comparing dedf81030abb32b86f0a4f25b50cb57a6bddd5dc and main on hailey.at/cocoon

+1 -1

.env.example

···

       6
       6
        
       COCOON_RELAYS=https://bsky.network

     

       7
       7
        
       # Generate with `openssl rand -hex 16`

     

       8
       8
        
       COCOON_ADMIN_PASSWORD=

     

       9
       9
       -
       # openssl rand -hex 32

     

       9
       9
       +
       # Generate with `openssl rand -hex 32`

     

       10
       10
        
       COCOON_SESSION_SECRET=

+116

.github/workflows/docker-image.yml

···

       1
       1
       +
       name: Docker image

     

       2
       2
       +
       

     

       3
       3
       +
       on:

     

       4
       4
       +
         workflow_dispatch:

     

       5
       5
       +
         push:

     

       6
       6
       +
           branches:

     

       7
       7
       +
             - main

     

       8
       8
       +
           tags:

     

       9
       9
       +
             - 'v*'

     

       10
       10
       +
       

     

       11
       11
       +
       env:

     

       12
       12
       +
         REGISTRY: ghcr.io

     

       13
       13
       +
         IMAGE_NAME: ${{ github.repository }}

     

       14
       14
       +
       

     

       15
       15
       +
       jobs:

     

       16
       16
       +
         build-and-push-image:

     

       17
       17
       +
           strategy:

     

       18
       18
       +
             matrix:

     

       19
       19
       +
               include:

     

       20
       20
       +
                 - arch: amd64

     

       21
       21
       +
                   runner: ubuntu-latest

     

       22
       22
       +
                 - arch: arm64

     

       23
       23
       +
                   runner: ubuntu-24.04-arm

     

       24
       24
       +
           runs-on: ${{ matrix.runner }}

     

       25
       25
       +
           # Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.

     

       26
       26
       +
           permissions:

     

       27
       27
       +
             contents: read

     

       28
       28
       +
             packages: write

     

       29
       29
       +
             attestations: write

     

       30
       30
       +
             id-token: write

     

       31
       31
       +
           outputs:

     

       32
       32
       +
             digest-amd64: ${{ matrix.arch == 'amd64' && steps.push.outputs.digest || '' }}

     

       33
       33
       +
             digest-arm64: ${{ matrix.arch == 'arm64' && steps.push.outputs.digest || '' }}

     

       34
       34
       +
           steps:

     

       35
       35
       +
             - name: Checkout repository

     

       36
       36
       +
               uses: actions/checkout@v4

     

       37
       37
       +
       

     

       38
       38
       +
             # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.

     

       39
       39
       +
             - name: Log in to the Container registry

     

       40
       40
       +
               uses: docker/login-action@v3

     

       41
       41
       +
               with:

     

       42
       42
       +
                 registry: ${{ env.REGISTRY }}

     

       43
       43
       +
                 username: ${{ github.actor }}

     

       44
       44
       +
                 password: ${{ secrets.GITHUB_TOKEN }}

     

       45
       45
       +
       

     

       46
       46
       +
             # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.

     

       47
       47
       +
             - name: Extract metadata (tags, labels) for Docker

     

       48
       48
       +
               id: meta

     

       49
       49
       +
               uses: docker/metadata-action@v5

     

       50
       50
       +
               with:

     

       51
       51
       +
                 images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

     

       52
       52
       +
                 tags: |

     

       53
       53
       +
                   type=raw,value=latest,enable={{is_default_branch}},suffix=-${{ matrix.arch }}

     

       54
       54
       +
                   type=sha,suffix=-${{ matrix.arch }}

     

       55
       55
       +
                   type=sha,format=long,suffix=-${{ matrix.arch }}

     

       56
       56
       +
                   type=semver,pattern={{version}},suffix=-${{ matrix.arch }}

     

       57
       57
       +
                   type=semver,pattern={{major}}.{{minor}},suffix=-${{ matrix.arch }}

     

       58
       58
       +
       

     

       59
       59
       +
             # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.

     

       60
       60
       +
             # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.

     

       61
       61
       +
             # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.

     

       62
       62
       +
             - name: Build and push Docker image

     

       63
       63
       +
               id: push

     

       64
       64
       +
               uses: docker/build-push-action@v6

     

       65
       65
       +
               with:

     

       66
       66
       +
                 context: .

     

       67
       67
       +
                 push: true

     

       68
       68
       +
                 tags: ${{ steps.meta.outputs.tags }}

     

       69
       69
       +
                 labels: ${{ steps.meta.outputs.labels }}

     

       70
       70
       +
       

     

       71
       71
       +
         publish-manifest:

     

       72
       72
       +
           needs: build-and-push-image

     

       73
       73
       +
           runs-on: ubuntu-latest

     

       74
       74
       +
           permissions:

     

       75
       75
       +
             packages: write

     

       76
       76
       +
             attestations: write

     

       77
       77
       +
             id-token: write

     

       78
       78
       +
           steps:

     

       79
       79
       +
             - name: Log in to the Container registry

     

       80
       80
       +
               uses: docker/login-action@v3

     

       81
       81
       +
               with:

     

       82
       82
       +
                 registry: ${{ env.REGISTRY }}

     

       83
       83
       +
                 username: ${{ github.actor }}

     

       84
       84
       +
                 password: ${{ secrets.GITHUB_TOKEN }}

     

       85
       85
       +
       

     

       86
       86
       +
             - name: Extract metadata (tags, labels) for Docker

     

       87
       87
       +
               id: meta

     

       88
       88
       +
               uses: docker/metadata-action@v5

     

       89
       89
       +
               with:

     

       90
       90
       +
                 images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

     

       91
       91
       +
                 tags: |

     

       92
       92
       +
                   type=raw,value=latest,enable={{is_default_branch}}

     

       93
       93
       +
                   type=sha

     

       94
       94
       +
                   type=sha,format=long

     

       95
       95
       +
                   type=semver,pattern={{version}}

     

       96
       96
       +
                   type=semver,pattern={{major}}.{{minor}}

     

       97
       97
       +
       

     

       98
       98
       +
             - name: Create and push manifest

     

       99
       99
       +
               run: |

     

       100
       100
       +
                 # Split tags into an array

     

       101
       101
       +
                 readarray -t tags <<< "${{ steps.meta.outputs.tags }}"

     

       102
       102
       +
       

     

       103
       103
       +
                 # Create and push manifest for each tag

     

       104
       104
       +
                 for tag in "${tags[@]}"; do

     

       105
       105
       +
                   docker buildx imagetools create -t "$tag" \

     

       106
       106
       +
                     "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push-image.outputs.digest-amd64 }}" \

     

       107
       107
       +
                     "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-and-push-image.outputs.digest-arm64 }}"

     

       108
       108
       +
                 done

     

       109
       109
       +
       

     

       110
       110
       +
             # This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see "[AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)."

     

       111
       111
       +
             - name: Generate artifact attestation

     

       112
       112
       +
               uses: actions/attest-build-provenance@v1

     

       113
       113
       +
               with:

     

       114
       114
       +
                 subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}

     

       115
       115
       +
                 subject-digest: ${{ needs.build-and-push-image.outputs.digest-amd64 }}

     

       116
       116
       +
                 push-to-registry: true

.gitignore

+10

Caddyfile

···

       1
       1
       +
       {$COCOON_HOSTNAME} {

     

       2
       2
       +
       	reverse_proxy localhost:8080

     

       3
       3
       +
       

     

       4
       4
       +
       	encode gzip

     

       5
       5
       +
       

     

       6
       6
       +
       	log {

     

       7
       7
       +
       		output file /data/access.log

     

       8
       8
       +
       		format json

     

       9
       9
       +
       	}

     

       10
       10
       +
       }

+10

Caddyfile.postgres

···

       1
       1
       +
       {$COCOON_HOSTNAME} {

     

       2
       2
       +
       	reverse_proxy cocoon:8080

     

       3
       3
       +
       

     

       4
       4
       +
       	encode gzip

     

       5
       5
       +
       

     

       6
       6
       +
       	log {

     

       7
       7
       +
       		output file /data/access.log

     

       8
       8
       +
       		format json

     

       9
       9
       +
       	}

     

       10
       10
       +
       }

+25

Dockerfile

···

       1
       1
       +
       ### Compile stage

     

       2
       2
       +
       FROM golang:1.25.1-bookworm AS build-env

     

       3
       3
       +
       

     

       4
       4
       +
       ADD . /dockerbuild

     

       5
       5
       +
       WORKDIR /dockerbuild

     

       6
       6
       +
       

     

       7
       7
       +
       RUN GIT_VERSION=$(git describe --tags --long --always || echo "dev-local") && \

     

       8
       8
       +
           go mod tidy && \

     

       9
       9
       +
           go build -ldflags "-X main.Version=$GIT_VERSION" -o cocoon ./cmd/cocoon

     

       10
       10
       +
       

     

       11
       11
       +
       ### Run stage

     

       12
       12
       +
       FROM debian:bookworm-slim AS run

     

       13
       13
       +
       

     

       14
       14
       +
       RUN apt-get update && apt-get install -y dumb-init runit ca-certificates curl && rm -rf /var/lib/apt/lists/*

     

       15
       15
       +
       ENTRYPOINT ["dumb-init", "--"]

     

       16
       16
       +
       

     

       17
       17
       +
       WORKDIR /

     

       18
       18
       +
       RUN mkdir -p data/cocoon

     

       19
       19
       +
       COPY --from=build-env /dockerbuild/cocoon /

     

       20
       20
       +
       

     

       21
       21
       +
       CMD ["/cocoon", "run"]

     

       22
       22
       +
       

     

       23
       23
       +
       LABEL org.opencontainers.image.source=https://github.com/haileyok/cocoon

     

       24
       24
       +
       LABEL org.opencontainers.image.description="Cocoon ATProto PDS"

     

       25
       25
       +
       LABEL org.opencontainers.image.licenses=MIT

+40

Makefile

···

       4
       4
        
       GIT_COMMIT := $(shell git rev-parse --short=9 HEAD)

     

       5
       5
        
       VERSION := $(if $(GIT_TAG),$(GIT_TAG),dev-$(GIT_COMMIT))

     

       6
       6
        
       

     

       7
       7
       +
       # Build output directory

     

       8
       8
       +
       BUILD_DIR := dist

     

       9
       9
       +
       

     

       10
       10
       +
       # Platforms to build for

     

       11
       11
       +
       PLATFORMS := \

     

       12
       12
       +
       	linux/amd64 \

     

       13
       13
       +
       	linux/arm64 \

     

       14
       14
       +
       	linux/arm \

     

       15
       15
       +
       	darwin/amd64 \

     

       16
       16
       +
       	darwin/arm64 \

     

       17
       17
       +
       	windows/amd64 \

     

       18
       18
       +
       	windows/arm64 \

     

       19
       19
       +
       	freebsd/amd64 \

     

       20
       20
       +
       	freebsd/arm64 \

     

       21
       21
       +
       	openbsd/amd64 \

     

       22
       22
       +
       	openbsd/arm64

     

       23
       23
       +
       

     

       7
       24
        
       .PHONY: help

     

       8
       25
        
       help: ## Print info about all commands

     

       9
       26
        
       	@echo "Commands:"

     
···

       14
       31
        
       build: ## Build all executables

     

       15
       32
        
       	go build -ldflags "-X main.Version=$(VERSION)" -o cocoon ./cmd/cocoon

     

       16
       33
        
       

     

       34
       34
       +
       .PHONY: build-release

     

       35
       35
       +
       build-all: ## Build binaries for all architectures

     

       36
       36
       +
       	@echo "Building for all architectures..."

     

       37
       37
       +
       	@mkdir -p $(BUILD_DIR)

     

       38
       38
       +
       	@$(foreach platform,$(PLATFORMS), \

     

       39
       39
       +
       		$(eval OS := $(word 1,$(subst /, ,$(platform)))) \

     

       40
       40
       +
       		$(eval ARCH := $(word 2,$(subst /, ,$(platform)))) \

     

       41
       41
       +
       		$(eval EXT := $(if $(filter windows,$(OS)),.exe,)) \

     

       42
       42
       +
       		$(eval OUTPUT := $(BUILD_DIR)/cocoon-$(VERSION)-$(OS)-$(ARCH)$(EXT)) \

     

       43
       43
       +
       		echo "Building $(OS)/$(ARCH)..."; \

     

       44
       44
       +
       		GOOS=$(OS) GOARCH=$(ARCH) go build -ldflags "-X main.Version=$(VERSION)" -o $(OUTPUT) ./cmd/cocoon && \

     

       45
       45
       +
       		echo "  ✓ $(OUTPUT)" || echo "  ✗ Failed: $(OS)/$(ARCH)"; \

     

       46
       46
       +
       	)

     

       47
       47
       +
       	@echo "Done! Binaries are in $(BUILD_DIR)/"

     

       48
       48
       +
       

     

       49
       49
       +
       .PHONY: clean-dist

     

       50
       50
       +
       clean-dist: ## Remove all built binaries

     

       51
       51
       +
       	rm -rf $(BUILD_DIR)

     

       52
       52
       +
       

     

       17
       53
        
       .PHONY: run

     

       18
       54
        
       run:

     

       19
       55
        
       	go build -ldflags "-X main.Version=dev-local" -o cocoon ./cmd/cocoon && ./cocoon run

     
···

       40
       76
        
       

     

       41
       77
        
       .env:

     

       42
       78
        
       	if [ ! -f ".env" ]; then cp example.dev.env .env; fi

     

       79
       79
       +
       

     

       80
       80
       +
       .PHONY: docker-build

     

       81
       81
       +
       docker-build:

     

       82
       82
       +
       	docker build -t cocoon .

+248 -60

README.md

···

       1
       1
        
       # Cocoon

     

       2
       2
        
       

     

       3
       3
        
       > [!WARNING]

     

       4
       4
       -
       You should not use this PDS. You should not rely on this code as a reference for a PDS implementation. You should not trust this code. Using this PDS implementation may result in data loss, corruption, etc.

     

       4
       4
       +
       I migrated and have been running my main account on this PDS for months now without issue, however, I am still not responsible if things go awry, particularly during account migration. Please use caution.

     

       5
       5
        
       

     

       6
       6
        
       Cocoon is a PDS implementation in Go. It is highly experimental, and is not ready for any production use.

     

       7
       7
        
       

     

       8
       8
       -
       ### Impmlemented Endpoints

     

       8
       8
       +
       ## Quick Start with Docker Compose

     

       9
       9
       +
       

     

       10
       10
       +
       ### Prerequisites

     

       11
       11
       +
       

     

       12
       12
       +
       - Docker and Docker Compose installed

     

       13
       13
       +
       - A domain name pointing to your server (for automatic HTTPS)

     

       14
       14
       +
       - Ports 80 and 443 open in i.e. UFW

     

       15
       15
       +
       

     

       16
       16
       +
       ### Installation

     

       17
       17
       +
       

     

       18
       18
       +
       1. **Clone the repository**

     

       19
       19
       +
          ```bash

     

       20
       20
       +
          git clone https://github.com/haileyok/cocoon.git

     

       21
       21
       +
          cd cocoon

     

       22
       22
       +
          ```

     

       23
       23
       +
       

     

       24
       24
       +
       2. **Create your configuration file**

     

       25
       25
       +
          ```bash

     

       26
       26
       +
          cp .env.example .env

     

       27
       27
       +
          ```

     

       28
       28
       +
       

     

       29
       29
       +
       3. **Edit `.env` with your settings**

     

       30
       30
       +
       

     

       31
       31
       +
          Required settings:

     

       32
       32
       +
          ```bash

     

       33
       33
       +
          COCOON_DID="did:web:your-domain.com"

     

       34
       34
       +
          COCOON_HOSTNAME="your-domain.com"

     

       35
       35
       +
          COCOON_CONTACT_EMAIL="you@example.com"

     

       36
       36
       +
          COCOON_RELAYS="https://bsky.network"

     

       37
       37
       +
       

     

       38
       38
       +
          # Generate with: openssl rand -hex 16

     

       39
       39
       +
          COCOON_ADMIN_PASSWORD="your-secure-password"

     

       40
       40
       +
       

     

       41
       41
       +
          # Generate with: openssl rand -hex 32

     

       42
       42
       +
          COCOON_SESSION_SECRET="your-session-secret"

     

       43
       43
       +
          ```

     

       44
       44
       +
       

     

       45
       45
       +
       4. **Start the services**

     

       46
       46
       +
          ```bash

     

       47
       47
       +
          # Pull pre-built image from GitHub Container Registry

     

       48
       48
       +
          docker-compose pull

     

       49
       49
       +
          docker-compose up -d

     

       50
       50
       +
          ```

     

       51
       51
       +
       

     

       52
       52
       +
          Or build locally:

     

       53
       53
       +
          ```bash

     

       54
       54
       +
          docker-compose build

     

       55
       55
       +
          docker-compose up -d

     

       56
       56
       +
          ```

     

       57
       57
       +
       

     

       58
       58
       +
          **For PostgreSQL deployment:**

     

       59
       59
       +
          ```bash

     

       60
       60
       +
          # Add POSTGRES_PASSWORD to your .env file first!

     

       61
       61
       +
          docker-compose -f docker-compose.postgres.yaml up -d

     

       62
       62
       +
          ```

     

       63
       63
       +
       

     

       64
       64
       +
       5. **Get your invite code**

     

       65
       65
       +
       

     

       66
       66
       +
          On first run, an invite code is automatically created. View it with:

     

       67
       67
       +
          ```bash

     

       68
       68
       +
          docker-compose logs create-invite

     

       69
       69
       +
          ```

     

       70
       70
       +
       

     

       71
       71
       +
          Or check the saved file:

     

       72
       72
       +
          ```bash

     

       73
       73
       +
          cat keys/initial-invite-code.txt

     

       74
       74
       +
          ```

     

       75
       75
       +
       

     

       76
       76
       +
          **IMPORTANT**: Save this invite code! You'll need it to create your first account.

     

       77
       77
       +
       

     

       78
       78
       +
       6. **Monitor the services**

     

       79
       79
       +
          ```bash

     

       80
       80
       +
          docker-compose logs -f

     

       81
       81
       +
          ```

     

       82
       82
       +
       

     

       83
       83
       +
       ### What Gets Set Up

     

       84
       84
       +
       

     

       85
       85
       +
       The Docker Compose setup includes:

     

       86
       86
       +
       

     

       87
       87
       +
       - **init-keys**: Automatically generates cryptographic keys (rotation key and JWK) on first run

     

       88
       88
       +
       - **cocoon**: The main PDS service running on port 8080

     

       89
       89
       +
       - **create-invite**: Automatically creates an initial invite code after Cocoon starts (first run only)

     

       90
       90
       +
       - **caddy**: Reverse proxy with automatic HTTPS via Let's Encrypt

     

       91
       91
       +
       

     

       92
       92
       +
       ### Data Persistence

     

       93
       93
       +
       

     

       94
       94
       +
       The following directories will be created automatically:

     

       95
       95
       +
       

     

       96
       96
       +
       - `./keys/` - Cryptographic keys (generated automatically)

     

       97
       97
       +
         - `rotation.key` - PDS rotation key

     

       98
       98
       +
         - `jwk.key` - JWK private key

     

       99
       99
       +
         - `initial-invite-code.txt` - Your first invite code (first run only)

     

       100
       100
       +
       - `./data/` - SQLite database and blockstore

     

       101
       101
       +
       - Docker volumes for Caddy configuration and certificates

     

       102
       102
       +
       

     

       103
       103
       +
       ### Optional Configuration

     

       104
       104
       +
       

     

       105
       105
       +
       #### Database Configuration

     

       106
       106
       +
       

     

       107
       107
       +
       By default, Cocoon uses SQLite which requires no additional setup. For production deployments with higher traffic, you can use PostgreSQL:

     

       108
       108
       +
       

     

       109
       109
       +
       ```bash

     

       110
       110
       +
       # Database type: sqlite (default) or postgres

     

       111
       111
       +
       COCOON_DB_TYPE="postgres"

     

       112
       112
       +
       

     

       113
       113
       +
       # PostgreSQL connection string (required if db-type is postgres)

     

       114
       114
       +
       # Format: postgres://user:password@host:port/database?sslmode=disable

     

       115
       115
       +
       COCOON_DATABASE_URL="postgres://cocoon:password@localhost:5432/cocoon?sslmode=disable"

     

       116
       116
       +
       

     

       117
       117
       +
       # Or use the standard DATABASE_URL environment variable

     

       118
       118
       +
       DATABASE_URL="postgres://cocoon:password@localhost:5432/cocoon?sslmode=disable"

     

       119
       119
       +
       ```

     

       120
       120
       +
       

     

       121
       121
       +
       For SQLite (default):

     

       122
       122
       +
       ```bash

     

       123
       123
       +
       COCOON_DB_TYPE="sqlite"

     

       124
       124
       +
       COCOON_DB_NAME="/data/cocoon/cocoon.db"

     

       125
       125
       +
       ```

     

       126
       126
       +
       

     

       127
       127
       +
       > **Note**: When using PostgreSQL, database backups to S3 are not handled by Cocoon. Use `pg_dump` or your database provider's backup solution instead.

