +
       		}

     

       181
       181
       +
       	} else {

     

       182
       182
       +
       		if err := s.db.Save(&actor, nil).Error; err != nil {

     

       183
       183
       +
       			s.logger.Error("error inserting new actor", "error", err)

     

       184
       184
       +
       			return helpers.ServerError(e, nil)

     

       185
       185
       +
       		}

     

       176
       186
        
       	}

     

       177
       187
        
       

     

       178
       178
       -
       	if customDidHeader == "" {

     

       188
       188
       +
       	if request.Did == nil || *request.Did == "" {

     

       179
       189
        
       		bs := s.getBlockstore(signupDid)

     

       180
       190
        
       		r := repo.NewRepo(context.TODO(), signupDid, bs)

     

       181
       191

+3 -1

server/handle_sync_get_record.go

···

       13
       13
        
       )

     

       14
       14
        
       

     

       15
       15
        
       func (s *Server) handleSyncGetRecord(e echo.Context) error {

     

       16
       16
       +
       	ctx := e.Request().Context()

     

       17
       17
       +
       

     

       16
       18
        
       	did := e.QueryParam("did")

     

       17
       19
        
       	collection := e.QueryParam("collection")

     

       18
       20
        
       	rkey := e.QueryParam("rkey")

     
···

       23
       25
        
       		return helpers.ServerError(e, nil)

     

       24
       26
        
       	}

     

       25
       27
        
       

     

       26
       26
       -
       	root, blocks, err := s.repoman.getRecordProof(urepo, collection, rkey)

     

       28
       28
       +
       	root, blocks, err := s.repoman.getRecordProof(ctx, urepo, collection, rkey)

     

       27
       29
        
       	if err != nil {

     

       28
       30
        
       		return err

     

       29
       31
        
       	}

+19

server/mail.go

···

       40
       40
        
       	return nil

     

       41
       41
        
       }

     

       42
       42
        
       

     

       43
       43
       +
       func (s *Server) sendPlcTokenReset(email, handle, code string) error {

     

       44
       44
       +
       	if s.mail == nil {

     

       45
       45
       +
       		return nil

     

       46
       46
       +
       	}

     

       47
       47
       +
       

     

       48
       48
       +
       	s.mailLk.Lock()

     

       49
       49
       +
       	defer s.mailLk.Unlock()

     

       50
       50
       +
       

     

       51
       51
       +
       	s.mail.To(email)

     

       52
       52
       +
       	s.mail.Subject("PLC token for " + s.config.Hostname)

     

       53
       53
       +
       	s.mail.Plain().Set(fmt.Sprintf("Hello %s. Your PLC operation code is %s. This code will expire in ten minutes.", handle, code))

     

       54
       54
       +
       

     

       55
       55
       +
       	if err := s.mail.Send(); err != nil {

     

       56
       56
       +
       		return err

     

       57
       57
       +
       	}

     

       58
       58
       +
       

     

       59
       59
       +
       	return nil

     

       60
       60
       +
       }

     

       61
       61
       +
       

     

       43
       62
        
       func (s *Server) sendEmailUpdate(email, handle, code string) error {

     

       44
       63
        
       	if s.mail == nil {

     

       45
       64
        
       		return nil

+19 -16

server/repo.go

···

       96
       96
        
       }

     

       97
       97
        
       

     

       98
       98
        
       // TODO make use of swap commit

     

       99
       99
       -
       func (rm *RepoMan) applyWrites(urepo models.Repo, writes []Op, swapCommit *string) ([]ApplyWriteResult, error) {

     

       99
       99
       +
       func (rm *RepoMan) applyWrites(ctx context.Context, urepo models.Repo, writes []Op, swapCommit *string) ([]ApplyWriteResult, error) {

     

       100
       100
        
       	rootcid, err := cid.Cast(urepo.Root)

     

       101
       101
        
       	if err != nil {

     

       102
       102
        
       		return nil, err

     
···

       104
       104
        
       

     

       105
       105
        
       	dbs := rm.s.getBlockstore(urepo.Did)

     

       106
       106
        
       	bs := recording_blockstore.New(dbs)

     

       107
       107
       -
       	r, err := repo.OpenRepo(context.TODO(), bs, rootcid)

     

       107
       107
       +
       	r, err := repo.OpenRepo(ctx, bs, rootcid)

     

       108
       108
        
       

     

       109
       109
       -
       	entries := []models.Record{}

     

       110
       110
       -
       	var results []ApplyWriteResult

     

       109
       109
       +
       	entries := make([]models.Record, 0, len(writes))

     

       110
       110
       +
       	results := make([]ApplyWriteResult, 0, len(writes))

     

       111
       111
        
       

     

       112
       112
        
       	for i, op := range writes {

     

       113
       113
        
       		if op.Type != OpTypeCreate && op.Rkey == nil {

     