     

       128
       128
       +
       

     

       129
       129
       +
       #### SMTP Email Settings

     

       130
       130
       +
       ```bash

     

       131
       131
       +
       COCOON_SMTP_USER="your-smtp-username"

     

       132
       132
       +
       COCOON_SMTP_PASS="your-smtp-password"

     

       133
       133
       +
       COCOON_SMTP_HOST="smtp.example.com"

     

       134
       134
       +
       COCOON_SMTP_PORT="587"

     

       135
       135
       +
       COCOON_SMTP_EMAIL="noreply@example.com"

     

       136
       136
       +
       COCOON_SMTP_NAME="Cocoon PDS"

     

       137
       137
       +
       ```

     

       138
       138
       +
       

     

       139
       139
       +
       #### S3 Storage

     

       140
       140
       +
       

     

       141
       141
       +
       Cocoon supports S3-compatible storage for both database backups (SQLite only) and blob storage (images, videos, etc.):

     

       142
       142
       +
       

     

       143
       143
       +
       ```bash

     

       144
       144
       +
       # Enable S3 backups (SQLite databases only - hourly backups)

     

       145
       145
       +
       COCOON_S3_BACKUPS_ENABLED=true

     

       146
       146
       +
       

     

       147
       147
       +
       # Enable S3 for blob storage (images, videos, etc.)

     

       148
       148
       +
       # When enabled, blobs are stored in S3 instead of the database

     

       149
       149
       +
       COCOON_S3_BLOBSTORE_ENABLED=true

     

       150
       150
       +
       

     

       151
       151
       +
       # S3 configuration (works with AWS S3, MinIO, Cloudflare R2, etc.)

     

       152
       152
       +
       COCOON_S3_REGION="us-east-1"

     

       153
       153
       +
       COCOON_S3_BUCKET="your-bucket"

     

       154
       154
       +
       COCOON_S3_ENDPOINT="https://s3.amazonaws.com"

     

       155
       155
       +
       COCOON_S3_ACCESS_KEY="your-access-key"

     

       156
       156
       +
       COCOON_S3_SECRET_KEY="your-secret-key"

     

       157
       157
       +
       

     

       158
       158
       +
       # Optional: CDN/public URL for blob redirects

     

       159
       159
       +
       # When set, com.atproto.sync.getBlob redirects to this URL instead of proxying

     

       160
       160
       +
       COCOON_S3_CDN_URL="https://cdn.example.com"

     

       161
       161
       +
       ```

     

       162
       162
       +
       

     

       163
       163
       +
       **Blob Storage Options:**

     

       164
       164
       +
       - `COCOON_S3_BLOBSTORE_ENABLED=false` (default): Blobs stored in the database

     

       165
       165
       +
       - `COCOON_S3_BLOBSTORE_ENABLED=true`: Blobs stored in S3 bucket under `blobs/{did}/{cid}`

     

       166
       166
       +
       

     

       167
       167
       +
       **Blob Serving Options:**

     

       168
       168
       +
       - Without `COCOON_S3_CDN_URL`: Blobs are proxied through the PDS server

     

       169
       169
       +
       - With `COCOON_S3_CDN_URL`: `getBlob` returns a 302 redirect to `{CDN_URL}/blobs/{did}/{cid}`

     

       170
       170
       +
       

     

       171
       171
       +
       > **Tip**: For Cloudflare R2, you can use the public bucket URL as the CDN URL. For AWS S3, you can use CloudFront or the S3 bucket URL directly if public access is enabled.

     

       172
       172
       +
       

     

       173
       173
       +
       ### Management Commands

     

       174
       174
       +
       

     

       175
       175
       +
       Create an invite code:

     

       176
       176
       +
       ```bash

     

       177
       177
       +
       docker exec cocoon-pds /cocoon create-invite-code --uses 1

     

       178
       178
       +
       ```

     

       179
       179
       +
       

     

       180
       180
       +
       Reset a user's password:

     

       181
       181
       +
       ```bash

     

       182
       182
       +
       docker exec cocoon-pds /cocoon reset-password --did "did:plc:xxx"

     

       183
       183
       +
       ```

     

       184
       184
       +
       

     

       185
       185
       +
       ### Updating

     

       186
       186
       +
       

     

       187
       187
       +
       ```bash

     

       188
       188
       +
       docker-compose pull

     

       189
       189
       +
       docker-compose up -d

     

       190
       190
       +
       ```

     

       191
       191
       +
       

     

       192
       192
       +
       ## Implemented Endpoints

     

       9
       193
        
       

     

       10
       194
        
       > [!NOTE]

     

       11
       11
       -
       Just because something is implemented doesn't mean it is finisehd. Tons of these are returning bad errors, don't do validation properly, etc. I'll make a "second pass" checklist at some point to do all of that.

     

       195
       195
       +
       Just because something is implemented doesn't mean it is finished. Tons of these are returning bad errors, don't do validation properly, etc. I'll make a "second pass" checklist at some point to do all of that.

     

       12
       196
        
       

     

       13
       13
       -
       #### Identity

     

       14
       14
       -
       - [ ] com.atproto.identity.getRecommendedDidCredentials

     

       15
       15
       -
       - [ ] com.atproto.identity.requestPlcOperationSignature

     

       16
       16
       -
       - [x] com.atproto.identity.resolveHandle

     

       17
       17
       -
       - [ ] com.atproto.identity.signPlcOperation

     

       18
       18
       -
       - [ ] com.atproto.identity.submitPlcOperatioin

     

       19
       19
       -
       - [x] com.atproto.identity.updateHandle

     

       197
       197
       +
       ### Identity

     

       20
       198
        
       

     

       21
       21
       -
       #### Repo

     

       22
       22
       -
       - [x] com.atproto.repo.applyWrites

     

       23
       23
       -
       - [x] com.atproto.repo.createRecord

     

       24
       24
       -
       - [x] com.atproto.repo.putRecord

     

       25
       25
       -
       - [x] com.atproto.repo.deleteRecord

     

       26
       26
       -
       - [x] com.atproto.repo.describeRepo

     

       27
       27
       -
       - [x] com.atproto.repo.getRecord

     

       28
       28
       -
       - [x] com.atproto.repo.importRepo (Works "okay". You still have to handle PLC operations on your own when migrating. Use with extreme caution.)

     

       29
       29
       -
       - [x] com.atproto.repo.listRecords

     

       30
       30
       -
       - [ ] com.atproto.repo.listMissingBlobs

     

       199
       199
       +
       - [x] `com.atproto.identity.getRecommendedDidCredentials`

     

       200
       200
       +
       - [x] `com.atproto.identity.requestPlcOperationSignature`

     

       201
       201
       +
       - [x] `com.atproto.identity.resolveHandle`

     

       202
       202
       +
       - [x] `com.atproto.identity.signPlcOperation`

     

       203
       203
       +
       - [x] `com.atproto.identity.submitPlcOperation`

     

       204
       204
       +
       - [x] `com.atproto.identity.updateHandle`

     

       31
       205
        
       

     

       32
       32
       -
       #### Server

     

       33
       33
       -
       - [ ] com.atproto.server.activateAccount

     

       34
       34
       -
       - [x] com.atproto.server.checkAccountStatus

     

       35
       35
       -
       - [x] com.atproto.server.confirmEmail

     

       36
       36
       -
       - [x] com.atproto.server.createAccount

     

       37
       37
       -
       - [x] com.atproto.server.createInviteCode

     

       38
       38
       -
       - [x] com.atproto.server.createInviteCodes

     

       39
       39
       -
       - [ ] com.atproto.server.deactivateAccount

     

       40
       40
       -
       - [ ] com.atproto.server.deleteAccount

     

       41
       41
       -
       - [x] com.atproto.server.deleteSession

     

       42
       42
       -
       - [x] com.atproto.server.describeServer

     

       43
       43
       -
       - [ ] com.atproto.server.getAccountInviteCodes

     

       44
       44
       -
       - [ ] com.atproto.server.getServiceAuth

     

       45
       45
       -
       - ~[ ] com.atproto.server.listAppPasswords~ - not going to add app passwords

     

       46
       46
       -
       - [x] com.atproto.server.refreshSession

     

       47
       47
       -
       - [ ] com.atproto.server.requestAccountDelete

     

       48
       48
       -
       - [x] com.atproto.server.requestEmailConfirmation

     

       49
       49
       -
       - [x] com.atproto.server.requestEmailUpdate

     

       50
       50
       -
       - [x] com.atproto.server.requestPasswordReset

     

       51
       51
       -
       - [ ] com.atproto.server.reserveSigningKey

     

       52
       52
       -
       - [x] com.atproto.server.resetPassword

     

       53
       53
       -
       - ~[ ] com.atproto.server.revokeAppPassword~ - not going to add app passwords

     

       54
       54
       -
       - [x] com.atproto.server.updateEmail

     

       206
       206
       +
       ### Repo

     

       207
       207
       +
       

     

       208
       208
       +
       - [x] `com.atproto.repo.applyWrites`

     

       209
       209
       +
       - [x] `com.atproto.repo.createRecord`

     

       210
       210
       +
       - [x] `com.atproto.repo.putRecord`

     

       211
       211
       +
       - [x] `com.atproto.repo.deleteRecord`

     

       212
       212
       +
       - [x] `com.atproto.repo.describeRepo`

     

       213
       213
       +
       - [x] `com.atproto.repo.getRecord`

     

       214
       214
       +
       - [x] `com.atproto.repo.importRepo` (Works "okay". Use with extreme caution.)

     

       215
       215
       +
       - [x] `com.atproto.repo.listRecords`

     

       216
       216
       +
       - [x] `com.atproto.repo.listMissingBlobs`

     

       217
       217
       +
       

     

       218
       218
       +
       ### Server

     

       219
       219
       +
       

     

       220
       220
       +
       - [x] `com.atproto.server.activateAccount`

     

       221
       221
       +
       - [x] `com.atproto.server.checkAccountStatus`

     

       222
       222
       +
       - [x] `com.atproto.server.confirmEmail`

     

       223
       223
       +
       - [x] `com.atproto.server.createAccount`

     

       224
       224
       +
       - [x] `com.atproto.server.createInviteCode`

     

       225
       225
       +
       - [x] `com.atproto.server.createInviteCodes`

     

       226
       226
       +
       - [x] `com.atproto.server.deactivateAccount`

     

       227
       227
       +
       - [x] `com.atproto.server.deleteAccount`

     

       228
       228
       +
       - [x] `com.atproto.server.deleteSession`

     

       229
       229
       +
       - [x] `com.atproto.server.describeServer`

     

       230
       230
       +
       - [ ] `com.atproto.server.getAccountInviteCodes`

     

       231
       231
       +
       - [x] `com.atproto.server.getServiceAuth`

     

       232
       232
       +
       - ~~[ ] `com.atproto.server.listAppPasswords`~~ - not going to add app passwords

     

       233
       233
       +
       - [x] `com.atproto.server.refreshSession`

     

       234
       234
       +
       - [x] `com.atproto.server.requestAccountDelete`

     

       235
       235
       +
       - [x] `com.atproto.server.requestEmailConfirmation`

     

       236
       236
       +
       - [x] `com.atproto.server.requestEmailUpdate`

     

       237
       237
       +
       - [x] `com.atproto.server.requestPasswordReset`

     

       238
       238
       +
       - [x] `com.atproto.server.reserveSigningKey`

     

       239
       239
       +
       - [x] `com.atproto.server.resetPassword`

     

       240
       240
       +
       - ~~[] `com.atproto.server.revokeAppPassword`~~ - not going to add app passwords

     

       241
       241
       +
       - [x] `com.atproto.server.updateEmail`

     

       242
       242
       +
       

     

       243
       243
       +
       ### Sync

     

       55
       244
        
       

     

       56
       56
       -
       #### Sync

     

       57
       57
       -
       - [x] com.atproto.sync.getBlob

     

       58
       58
       -
       - [x] com.atproto.sync.getBlocks

     

       59
       59
       -
       - [x] com.atproto.sync.getLatestCommit

     

       60
       60
       -
       - [x] com.atproto.sync.getRecord

     

       61
       61
       -
       - [x] com.atproto.sync.getRepoStatus

     

       62
       62
       -
       - [x] com.atproto.sync.getRepo

     

       63
       63
       -
       - [x] com.atproto.sync.listBlobs

     

       64
       64
       -
       - [x] com.atproto.sync.listRepos

     

       65
       65
       -
       - ~[ ] com.atproto.sync.notifyOfUpdate~ - BGS doesn't even have this implemented lol

     

       66
       66
       -
       - [x] com.atproto.sync.requestCrawl

     

       67
       67
       -
       - [x] com.atproto.sync.subscribeRepos

     

       245
       245
       +
       - [x] `com.atproto.sync.getBlob`

     

       246
       246
       +
       - [x] `com.atproto.sync.getBlocks`

     

       247
       247
       +
       - [x] `com.atproto.sync.getLatestCommit`

     

       248
       248
       +
       - [x] `com.atproto.sync.getRecord`

     

       249
       249
       +
       - [x] `com.atproto.sync.getRepoStatus`

     

       250
       250
       +
       - [x] `com.atproto.sync.getRepo`

     

       251
       251
       +
       - [x] `com.atproto.sync.listBlobs`

     

       252
       252
       +
       - [x] `com.atproto.sync.listRepos`

     

       253
       253
       +
       - ~~[ ] `com.atproto.sync.notifyOfUpdate`~~ - BGS doesn't even have this implemented lol

     

       254
       254
       +
       - [x] `com.atproto.sync.requestCrawl`

     

       255
       255
       +
       - [x] `com.atproto.sync.subscribeRepos`

     

       68
       256
        
       

     

       69
       69
       -
       #### Other

     

       70
       70
       -
       - [ ] com.atproto.label.queryLabels

     

       71
       71
       -
       - [ ] com.atproto.moderation.createReport

     

       72
       72
       -
       - [x] app.bsky.actor.getPreferences

     

       73
       73
       -
       - [x] app.bsky.actor.putPreferences

     

       257
       257
       +
       ### Other

     

       74
       258
        
       

     

       259
       259
       +
       - [x] `com.atproto.label.queryLabels`

     

       260
       260
       +
       - [x] `com.atproto.moderation.createReport` (Note: this should be handled by proxying, not actually implemented in the PDS)

     

       261
       261
       +
       - [x] `app.bsky.actor.getPreferences`

     

       262
       262
       +
       - [x] `app.bsky.actor.putPreferences`

     

       75
       263
        
       

     

       76
       264
        
       ## License

     

       77
       265

-163

blockstore/blockstore.go

···

       1
       1
       -
       package blockstore

     

       2
       2
       -
       

     

       3
       3
       -
       import (

     

       4
       4
       -
       	"context"

     

       5
       5
       -
       	"fmt"

     

       6
       6
       -
       

     

       7
       7
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       8
       8
       -
       	"github.com/haileyok/cocoon/internal/db"

     

       9
       9
       -
       	"github.com/haileyok/cocoon/models"

     

       10
       10
       -
       	blocks "github.com/ipfs/go-block-format"

     

       11
       11
       -
       	"github.com/ipfs/go-cid"

     

       12
       12
       -
       	"gorm.io/gorm/clause"

     

       13
       13
       -
       )

     

       14
       14
       -
       

     

       15
       15
       -
       type SqliteBlockstore struct {

     

       16
       16
       -
       	db       *db.DB

     

       17
       17
       -
       	did      string

     

       18
       18
       -
       	readonly bool

     

       19
       19
       -
       	inserts  map[cid.Cid]blocks.Block

     

       20
       20
       -
       }

     

       21
       21
       -
       

     

       22
       22
       -
       func New(did string, db *db.DB) *SqliteBlockstore {

     

       23
       23
       -
       	return &SqliteBlockstore{

     

       24
       24
       -
       		did:      did,

     

       25
       25
       -
       		db:       db,

     

       26
       26
       -
       		readonly: false,

     

       27
       27
       -
       		inserts:  map[cid.Cid]blocks.Block{},

     

       28
       28
       -
       	}

     

       29
       29
       -
       }

     

       30
       30
       -
       

     

       31
       31
       -
       func NewReadOnly(did string, db *db.DB) *SqliteBlockstore {

     

       32
       32
       -
       	return &SqliteBlockstore{

     

       33
       33
       -
       		did:      did,

     

       34
       34
       -
       		db:       db,

     

       35
       35
       -
       		readonly: true,

     

       36
       36
       -
       		inserts:  map[cid.Cid]blocks.Block{},

     

       37
       37
       -
       	}

     

       38
       38
       -
       }

     

       39
       39
       -
       

     

       40
       40
       -
       func (bs *SqliteBlockstore) Get(ctx context.Context, cid cid.Cid) (blocks.Block, error) {

     

       41
       41
       -
       	var block models.Block

     

       42
       42
       -
       

     

       43
       43
       -
       	maybeBlock, ok := bs.inserts[cid]

     

       44
       44
       -
       	if ok {

     

       45
       45
       -
       		return maybeBlock, nil

     

       46
       46
       -
       	}

     

       47
       47
       -
       

     

       48
       48
       -
       	if err := bs.db.Raw("SELECT * FROM blocks WHERE did = ? AND cid = ?", nil, bs.did, cid.Bytes()).Scan(&block).Error; err != nil {

     

       49
       49
       -
       		return nil, err

     

       50
       50
       -
       	}

     

       51
       51
       -
       

     

       52
       52
       -
       	b, err := blocks.NewBlockWithCid(block.Value, cid)

     

       53
       53
       -
       	if err != nil {

     

       54
       54
       -
       		return nil, err

     

       55
       55
       -
       	}

     

       56
       56
       -
       

     

       57
       57
       -
       	return b, nil

     

       58
       58
       -
       }

     

       59
       59
       -
       

     

       60
       60
       -
       func (bs *SqliteBlockstore) Put(ctx context.Context, block blocks.Block) error {

     

       61
       61
       -
       	bs.inserts[block.Cid()] = block

     

       62
       62
       -
       

     

       63
       63
       -
       	if bs.readonly {

     

       64
       64
       -
       		return nil

     

       65
       65
       -
       	}

     

       66
       66
       -
       

     

       67
       67
       -
       	b := models.Block{

     

       68
       68
       -
       		Did:   bs.did,

     

       69
       69
       -
       		Cid:   block.Cid().Bytes(),

     

       70
       70
       -
       		Rev:   syntax.NewTIDNow(0).String(), // TODO: WARN, this is bad. don't do this

     

       71
       71
       -
       		Value: block.RawData(),

     

       72
       72
       -
       	}

     

       73
       73
       -
       

     

       74
       74
       -
       	if err := bs.db.Create(&b, []clause.Expression{clause.OnConflict{

     

       75
       75
       -
       		Columns:   []clause.Column{{Name: "did"}, {Name: "cid"}},

     

       76
       76
       -
       		UpdateAll: true,

     

       77
       77
       -
       	}}).Error; err != nil {

     

       78
       78
       -
       		return err

     

       79
       79
       -
       	}

     

       80
       80
       -
       

     

       81
       81
       -
       	return nil

     

       82
       82
       -
       }

     

       83
       83
       -
       

     

       84
       84
       -
       func (bs *SqliteBlockstore) DeleteBlock(context.Context, cid.Cid) error {

     

       85
       85
       -
       	panic("not implemented")

     

       86
       86
       -
       }

     

       87
       87
       -
       

     

       88
       88
       -
       func (bs *SqliteBlockstore) Has(context.Context, cid.Cid) (bool, error) {

     

       89
       89
       -
       	panic("not implemented")

     

       90
       90
       -
       }

     

       91
       91
       -
       

     

       92
       92
       -
       func (bs *SqliteBlockstore) GetSize(context.Context, cid.Cid) (int, error) {

     

       93
       93
       -
       	panic("not implemented")

     

       94
       94
       -
       }

     

       95
       95
       -
       

     

       96
       96
       -
       func (bs *SqliteBlockstore) PutMany(ctx context.Context, blocks []blocks.Block) error {

     

       97
       97
       -
       	tx := bs.db.BeginDangerously()

     

       98
       98
       -
       

     

       99
       99
       -
       	for _, block := range blocks {

     

       100
       100
       -
       		bs.inserts[block.Cid()] = block

     

       101
       101
       -
       

     

       102
       102
       -
       		if bs.readonly {

     

       103
       103
       -
       			continue

     

       104
       104
       -
       		}

     

       105
       105
       -
       

     

       106
       106
       -
       		b := models.Block{

     

       107
       107
       -
       			Did:   bs.did,

     

       108
       108
       -
       			Cid:   block.Cid().Bytes(),

     

       109
       109
       -
       			Rev:   syntax.NewTIDNow(0).String(), // TODO: WARN, this is bad. don't do this

     

       110
       110
       -
       			Value: block.RawData(),

     

       111
       111
       -
       		}

     

       112
       112
       -
       

     

       113
       113
       -
       		if err := tx.Clauses(clause.OnConflict{

     

       114
       114
       -
       			Columns:   []clause.Column{{Name: "did"}, {Name: "cid"}},

     

       115
       115
       -
       			UpdateAll: true,

     

       116
       116
       -
       		}).Create(&b).Error; err != nil {

     

       117
       117
       -
       			tx.Rollback()

     

       118
       118
       -
       			return err

     

       119
       119
       -
       		}

     

       120
       120
       -
       	}

     

       121
       121
       -
       

     

       122
       122
       -
       	if bs.readonly {

     

       123
       123
       -
       		return nil

     

       124
       124
       -
       	}

     

       125
       125
       -
       

     

       126
       126
       -
       	tx.Commit()

     

       127
       127
       -
       

     

       128
       128
       -
       	return nil

     

       129
       129
       -
       }

     

       130
       130
       -
       

     

       131
       131
       -
       func (bs *SqliteBlockstore) AllKeysChan(ctx context.Context) (<-chan cid.Cid, error) {

     

       132
       132
       -
       	panic("not implemented")

     

       133
       133
       -
       }

     

       134
       134
       -
       

     

       135
       135
       -
       func (bs *SqliteBlockstore) HashOnRead(enabled bool) {

     

       136
       136
       -
       	panic("not implemented")

     

       137
       137
       -
       }

     

       138
       138
       -
       

     

       139
       139
       -
       func (bs *SqliteBlockstore) UpdateRepo(ctx context.Context, root cid.Cid, rev string) error {

     

       140
       140
       -
       	if err := bs.db.Exec("UPDATE repos SET root = ?, rev = ? WHERE did = ?", nil, root.Bytes(), rev, bs.did).Error; err != nil {

     

       141
       141
       -
       		return err

     

       142
       142
       -
       	}

     

       143
       143
       -
       

     

       144
       144
       -
       	return nil

     

       145
       145
       -
       }

     

       146
       146
       -
       

     

       147
       147
       -
       func (bs *SqliteBlockstore) Execute(ctx context.Context) error {

     

       148
       148
       -
       	if !bs.readonly {

     

       149
       149
       -
       		return fmt.Errorf("blockstore was not readonly")

     

       150
       150
       -
       	}

     

       151
       151
       -
       

     

       152
       152
       -
       	bs.readonly = false

     

       153
       153
       -
       	for _, b := range bs.inserts {

     

       154
       154
       -
       		bs.Put(ctx, b)

     

       155
       155
       -
       	}

     

       156
       156
       -
       	bs.readonly = true

     

       157
       157
       -
       

     

       158
       158
       -
       	return nil

     

       159
       159
       -
       }

     

       160
       160
       -
       

     

       161
       161
       -
       func (bs *SqliteBlockstore) GetLog() map[cid.Cid]blocks.Block {

     

       162
       162
       -
       	return bs.inserts

     

       163
       163
       -
       }

+104 -52

cmd/cocoon/main.go

···

       9
       9
        
       	"os"

     

       10
       10
        
       	"time"

     

       11
       11
        
       

     

       12
       12
       -
       	"github.com/bluesky-social/indigo/atproto/crypto"

     

       12
       12
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       13
       13
        
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       14
       14
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       15
       15
        
       	"github.com/haileyok/cocoon/server"

     
···

       17
       17
        
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       18
       18
        
       	"github.com/urfave/cli/v2"

     

       19
       19
        
       	"golang.org/x/crypto/bcrypt"

     

       20
       20
       +
       	"gorm.io/driver/postgres"

     

       20
       21
        
       	"gorm.io/driver/sqlite"

     

       21
       22
        
       	"gorm.io/gorm"

     

       22
       23
        
       )

     
···

       39
       40
        
       				EnvVars: []string{"COCOON_DB_NAME"},

     

       40
       41
        
       			},

     

       41
       42
        
       			&cli.StringFlag{

     

       42
       42
       -
       				Name:     "did",

     

       43
       43
       -
       				Required: true,

     

       44
       44
       -
       				EnvVars:  []string{"COCOON_DID"},

     

       43
       43
       +
       				Name:    "db-type",

     

       44
       44
       +
       				Value:   "sqlite",

     

       45
       45
       +
       				Usage:   "Database type: sqlite or postgres",

     

       46
       46
       +
       				EnvVars: []string{"COCOON_DB_TYPE"},

     

       45
       47
        
       			},

     

       46
       48
        
       			&cli.StringFlag{

     

       47
       47
       -
       				Name:     "hostname",

     

       48
       48
       -
       				Required: true,

     

       49
       49
       -
       				EnvVars:  []string{"COCOON_HOSTNAME"},

     

       49
       49
       +
       				Name:    "database-url",

     

       50
       50
       +
       				Aliases: []string{"db-url"},

     

       51
       51
       +
       				Usage:   "PostgreSQL connection string (required if db-type is postgres)",

     

       52
       52
       +
       				EnvVars: []string{"COCOON_DATABASE_URL", "DATABASE_URL"},

     

       53
       53
       +
       			},

     

       54
       54
       +
       			&cli.StringFlag{

     

       55
       55
       +
       				Name:    "did",

     

       56
       56
       +
       				EnvVars: []string{"COCOON_DID"},

     

       50
       57
        
       			},

     

       51
       58
        
       			&cli.StringFlag{

     

       52
       52
       -
       				Name:     "rotation-key-path",

     

       53
       53
       -
       				Required: true,

     

       54
       54
       -
       				EnvVars:  []string{"COCOON_ROTATION_KEY_PATH"},

     

       59
       59
       +
       				Name:    "hostname",

     

       60
       60
       +
       				EnvVars: []string{"COCOON_HOSTNAME"},

     

       55
       61
        
       			},

     

       56
       62
        
       			&cli.StringFlag{

     

       57
       57
       -
       				Name:     "jwk-path",

     

       58
       58
       -
       				Required: true,

     

       59
       59
       -
       				EnvVars:  []string{"COCOON_JWK_PATH"},

     

       63
       63
       +
       				Name:    "rotation-key-path",

     

       64
       64
       +
       				EnvVars: []string{"COCOON_ROTATION_KEY_PATH"},

     

       60
       65
        
       			},

     

       61
       66
        
       			&cli.StringFlag{

     

       62
       62
       -
       				Name:     "contact-email",

     

       63
       63
       -
       				Required: true,

     

       64
       64
       -
       				EnvVars:  []string{"COCOON_CONTACT_EMAIL"},

     

       67
       67
       +
       				Name:    "jwk-path",

     

       68
       68
       +
       				EnvVars: []string{"COCOON_JWK_PATH"},

     

       69
       69
       +
       			},

     

       70
       70
       +
       			&cli.StringFlag{

     

       71
       71
       +
       				Name:    "contact-email",

     

       72
       72
       +
       				EnvVars: []string{"COCOON_CONTACT_EMAIL"},

     

       65
       73
        
       			},

     

       66
       74
        
       			&cli.StringSliceFlag{

     

       67
       67
       -
       				Name:     "relays",

     

       68
       68
       -
       				Required: true,

     

       69
       69
       -
       				EnvVars:  []string{"COCOON_RELAYS"},

     

       75
       75
       +
       				Name:    "relays",

     

       76
       76
       +
       				EnvVars: []string{"COCOON_RELAYS"},

     

       70
       77
        
       			},

     

       71
       78
        
       			&cli.StringFlag{

     

       72
       72
       -
       				Name:     "admin-password",

     

       73
       73
       -
       				Required: true,

     

       74
       74
       -
       				EnvVars:  []string{"COCOON_ADMIN_PASSWORD"},

     

       79
       79
       +
       				Name:    "admin-password",

     

       80
       80
       +
       				EnvVars: []string{"COCOON_ADMIN_PASSWORD"},

     

       81
       81
       +
       			},

     

       82
       82
       +
       			&cli.BoolFlag{

     

       83
       83
       +
       				Name:    "require-invite",

     

       84
       84
       +
       				EnvVars: []string{"COCOON_REQUIRE_INVITE"},

     

       85
       85
       +
       				Value:   true,

     

       75
       86
        
       			},

     

       76
       87
        
       			&cli.StringFlag{

     

       77
       77
       -
       				Name:     "smtp-user",

     

       78
       78
       -
       				Required: false,

     

       79
       79
       -
       				EnvVars:  []string{"COCOON_SMTP_USER"},

     

       88
       88
       +
       				Name:    "smtp-user",

     

       89
       89
       +
       				EnvVars: []string{"COCOON_SMTP_USER"},

     

       80
       90
        
       			},

     

       81
       91
        
       			&cli.StringFlag{

     

       82
       82
       -
       				Name:     "smtp-pass",

     

       83
       83
       -
       				Required: false,

     

       84
       84
       -
       				EnvVars:  []string{"COCOON_SMTP_PASS"},

     

       92
       92
       +
       				Name:    "smtp-pass",

     

       93
       93
       +
       				EnvVars: []string{"COCOON_SMTP_PASS"},

     

       85
       94
        
       			},

     

       86
       95
        
       			&cli.StringFlag{

     

       87
       87
       -
       				Name:     "smtp-host",

     

       88
       88
       -
       				Required: false,

     

       89
       89
       -
       				EnvVars:  []string{"COCOON_SMTP_HOST"},

     

       96
       96
       +
       				Name:    "smtp-host",

     

       97
       97
       +
       				EnvVars: []string{"COCOON_SMTP_HOST"},

     

       90
       98
        
       			},

     

       91
       99
        
       			&cli.StringFlag{

     

       92
       92
       -
       				Name:     "smtp-port",

     

       93
       93
       -
       				Required: false,

     

       94
       94
       -
       				EnvVars:  []string{"COCOON_SMTP_PORT"},

     

       100
       100
       +
       				Name:    "smtp-port",

     

       101
       101
       +
       				EnvVars: []string{"COCOON_SMTP_PORT"},

     

       95
       102
        
       			},

     

       96
       103
        
       			&cli.StringFlag{

     

       97
       97
       -
       				Name:     "smtp-email",

     

       98
       98
       -
       				Required: false,

     

       99
       99
       -
       				EnvVars:  []string{"COCOON_SMTP_EMAIL"},

     

       104
       104
       +
       				Name:    "smtp-email",

     

       105
       105
       +
       				EnvVars: []string{"COCOON_SMTP_EMAIL"},

     

       100
       106
        
       			},

     

       101
       107
        
       			&cli.StringFlag{

     

       102
       102
       -
       				Name:     "smtp-name",

     

       103
       103
       -
       				Required: false,

     

       104
       104
       -
       				EnvVars:  []string{"COCOON_SMTP_NAME"},

     

       108
       108
       +
       				Name:    "smtp-name",

     

       109
       109
       +
       				EnvVars: []string{"COCOON_SMTP_NAME"},

     

       105
       110
        
       			},

     

       106
       111
        
       			&cli.BoolFlag{

     

       107
       112
        
       				Name:    "s3-backups-enabled",

     

       108
       113
        
       				EnvVars: []string{"COCOON_S3_BACKUPS_ENABLED"},

     

       109
       114
        
       			},

     

       115
       115
       +
       			&cli.BoolFlag{

     

       116
       116
       +
       				Name:    "s3-blobstore-enabled",

     

       117
       117
       +
       				EnvVars: []string{"COCOON_S3_BLOBSTORE_ENABLED"},

     

       118
       118
       +
       			},

     

       110
       119
        
       			&cli.StringFlag{

     

       111
       120
        
       				Name:    "s3-region",

     

       112
       121
        
       				EnvVars: []string{"COCOON_S3_REGION"},

     
···

       128
       137
        
       				EnvVars: []string{"COCOON_S3_SECRET_KEY"},

     

       129
       138
        
       			},

     

       130
       139
        
       			&cli.StringFlag{

     

       140
       140
       +
       				Name:    "s3-cdn-url",

     

       141
       141
       +
       				EnvVars: []string{"COCOON_S3_CDN_URL"},

     

       142
       142
       +
       				Usage:   "Public URL for S3 blob redirects (e.g., https://cdn.example.com). When set, getBlob redirects to this URL instead of proxying.",

     

       143
       143
       +
       			},

     

       144
       144
       +
       			&cli.StringFlag{

     

       131
       145
        
       				Name:    "session-secret",

     

       132
       146
        
       				EnvVars: []string{"COCOON_SESSION_SECRET"},

     

       133
       147
        
       			},

     

       148
       148
       +
       			&cli.StringFlag{

     

       149
       149
       +
       				Name:    "blockstore-variant",

     

       150
       150
       +
       				EnvVars: []string{"COCOON_BLOCKSTORE_VARIANT"},

     

       151
       151
       +
       				Value:   "sqlite",

     

       152
       152
       +
       			},

     

       153
       153
       +
       			&cli.StringFlag{

     

       154
       154
       +
       				Name:    "fallback-proxy",

     

       155
       155
       +
       				EnvVars: []string{"COCOON_FALLBACK_PROXY"},

     

       156
       156
       +
       			},

     

       134
       157
        
       		},

     

       135
       158
        
       		Commands: []*cli.Command{

     

       136
       159
        
       			runServe,

     
···

       153
       176
        
       	Usage: "Start the cocoon PDS",

     

       154
       177
        
       	Flags: []cli.Flag{},

     

       155
       178
        
       	Action: func(cmd *cli.Context) error {

     

       179
       179
       +
       

     

       156
       180
        
       		s, err := server.New(&server.Args{

     

       157
       181
        
       			Addr:            cmd.String("addr"),

     

       158
       182
        
       			DbName:          cmd.String("db-name"),

     

       183
       183
       +
       			DbType:          cmd.String("db-type"),

     

       184
       184
       +
       			DatabaseURL:     cmd.String("database-url"),

     

       159
       185
        
       			Did:             cmd.String("did"),

     

       160
       186
        
       			Hostname:        cmd.String("hostname"),

     

       161
       187
        
       			RotationKeyPath: cmd.String("rotation-key-path"),

     
···

       164
       190
        
       			Version:         Version,

     

       165
       191
        
       			Relays:          cmd.StringSlice("relays"),

     

       166
       192
        
       			AdminPassword:   cmd.String("admin-password"),

     

       193
       193
       +
       			RequireInvite:   cmd.Bool("require-invite"),

     

       167
       194
        
       			SmtpUser:        cmd.String("smtp-user"),

     

       168
       195
        
       			SmtpPass:        cmd.String("smtp-pass"),

     

       169
       196
        
       			SmtpHost:        cmd.String("smtp-host"),

     
···

       171
       198
        
       			SmtpEmail:       cmd.String("smtp-email"),

     

       172
       199
        
       			SmtpName:        cmd.String("smtp-name"),

     

       173
       200
        
       			S3Config: &server.S3Config{

     

       174
       174
       -
       				BackupsEnabled: cmd.Bool("s3-backups-enabled"),

     

       175
       175
       -
       				Region:         cmd.String("s3-region"),

     

       176
       176
       -
       				Bucket:         cmd.String("s3-bucket"),

     

       177
       177
       -
       				Endpoint:       cmd.String("s3-endpoint"),

     

       178
       178
       -
       				AccessKey:      cmd.String("s3-access-key"),

     

       179
       179
       -
       				SecretKey:      cmd.String("s3-secret-key"),

     

       201
       201
       +
       				BackupsEnabled:   cmd.Bool("s3-backups-enabled"),

     

       202
       202
       +
       				BlobstoreEnabled: cmd.Bool("s3-blobstore-enabled"),

     

       203
       203
       +
       				Region:           cmd.String("s3-region"),

     

       204
       204
       +
       				Bucket:           cmd.String("s3-bucket"),

     

       205
       205
       +
       				Endpoint:         cmd.String("s3-endpoint"),

     

       206
       206
       +
       				AccessKey:        cmd.String("s3-access-key"),

     

       207
       207
       +
       				SecretKey:        cmd.String("s3-secret-key"),

     

       208
       208
       +
       				CDNUrl:           cmd.String("s3-cdn-url"),

     

       180
       209
        
       			},

     

       181
       181
       -
       			SessionSecret: cmd.String("session-secret"),

     

       210
       210
       +
       			SessionSecret:     cmd.String("session-secret"),

     

       211
       211
       +
       			BlockstoreVariant: server.MustReturnBlockstoreVariant(cmd.String("blockstore-variant")),

     

       212
       212
       +
       			FallbackProxy:     cmd.String("fallback-proxy"),

     

       182
       213
        
       		})

     

       183
       214
        
       		if err != nil {

     

       184
       215
        
       			fmt.Printf("error creating cocoon: %v", err)

     
···

       205
       236
        
       		},

     

       206
       237
        
       	},

     

       207
       238
        
       	Action: func(cmd *cli.Context) error {

     

       208
       208
       -
       		key, err := crypto.GeneratePrivateKeyK256()

     

       239
       239
       +
       		key, err := atcrypto.GeneratePrivateKeyK256()

     

       209
       240
        
       		if err != nil {

     

       210
       241
        
       			return err

     

       211
       242
        
       		}

     
···

       275
       306
        
       		},

     

       276
       307
        
       	},

     

       277
       308
        
       	Action: func(cmd *cli.Context) error {

     

       278
       278
       -
       		db, err := newDb()

     

       309
       309
       +
       		db, err := newDb(cmd)

     

       279
       310
        
       		if err != nil {

     

       280
       311
        
       			return err

     

       281
       312
        
       		}

     
···

       314
       345
        
       		},

     

       315
       346
        
       	},

     

       316
       347
        
       	Action: func(cmd *cli.Context) error {

     

       317
       317
       -
       		db, err := newDb()

     

       348
       348
       +
       		db, err := newDb(cmd)

     

       318
       349
        
       		if err != nil {

     

       319
       350
        
       			return err

     

       320
       351
        
       		}

     
···

       341
       372
        
       	},

     

       342
       373
        
       }

     

       343
       374
        
       

     

       344
       344
       -
       func newDb() (*gorm.DB, error) {

     

       345
       345
       -
       	return gorm.Open(sqlite.Open("cocoon.db"), &gorm.Config{})

     

       375
       375
       +
       func newDb(cmd *cli.Context) (*gorm.DB, error) {

     

       376
       376
       +
       	dbType := cmd.String("db-type")

     

       377
       377
       +
       	if dbType == "" {

     

       378
       378
       +
       		dbType = "sqlite"

     

       379
       379
       +
       	}

     

       380
       380
       +
       

     

       381
       381
       +
       	switch dbType {

     

       382
       382
       +
       	case "postgres":

     

       383
       383
       +
       		databaseURL := cmd.String("database-url")

     

       384
       384
       +
       		if databaseURL == "" {

     

       385
       385
       +
       			databaseURL = cmd.String("database-url")

     

       386
       386
       +
       		}

     

       387
       387
       +
       		if databaseURL == "" {

     

       388
       388
       +
       			return nil, fmt.Errorf("COCOON_DATABASE_URL or DATABASE_URL must be set when using postgres")

     

       389
       389
       +
       		}

     

       390
       390
       +
       		return gorm.Open(postgres.Open(databaseURL), &gorm.Config{})

     

       391
       391
       +
       	default:

     

       392
       392
       +
       		dbName := cmd.String("db-name")

     

       393
       393
       +
       		if dbName == "" {

     

       394
       394
       +
       			dbName = "cocoon.db"

     

       395
       395
       +
       		}

     

       396
       396
       +
       		return gorm.Open(sqlite.Open(dbName), &gorm.Config{})

     

       397
       397
       +
       	}

     

       346
       398
        
       }

+56

create-initial-invite.sh

···

       1
       1
       +
       #!/bin/sh

     

       2
       2
       +
       

     

       3
       3
       +
       INVITE_FILE="/keys/initial-invite-code.txt"

     

       4
       4
       +
       MARKER="/keys/.invite_created"

     

       5
       5
       +
       

     

       6
       6
       +
       # Check if invite code was already created

     

       7
       7
       +
       if [ -f "$MARKER" ]; then

     

       8
       8
       +
           echo "✓ Initial invite code already created"

     

       9
       9
       +
           exit 0

     

       10
       10
       +
       fi

     

       11
       11
       +
       

     

       12
       12
       +
       echo "Waiting for database to be ready..."

     

       13
       13
       +
       sleep 10

     

       14
       14
       +
       

     

       15
       15
       +
       # Try to create invite code - retry until database is ready

     

       16
       16
       +
       MAX_ATTEMPTS=30

     

       17
       17
       +
       ATTEMPT=0

     

       18
       18
       +
       INVITE_CODE=""

     

       19
       19
       +
       

     

       20
       20
       +
       while [ $ATTEMPT -lt $MAX_ATTEMPTS ]; do

     

       21
       21
       +
           ATTEMPT=$((ATTEMPT + 1))

     

       22
       22
       +
           OUTPUT=$(/cocoon create-invite-code --uses 1 2>&1)

     

       23
       23
       +
           INVITE_CODE=$(echo "$OUTPUT" | grep -oE '[a-zA-Z0-9]{8}-[a-zA-Z0-9]{8}' || echo "")

     

       24
       24
       +
       

     

       25
       25
       +
           if [ -n "$INVITE_CODE" ]; then

     

       26
       26
       +
               break

     

       27
       27
       +
           fi

     

       28
       28
       +
       

     

       29
       29
       +
           if [ $((ATTEMPT % 5)) -eq 0 ]; then

     

       30
       30
       +
               echo "  Waiting for database... ($ATTEMPT/$MAX_ATTEMPTS)"

     

       31
       31
       +
           fi

     

       32
       32
       +
           sleep 2

     

       33
       33
       +
       done

     

       34
       34
       +
       

     

       35
       35
       +
       if [ -n "$INVITE_CODE" ]; then

     

       36
       36
       +
           echo ""

     

       37
       37
       +
           echo "╔════════════════════════════════════════╗"

     

       38
       38
       +
           echo "║   SAVE THIS INVITE CODE!               ║"

     

       39
       39
       +
           echo "║                                        ║"

     

       40
       40
       +
           echo "║   $INVITE_CODE                         ║"

     

       41
       41
       +
           echo "║                                        ║"

     

       42
       42
       +
           echo "║   Use this to create your first        ║"

     

       43
       43
       +
           echo "║   account on your PDS.                 ║"

     

       44
       44
       +
           echo "╚════════════════════════════════════════╝"

     

       45
       45
       +
           echo ""

     

       46
       46
       +
       

     

       47
       47
       +
           echo "$INVITE_CODE" > "$INVITE_FILE"

     

       48
       48
       +
           echo "✓ Invite code saved to: $INVITE_FILE"

     

       49
       49
       +
       

     

       50
       50
       +
           touch "$MARKER"

     

       51
       51
       +
           echo "✓ Initial setup complete!"