       114
       114
        
       			return nil, fmt.Errorf("invalid rkey")

     

       115
       115
        
       		} else if op.Type == OpTypeCreate && op.Rkey != nil {

     

       116
       116
       -
       			_, _, err := r.GetRecord(context.TODO(), op.Collection+"/"+*op.Rkey)

     

       116
       116
       +
       			_, _, err := r.GetRecord(ctx, op.Collection+"/"+*op.Rkey)

     

       117
       117
        
       			if err == nil {

     

       118
       118
        
       				op.Type = OpTypeUpdate

     

       119
       119
        
       			}

     
···

       144
       144
        
       				mm["$type"] = op.Collection

     

       145
       145
        
       			}

     

       146
       146
        
       

     

       147
       147
       -
       			nc, err := r.PutRecord(context.TODO(), op.Collection+"/"+*op.Rkey, &mm)

     

       147
       147
       +
       			nc, err := r.PutRecord(ctx, op.Collection+"/"+*op.Rkey, &mm)

     

       148
       148
        
       			if err != nil {

     

       149
       149
        
       				return nil, err

     

       150
       150
        
       			}

     
···

       177
       177
        
       				Rkey:  *op.Rkey,

     

       178
       178
        
       				Value: old.Value,

     

       179
       179
        
       			})

     

       180
       180
       -
       			err := r.DeleteRecord(context.TODO(), op.Collection+"/"+*op.Rkey)

     

       180
       180
       +
       			err := r.DeleteRecord(ctx, op.Collection+"/"+*op.Rkey)

     

       181
       181
        
       			if err != nil {

     

       182
       182
        
       				return nil, err

     

       183
       183
        
       			}

     
···

       194
       194
        
       				return nil, err

     

       195
       195
        
       			}

     

       196
       196
        
       			mm := MarshalableMap(out)

     

       197
       197
       -
       			nc, err := r.UpdateRecord(context.TODO(), op.Collection+"/"+*op.Rkey, &mm)

     

       197
       197
       +
       			nc, err := r.UpdateRecord(ctx, op.Collection+"/"+*op.Rkey, &mm)

     

       198
       198
        
       			if err != nil {

     

       199
       199
        
       				return nil, err

     

       200
       200
        
       			}

     
···

       219
       219
        
       		}

     

       220
       220
        
       	}

     

       221
       221
        
       

     

       222
       222
       -
       	newroot, rev, err := r.Commit(context.TODO(), urepo.SignFor)

     

       222
       222
       +
       	newroot, rev, err := r.Commit(ctx, urepo.SignFor)

     

       223
       223
        
       	if err != nil {

     

       224
       224
        
       		return nil, err

     

       225
       225
        
       	}

     
···

       230
       230
        
       		Roots:   []cid.Cid{newroot},

     

       231
       231
        
       		Version: 1,

     

       232
       232
        
       	})

     

       233
       233
       +
       	if err != nil {

     

       234
       234
       +
       		return nil, err

     

       235
       235
       +
       	}

     

       233
       236
        
       

     

       234
       237
        
       	if _, err := carstore.LdWrite(buf, hb); err != nil {

     

       235
       238
        
       		return nil, err

     

       236
       239
        
       	}

     

       237
       240
        
       

     

       238
       238
       -
       	diffops, err := r.DiffSince(context.TODO(), rootcid)

     

       241
       241
       +
       	diffops, err := r.DiffSince(ctx, rootcid)

     

       239
       242
        
       	if err != nil {

     

       240
       243
        
       		return nil, err

     

       241
       244
        
       	}

     
···

       270
       273
        
       			})

     

       271
       274
        
       		}

     

       272
       275
        
       

     

       273
       273
       -
       		blk, err := dbs.Get(context.TODO(), c)

     

       276
       276
       +
       		blk, err := dbs.Get(ctx, c)

     

       274
       277
        
       		if err != nil {

     

       275
       278
        
       			return nil, err

     

       276
       279
        
       		}

     
···

       316
       319
        
       		}

     

       317
       320
        
       	}

     

       318
       321
        
       

     

       319
       319
       -
       	rm.s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       322
       322
       +
       	rm.s.evtman.AddEvent(ctx, &events.XRPCStreamEvent{

     

       320
       323
        
       		RepoCommit: &atproto.SyncSubscribeRepos_Commit{

     

       321
       324
        
       			Repo:   urepo.Did,

     

       322
       325
        
       			Blocks: buf.Bytes(),

     
···

       330
       333
        
       		},

     

       331
       334
        
       	})

     

       332
       335
        
       

     

       333
       333
       -
       	if err := rm.s.UpdateRepo(context.TODO(), urepo.Did, newroot, rev); err != nil {

     

       336
       336
       +
       	if err := rm.s.UpdateRepo(ctx, urepo.Did, newroot, rev); err != nil {

     

       334
       337
        
       		return nil, err

     

       335
       338
        
       	}

     

       336
       339
        
       

     
···

       345
       348
        
       	return results, nil

     

       346
       349
        
       }

     

       347
       350
        
       

     

       348
       348
       -
       func (rm *RepoMan) getRecordProof(urepo models.Repo, collection, rkey string) (cid.Cid, []blocks.Block, error) {

     

       351
       351
       +
       func (rm *RepoMan) getRecordProof(ctx context.Context, urepo models.Repo, collection, rkey string) (cid.Cid, []blocks.Block, error) {

     

       349
       352
        
       	c, err := cid.Cast(urepo.Root)

     

       350
       353
        
       	if err != nil {

     

       351
       354
        
       		return cid.Undef, nil, err

     
···

       354
       357
        
       	dbs := rm.s.getBlockstore(urepo.Did)

     

       355
       358
        
       	bs := recording_blockstore.New(dbs)

     

       356
       359
        
       

     

       357
       357
       -
       	r, err := repo.OpenRepo(context.TODO(), bs, c)

     

       360
       360
       +
       	r, err := repo.OpenRepo(ctx, bs, c)

     

       358
       361
        
       	if err != nil {

     

       359
       362
        
       		return cid.Undef, nil, err

     

       360
       363
        
       	}

     

       361
       364
        
       

     

       362
       362
       -
       	_, _, err = r.GetRecordBytes(context.TODO(), collection+"/"+rkey)

     

       365
       365
       +
       	_, _, err = r.GetRecordBytes(ctx, collection+"/"+rkey)

     

       363
       366
        
       	if err != nil {

     

       364
       367
        
       		return cid.Undef, nil, err

     

       365
       368
        
       	}

+5 -1

server/server.go

···

       423
       423
        
       	// public

     

       424
       424
        
       	s.echo.GET("/xrpc/com.atproto.identity.resolveHandle", s.handleResolveHandle)

     

       425
       425
        
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       426
       426
       -
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       427
       426
        
       	s.echo.POST("/xrpc/com.atproto.server.createSession", s.handleCreateSession)

     

       428
       427
        
       	s.echo.GET("/xrpc/com.atproto.server.describeServer", s.handleDescribeServer)

     

       429
       428
        
       

     
···

       460
       459
        
       	s.echo.GET("/xrpc/com.atproto.server.getSession", s.handleGetSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       461
       460
        
       	s.echo.POST("/xrpc/com.atproto.server.refreshSession", s.handleRefreshSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       462
       461
        
       	s.echo.POST("/xrpc/com.atproto.server.deleteSession", s.handleDeleteSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       462
       462
       +
       	s.echo.GET("/xrpc/com.atproto.identity.getRecommendedDidCredentials", s.handleGetRecommendedDidCredentials, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       463
       463
        
       	s.echo.POST("/xrpc/com.atproto.identity.updateHandle", s.handleIdentityUpdateHandle, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       464
       464
       +
       	s.echo.POST("/xrpc/com.atproto.identity.requestPlcOperationSignature", s.handleIdentityRequestPlcOperationSignature, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       465
       465
       +
       	s.echo.POST("/xrpc/com.atproto.identity.signPlcOperation", s.handleSignPlcOperation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       466
       466
       +
       	s.echo.POST("/xrpc/com.atproto.identity.submitPlcOperation", s.handleSubmitPlcOperation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       464
       467
        
       	s.echo.POST("/xrpc/com.atproto.server.confirmEmail", s.handleServerConfirmEmail, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       465
       468
        
       	s.echo.POST("/xrpc/com.atproto.server.requestEmailConfirmation", s.handleServerRequestEmailConfirmation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       466
       469
        
       	s.echo.POST("/xrpc/com.atproto.server.requestPasswordReset", s.handleServerRequestPasswordReset) // AUTH NOT REQUIRED FOR THIS ONE

     
···

       483
       486
        
       	// stupid silly endpoints

     

       484
       487
        
       	s.echo.GET("/xrpc/app.bsky.actor.getPreferences", s.handleActorGetPreferences, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       485
       488
        
       	s.echo.POST("/xrpc/app.bsky.actor.putPreferences", s.handleActorPutPreferences, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       489
       489
       +
       	s.echo.GET("/xrpc/app.bsky.feed.getFeed", s.handleProxyBskyFeedGetFeed, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       486
       490
        
       

     

       487
       491
        
       	// admin routes

     

       488
       492
        
       	s.echo.POST("/xrpc/com.atproto.server.createInviteCode", s.handleCreateInviteCode, s.handleAdminMiddleware)

+91

server/service_auth.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/identity"

     

       10
       10
       +
       	atproto_identity "github.com/bluesky-social/indigo/atproto/identity"

     