     

       52
       52
       +
       else

     

       53
       53
       +
           echo "✗ Failed to create invite code"

     

       54
       54
       +
           echo "Output: $OUTPUT"

     

       55
       55
       +
           exit 1

     

       56
       56
       +
       fi

+45

cspell.json

···

       1
       1
       +
       {

     

       2
       2
       +
         "version": "0.2",

     

       3
       3
       +
         "language": "en",

     

       4
       4
       +
         "words": [

     

       5
       5
       +
           "atproto",

     

       6
       6
       +
           "bsky",

     

       7
       7
       +
           "Cocoon",

     

       8
       8
       +
           "PDS",

     

       9
       9
       +
           "Plc",

     

       10
       10
       +
           "plc",

     

       11
       11
       +
           "repo",

     

       12
       12
       +
           "InviteCodes",

     

       13
       13
       +
           "InviteCode",

     

       14
       14
       +
           "Invite",

     

       15
       15
       +
           "Signin",

     

       16
       16
       +
           "Signout",

     

       17
       17
       +
           "JWKS",

     

       18
       18
       +
           "dpop",

     

       19
       19
       +
           "BGS",

     

       20
       20
       +
           "pico",

     

       21
       21
       +
           "picocss",

     

       22
       22
       +
           "par",

     

       23
       23
       +
           "blobs",

     

       24
       24
       +
           "blob",

     

       25
       25
       +
           "did",

     

       26
       26
       +
           "DID",

     

       27
       27
       +
           "OAuth",

     

       28
       28
       +
           "oauth",

     

       29
       29
       +
           "par",

     

       30
       30
       +
           "Cocoon",

     

       31
       31
       +
           "memcache",

     

       32
       32
       +
           "db",

     

       33
       33
       +
           "helpers",

     

       34
       34
       +
           "middleware",

     

       35
       35
       +
           "repo",

     

       36
       36
       +
           "static",

     

       37
       37
       +
           "pico",

     

       38
       38
       +
           "picocss",

     

       39
       39
       +
           "MIT",

     

       40
       40
       +
           "Go"

     

       41
       41
       +
         ],

     

       42
       42
       +
         "ignorePaths": [

     

       43
       43
       +
           "server/static/pico.css"

     

       44
       44
       +
         ]

     

       45
       45
       +
       }

+158

docker-compose.postgres.yaml

···

       1
       1
       +
       # Docker Compose with PostgreSQL

     

       2
       2
       +
       # 

     

       3
       3
       +
       # Usage:

     

       4
       4
       +
       #   docker-compose -f docker-compose.postgres.yaml up -d

     

       5
       5
       +
       #

     

       6
       6
       +
       # This file extends the base docker-compose.yaml with a PostgreSQL database.

     

       7
       7
       +
       # Set the following in your .env file:

     

       8
       8
       +
       #   COCOON_DB_TYPE=postgres

     

       9
       9
       +
       #   POSTGRES_PASSWORD=your-secure-password

     

       10
       10
       +
       

     

       11
       11
       +
       version: '3.8'

     

       12
       12
       +
       

     

       13
       13
       +
       services:

     

       14
       14
       +
         postgres:

     

       15
       15
       +
           image: postgres:16-alpine

     

       16
       16
       +
           container_name: cocoon-postgres

     

       17
       17
       +
           environment:

     

       18
       18
       +
             POSTGRES_USER: cocoon

     

       19
       19
       +
             POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}

     

       20
       20
       +
             POSTGRES_DB: cocoon

     

       21
       21
       +
           volumes:

     

       22
       22
       +
             - postgres_data:/var/lib/postgresql/data

     

       23
       23
       +
           healthcheck:

     

       24
       24
       +
             test: ["CMD-SHELL", "pg_isready -U cocoon -d cocoon"]

     

       25
       25
       +
             interval: 10s

     

       26
       26
       +
             timeout: 5s

     

       27
       27
       +
             retries: 5

     

       28
       28
       +
           restart: unless-stopped

     

       29
       29
       +
       

     

       30
       30
       +
         init-keys:

     

       31
       31
       +
           build:

     

       32
       32
       +
             context: .

     

       33
       33
       +
             dockerfile: Dockerfile

     

       34
       34
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       35
       35
       +
           container_name: cocoon-init-keys

     

       36
       36
       +
           volumes:

     

       37
       37
       +
             - ./keys:/keys

     

       38
       38
       +
             - ./data:/data/cocoon

     

       39
       39
       +
             - ./init-keys.sh:/init-keys.sh:ro

     

       40
       40
       +
           environment:

     

       41
       41
       +
             COCOON_DID: ${COCOON_DID}

     

       42
       42
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       43
       43
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       44
       44
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       45
       45
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       46
       46
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       47
       47
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       48
       48
       +
           entrypoint: ["/bin/sh", "/init-keys.sh"]

     

       49
       49
       +
           restart: "no"

     

       50
       50
       +
       

     

       51
       51
       +
         cocoon:

     

       52
       52
       +
           build:

     

       53
       53
       +
             context: .

     

       54
       54
       +
             dockerfile: Dockerfile

     

       55
       55
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       56
       56
       +
           container_name: cocoon-pds

     

       57
       57
       +
           depends_on:

     

       58
       58
       +
             init-keys:

     

       59
       59
       +
               condition: service_completed_successfully

     

       60
       60
       +
             postgres:

     

       61
       61
       +
               condition: service_healthy

     

       62
       62
       +
           ports:

     

       63
       63
       +
             - "8080:8080"

     

       64
       64
       +
           volumes:

     

       65
       65
       +
             - ./data:/data/cocoon

     

       66
       66
       +
             - ./keys/rotation.key:/keys/rotation.key:ro

     

       67
       67
       +
             - ./keys/jwk.key:/keys/jwk.key:ro

     

       68
       68
       +
           environment:

     

       69
       69
       +
             # Required settings

     

       70
       70
       +
             COCOON_DID: ${COCOON_DID}

     

       71
       71
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       72
       72
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       73
       73
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       74
       74
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       75
       75
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       76
       76
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       77
       77
       +
             COCOON_SESSION_SECRET: ${COCOON_SESSION_SECRET}

     

       78
       78
       +
       

     

       79
       79
       +
             # Database configuration - PostgreSQL

     

       80
       80
       +
             COCOON_ADDR: ":8080"

     

       81
       81
       +
             COCOON_DB_TYPE: postgres

     

       82
       82
       +
             COCOON_DATABASE_URL: postgres://cocoon:${POSTGRES_PASSWORD}@postgres:5432/cocoon?sslmode=disable

     

       83
       83
       +
             COCOON_BLOCKSTORE_VARIANT: ${COCOON_BLOCKSTORE_VARIANT:-sqlite}

     

       84
       84
       +
       

     

       85
       85
       +
             # Optional: SMTP settings for email

     

       86
       86
       +
             COCOON_SMTP_USER: ${COCOON_SMTP_USER:-}

     

       87
       87
       +
             COCOON_SMTP_PASS: ${COCOON_SMTP_PASS:-}

     

       88
       88
       +
             COCOON_SMTP_HOST: ${COCOON_SMTP_HOST:-}

     

       89
       89
       +
             COCOON_SMTP_PORT: ${COCOON_SMTP_PORT:-}

     

       90
       90
       +
             COCOON_SMTP_EMAIL: ${COCOON_SMTP_EMAIL:-}

     

       91
       91
       +
             COCOON_SMTP_NAME: ${COCOON_SMTP_NAME:-}

     

       92
       92
       +
       

     

       93
       93
       +
             # Optional: S3 configuration

     

       94
       94
       +
             COCOON_S3_BACKUPS_ENABLED: ${COCOON_S3_BACKUPS_ENABLED:-false}

     

       95
       95
       +
             COCOON_S3_BLOBSTORE_ENABLED: ${COCOON_S3_BLOBSTORE_ENABLED:-false}

     

       96
       96
       +
             COCOON_S3_REGION: ${COCOON_S3_REGION:-}

     

       97
       97
       +
             COCOON_S3_BUCKET: ${COCOON_S3_BUCKET:-}

     

       98
       98
       +
             COCOON_S3_ENDPOINT: ${COCOON_S3_ENDPOINT:-}

     

       99
       99
       +
             COCOON_S3_ACCESS_KEY: ${COCOON_S3_ACCESS_KEY:-}

     

       100
       100
       +
             COCOON_S3_SECRET_KEY: ${COCOON_S3_SECRET_KEY:-}

     

       101
       101
       +
       

     

       102
       102
       +
             # Optional: Fallback proxy

     

       103
       103
       +
             COCOON_FALLBACK_PROXY: ${COCOON_FALLBACK_PROXY:-}

     

       104
       104
       +
           restart: unless-stopped

     

       105
       105
       +
           healthcheck:

     

       106
       106
       +
             test: ["CMD", "curl", "-f", "http://localhost:8080/xrpc/_health"]

     

       107
       107
       +
             interval: 30s

     

       108
       108
       +
             timeout: 10s

     

       109
       109
       +
             retries: 3

     

       110
       110
       +
             start_period: 40s

     

       111
       111
       +
       

     

       112
       112
       +
         create-invite:

     

       113
       113
       +
           build:

     

       114
       114
       +
             context: .

     

       115
       115
       +
             dockerfile: Dockerfile

     

       116
       116
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       117
       117
       +
           container_name: cocoon-create-invite

     

       118
       118
       +
           volumes:

     

       119
       119
       +
             - ./keys:/keys

     

       120
       120
       +
             - ./create-initial-invite.sh:/create-initial-invite.sh:ro

     

       121
       121
       +
           environment:

     

       122
       122
       +
             COCOON_DID: ${COCOON_DID}

     

       123
       123
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       124
       124
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       125
       125
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       126
       126
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       127
       127
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       128
       128
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       129
       129
       +
             COCOON_DB_TYPE: postgres

     

       130
       130
       +
             COCOON_DATABASE_URL: postgres://cocoon:${POSTGRES_PASSWORD}@postgres:5432/cocoon?sslmode=disable

     

       131
       131
       +
           depends_on:

     

       132
       132
       +
             cocoon:

     

       133
       133
       +
               condition: service_healthy

     

       134
       134
       +
           entrypoint: ["/bin/sh", "/create-initial-invite.sh"]

     

       135
       135
       +
           restart: "no"

     

       136
       136
       +
       

     

       137
       137
       +
         caddy:

     

       138
       138
       +
           image: caddy:2-alpine

     

       139
       139
       +
           container_name: cocoon-caddy

     

       140
       140
       +
           ports:

     

       141
       141
       +
             - "80:80"

     

       142
       142
       +
             - "443:443"

     

       143
       143
       +
           volumes:

     

       144
       144
       +
             - ./Caddyfile.postgres:/etc/caddy/Caddyfile:ro

     

       145
       145
       +
             - caddy_data:/data

     

       146
       146
       +
             - caddy_config:/config

     

       147
       147
       +
           restart: unless-stopped

     

       148
       148
       +
           environment:

     

       149
       149
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       150
       150
       +
             CADDY_ACME_EMAIL: ${COCOON_CONTACT_EMAIL:-}

     

       151
       151
       +
       

     

       152
       152
       +
       volumes:

     

       153
       153
       +
         postgres_data:

     

       154
       154
       +
           driver: local

     

       155
       155
       +
         caddy_data:

     

       156
       156
       +
           driver: local

     

       157
       157
       +
         caddy_config:

     

       158
       158
       +
           driver: local

+130

docker-compose.yaml

···

       1
       1
       +
       version: '3.8'

     

       2
       2
       +
       

     

       3
       3
       +
       services:

     

       4
       4
       +
         init-keys:

     

       5
       5
       +
           build:

     

       6
       6
       +
             context: .

     

       7
       7
       +
             dockerfile: Dockerfile

     

       8
       8
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       9
       9
       +
           container_name: cocoon-init-keys

     

       10
       10
       +
           volumes:

     

       11
       11
       +
             - ./keys:/keys

     

       12
       12
       +
             - ./data:/data/cocoon

     

       13
       13
       +
             - ./init-keys.sh:/init-keys.sh:ro

     

       14
       14
       +
           environment:

     

       15
       15
       +
             COCOON_DID: ${COCOON_DID}

     

       16
       16
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       17
       17
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       18
       18
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       19
       19
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       20
       20
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       21
       21
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       22
       22
       +
           entrypoint: ["/bin/sh", "/init-keys.sh"]

     

       23
       23
       +
           restart: "no"

     

       24
       24
       +
       

     

       25
       25
       +
         cocoon:

     

       26
       26
       +
           build:

     

       27
       27
       +
             context: .

     

       28
       28
       +
             dockerfile: Dockerfile

     

       29
       29
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       30
       30
       +
           container_name: cocoon-pds

     

       31
       31
       +
           network_mode: host

     

       32
       32
       +
           depends_on:

     

       33
       33
       +
             init-keys:

     

       34
       34
       +
               condition: service_completed_successfully

     

       35
       35
       +
           volumes:

     

       36
       36
       +
             - ./data:/data/cocoon

     

       37
       37
       +
             - ./keys/rotation.key:/keys/rotation.key:ro

     

       38
       38
       +
             - ./keys/jwk.key:/keys/jwk.key:ro

     

       39
       39
       +
           environment:

     

       40
       40
       +
             # Required settings

     

       41
       41
       +
             COCOON_DID: ${COCOON_DID}

     

       42
       42
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       43
       43
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       44
       44
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       45
       45
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       46
       46
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       47
       47
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       48
       48
       +
             COCOON_SESSION_SECRET: ${COCOON_SESSION_SECRET}

     

       49
       49
       +
       

     

       50
       50
       +
             # Server configuration

     

       51
       51
       +
             COCOON_ADDR: ":8080"

     

       52
       52
       +
             COCOON_DB_TYPE: ${COCOON_DB_TYPE:-sqlite}

     

       53
       53
       +
             COCOON_DB_NAME: ${COCOON_DB_NAME:-/data/cocoon/cocoon.db}

     

       54
       54
       +
             COCOON_DATABASE_URL: ${COCOON_DATABASE_URL:-}

     

       55
       55
       +
             COCOON_BLOCKSTORE_VARIANT: ${COCOON_BLOCKSTORE_VARIANT:-sqlite}

     

       56
       56
       +
       

     

       57
       57
       +
             # Optional: SMTP settings for email

     

       58
       58
       +
             COCOON_SMTP_USER: ${COCOON_SMTP_USER:-}

     

       59
       59
       +
             COCOON_SMTP_PASS: ${COCOON_SMTP_PASS:-}

     

       60
       60
       +
             COCOON_SMTP_HOST: ${COCOON_SMTP_HOST:-}

     

       61
       61
       +
             COCOON_SMTP_PORT: ${COCOON_SMTP_PORT:-}

     

       62
       62
       +
             COCOON_SMTP_EMAIL: ${COCOON_SMTP_EMAIL:-}

     

       63
       63
       +
             COCOON_SMTP_NAME: ${COCOON_SMTP_NAME:-}

     

       64
       64
       +
       

     

       65
       65
       +
             # Optional: S3 configuration

     

       66
       66
       +
             COCOON_S3_BACKUPS_ENABLED: ${COCOON_S3_BACKUPS_ENABLED:-false}

     

       67
       67
       +
             COCOON_S3_BLOBSTORE_ENABLED: ${COCOON_S3_BLOBSTORE_ENABLED:-false}

     

       68
       68
       +
             COCOON_S3_REGION: ${COCOON_S3_REGION:-}

     

       69
       69
       +
             COCOON_S3_BUCKET: ${COCOON_S3_BUCKET:-}

     

       70
       70
       +
             COCOON_S3_ENDPOINT: ${COCOON_S3_ENDPOINT:-}

     

       71
       71
       +
             COCOON_S3_ACCESS_KEY: ${COCOON_S3_ACCESS_KEY:-}

     

       72
       72
       +
             COCOON_S3_SECRET_KEY: ${COCOON_S3_SECRET_KEY:-}

     

       73
       73
       +
             COCOON_S3_CDN_URL: ${COCOON_S3_CDN_URL:-}

     

       74
       74
       +
       

     

       75
       75
       +
             # Optional: Fallback proxy

     

       76
       76
       +
             COCOON_FALLBACK_PROXY: ${COCOON_FALLBACK_PROXY:-}

     

       77
       77
       +
           restart: unless-stopped

     

       78
       78
       +
           healthcheck:

     

       79
       79
       +
             test: ["CMD", "curl", "-f", "http://localhost:8080/xrpc/_health"]

     

       80
       80
       +
             interval: 30s

     

       81
       81
       +
             timeout: 10s

     

       82
       82
       +
             retries: 3

     

       83
       83
       +
             start_period: 40s

     

       84
       84
       +
       

     

       85
       85
       +
         create-invite:

     

       86
       86
       +
           build:

     

       87
       87
       +
             context: .

     

       88
       88
       +
             dockerfile: Dockerfile

     

       89
       89
       +
           image: ghcr.io/haileyok/cocoon:latest

     

       90
       90
       +
           container_name: cocoon-create-invite

     

       91
       91
       +
           network_mode: host

     

       92
       92
       +
           volumes:

     

       93
       93
       +
             - ./keys:/keys

     

       94
       94
       +
             - ./create-initial-invite.sh:/create-initial-invite.sh:ro

     

       95
       95
       +
           environment:

     

       96
       96
       +
             COCOON_DID: ${COCOON_DID}

     

       97
       97
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       98
       98
       +
             COCOON_ROTATION_KEY_PATH: /keys/rotation.key

     

       99
       99
       +
             COCOON_JWK_PATH: /keys/jwk.key

     

       100
       100
       +
             COCOON_CONTACT_EMAIL: ${COCOON_CONTACT_EMAIL}

     

       101
       101
       +
             COCOON_RELAYS: ${COCOON_RELAYS:-https://bsky.network}

     

       102
       102
       +
             COCOON_ADMIN_PASSWORD: ${COCOON_ADMIN_PASSWORD}

     

       103
       103
       +
             COCOON_DB_TYPE: ${COCOON_DB_TYPE:-sqlite}

     

       104
       104
       +
             COCOON_DB_NAME: ${COCOON_DB_NAME:-/data/cocoon/cocoon.db}

     

       105
       105
       +
             COCOON_DATABASE_URL: ${COCOON_DATABASE_URL:-}

     

       106
       106
       +
           depends_on:

     

       107
       107
       +
             - init-keys

     

       108
       108
       +
           entrypoint: ["/bin/sh", "/create-initial-invite.sh"]

     

       109
       109
       +
           restart: "no"

     

       110
       110
       +
       

     

       111
       111
       +
         caddy:

     

       112
       112
       +
           image: caddy:2-alpine

     

       113
       113
       +
           container_name: cocoon-caddy

     

       114
       114
       +
           network_mode: host

     

       115
       115
       +
           volumes:

     

       116
       116
       +
             - ./Caddyfile:/etc/caddy/Caddyfile:ro

     

       117
       117
       +
             - caddy_data:/data

     

       118
       118
       +
             - caddy_config:/config

     

       119
       119
       +
           restart: unless-stopped

     

       120
       120
       +
           environment:

     

       121
       121
       +
             COCOON_HOSTNAME: ${COCOON_HOSTNAME}

     

       122
       122
       +
             CADDY_ACME_EMAIL: ${COCOON_CONTACT_EMAIL:-}

     

       123
       123
       +
       

     

       124
       124
       +
       volumes:

     

       125
       125
       +
         data:

     

       126
       126
       +
           driver: local

     

       127
       127
       +
         caddy_data:

     

       128
       128
       +
           driver: local

     

       129
       129
       +
         caddy_config:

     

       130
       130
       +
           driver: local

+3 -2

go.mod

···

       5
       5
        
       require (

     

       6
       6
        
       	github.com/Azure/go-autorest/autorest/to v0.4.1

     

       7
       7
        
       	github.com/aws/aws-sdk-go v1.55.7

     

       8
       8
       -
       	github.com/bluesky-social/indigo v0.0.0-20250414202759-826fcdeaa36b

     

       8
       8
       +
       	github.com/bluesky-social/indigo v0.0.0-20251009212240-20524de167fe

     

       9
       9
        
       	github.com/btcsuite/websocket v0.0.0-20150119174127-31079b680792

     

       10
       10
        
       	github.com/domodwyer/mailyak/v3 v3.6.2

     

       11
       11
        
       	github.com/go-pkgz/expirable-cache/v3 v3.0.0

     
···

       14
       14
        
       	github.com/google/uuid v1.4.0

     

       15
       15
        
       	github.com/gorilla/sessions v1.4.0

     

       16
       16
        
       	github.com/gorilla/websocket v1.5.1

     

       17
       17
       +
       	github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b

     

       17
       18
        
       	github.com/hashicorp/golang-lru/v2 v2.0.7

     

       18
       19
        
       	github.com/ipfs/go-block-format v0.2.0

     

       19
       20
        
       	github.com/ipfs/go-cid v0.4.1

     

       21
       21
       +
       	github.com/ipfs/go-ipfs-blockstore v1.3.1

     

       20
       22
        
       	github.com/ipfs/go-ipld-cbor v0.1.0

     

       21
       23
        
       	github.com/ipld/go-car v0.6.1-0.20230509095817-92d28eb23ba4

     

       22
       24
        
       	github.com/joho/godotenv v1.5.1

     
···

       59
       61
        
       	github.com/ipfs/bbloom v0.0.4 // indirect

     

       60
       62
        
       	github.com/ipfs/go-blockservice v0.5.2 // indirect

     

       61
       63
        
       	github.com/ipfs/go-datastore v0.6.0 // indirect

     

       62
       62
       -
       	github.com/ipfs/go-ipfs-blockstore v1.3.1 // indirect

     

       63
       64
        
       	github.com/ipfs/go-ipfs-ds-help v1.1.1 // indirect

     

       64
       65
        
       	github.com/ipfs/go-ipfs-exchange-interface v0.2.1 // indirect

     

       65
       66
        
       	github.com/ipfs/go-ipfs-util v0.0.3 // indirect

+4 -4

go.sum

···

       16
       16
        
       github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=

     

       17
       17
        
       github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932 h1:mXoPYz/Ul5HYEDvkta6I8/rnYM5gSdSV2tJ6XbZuEtY=

     

       18
       18
        
       github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=

     

       19
       19
       -
       github.com/bluesky-social/indigo v0.0.0-20250414202759-826fcdeaa36b h1:elwfbe+W7GkUmPKFX1h7HaeHvC/kC0XJWfiEHC62xPg=

     

       20
       20
       -
       github.com/bluesky-social/indigo v0.0.0-20250414202759-826fcdeaa36b/go.mod h1:yjdhLA1LkK8VDS/WPUoYPo25/Hq/8rX38Ftr67EsqKY=

     

       19
       19
       +
       github.com/bluesky-social/indigo v0.0.0-20251009212240-20524de167fe h1:VBhaqE5ewQgXbY5SfSWFZC/AwHFo7cHxZKFYi2ce9Yo=

     

       20
       20
       +
       github.com/bluesky-social/indigo v0.0.0-20251009212240-20524de167fe/go.mod h1:RuQVrCGm42QNsgumKaR6se+XkFKfCPNwdCiTvqKRUck=

     

       21
       21
        
       github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=

     

       22
       22
        
       github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=

     

       23
       23
        
       github.com/btcsuite/websocket v0.0.0-20150119174127-31079b680792 h1:R8vQdOQdZ9Y3SkEwmHoWBmX1DNXhXZqlTpq6s4tyJGc=

     
···

       91
       91
        
       github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=

     

       92
       92
        
       github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=

     

       93
       93
        
       github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=

     

       94
       94
       +
       github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b h1:wDUNC2eKiL35DbLvsDhiblTUXHxcOPwQSCzi7xpQUN4=

     

       95
       95
       +
       github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b/go.mod h1:VzxiSdG6j1pi7rwGm/xYI5RbtpBgM8sARDXlvEvxlu0=

     

       94
       96
        
       github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=

     

       95
       97
        
       github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=

     

       96
       98
        
       github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=

     
···

       111
       113
        
       github.com/ipfs/go-block-format v0.2.0/go.mod h1:+jpL11nFx5A/SPpsoBn6Bzkra/zaArfSmsknbPMYgzM=

     

       112
       114
        
       github.com/ipfs/go-blockservice v0.5.2 h1:in9Bc+QcXwd1apOVM7Un9t8tixPKdaHQFdLSUM1Xgk8=

     

       113
       115
        
       github.com/ipfs/go-blockservice v0.5.2/go.mod h1:VpMblFEqG67A/H2sHKAemeH9vlURVavlysbdUI632yk=

     

       114
       114
       -
       github.com/ipfs/go-bs-sqlite3 v0.0.0-20221122195556-bfcee1be620d h1:9V+GGXCuOfDiFpdAHz58q9mKLg447xp0cQKvqQrAwYE=

     

       115
       115
       -
       github.com/ipfs/go-bs-sqlite3 v0.0.0-20221122195556-bfcee1be620d/go.mod h1:pMbnFyNAGjryYCLCe59YDLRv/ujdN+zGJBT1umlvYRM=

     

       116
       116
        
       github.com/ipfs/go-cid v0.4.1 h1:A/T3qGvxi4kpKWWcPC/PgbvDA2bjVLO7n4UeVwnbs/s=

     

       117
       117
        
       github.com/ipfs/go-cid v0.4.1/go.mod h1:uQHwDeX4c6CtyrFwdqyhpNcxVewur1M7l7fNU7LKwZk=

     

       118
       118
        
       github.com/ipfs/go-datastore v0.6.0 h1:JKyz+Gvz1QEZw0LsX1IBn+JFCJQH4SJVFtM4uWU0Myk=

+74 -55

identity/identity.go

···

       13
       13
        
       	"github.com/bluesky-social/indigo/util"

     

       14
       14
        
       )

     

       15
       15
        
       

     

       16
       16
       -
       func ResolveHandle(ctx context.Context, cli *http.Client, handle string) (string, error) {

     

       17
       17
       -
       	if cli == nil {

     

       18
       18
       -
       		cli = util.RobustHTTPClient()

     

       16
       16
       +
       func ResolveHandleFromTXT(ctx context.Context, handle string) (string, error) {

     

       17
       17
       +
       	name := fmt.Sprintf("_atproto.%s", handle)

     

       18
       18
       +
       	recs, err := net.LookupTXT(name)

     

       19
       19
       +
       	if err != nil {

     

       20
       20
       +
       		return "", fmt.Errorf("handle could not be resolved via txt: %w", err)

     

       21
       21
       +
       	}

     

       22
       22
       +
       

     

       23
       23
       +
       	for _, rec := range recs {

     

       24
       24
       +
       		if strings.HasPrefix(rec, "did=") {

     

       25
       25
       +
       			maybeDid := strings.Split(rec, "did=")[1]

     

       26
       26
       +
       			if _, err := syntax.ParseDID(maybeDid); err == nil {

     

       27
       27
       +
       				return maybeDid, nil

     

       28
       28
       +
       			}

     

       29
       29
       +
       		}

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	return "", fmt.Errorf("handle could not be resolved via txt: no record found")

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       func ResolveHandleFromWellKnown(ctx context.Context, cli *http.Client, handle string) (string, error) {

     

       36
       36
       +
       	ustr := fmt.Sprintf("https://%s/.well-known/atproto-did", handle)

     

       37
       37
       +
       	req, err := http.NewRequestWithContext(

     

       38
       38
       +
       		ctx,

     

       39
       39
       +
       		"GET",

     

       40
       40
       +
       		ustr,

     

       41
       41
       +
       		nil,

     

       42
       42
       +
       	)

     

       43
       43
       +
       	if err != nil {

     

       44
       44
       +
       		return "", fmt.Errorf("handle could not be resolved via web: %w", err)

     

       19
       45
        
       	}

     

       20
       46
        
       

     

       21
       21
       -
       	var did string

     

       47
       47
       +
       	resp, err := cli.Do(req)

     

       48
       48
       +
       	if err != nil {

     

       49
       49
       +
       		return "", fmt.Errorf("handle could not be resolved via web: %w", err)

     

       50
       50
       +
       	}

     

       51
       51
       +
       	defer resp.Body.Close()

     

       22
       52
        
       

     

       23
       23
       -
       	_, err := syntax.ParseHandle(handle)

     

       53
       53
       +
       	b, err := io.ReadAll(resp.Body)

     

       24
       54
        
       	if err != nil {

     

       25
       25
       -
       		return "", err

     

       55
       55
       +
       		return "", fmt.Errorf("handle could not be resolved via web: %w", err)

     

       26
       56
        
       	}

     

       27
       57
        
       

     

       28
       28
       -
       	recs, err := net.LookupTXT(fmt.Sprintf("_atproto.%s", handle))

     

       29
       29
       -
       	if err == nil {

     

       30
       30
       -
       		for _, rec := range recs {

     

       31
       31
       -
       			if strings.HasPrefix(rec, "did=") {

     

       32
       32
       -
       				did = strings.Split(rec, "did=")[1]

     

       33
       33
       -
       				break

     

       34
       34
       -
       			}

     

       35
       35
       -
       		}

     

       36
       36
       -
       	} else {

     

       37
       37
       -
       		fmt.Printf("erorr getting txt records: %v\n", err)

     

       58
       58
       +
       	if resp.StatusCode != http.StatusOK {

     

       59
       59
       +
       		return "", fmt.Errorf("handle could not be resolved via web: invalid status code %d", resp.StatusCode)

     

       38
       60
        
       	}

     

       39
       61
        
       

     

       40
       40
       -
       	if did == "" {

     

       41
       41
       -
       		req, err := http.NewRequestWithContext(

     

       42
       42
       -
       			ctx,

     

       43
       43
       -
       			"GET",

     

       44
       44
       -
       			fmt.Sprintf("https://%s/.well-known/atproto-did", handle),

     

       45
       45
       -
       			nil,

     

       46
       46
       -
       		)

     

       47
       47
       -
       		if err != nil {

     

       48
       48
       -
       			return "", nil

     

       49
       49
       -
       		}

     

       62
       62
       +
       	maybeDid := string(b)

     

       50
       63
        
       

     

       51
       51
       -
       		resp, err := http.DefaultClient.Do(req)

     

       52
       52
       -
       		if err != nil {

     

       53
       53
       -
       			return "", nil

     

       54
       54
       -
       		}

     

       55
       55
       -
       		defer resp.Body.Close()

     

       64
       64
       +
       	if _, err := syntax.ParseDID(maybeDid); err != nil {

     

       65
       65
       +
       		return "", fmt.Errorf("handle could not be resolved via web: invalid did in document")

     

       66
       66
       +
       	}

     

       56
       67
        
       

     

       57
       57
       -
       		if resp.StatusCode != http.StatusOK {

     

       58
       58
       -
       			io.Copy(io.Discard, resp.Body)

     

       59
       59
       -
       			return "", fmt.Errorf("unable to resolve handle")

     

       60
       60
       -
       		}

     

       68
       68
       +
       	return maybeDid, nil

     

       69
       69
       +
       }

     

       61
       70
        
       

     

       62
       62
       -
       		b, err := io.ReadAll(resp.Body)

     

       63
       63
       -
       		if err != nil {

     

       64
       64
       -
       			return "", err

     

       65
       65
       -
       		}

     

       71
       71
       +
       func ResolveHandle(ctx context.Context, cli *http.Client, handle string) (string, error) {

     

       72
       72
       +
       	if cli == nil {

     

       73
       73
       +
       		cli = util.RobustHTTPClient()

     

       74
       74
       +
       	}

     

       66
       75
        
       

     

       67
       67
       -
       		maybeDid := string(b)

     

       76
       76
       +
       	_, err := syntax.ParseHandle(handle)

     

       77
       77
       +
       	if err != nil {

     

       78
       78
       +
       		return "", err

     

       79
       79
       +
       	}

     

       68
       80
        
       

     

       69
       69
       -
       		if _, err := syntax.ParseDID(maybeDid); err != nil {

     

       70
       70
       -
       			return "", fmt.Errorf("unable to resolve handle")

     

       71
       71
       -
       		}

     

       81
       81
       +
       	if maybeDidFromTxt, err := ResolveHandleFromTXT(ctx, handle); err == nil {

     

       82
       82
       +
       		return maybeDidFromTxt, nil

     

       83
       83
       +
       	}

     

       72
       84
        
       

     

       73
       73
       -
       		did = maybeDid

     

       85
       85
       +
       	if maybeDidFromWeb, err := ResolveHandleFromWellKnown(ctx, cli, handle); err == nil {

     

       86
       86
       +
       		return maybeDidFromWeb, nil

     

       74
       87
        
       	}

     

       75
       88
        
       

     

       76
       76
       -
       	return did, nil

     

       89
       89
       +
       	return "", fmt.Errorf("handle could not be resolved")

     

       90
       90
       +
       }

     

       91
       91
       +
       

     

       92
       92
       +
       func DidToDocUrl(did string) (string, error) {

     

       93
       93
       +
       	if strings.HasPrefix(did, "did:plc:") {

     

       94
       94
       +
       		return fmt.Sprintf("https://plc.directory/%s", did), nil

     

       95
       95
       +
       	} else if after, ok := strings.CutPrefix(did, "did:web:"); ok {

     

       96
       96
       +
       		return fmt.Sprintf("https://%s/.well-known/did.json", after), nil

     

       97
       97
       +
       	} else {

     

       98
       98
       +
       		return "", fmt.Errorf("did was not a supported did type")

     

       99
       99
       +
       	}

     

       77
       100
        
       }

     

       78
       101
        
       

     

       79
       102
        
       func FetchDidDoc(ctx context.Context, cli *http.Client, did string) (*DidDoc, error) {

     
···

       81
       104
        
       		cli = util.RobustHTTPClient()

     

       82
       105
        
       	}

     

       83
       106
        
       

     

       84
       84
       -
       	var ustr string

     

       85
       85
       -
       	if strings.HasPrefix(did, "did:plc:") {

     

       86
       86
       -
       		ustr = fmt.Sprintf("https://plc.directory/%s", did)

     

       87
       87
       -
       	} else if strings.HasPrefix(did, "did:web:") {

     

       88
       88
       -
       		ustr = fmt.Sprintf("https://%s/.well-known/did.json", strings.TrimPrefix(did, "did:web:"))

     

       89
       89
       -
       	} else {

     

       90
       90
       -
       		return nil, fmt.Errorf("did was not a supported did type")

     

       107
       107
       +
       	ustr, err := DidToDocUrl(did)

     

       108
       108
       +
       	if err != nil {

     

       109
       109
       +
       		return nil, err

     

       91
       110
        
       	}

     

       92
       111
        
       

     

       93
       112
        
       	req, err := http.NewRequestWithContext(ctx, "GET", ustr, nil)

     
···

       95
       114
        
       		return nil, err

     

       96
       115
        
       	}

     

       97
       116
        
       

     

       98
       98
       -
       	resp, err := http.DefaultClient.Do(req)

     

       117
       117
       +
       	resp, err := cli.Do(req)

     

       99
       118
        
       	if err != nil {

     

       100
       119
        
       		return nil, err

     

       101
       120
        
       	}

     
···

       103
       122
        
       

     

       104
       123
        
       	if resp.StatusCode != 200 {

     

       105
       124
        
       		io.Copy(io.Discard, resp.Body)

     

       106
       106
       -
       		return nil, fmt.Errorf("could not find identity in plc registry")

     

       125
       125
       +
       		return nil, fmt.Errorf("unable to find did doc at url. did: %s. url: %s", did, ustr)

     

       107
       126
        
       	}

     

       108
       127
        
       

     

       109
       128
        
       	var diddoc DidDoc

     
···

       127
       146
        
       		return nil, err

     

       128
       147
        
       	}

     

       129
       148
        
       

     

       130
       130
       -
       	resp, err := http.DefaultClient.Do(req)

     

       149
       149
       +
       	resp, err := cli.Do(req)

     

       131
       150
        
       	if err != nil {

     

       132
       151
        
       		return nil, err

     

       133
       152
        
       	}

+15 -5

identity/passport.go

···

       19
       19
        
       type Passport struct {

     

       20
       20
        
       	h  *http.Client

     

       21
       21
        
       	bc BackingCache

     

       22
       22
       -
       	lk sync.Mutex

     

       22
       22
       +
       	mu sync.RWMutex

     

       23
       23
        
       }

     

       24
       24
        
       

     

       25
       25
        
       func NewPassport(h *http.Client, bc BackingCache) *Passport {

     
···

       30
       30
        
       	return &Passport{

     

       31
       31
        
       		h:  h,

     

       32
       32
        
       		bc: bc,

     

       33
       33
       -
       		lk: sync.Mutex{},

     

       34
       33
        
       	}

     

       35
       34
        
       }

     

       36
       35
        
       

     
···

       38
       37
        
       	skipCache, _ := ctx.Value("skip-cache").(bool)

     

       39
       38
        
       

     

       40
       39
        
       	if !skipCache {

     

       40
       40
       +
       		p.mu.RLock()

     

       41
       41
        
       		cached, ok := p.bc.GetDoc(did)

     

       42
       42
       +
       		p.mu.RUnlock()

     

       43
       43
       +
       

     

       42
       44
        
       		if ok {

     

       43
       45
        
       			return cached, nil

     

       44
       46
        
       		}

     

       45
       47
        
       	}

     

       46
       48
        
       

     

       47
       47
       -
       	p.lk.Lock() // this is pretty pathetic, and i should rethink this. but for now, fuck it

     

       48
       48
       -
       	defer p.lk.Unlock()

     

       49
       49
       -
       

     

       50
       49
        
       	doc, err := FetchDidDoc(ctx, p.h, did)

     

       51
       50
        
       	if err != nil {

     

       52
       51
        
       		return nil, err

     

       53
       52
        
       	}

     

       54
       53
        
       

     

       54
       54
       +
       	p.mu.Lock()

     

       55
       55
        
       	p.bc.PutDoc(did, doc)

     

       56
       56
       +
       	p.mu.Unlock()

     

       56
       57
        
       

     

       57
       58
        
       	return doc, nil

     

       58
       59
        
       }

     
···

       61
       62
        
       	skipCache, _ := ctx.Value("skip-cache").(bool)

     

       62
       63
        
       

     

       63
       64
        
       	if !skipCache {

     

       65
       65
       +
       		p.mu.RLock()

     

       64
       66
        
       		cached, ok := p.bc.GetDid(handle)

     

       67
       67
       +
       		p.mu.RUnlock()

     

       68
       68
       +
       

     

       65
       69
        
       		if ok {

     

       66
       70
        
       			return cached, nil

     

       67
       71
        
       		}

     
···

       72
       76
        
       		return "", err

     

       73
       77
        
       	}

     

       74
       78
        
       

     

       79
       79
       +
       	p.mu.Lock()

     

       75
       80
        
       	p.bc.PutDid(handle, did)

     

       81
       81
       +
       	p.mu.Unlock()

     

       76
       82
        
       

     

       77
       83
        
       	return did, nil

     

       78
       84
        
       }

     

       79
       85
        
       

     

       80
       86
        
       func (p *Passport) BustDoc(ctx context.Context, did string) error {

     

       87
       87
       +
       	p.mu.Lock()

     

       88
       88
       +
       	defer p.mu.Unlock()

     

       81
       89
        
       	return p.bc.BustDoc(did)

     

       82
       90
        
       }

     

       83
       91
        
       

     

       84
       92
        
       func (p *Passport) BustDid(ctx context.Context, handle string) error {

     

       93
       93
       +
       	p.mu.Lock()

     

       94
       94
       +
       	defer p.mu.Unlock()

     

       85
       95
        
       	return p.bc.BustDid(handle)

     

       86
       96
        
       }

+1 -1

identity/types.go

···

       4
       4
        
       	Context             []string                   `json:"@context"`

     

       5
       5
        
       	Id                  string                     `json:"id"`

     

       6
       6
        
       	AlsoKnownAs         []string                   `json:"alsoKnownAs"`

     

       7
       7
       -
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethods"`

     

       7
       7
       +
       	VerificationMethods []DidDocVerificationMethod `json:"verificationMethod"`

     

       8
       8
        
       	Service             []DidDocService            `json:"service"`

     

       9
       9
        
       }

     

       10
       10

+34

init-keys.sh

···

       1
       1
       +
       #!/bin/sh

     

       2
       2
       +
       set -e

     

       3
       3
       +
       

     

       4
       4
       +
       mkdir -p /keys

     

       5
       5
       +
       mkdir -p /data/cocoon

     

       6
       6
       +
       

     

       7
       7
       +
       if [ ! -f /keys/rotation.key ]; then

     

       8
       8
       +
           echo "Generating rotation key..."

     

       9
       9
       +
           /cocoon create-rotation-key --out /keys/rotation.key 2>/dev/null || true

     

       10
       10
       +
           if [ -f /keys/rotation.key ]; then

     

       11
       11
       +
               echo "✓ Rotation key generated at /keys/rotation.key"

     

       12
       12
       +
           else

     

       13
       13
       +
               echo "✗ Failed to generate rotation key"

     

       14
       14
       +
               exit 1

     

       15
       15
       +
           fi

     

       16
       16
       +
       else

     

       17
       17
       +
           echo "✓ Rotation key already exists"

     

       18
       18
       +
       fi

     

       19
       19
       +
       

     

       20
       20
       +
       if [ ! -f /keys/jwk.key ]; then

     

       21
       21
       +
           echo "Generating JWK..."