       11
       11
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       12
       12
       +
       	"github.com/golang-jwt/jwt/v4"

     

       13
       13
       +
       )

     

       14
       14
       +
       

     

       15
       15
       +
       type ES256KSigningMethod struct {

     

       16
       16
       +
       	alg string

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       func (m *ES256KSigningMethod) Alg() string {

     

       20
       20
       +
       	return m.alg

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func (m *ES256KSigningMethod) Verify(signingString string, signature string, key interface{}) error {

     

       24
       24
       +
       	signatureBytes, err := jwt.DecodeSegment(signature)

     

       25
       25
       +
       	if err != nil {

     

       26
       26
       +
       		return err

     

       27
       27
       +
       	}

     

       28
       28
       +
       	return key.(atcrypto.PublicKey).HashAndVerifyLenient([]byte(signingString), signatureBytes)

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       func (m *ES256KSigningMethod) Sign(signingString string, key interface{}) (string, error) {

     

       32
       32
       +
       	return "", fmt.Errorf("unimplemented")

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       func init() {

     

       36
       36
       +
       	ES256K := ES256KSigningMethod{alg: "ES256K"}

     

       37
       37
       +
       	jwt.RegisterSigningMethod(ES256K.Alg(), func() jwt.SigningMethod {

     

       38
       38
       +
       		return &ES256K

     

       39
       39
       +
       	})

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       func (s *Server) validateServiceAuth(ctx context.Context, rawToken string, nsid string) (string, error) {

     

       43
       43
       +
       	token := strings.TrimSpace(rawToken)

     

       44
       44
       +
       

     

       45
       45
       +
       	parsedToken, err := jwt.ParseWithClaims(token, jwt.MapClaims{}, func(token *jwt.Token) (interface{}, error) {

     

       46
       46
       +
       		did := syntax.DID(token.Claims.(jwt.MapClaims)["iss"].(string))

     

       47
       47
       +
       		didDoc, err := s.passport.FetchDoc(ctx, did.String());

     

       48
       48
       +
       		if err != nil {

     

       49
       49
       +
       			return nil, fmt.Errorf("unable to resolve did %s: %s", did, err)

     

       50
       50
       +
       		}

     

       51
       51
       +
       

     

       52
       52
       +
       		verificationMethods := make([]atproto_identity.DocVerificationMethod, len(didDoc.VerificationMethods))

     

       53
       53
       +
       		for i, verificationMethod := range didDoc.VerificationMethods {

     

       54
       54
       +
       			verificationMethods[i] = atproto_identity.DocVerificationMethod{

     

       55
       55
       +
       				ID: verificationMethod.Id,

     

       56
       56
       +
       				Type: verificationMethod.Type,

     

       57
       57
       +
       				PublicKeyMultibase: verificationMethod.PublicKeyMultibase,

     

       58
       58
       +
       				Controller: verificationMethod.Controller,

     

       59
       59
       +
       			}

     

       60
       60
       +
       		}

     

       61
       61
       +
       		services := make([]atproto_identity.DocService, len(didDoc.Service))

     

       62
       62
       +
       		for i, service := range didDoc.Service {

     

       63
       63
       +
       			services[i] = atproto_identity.DocService{

     

       64
       64
       +
       				ID: service.Id,

     

       65
       65
       +
       				Type: service.Type,

     

       66
       66
       +
       				ServiceEndpoint: service.ServiceEndpoint,

     

       67
       67
       +
       			}

     

       68
       68
       +
       		}

     

       69
       69
       +
       		parsedIdentity := atproto_identity.ParseIdentity(&identity.DIDDocument{

     

       70
       70
       +
       			DID: did,

     

       71
       71
       +
       			AlsoKnownAs: didDoc.AlsoKnownAs,

     

       72
       72
       +
       			VerificationMethod: verificationMethods,

     

       73
       73
       +
       			Service: services,

     

       74
       74
       +
       		})

     

       75
       75
       +
       

     

       76
       76
       +
       		key, err := parsedIdentity.PublicKey()

     

       77
       77
       +
       		if err != nil {

     

       78
       78
       +
       			return nil, fmt.Errorf("signing key not found for did %s: %s", did, err)

     

       79
       79
       +
       		}

     

       80
       80
       +
       		return key, nil

     

       81
       81
       +
       	})

     

       82
       82
       +
       	if err != nil {

     

       83
       83
       +
       		return "", fmt.Errorf("invalid token: %s", err)

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	claims := parsedToken.Claims.(jwt.MapClaims)

     

       87
       87
       +
       	if claims["lxm"] != nsid {

     

       88
       88
       +
       		return "", fmt.Errorf("bad jwt lexicon method (\"lxm\"). must match: %s", nsid)

     

       89
       89
       +
       	}

     

       90
       90
       +
       	return claims["iss"].(string), nil

     

       91
       91
       +
       }

Compare changes