     

       22
       22
       +
           /cocoon create-private-jwk --out /keys/jwk.key 2>/dev/null || true

     

       23
       23
       +
           if [ -f /keys/jwk.key ]; then

     

       24
       24
       +
               echo "✓ JWK generated at /keys/jwk.key"

     

       25
       25
       +
           else

     

       26
       26
       +
               echo "✗ Failed to generate JWK"

     

       27
       27
       +
               exit 1

     

       28
       28
       +
           fi

     

       29
       29
       +
       else

     

       30
       30
       +
           echo "✓ JWK already exists"

     

       31
       31
       +
       fi

     

       32
       32
       +
       

     

       33
       33
       +
       echo ""

     

       34
       34
       +
       echo "✓ Key initialization complete!"

internal/db/db.go

···

       25
       25
        
       	return db.cli.Clauses(clauses...).Create(value)

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
       +
       func (db *DB) Save(value any, clauses []clause.Expression) *gorm.DB {

     

       29
       29
       +
       	db.mu.Lock()

     

       30
       30
       +
       	defer db.mu.Unlock()

     

       31
       31
       +
       	return db.cli.Clauses(clauses...).Save(value)

     

       32
       32
       +
       }

     

       33
       33
       +
       

     

       28
       34
        
       func (db *DB) Exec(sql string, clauses []clause.Expression, values ...any) *gorm.DB {

     

       29
       35
        
       	db.mu.Lock()

     

       30
       36
        
       	defer db.mu.Unlock()

+29

internal/helpers/helpers.go

···

       7
       7
        
       	"math/rand"

     

       8
       8
        
       	"net/url"

     

       9
       9
        
       

     

       10
       10
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       10
       11
        
       	"github.com/labstack/echo/v4"

     

       11
       12
        
       	"github.com/lestrrat-go/jwx/v2/jwk"

     

       12
       13
        
       )

     
···

       29
       30
        
       		msg += ". " + *suffix

     

       30
       31
        
       	}

     

       31
       32
        
       	return genericError(e, 400, msg)

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       func UnauthorizedError(e echo.Context, suffix *string) error {

     

       36
       36
       +
       	msg := "Unauthorized"

     

       37
       37
       +
       	if suffix != nil {

     

       38
       38
       +
       		msg += ". " + *suffix

     

       39
       39
       +
       	}

     

       40
       40
       +
       	return genericError(e, 401, msg)

     

       41
       41
       +
       }

     

       42
       42
       +
       

     

       43
       43
       +
       func ForbiddenError(e echo.Context, suffix *string) error {

     

       44
       44
       +
       	msg := "Forbidden"

     

       45
       45
       +
       	if suffix != nil {

     

       46
       46
       +
       		msg += ". " + *suffix

     

       47
       47
       +
       	}

     

       48
       48
       +
       	return genericError(e, 403, msg)

     

       49
       49
       +
       }

     

       50
       50
       +
       

     

       51
       51
       +
       func InvalidTokenError(e echo.Context) error {

     

       52
       52
       +
       	return InputError(e, to.StringPtr("InvalidToken"))

     

       53
       53
       +
       }

     

       54
       54
       +
       

     

       55
       55
       +
       func ExpiredTokenError(e echo.Context) error {

     

       56
       56
       +
       	// WARN: See https://github.com/bluesky-social/atproto/discussions/3319

     

       57
       57
       +
       	return e.JSON(400, map[string]string{

     

       58
       58
       +
       		"error":   "ExpiredToken",

     

       59
       59
       +
       		"message": "*",

     

       60
       60
       +
       	})

     

       32
       61
        
       }

     

       33
       62
        
       

     

       34
       63
        
       func genericError(e echo.Context, code int, msg string) error {

+28 -2

models/models.go

···

       4
       4
        
       	"context"

     

       5
       5
        
       	"time"

     

       6
       6
        
       

     

       7
       7
       -
       	"github.com/bluesky-social/indigo/atproto/crypto"

     

       7
       7
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       8
       9
        
       )

     

       9
       10
        
       

     

       10
       11
        
       type Repo struct {

     
···

       18
       19
        
       	EmailUpdateCodeExpiresAt       *time.Time

     

       19
       20
        
       	PasswordResetCode              *string

     

       20
       21
        
       	PasswordResetCodeExpiresAt     *time.Time

     

       22
       22
       +
       	PlcOperationCode               *string

     

       23
       23
       +
       	PlcOperationCodeExpiresAt      *time.Time

     

       24
       24
       +
       	AccountDeleteCode              *string

     

       25
       25
       +
       	AccountDeleteCodeExpiresAt     *time.Time

     

       21
       26
        
       	Password                       string

     

       22
       27
        
       	SigningKey                     []byte

     

       23
       28
        
       	Rev                            string

     

       24
       29
        
       	Root                           []byte

     

       25
       30
        
       	Preferences                    []byte

     

       31
       31
       +
       	Deactivated                    bool

     

       26
       32
        
       }

     

       27
       33
        
       

     

       28
       34
        
       func (r *Repo) SignFor(ctx context.Context, did string, msg []byte) ([]byte, error) {

     

       29
       29
       -
       	k, err := crypto.ParsePrivateBytesK256(r.SigningKey)

     

       35
       35
       +
       	k, err := atcrypto.ParsePrivateBytesK256(r.SigningKey)

     

       30
       36
        
       	if err != nil {

     

       31
       37
        
       		return nil, err

     

       32
       38
        
       	}

     
···

       39
       45
        
       	return sig, nil

     

       40
       46
        
       }

     

       41
       47
        
       

     

       48
       48
       +
       func (r *Repo) Status() *string {

     

       49
       49
       +
       	var status *string

     

       50
       50
       +
       	if r.Deactivated {

     

       51
       51
       +
       		status = to.StringPtr("deactivated")

     

       52
       52
       +
       	}

     

       53
       53
       +
       	return status

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       func (r *Repo) Active() bool {

     

       57
       57
       +
       	return r.Status() == nil

     

       58
       58
       +
       }

     

       59
       59
       +
       

     

       42
       60
        
       type Actor struct {

     

       43
       61
        
       	Did    string `gorm:"primaryKey"`

     

       44
       62
        
       	Handle string `gorm:"uniqueIndex"`

     
···

       92
       110
        
       	Did       string `gorm:"index;index:idx_blob_did_cid"`

     

       93
       111
        
       	Cid       []byte `gorm:"index;index:idx_blob_did_cid"`

     

       94
       112
        
       	RefCount  int

     

       113
       113
       +
       	Storage   string `gorm:"default:sqlite"`

     

       95
       114
        
       }

     

       96
       115
        
       

     

       97
       116
        
       type BlobPart struct {

     
···

       100
       119
        
       	Idx    int  `gorm:"primaryKey"`

     

       101
       120
        
       	Data   []byte

     

       102
       121
        
       }

     

       122
       122
       +
       

     

       123
       123
       +
       type ReservedKey struct {

     

       124
       124
       +
       	KeyDid    string `gorm:"primaryKey"`

     

       125
       125
       +
       	Did       *string `gorm:"index"`

     

       126
       126
       +
       	PrivateKey []byte

     

       127
       127
       +
       	CreatedAt  time.Time `gorm:"index"`

     

       128
       128
       +
       }

+48 -24

oauth/client/manager.go

···

       22
       22
        
       	cli           *http.Client

     

       23
       23
        
       	logger        *slog.Logger

     

       24
       24
        
       	jwksCache     cache.Cache[string, jwk.Key]

     

       25
       25
       -
       	metadataCache cache.Cache[string, Metadata]

     

       25
       25
       +
       	metadataCache cache.Cache[string, *Metadata]

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
        
       type ManagerArgs struct {

     
···

       40
       40
        
       	}

     

       41
       41
        
       

     

       42
       42
        
       	jwksCache := cache.NewCache[string, jwk.Key]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       43
       43
       -
       	metadataCache := cache.NewCache[string, Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       43
       43
       +
       	metadataCache := cache.NewCache[string, *Metadata]().WithLRU().WithMaxKeys(500).WithTTL(5 * time.Minute)

     

       44
       44
        
       

     

       45
       45
        
       	return &Manager{

     

       46
       46
        
       		cli:           args.Cli,

     
···

       57
       57
        
       	}

     

       58
       58
        
       

     

       59
       59
        
       	var jwks jwk.Key

     

       60
       60
       -
       	if metadata.JWKS != nil {

     

       61
       61
       -
       		// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to

     

       62
       62
       -
       		// make sure we use the right one

     

       63
       63
       -
       		k, err := helpers.ParseJWKFromBytes((*metadata.JWKS)[0])

     

       64
       64
       -
       		if err != nil {

     

       65
       65
       -
       			return nil, err

     

       66
       66
       -
       		}

     

       67
       67
       -
       		jwks = k

     

       68
       68
       -
       	} else if metadata.JWKSURI != nil {

     

       69
       69
       -
       		maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)

     

       70
       70
       -
       		if err != nil {

     

       71
       71
       -
       			return nil, err

     

       72
       72
       -
       		}

     

       60
       60
       +
       	if metadata.TokenEndpointAuthMethod == "private_key_jwt" {

     

       61
       61
       +
       		if metadata.JWKS != nil && len(metadata.JWKS.Keys) > 0 {

     

       62
       62
       +
       			// TODO: this is kinda bad but whatever for now. there could obviously be more than one jwk, and we need to

     

       63
       63
       +
       			// make sure we use the right one

     

       64
       64
       +
       			b, err := json.Marshal(metadata.JWKS.Keys[0])

     

       65
       65
       +
       			if err != nil {

     

       66
       66
       +
       				return nil, err

     

       67
       67
       +
       			}

     

       73
       68
        
       

     

       74
       74
       -
       		jwks = maybeJwks

     

       69
       69
       +
       			k, err := helpers.ParseJWKFromBytes(b)

     

       70
       70
       +
       			if err != nil {

     

       71
       71
       +
       				return nil, err

     

       72
       72
       +
       			}

     

       73
       73
       +
       

     

       74
       74
       +
       			jwks = k

     

       75
       75
       +
       		} else if metadata.JWKS != nil {

     

       76
       76
       +
       		} else if metadata.JWKSURI != nil {

     

       77
       77
       +
       			maybeJwks, err := cm.getClientJwks(ctx, clientId, *metadata.JWKSURI)

     

       78
       78
       +
       			if err != nil {

     

       79
       79
       +
       				return nil, err

     

       80
       80
       +
       			}

     

       81
       81
       +
       

     

       82
       82
       +
       			jwks = maybeJwks

     

       83
       83
       +
       		} else {

     

       84
       84
       +
       			return nil, fmt.Errorf("no valid jwks found in oauth client metadata")

     

       85
       85
       +
       		}

     

       75
       86
        
       	}

     

       76
       87
        
       

     

       77
       88
        
       	return &Client{

     
···

       81
       92
        
       }

     

       82
       93
        
       

     

       83
       94
        
       func (cm *Manager) getClientMetadata(ctx context.Context, clientId string) (*Metadata, error) {

     

       84
       84
       -
       	metadataCached, ok := cm.metadataCache.Get(clientId)

     

       95
       95
       +
       	cached, ok := cm.metadataCache.Get(clientId)

     

       85
       96
        
       	if !ok {

     

       86
       97
        
       		req, err := http.NewRequestWithContext(ctx, "GET", clientId, nil)

     

       87
       98
        
       		if err != nil {

     
···

       109
       120
        
       			return nil, err

     

       110
       121
        
       		}

     

       111
       122
        
       

     

       123
       123
       +
       		cm.metadataCache.Set(clientId, validated, 10*time.Minute)

     

       124
       124
       +
       

     

       112
       125
        
       		return validated, nil

     

       113
       126
        
       	} else {

     

       114
       114
       -
       		return &metadataCached, nil

     

       127
       127
       +
       		return cached, nil

     

       115
       128
        
       	}

     

       116
       129
        
       }

     

       117
       130
        
       

     
···

       196
       209
        
       		return nil, fmt.Errorf("error unmarshaling metadata: %w", err)

     

       197
       210
        
       	}

     

       198
       211
        
       

     

       212
       212
       +
       	if metadata.ClientURI == "" {

     

       213
       213
       +
       		u, err := url.Parse(metadata.ClientID)

     

       214
       214
       +
       		if err != nil {

     

       215
       215
       +
       			return nil, fmt.Errorf("unable to parse client id: %w", err)

     

       216
       216
       +
       		}

     

       217
       217
       +
       		u.RawPath = ""

     

       218
       218
       +
       		u.RawQuery = ""

     

       219
       219
       +
       		metadata.ClientURI = u.String()

     

       220
       220
       +
       	}

     

       221
       221
       +
       

     

       199
       222
        
       	u, err := url.Parse(metadata.ClientURI)

     

       200
       223
        
       	if err != nil {

     

       201
       224
        
       		return nil, fmt.Errorf("unable to parse client uri: %w", err)

     

       225
       225
       +
       	}

     

       226
       226
       +
       

     

       227
       227
       +
       	if metadata.ClientName == "" {

     

       228
       228
       +
       		metadata.ClientName = metadata.ClientURI

     

       202
       229
        
       	}

     

       203
       230
        
       

     

       204
       231
        
       	if isLocalHostname(u.Hostname()) {

     

       205
       205
       -
       		return nil, errors.New("`client_uri` hostname is invalid")

     

       232
       232
       +
       		return nil, fmt.Errorf("`client_uri` hostname is invalid: %s", u.Hostname())

     

       206
       233
        
       	}

     

       207
       234
        
       

     

       208
       235
        
       	if metadata.Scope == "" {

     
···

       262
       289
        
       			return nil, errors.New("private_key_jwt auth method requires jwks or jwks_uri")

     

       263
       290
        
       		}

     

       264
       291
        
       

     

       265
       265
       -
       		if metadata.JWKS != nil && len(*metadata.JWKS) == 0 {

     

       292
       292
       +
       		if metadata.JWKS != nil && len(metadata.JWKS.Keys) == 0 {

     

       266
       293
        
       			return nil, errors.New("private_key_jwt auth method requires atleast one key in jwks")

     

       267
       294
        
       		}

     

       268
       295
        
       

     
···

       289
       316
        
       		return nil, errors.New("at least one `redirect_uri` is required")

     

       290
       317
        
       	}

     

       291
       318
        
       

     

       292
       292
       -
       	if metadata.ApplicationType == "native" && metadata.TokenEndpointAuthMethod == "none" {

     

       319
       319
       +
       	if metadata.ApplicationType == "native" && metadata.TokenEndpointAuthMethod != "none" {

     

       293
       320
        
       		return nil, errors.New("native clients must authenticate using `none` method")

     

       294
       321
        
       	}

     

       295
       322
        
       

     
···

       341
       368
        
       			if u.Scheme != "http" {

     

       342
       369
        
       				return nil, fmt.Errorf("loopback redirect uri %s must use http", ruri)

     

       343
       370
        
       			}

     

       344
       344
       -
       

     

       345
       345
       -
       			break

     

       346
       371
        
       		case u.Scheme == "http":

     

       347
       372
        
       			return nil, errors.New("only loopbvack redirect uris are allowed to use the `http` scheme")

     

       348
       373
        
       		case u.Scheme == "https":

     

       349
       374
        
       			if isLocalHostname(u.Hostname()) {

     

       350
       375
        
       				return nil, fmt.Errorf("redirect uri %s's domain must not be a local hostname", ruri)

     

       351
       376
        
       			}

     

       352
       352
       -
       			break

     

       353
       377
        
       		case strings.Contains(u.Scheme, "."):

     

       354
       378
        
       			if metadata.ApplicationType != "native" {

     

       355
       379
        
       				return nil, errors.New("private-use uri scheme redirect uris are only allowed for native apps")

+20 -16

oauth/client/metadata.go

···

       1
       1
        
       package client

     

       2
       2
        
       

     

       3
       3
        
       type Metadata struct {

     

       4
       4
       -
       	ClientID                    string    `json:"client_id"`

     

       5
       5
       -
       	ClientName                  string    `json:"client_name"`

     

       6
       6
       -
       	ClientURI                   string    `json:"client_uri"`

     

       7
       7
       -
       	LogoURI                     string    `json:"logo_uri"`

     

       8
       8
       -
       	TOSURI                      string    `json:"tos_uri"`

     

       9
       9
       -
       	PolicyURI                   string    `json:"policy_uri"`

     

       10
       10
       -
       	RedirectURIs                []string  `json:"redirect_uris"`

     

       11
       11
       -
       	GrantTypes                  []string  `json:"grant_types"`

     

       12
       12
       -
       	ResponseTypes               []string  `json:"response_types"`

     

       13
       13
       -
       	ApplicationType             string    `json:"application_type"`

     

       14
       14
       -
       	DpopBoundAccessTokens       bool      `json:"dpop_bound_access_tokens"`

     

       15
       15
       -
       	JWKSURI                     *string   `json:"jwks_uri,omitempty"`

     

       16
       16
       -
       	JWKS                        *[][]byte `json:"jwks,omitempty"`

     

       17
       17
       -
       	Scope                       string    `json:"scope"`

     

       18
       18
       -
       	TokenEndpointAuthMethod     string    `json:"token_endpoint_auth_method"`

     

       19
       19
       -
       	TokenEndpointAuthSigningAlg string    `json:"token_endpoint_auth_signing_alg"`

     

       4
       4
       +
       	ClientID                    string        `json:"client_id"`

     

       5
       5
       +
       	ClientName                  string        `json:"client_name"`

     

       6
       6
       +
       	ClientURI                   string        `json:"client_uri"`

     

       7
       7
       +
       	LogoURI                     string        `json:"logo_uri"`

     

       8
       8
       +
       	TOSURI                      string        `json:"tos_uri"`

     

       9
       9
       +
       	PolicyURI                   string        `json:"policy_uri"`

     

       10
       10
       +
       	RedirectURIs                []string      `json:"redirect_uris"`

     

       11
       11
       +
       	GrantTypes                  []string      `json:"grant_types"`

     

       12
       12
       +
       	ResponseTypes               []string      `json:"response_types"`

     

       13
       13
       +
       	ApplicationType             string        `json:"application_type"`

     

       14
       14
       +
       	DpopBoundAccessTokens       bool          `json:"dpop_bound_access_tokens"`

     

       15
       15
       +
       	JWKSURI                     *string       `json:"jwks_uri,omitempty"`

     

       16
       16
       +
       	JWKS                        *MetadataJwks `json:"jwks,omitempty"`

     

       17
       17
       +
       	Scope                       string        `json:"scope"`

     

       18
       18
       +
       	TokenEndpointAuthMethod     string        `json:"token_endpoint_auth_method"`

     

       19
       19
       +
       	TokenEndpointAuthSigningAlg string        `json:"token_endpoint_auth_signing_alg"`

     

       20
       20
       +
       }

     

       21
       21
       +
       

     

       22
       22
       +
       type MetadataJwks struct {

     

       23
       23
       +
       	Keys []any `json:"keys"`

     

       20
       24
        
       }

+6 -2

oauth/dpop/manager.go

···

       36
       36
        
       	Hostname              string

     

       37
       37
        
       }

     

       38
       38
        
       

     

       39
       39
       +
       var (

     

       40
       40
       +
       	ErrUseDpopNonce = errors.New("use_dpop_nonce")

     

       41
       41
       +
       )

     

       42
       42
       +
       

     

       39
       43
        
       func NewManager(args ManagerArgs) *Manager {

     

       40
       44
        
       	if args.Logger == nil {

     

       41
       45
        
       		args.Logger = slog.Default()

     
···

       194
       198
        
       	nonce, _ := claims["nonce"].(string)

     

       195
       199
        
       	if nonce == "" {

     

       196
       200
        
       		// WARN: this _must_ be `use_dpop_nonce` for clients know they should make another request

     

       197
       197
       -
       		return nil, errors.New("use_dpop_nonce")

     

       201
       201
       +
       		return nil, ErrUseDpopNonce

     

       198
       202
        
       	}

     

       199
       203
        
       

     

       200
       204
        
       	if nonce != "" && !dm.nonce.Check(nonce) {

     

       201
       205
        
       		// WARN: this _must_ be `use_dpop_nonce` so that clients will fetch a new nonce

     

       202
       202
       -
       		return nil, errors.New("use_dpop_nonce")

     

       206
       206
       +
       		return nil, ErrUseDpopNonce

     

       203
       207
        
       	}

     

       204
       208
        
       

     

       205
       209
        
       	ath, _ := claims["ath"].(string)

+3 -2

oauth/dpop/nonce.go

···

       102
       102
        
       }

     

       103
       103
        
       

     

       104
       104
        
       func (n *Nonce) Check(nonce string) bool {

     

       105
       105
       -
       	n.mu.RLock()

     

       106
       106
       -
       	defer n.mu.RUnlock()

     

       105
       105
       +
       	n.mu.Lock()

     

       106
       106
       +
       	defer n.mu.Unlock()

     

       107
       107
       +
       	n.rotate()

     

       107
       108
        
       	return nonce == n.prev || nonce == n.curr || nonce == n.next

     

       108
       109
        
       }

+32

oauth/helpers.go

···

       4
       4
        
       	"errors"

     

       5
       5
        
       	"fmt"

     

       6
       6
        
       	"net/url"

     

       7
       7
       +
       	"time"

     

       7
       8
        
       

     

       8
       9
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       9
       10
        
       	"github.com/haileyok/cocoon/oauth/constants"

     

       11
       11
       +
       	"github.com/haileyok/cocoon/oauth/provider"

     

       10
       12
        
       )

     

       11
       13
        
       

     

       12
       14
        
       func GenerateCode() string {

     
···

       46
       48
        
       

     

       47
       49
        
       	return reqId, nil

     

       48
       50
        
       }

     

       51
       51
       +
       

     

       52
       52
       +
       type SessionAgeResult struct {

     

       53
       53
       +
       	SessionAge     time.Duration

     

       54
       54
       +
       	RefreshAge     time.Duration

     

       55
       55
       +
       	SessionExpired bool

     

       56
       56
       +
       	RefreshExpired bool

     

       57
       57
       +
       }

     

       58
       58
       +
       

     

       59
       59
       +
       func GetSessionAgeFromToken(t provider.OauthToken) SessionAgeResult {

     

       60
       60
       +
       	sessionLifetime := constants.PublicClientSessionLifetime

     

       61
       61
       +
       	refreshLifetime := constants.PublicClientRefreshLifetime

     

       62
       62
       +
       	if t.ClientAuth.Method != "none" {

     

       63
       63
       +
       		sessionLifetime = constants.ConfidentialClientSessionLifetime

     

       64
       64
       +
       		refreshLifetime = constants.ConfidentialClientRefreshLifetime

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	res := SessionAgeResult{}

     

       68
       68
       +
       

     

       69
       69
       +
       	res.SessionAge = time.Since(t.CreatedAt)

     

       70
       70
       +
       	if res.SessionAge > sessionLifetime {

     

       71
       71
       +
       		res.SessionExpired = true

     

       72
       72
       +
       	}

     

       73
       73
       +
       

     

       74
       74
       +
       	refreshAge := time.Since(t.UpdatedAt)

     

       75
       75
       +
       	if refreshAge > refreshLifetime {

     

       76
       76
       +
       		res.RefreshExpired = true

     

       77
       77
       +
       	}

     

       78
       78
       +
       

     

       79
       79
       +
       	return res

     

       80
       80
       +
       }

oauth/provider/models.go

···

       65
       65
        
       	Code         string `gorm:"index"`

     

       66
       66
        
       	Token        string `gorm:"uniqueIndex"`

     

       67
       67
        
       	RefreshToken string `gorm:"uniqueIndex"`

     

       68
       68
       +
       	Ip           string

     

       68
       69
        
       }

     

       69
       70
        
       

     

       70
       71
        
       type OauthAuthorizationRequest struct {

     
···

       78
       79
        
       	Sub        *string

     

       79
       80
        
       	Code       *string

     

       80
       81
        
       	Accepted   *bool

     

       82
       82
       +
       	Ip         string

     

       81
       83
        
       }

+36 -20

plc/client.go

···

       13
       13
        
       	"net/url"

     

       14
       14
        
       	"strings"

     

       15
       15
        
       

     

       16
       16
       -
       	"github.com/bluesky-social/indigo/atproto/crypto"

     

       16
       16
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       17
       17
        
       	"github.com/bluesky-social/indigo/util"

     

       18
       18
        
       	"github.com/haileyok/cocoon/identity"

     

       19
       19
        
       )

     
···

       22
       22
        
       	h           *http.Client

     

       23
       23
        
       	service     string

     

       24
       24
        
       	pdsHostname string

     

       25
       25
       -
       	rotationKey *crypto.PrivateKeyK256

     

       25
       25
       +
       	rotationKey *atcrypto.PrivateKeyK256

     

       26
       26
        
       }

     

       27
       27
        
       

     

       28
       28
        
       type ClientArgs struct {

     
···

       41
       41
        
       		args.H = util.RobustHTTPClient()

     

       42
       42
        
       	}

     

       43
       43
        
       

     

       44
       44
       -
       	rk, err := crypto.ParsePrivateBytesK256([]byte(args.RotationKey))

     

       44
       44
       +
       	rk, err := atcrypto.ParsePrivateBytesK256([]byte(args.RotationKey))

     

       45
       45
        
       	if err != nil {

     

       46
       46
        
       		return nil, err

     

       47
       47
        
       	}

     
···

       54
       54
        
       	}, nil

     

       55
       55
        
       }

     

       56
       56
        
       

     

       57
       57
       -
       func (c *Client) CreateDID(sigkey *crypto.PrivateKeyK256, recovery string, handle string) (string, *Operation, error) {

     

       58
       58
       -
       	pubsigkey, err := sigkey.PublicKey()

     

       57
       57
       +
       func (c *Client) CreateDID(sigkey *atcrypto.PrivateKeyK256, recovery string, handle string) (string, *Operation, error) {

     

       58
       58
       +
       	creds, err := c.CreateDidCredentials(sigkey, recovery, handle)

     

       59
       59
        
       	if err != nil {

     

       60
       60
        
       		return "", nil, err

     

       61
       61
        
       	}

     

       62
       62
        
       

     

       63
       63
       -
       	pubrotkey, err := c.rotationKey.PublicKey()

     

       63
       63
       +
       	op := Operation{

     

       64
       64
       +
       		Type: "plc_operation",

     

       65
       65
       +
       		VerificationMethods: creds.VerificationMethods,

     

       66
       66
       +
       		RotationKeys: creds.RotationKeys,

     

       67
       67
       +
       		AlsoKnownAs: creds.AlsoKnownAs,

     

       68
       68
       +
       		Services: creds.Services,

     

       69
       69
       +
       		Prev: nil,

     

       70
       70
       +
       	}

     

       71
       71
       +
       

     

       72
       72
       +
       	if err := c.SignOp(sigkey, &op); err != nil {

     

       73
       73
       +
       		return "", nil, err

     

       74
       74
       +
       	}

     

       75
       75
       +
       

     

       76
       76
       +
       	did, err := DidFromOp(&op)

     

       64
       77
        
       	if err != nil {

     

       65
       78
        
       		return "", nil, err

     

       66
       79
        
       	}

     

       67
       80
        
       

     

       81
       81
       +
       	return did, &op, nil

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       func (c *Client) CreateDidCredentials(sigkey *atcrypto.PrivateKeyK256, recovery string, handle string) (*DidCredentials, error) {

     

       85
       85
       +
       	pubsigkey, err := sigkey.PublicKey()

     

       86
       86
       +
       	if err != nil {

     

       87
       87
       +
       		return nil, err

     

       88
       88
       +
       	}

     

       89
       89
       +
       

     

       90
       90
       +
       	pubrotkey, err := c.rotationKey.PublicKey()

     

       91
       91
       +
       	if err != nil {

     

       92
       92
       +
       		return nil, err

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       68
       95
        
       	// todo

     

       69
       96
        
       	rotationKeys := []string{pubrotkey.DIDKey()}

     

       70
       97
        
       	if recovery != "" {

     
···

       77
       104
        
       		}(recovery)

     

       78
       105
        
       	}

     

       79
       106
        
       

     

       80
       80
       -
       	op := Operation{

     

       81
       81
       -
       		Type: "plc_operation",

     

       107
       107
       +
       	creds := DidCredentials{

     

       82
       108
        
       		VerificationMethods: map[string]string{

     

       83
       109
        
       			"atproto": pubsigkey.DIDKey(),

     

       84
       110
        
       		},

     
···

       92
       118
        
       				Endpoint: "https://" + c.pdsHostname,

     

       93
       119
        
       			},

     

       94
       120
        
       		},

     

       95
       95
       -
       		Prev: nil,

     

       96
       121
        
       	}

     

       97
       122
        
       

     

       98
       98
       -
       	if err := c.SignOp(sigkey, &op); err != nil {

     

       99
       99
       -
       		return "", nil, err

     

       100
       100
       -
       	}

     

       101
       101
       -
       

     

       102
       102
       -
       	did, err := DidFromOp(&op)

     

       103
       103
       -
       	if err != nil {

     

       104
       104
       -
       		return "", nil, err

     

       105
       105
       -
       	}

     

       106
       106
       -
       

     

       107
       107
       -
       	return did, &op, nil

     

       123
       123
       +
       	return &creds, nil

     

       108
       124
        
       }

     

       109
       125
        
       

     

       110
       110
       -
       func (c *Client) SignOp(sigkey *crypto.PrivateKeyK256, op *Operation) error {

     

       126
       126
       +
       func (c *Client) SignOp(sigkey *atcrypto.PrivateKeyK256, op *Operation) error {

     

       111
       127
        
       	b, err := op.MarshalCBOR()

     

       112
       128
        
       	if err != nil {

     

       113
       129
        
       		return err

+10 -2

plc/types.go

···

       3
       3
        
       import (

     

       4
       4
        
       	"encoding/json"

     

       5
       5
        
       

     

       6
       6
       -
       	"github.com/bluesky-social/indigo/atproto/data"

     

       6
       6
       +
       	"github.com/bluesky-social/indigo/atproto/atdata"

     

       7
       7
        
       	"github.com/haileyok/cocoon/identity"

     

       8
       8
        
       	cbg "github.com/whyrusleeping/cbor-gen"

     

       9
       9
        
       )

     

       10
       10
       +
       

     

       11
       11
       +
       

     

       12
       12
       +
       type DidCredentials struct {

     

       13
       13
       +
       	VerificationMethods map[string]string                    `json:"verificationMethods"`

     

       14
       14
       +
       	RotationKeys        []string                             `json:"rotationKeys"`

     

       15
       15
       +
       	AlsoKnownAs         []string                             `json:"alsoKnownAs"`

     

       16
       16
       +
       	Services            map[string]identity.OperationService `json:"services"`

     

       17
       17
       +
       }

     

       10
       18
        
       

     

       11
       19
        
       type Operation struct {

     

       12
       20
        
       	Type                string                               `json:"type"`

     
···

       38
       46
        
       		return nil, err

     

       39
       47
        
       	}

     

       40
       48
        
       

     

       41
       41
       -
       	b, err = data.MarshalCBOR(m)

     

       49
       49
       +
       	b, err = atdata.MarshalCBOR(m)

     

       42
       50
        
       	if err != nil {

     

       43
       51
        
       		return nil, err

     

       44
       52
        
       	}

+85

recording_blockstore/recording_blockstore.go

···

       1
       1
       +
       package recording_blockstore

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       

     

       7
       7
       +
       	blockformat "github.com/ipfs/go-block-format"

     

       8
       8
       +
       	"github.com/ipfs/go-cid"

     

       9
       9
       +
       	blockstore "github.com/ipfs/go-ipfs-blockstore"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       type RecordingBlockstore struct {

     

       13
       13
       +
       	base blockstore.Blockstore

     

       14
       14
       +
       

     

       15
       15
       +
       	inserts map[cid.Cid]blockformat.Block

     

       16
       16
       +
       	reads   map[cid.Cid]blockformat.Block

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       func New(base blockstore.Blockstore) *RecordingBlockstore {

     

       20
       20
       +
       	return &RecordingBlockstore{

     

       21
       21
       +
       		base:    base,

     

       22
       22
       +
       		inserts: make(map[cid.Cid]blockformat.Block),

     

       23
       23
       +
       		reads:   make(map[cid.Cid]blockformat.Block),

     

       24
       24
       +
       	}

     

       25
       25
       +
       }

     

       26
       26
       +
       

     

       27
       27
       +
       func (bs *RecordingBlockstore) Has(ctx context.Context, c cid.Cid) (bool, error) {

     

       28
       28
       +
       	return bs.base.Has(ctx, c)

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       func (bs *RecordingBlockstore) Get(ctx context.Context, c cid.Cid) (blockformat.Block, error) {

     

       32
       32
       +
       	b, err := bs.base.Get(ctx, c)

     

       33
       33
       +
       	if err != nil {

     

       34
       34
       +
       		return nil, err

     

       35
       35
       +
       	}

     

       36
       36
       +
       	bs.reads[c] = b

     

       37
       37
       +
       	return b, nil

     

       38
       38
       +
       }

     

       39
       39
       +
       

     

       40
       40
       +
       func (bs *RecordingBlockstore) GetSize(ctx context.Context, c cid.Cid) (int, error) {

     

       41
       41
       +
       	return bs.base.GetSize(ctx, c)

     

       42
       42
       +
       }

     

       43
       43
       +
       

     

       44
       44
       +
       func (bs *RecordingBlockstore) DeleteBlock(ctx context.Context, c cid.Cid) error {

     

       45
       45
       +
       	return bs.base.DeleteBlock(ctx, c)

     

       46
       46
       +
       }

     

       47
       47
       +
       

     

       48
       48
       +
       func (bs *RecordingBlockstore) Put(ctx context.Context, block blockformat.Block) error {

     

       49
       49
       +
       	if err := bs.base.Put(ctx, block); err != nil {

     

       50
       50
       +
       		return err

     

       51
       51
       +
       	}

     

       52
       52
       +
       	bs.inserts[block.Cid()] = block

     

       53
       53
       +
       	return nil

     

       54
       54
       +
       }

     

       55
       55
       +
       

     

       56
       56
       +
       func (bs *RecordingBlockstore) PutMany(ctx context.Context, blocks []blockformat.Block) error {

     

       57
       57
       +
       	if err := bs.base.PutMany(ctx, blocks); err != nil {

     

       58
       58
       +
       		return err

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	for _, b := range blocks {

     

       62
       62
       +
       		bs.inserts[b.Cid()] = b

     

       63
       63
       +
       	}

     

       64
       64
       +
       

     

       65
       65
       +
       	return nil

     

       66
       66
       +
       }

     

       67
       67
       +
       

     

       68
       68
       +
       func (bs *RecordingBlockstore) AllKeysChan(ctx context.Context) (<-chan cid.Cid, error) {

     

       69
       69
       +
       	return nil, fmt.Errorf("iteration not allowed on recording blockstore")

     

       70
       70
       +
       }

     

       71
       71
       +
       

     

       72
       72
       +
       func (bs *RecordingBlockstore) HashOnRead(enabled bool) {

     

       73
       73
       +
       }

     

       74
       74
       +
       

     

       75
       75
       +
       func (bs *RecordingBlockstore) GetWriteLog() map[cid.Cid]blockformat.Block {

     

       76
       76
       +
       	return bs.inserts

     

       77
       77
       +
       }

     

       78
       78
       +
       

     

       79
       79
       +
       func (bs *RecordingBlockstore) GetReadLog() []blockformat.Block {

     

       80
       80
       +
       	var blocks []blockformat.Block

     

       81
       81
       +
       	for _, b := range bs.reads {

     

       82
       82
       +
       		blocks = append(blocks, b)

     

       83
       83
       +
       	}

     

       84
       84
       +
       	return blocks

     

       85
       85
       +
       }

+30

server/blockstore_variant.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"github.com/haileyok/cocoon/sqlite_blockstore"

     

       5
       5
       +
       	blockstore "github.com/ipfs/go-ipfs-blockstore"

     

       6
       6
       +
       )

     

       7
       7
       +
       

     

       8
       8
       +
       type BlockstoreVariant int

     

       9
       9
       +
       

     

       10
       10
       +
       const (

     

       11
       11
       +
       	BlockstoreVariantSqlite = iota

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       func MustReturnBlockstoreVariant(maybeBsv string) BlockstoreVariant {

     

       15
       15
       +
       	switch maybeBsv {

     

       16
       16
       +
       	case "sqlite":

     

       17
       17
       +
       		return BlockstoreVariantSqlite

     

       18
       18
       +
       	default:

     

       19
       19
       +
       		panic("invalid blockstore variant provided")

     

       20
       20
       +
       	}

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func (s *Server) getBlockstore(did string) blockstore.Blockstore {

     

       24
       24
       +
       	switch s.config.BlockstoreVariant {

     

       25
       25
       +
       	case BlockstoreVariantSqlite:

     

       26
       26
       +
       		return sqlite_blockstore.New(did, s.db)

     

       27
       27
       +
       	default:

     

       28
       28
       +
       		return sqlite_blockstore.New(did, s.db)

     

       29
       29
       +
       	}

     

       30
       30
       +
       }

+37 -7

server/handle_account.go

···

       3
       3
        
       import (

     

       4
       4
        
       	"time"

     

       5
       5
        
       

     

       6
       6
       +
       	"github.com/haileyok/cocoon/oauth"

     

       7
       7
       +
       	"github.com/haileyok/cocoon/oauth/constants"

     

       6
       8
        
       	"github.com/haileyok/cocoon/oauth/provider"

     

       9
       9
       +
       	"github.com/hako/durafmt"

     

       7
       10
        
       	"github.com/labstack/echo/v4"

     

       8
       11
        
       )

     

       9
       12
        
       

     

       10
       13
        
       func (s *Server) handleAccount(e echo.Context) error {

     

       14
       14
       +
       	ctx := e.Request().Context()

     

       11
       15
        
       	repo, sess, err := s.getSessionRepoOrErr(e)

     

       12
       16
        
       	if err != nil {

     

       13
       17
        
       		return e.Redirect(303, "/account/signin")

     

       14
       18
        
       	}

     

       15
       19
        
       

     

       16
       16
       -
       	now := time.Now()

     

       20
       20
       +
       	oldestPossibleSession := time.Now().Add(constants.ConfidentialClientSessionLifetime)

     

       17
       21
        
       

     

       18
       22
        
       	var tokens []provider.OauthToken

     

       19
       19
       -
       	if err := s.db.Raw("SELECT * FROM oauth_tokens WHERE sub = ? AND expires_at >= ? ORDER BY created_at ASC", nil, repo.Repo.Did, now).Scan(&tokens).Error; err != nil {

     

       23
       23
       +
       	if err := s.db.Raw("SELECT * FROM oauth_tokens WHERE sub = ? AND created_at < ? ORDER BY created_at ASC", nil, repo.Repo.Did, oldestPossibleSession).Scan(&tokens).Error; err != nil {

     

       20
       24
        
       		s.logger.Error("couldnt fetch oauth sessions for account", "did", repo.Repo.Did, "error", err)

     

       21
       25
        
       		sess.AddFlash("Unable to fetch sessions. See server logs for more details.", "error")

     

       22
       26
        
       		sess.Save(e.Request(), e.Response())

     
···

       25
       29
        
       		})

     

       26
       30
        
       	}

     

       27
       31
        
       

     

       32
       32
       +
       	var filtered []provider.OauthToken

     

       33
       33
       +
       	for _, t := range tokens {

     

       34
       34
       +
       		ageRes := oauth.GetSessionAgeFromToken(t)

     

       35
       35
       +
       		if ageRes.SessionExpired {

     

       36
       36
       +
       			continue

     

       37
       37
       +
       		}

     

       38
       38
       +
       		filtered = append(filtered, t)

     

       39
       39
       +
       	}

     

       40
       40
       +
       

     

       41
       41
       +
       	now := time.Now()

     

       42
       42
       +
       

     

       28
       43
        
       	tokenInfo := []map[string]string{}

     

       29
       44
        
       	for _, t := range tokens {

     

       45
       45
       +
       		ageRes := oauth.GetSessionAgeFromToken(t)

     

       46
       46
       +
       		maxTime := constants.PublicClientSessionLifetime

     

       47
       47
       +
       		if t.ClientAuth.Method != "none" {

     

       48
       48
       +
       			maxTime = constants.ConfidentialClientSessionLifetime

     

       49
       49
       +
       		}

     

       50
       50
       +
       

     

       51
       51
       +
       		var clientName string

     

       52
       52
       +
       		metadata, err := s.oauthProvider.ClientManager.GetClient(ctx, t.ClientId)

     

       53
       53
       +
       		if err != nil {

     

       54
       54
       +
       			clientName = t.ClientId

     

       55
       55
       +
       		} else {

     

       56
       56
       +
       			clientName = metadata.Metadata.ClientName

     

       57
       57
       +
       		}

     

       58
       58
       +
       

     

       30
       59
        
       		tokenInfo = append(tokenInfo, map[string]string{

     

       31
       31
       -
       			"ClientId":  t.ClientId,

     

       32
       32
       -
       			"CreatedAt": t.CreatedAt.Format("02 Jan 06 15:04 MST"),

     

       33
       33
       -
       			"UpdatedAt": t.CreatedAt.Format("02 Jan 06 15:04 MST"),

     

       34
       34
       -
       			"ExpiresAt": t.CreatedAt.Format("02 Jan 06 15:04 MST"),

     

       35
       35
       -
       			"Token":     t.Token,

     

       60
       60
       +
       			"ClientName":  clientName,

     

       61
       61
       +
       			"Age":         durafmt.Parse(ageRes.SessionAge).LimitFirstN(2).String(),

     

       62
       62
       +
       			"LastUpdated": durafmt.Parse(now.Sub(t.UpdatedAt)).LimitFirstN(2).String(),

     

       63
       63
       +
       			"ExpiresIn":   durafmt.Parse(now.Add(maxTime).Sub(now)).LimitFirstN(2).String(),

     

       64
       64
       +
       			"Token":       t.Token,

     

       65
       65
       +
       			"Ip":          t.Ip,

     

       36
       66
        
       		})

     

       37
       67
        
       	}

     

       38
       68

+1 -1

server/handle_actor_get_preferences.go

···

       16
       16
        
       	err := json.Unmarshal(repo.Preferences, &prefs)

     

       17
       17
        
       	if err != nil || prefs["preferences"] == nil {

     

       18
       18
        
       		prefs = map[string]any{

     

       19
       19
       -
       			"preferences": map[string]any{},

     

       19
       19
       +
       			"preferences": []any{},

     

       20
       20
        
       		}

     

       21
       21
        
       	}

     

       22
       22

+24

server/handle_identity_get_recommended_did_credentials.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       5
       5
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       6
       6
       +
       	"github.com/haileyok/cocoon/models"

     

       7
       7
       +
       	"github.com/labstack/echo/v4"

     

       8
       8
       +
       )

     

       9
       9
       +
       

     

       10
       10
       +
       func (s *Server) handleGetRecommendedDidCredentials(e echo.Context) error {

     

       11
       11
       +
       	repo := e.Get("repo").(*models.RepoActor)

     

       12
       12
       +
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       13
       13
       +
       	if err != nil {

     

       14
       14
       +
       		s.logger.Error("error parsing key", "error", err)

     

       15
       15
       +
       		return helpers.ServerError(e, nil)

     

       16
       16
       +
       	}

     

       17
       17
       +
       	creds, err := s.plcClient.CreateDidCredentials(k, "", repo.Actor.Handle)

     

       18
       18
       +
       	if err != nil {

     

       19
       19
       +
       		s.logger.Error("error crating did credentials", "error", err)

     

       20
       20
       +
       		return helpers.ServerError(e, nil)

     

       21
       21
       +
       	}

     

       22
       22
       +
       

     

       23
       23
       +
       	return e.JSON(200, creds)

     

       24
       24
       +
       }

+29

server/handle_identity_request_plc_operation.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       8
       +
       	"github.com/haileyok/cocoon/models"

     

       9
       9
       +
       	"github.com/labstack/echo/v4"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       func (s *Server) handleIdentityRequestPlcOperationSignature(e echo.Context) error {

     

       13
       13
       +
       	urepo := e.Get("repo").(*models.RepoActor)

     

       14
       14
       +
       

     

       15
       15
       +
       	code := fmt.Sprintf("%s-%s", helpers.RandomVarchar(5), helpers.RandomVarchar(5))

     

       16
       16
       +
       	eat := time.Now().Add(10 * time.Minute).UTC()

     

       17
       17
       +
       

     

       18
       18
       +
       	if err := s.db.Exec("UPDATE repos SET plc_operation_code = ?, plc_operation_code_expires_at = ? WHERE did = ?", nil, code, eat, urepo.Repo.Did).Error; err != nil {

     

       19
       19
       +
       		s.logger.Error("error updating user", "error", err)

     

       20
       20
       +
       		return helpers.ServerError(e, nil)

     

       21
       21
       +
       	}

     

       22
       22
       +
       

     

       23
       23
       +
       	if err := s.sendPlcTokenReset(urepo.Email, urepo.Handle, code); err != nil {

     

       24
       24
       +
       		s.logger.Error("error sending mail", "error", err)

     

       25
       25
       +
       		return helpers.ServerError(e, nil)

     

       26
       26
       +
       	}

     

       27
       27
       +
       

     

       28
       28
       +
       	return e.NoContent(200)

     

       29
       29
       +
       }

+103

server/handle_identity_sign_plc_operation.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"strings"

     

       6
       6
       +
       	"time"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       10
       10
       +
       	"github.com/haileyok/cocoon/identity"

     

       11
       11
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       12
       12
       +
       	"github.com/haileyok/cocoon/models"

     

       13
       13
       +
       	"github.com/haileyok/cocoon/plc"

     

       14
       14
       +
       	"github.com/labstack/echo/v4"

     

       15
       15
       +
       )

     

       16
       16
       +
       

     

       17
       17
       +
       type ComAtprotoSignPlcOperationRequest struct {

     

       18
       18
       +
       	Token               string                                `json:"token"`

     

       19
       19
       +
       	VerificationMethods *map[string]string                    `json:"verificationMethods"`

     

       20
       20
       +
       	RotationKeys        *[]string                             `json:"rotationKeys"`

     

       21
       21
       +
       	AlsoKnownAs         *[]string                             `json:"alsoKnownAs"`

     

       22
       22
       +
       	Services            *map[string]identity.OperationService `json:"services"`

     

       23
       23
       +
       }

     

       24
       24
       +
       

     

       25
       25
       +
       type ComAtprotoSignPlcOperationResponse struct {

     

       26
       26
       +
       	Operation plc.Operation `json:"operation"`

     

       27
       27
       +
       }

     

       28
       28
       +
       

     

       29
       29
       +
       func (s *Server) handleSignPlcOperation(e echo.Context) error {

     

       30
       30
       +
       	repo := e.Get("repo").(*models.RepoActor)

     

       31
       31
       +
       

     

       32
       32
       +
       	var req ComAtprotoSignPlcOperationRequest

     

       33
       33
       +
       	if err := e.Bind(&req); err != nil {

     

       34
       34
       +
       		s.logger.Error("error binding", "error", err)

     

       35
       35
       +
       		return helpers.ServerError(e, nil)

     

       36
       36
       +
       	}

     

       37
       37
       +
       

     

       38
       38
       +
       	if !strings.HasPrefix(repo.Repo.Did, "did:plc:") {

     

       39
       39
       +
       		return helpers.InputError(e, nil)

     

       40
       40
       +
       	}

     

       41
       41
       +
       

     

       42
       42
       +
       	if repo.PlcOperationCode == nil || repo.PlcOperationCodeExpiresAt == nil {

     

       43
       43
       +
       		return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       44
       44
       +
       	}

     

       45
       45
       +
       

     

       46
       46
       +
       	if *repo.PlcOperationCode != req.Token {

     

       47
       47
       +
       		return helpers.InvalidTokenError(e)

     

       48
       48
       +
       	}

     

       49
       49
       +
       

     

       50
       50
       +
       	if time.Now().UTC().After(*repo.PlcOperationCodeExpiresAt) {

     

       51
       51
       +
       		return helpers.ExpiredTokenError(e)

     

       52
       52
       +
       	}

     

       53
       53
       +
       

     

       54
       54
       +
       	ctx := context.WithValue(e.Request().Context(), "skip-cache", true)

     

       55
       55
       +
       	log, err := identity.FetchDidAuditLog(ctx, nil, repo.Repo.Did)

     

       56
       56
       +
       	if err != nil {

     

       57
       57
       +
       		s.logger.Error("error fetching doc", "error", err)

     

       58
       58
       +
       		return helpers.ServerError(e, nil)

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	latest := log[len(log)-1]

     

       62
       62
       +
       

     

       63
       63
       +
       	op := plc.Operation{

     

       64
       64
       +
       		Type:                "plc_operation",

     

       65
       65
       +
       		VerificationMethods: latest.Operation.VerificationMethods,

     

       66
       66
       +
       		RotationKeys:        latest.Operation.RotationKeys,

     

       67
       67
       +
       		AlsoKnownAs:         latest.Operation.AlsoKnownAs,

     

       68
       68
       +
       		Services:            latest.Operation.Services,

     

       69
       69
       +
       		Prev:                &latest.Cid,

     

       70
       70
       +
       	}

     

       71
       71
       +
       	if req.VerificationMethods != nil {

     

       72
       72
       +
       		op.VerificationMethods = *req.VerificationMethods

     

       73
       73
       +
       	}

     

       74
       74
       +
       	if req.RotationKeys != nil {

     

       75
       75
       +
       		op.RotationKeys = *req.RotationKeys

     

       76
       76
       +
       	}

     

       77
       77
       +
       	if req.AlsoKnownAs != nil {

     

       78
       78
       +
       		op.AlsoKnownAs = *req.AlsoKnownAs

     

       79
       79
       +
       	}

     

       80
       80
       +
       	if req.Services != nil {

     

       81
       81
       +
       		op.Services = *req.Services

     

       82
       82
       +
       	}

     

       83
       83
       +
       

     

       84
       84
       +
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       85
       85
       +
       	if err != nil {

     

       86
       86
       +
       		s.logger.Error("error parsing signing key", "error", err)

     

       87
       87
       +
       		return helpers.ServerError(e, nil)

     

       88
       88
       +
       	}

     

       89
       89
       +
       

     

       90
       90
       +
       	if err := s.plcClient.SignOp(k, &op); err != nil {

     

       91
       91
       +
       		s.logger.Error("error signing plc operation", "error", err)

     

       92
       92
       +
       		return helpers.ServerError(e, nil)

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	if err := s.db.Exec("UPDATE repos SET plc_operation_code = NULL, plc_operation_code_expires_at = NULL WHERE did = ?", nil, repo.Repo.Did).Error; err != nil {

     

       96
       96
       +
       		s.logger.Error("error updating repo", "error", err)

     

       97
       97
       +
       		return helpers.ServerError(e, nil)

     

       98
       98
       +
       	}

     

       99
       99
       +
       

     

       100
       100
       +
       	return e.JSON(200, ComAtprotoSignPlcOperationResponse{

     

       101
       101
       +
       		Operation: op,

     

       102
       102
       +
       	})

     

       103
       103
       +
       }

+87

server/handle_identity_submit_plc_operation.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"slices"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       	"time"

     

       8
       8
       +
       

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       11
       11
       +
       	"github.com/bluesky-social/indigo/events"

     

       12
       12
       +
       	"github.com/bluesky-social/indigo/util"

     

       13
       13
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       14
       14
       +
       	"github.com/haileyok/cocoon/models"

     

       15
       15
       +
       	"github.com/haileyok/cocoon/plc"

     

       16
       16
       +
       	"github.com/labstack/echo/v4"

     

       17
       17
       +
       )

     

       18
       18
       +
       

     

       19
       19
       +
       type ComAtprotoSubmitPlcOperationRequest struct {

     

       20
       20
       +
       	Operation plc.Operation `json:"operation"`

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func (s *Server) handleSubmitPlcOperation(e echo.Context) error {

     

       24
       24
       +
       	repo := e.Get("repo").(*models.RepoActor)

     

       25
       25
       +
       

     

       26
       26
       +
       	var req ComAtprotoSubmitPlcOperationRequest

     

       27
       27
       +
       	if err := e.Bind(&req); err != nil {

     

       28
       28
       +
       		s.logger.Error("error binding", "error", err)

     

       29
       29
       +
       		return helpers.ServerError(e, nil)

     

       30
       30
       +
       	}

     

       31
       31
       +
       

     

       32
       32
       +
       	if err := e.Validate(req); err != nil {

     

       33
       33
       +
       		return helpers.InputError(e, nil)

     

       34
       34
       +
       	}

     

       35
       35
       +
       	if !strings.HasPrefix(repo.Repo.Did, "did:plc:") {

     

       36
       36
       +
       		return helpers.InputError(e, nil)

     

       37
       37
       +
       	}

     

       38
       38
       +
       

     

       39
       39
       +
       	op := req.Operation

     

       40
       40
       +
       

     

       41
       41
       +
       	k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       42
       42
       +
       	if err != nil {

     

       43
       43
       +
       		s.logger.Error("error parsing key", "error", err)

     

       44
       44
       +
       		return helpers.ServerError(e, nil)

     

       45
       45
       +
       	}

     

       46
       46
       +
       	required, err := s.plcClient.CreateDidCredentials(k, "", repo.Actor.Handle)

     

       47
       47
       +
       	if err != nil {

     

       48
       48
       +
       		s.logger.Error("error crating did credentials", "error", err)

     

       49
       49
       +
       		return helpers.ServerError(e, nil)

     

       50
       50
       +
       	}

     

       51
       51
       +
       

     

       52
       52
       +
       	for _, expectedKey := range required.RotationKeys {

     

       53
       53
       +
       		if !slices.Contains(op.RotationKeys, expectedKey) {

     

       54
       54
       +
       			return helpers.InputError(e, nil)

     

       55
       55
       +
       		}

     

       56
       56
       +
       	}

     

       57
       57
       +
       	if op.Services["atproto_pds"].Type != "AtprotoPersonalDataServer" {

     

       58
       58
       +
       		return helpers.InputError(e, nil)

     

       59
       59
       +
       	}

     

       60
       60
       +
       	if op.Services["atproto_pds"].Endpoint != required.Services["atproto_pds"].Endpoint {

     

       61
       61
       +
       		return helpers.InputError(e, nil)

     

       62
       62
       +
       	}

     

       63
       63
       +
       	if op.VerificationMethods["atproto"] != required.VerificationMethods["atproto"] {

     

       64
       64
       +
       		return helpers.InputError(e, nil)

     

       65
       65
       +
       	}

     

       66
       66
       +
       	if op.AlsoKnownAs[0] != required.AlsoKnownAs[0] {

     

       67
       67
       +
       		return helpers.InputError(e, nil)

     

       68
       68
       +
       	}

     

       69
       69
       +
       

     

       70
       70
       +
       	if err := s.plcClient.SendOperation(e.Request().Context(), repo.Repo.Did, &op); err != nil {

     

       71
       71
       +
       		return err

     

       72
       72
       +
       	}

     

       73
       73
       +
       

     

       74
       74
       +
       	if err := s.passport.BustDoc(context.TODO(), repo.Repo.Did); err != nil {

     

       75
       75
       +
       		s.logger.Warn("error busting did doc", "error", err)

     

       76
       76
       +
       	}

     

       77
       77
       +
       

     

       78
       78
       +
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       79
       79
       +
       		RepoIdentity: &atproto.SyncSubscribeRepos_Identity{

     

       80
       80
       +
       			Did:  repo.Repo.Did,

     

       81
       81
       +
       			Seq:  time.Now().UnixMicro(), // TODO: no

     

       82
       82
       +
       			Time: time.Now().Format(util.ISO8601),

     

       83
       83
       +
       		},

     

       84
       84
       +
       	})

     

       85
       85
       +
       

     

       86
       86
       +
       	return nil

     

       87
       87
       +
       }

+2 -11

server/handle_identity_update_handle.go

···

       7
       7
        
       

     

       8
       8
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       9
       9
        
       	"github.com/bluesky-social/indigo/api/atproto"

     

       10
       10
       -
       	"github.com/bluesky-social/indigo/atproto/crypto"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       11
       11
        
       	"github.com/bluesky-social/indigo/events"

     

       12
       12
        
       	"github.com/bluesky-social/indigo/util"

     

       13
       13
        
       	"github.com/haileyok/cocoon/identity"

     
···

       66
       66
        
       			Prev:                &latest.Cid,

     

       67
       67
        
       		}

     

       68
       68
        
       

     

       69
       69
       -
       		k, err := crypto.ParsePrivateBytesK256(repo.SigningKey)

     

       69
       69
       +
       		k, err := atcrypto.ParsePrivateBytesK256(repo.SigningKey)

     

       70
       70
        
       		if err != nil {

     

       71
       71
        
       			s.logger.Error("error parsing signing key", "error", err)

     

       72
       72
        
       			return helpers.ServerError(e, nil)

     
···

       84
       84
        
       	if err := s.passport.BustDoc(context.TODO(), repo.Repo.Did); err != nil {

     

       85
       85
        
       		s.logger.Warn("error busting did doc", "error", err)

     

       86
       86
        
       	}

     

       87
       87
       -
       

     

       88
       88
       -
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       89
       89
       -
       		RepoHandle: &atproto.SyncSubscribeRepos_Handle{

     

       90
       90
       -
       			Did:    repo.Repo.Did,

     

       91
       91
       -
       			Handle: req.Handle,

     

       92
       92
       -
       			Seq:    time.Now().UnixMicro(), // TODO: no

     

       93
       93
       -
       			Time:   time.Now().Format(util.ISO8601),

     

       94
       94
       -
       		},

     

       95
       95
       -
       	})

     

       96
       87
        
       

     

       97
       88
        
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       98
       89
        
       		RepoIdentity: &atproto.SyncSubscribeRepos_Identity{

+3 -4

server/handle_import_repo.go

···

       9
       9
        
       

     

       10
       10
        
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       11
       11
        
       	"github.com/bluesky-social/indigo/repo"

     

       12
       12
       -
       	"github.com/haileyok/cocoon/blockstore"

     

       13
       12
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       14
       13
        
       	"github.com/haileyok/cocoon/models"

     

       15
       14
        
       	blocks "github.com/ipfs/go-block-format"

     
···

       27
       26
        
       		return helpers.ServerError(e, nil)

     

       28
       27
        
       	}

     

       29
       28
        
       

     

       30
       30
       -
       	bs := blockstore.New(urepo.Repo.Did, s.db)

     

       29
       29
       +
       	bs := s.getBlockstore(urepo.Repo.Did)

     

       31
       30
        
       

     

       32
       31
        
       	cs, err := car.NewCarReader(bytes.NewReader(b))

     

       33
       32
        
       	if err != nil {

     
···

       88
       87
        
       			Value:     b.RawData(),

     

       89
       88
        
       		}

     

       90
       89
        
       

     

       91
       91
       -
       		if err := tx.Create(rec).Error; err != nil {

     

       90
       90
       +
       		if err := tx.Save(rec).Error; err != nil {

     

       92
       91
        
       			return err

     

       93
       92
        
       		}

     

       94
       93
        
       

     
···

       107
       106
        
       		return helpers.ServerError(e, nil)

     

       108
       107
        
       	}

     

       109
       108
        
       

     

       110
       110
       -
       	if err := bs.UpdateRepo(context.TODO(), root, rev); err != nil {

     

       109
       109
       +
       	if err := s.UpdateRepo(context.TODO(), urepo.Repo.Did, root, rev); err != nil {

     

       111
       110
        
       		s.logger.Error("error updating repo after commit", "error", err)

     

       112
       111
        
       		return helpers.ServerError(e, nil)

     

       113
       112
        
       	}

+34

server/handle_label_query_labels.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"github.com/labstack/echo/v4"

     

       5
       5
       +
       )

     

       6
       6
       +
       

     

       7
       7
       +
       type Label struct {

     

       8
       8
       +
       	Ver *int    `json:"ver,omitempty"`

     

       9
       9
       +
       	Src string  `json:"src"`

     

       10
       10
       +
       	Uri string  `json:"uri"`

     

       11
       11
       +
       	Cid *string `json:"cid,omitempty"`

     

       12
       12
       +
       	Val string  `json:"val"`

     

       13
       13
       +
       	Neg *bool   `json:"neg,omitempty"`

     

       14
       14
       +
       	Cts string  `json:"cts"`

     

       15
       15
       +
       	Exp *string `json:"exp,omitempty"`

     

       16
       16
       +
       	Sig []byte  `json:"sig,omitempty"`

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       type ComAtprotoLabelQueryLabelsResponse struct {

     

       20
       20
       +
       	Cursor *string `json:"cursor,omitempty"`

     

       21
       21
       +
       	Labels []Label `json:"labels"`

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       func (s *Server) handleLabelQueryLabels(e echo.Context) error {

     

       25
       25
       +
       	svc := e.Request().Header.Get("atproto-proxy")

     

       26
       26
       +
       	if svc != "" || s.config.FallbackProxy != "" {

     

       27
       27
       +
       		return s.handleProxy(e)

     

       28
       28
       +
       	}

     

       29
       29
       +
       

     

       30
       30
       +
       	return e.JSON(200, ComAtprotoLabelQueryLabelsResponse{

     

       31
       31
       +
       		Cursor: nil,

     

       32
       32
       +
       		Labels: []Label{},

     

       33
       33
       +
       	})

     

       34
       34
       +
       }

+1 -1

server/handle_oauth_authorize.go

···

       113
       113
        
       

     

       114
       114
        
       	code := oauth.GenerateCode()

     

       115
       115
        
       

     

       116
       116
       -
       	if err := s.db.Exec("UPDATE oauth_authorization_requests SET sub = ?, code = ?, accepted = ? WHERE request_id = ?", nil, repo.Repo.Did, code, true, reqId).Error; err != nil {

     

       116
       116
       +
       	if err := s.db.Exec("UPDATE oauth_authorization_requests SET sub = ?, code = ?, accepted = ?, ip = ? WHERE request_id = ?", nil, repo.Repo.Did, code, true, e.RealIP(), reqId).Error; err != nil {

     

       117
       117
        
       		s.logger.Error("error updating authorization request", "error", err)

     

       118
       118
        
       		return helpers.ServerError(e, nil)

     

       119
       119
        
       	}

+14 -2

server/handle_oauth_par.go

···

       1
       1
        
       package server

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"errors"

     

       4
       5
        
       	"time"

     

       5
       6
        
       

     

       6
       7
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       7
       8
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       9
        
       	"github.com/haileyok/cocoon/oauth"

     

       9
       10
        
       	"github.com/haileyok/cocoon/oauth/constants"

     

       11
       11
       +
       	"github.com/haileyok/cocoon/oauth/dpop"

     

       10
       12
        
       	"github.com/haileyok/cocoon/oauth/provider"

     

       11
       13
        
       	"github.com/labstack/echo/v4"

     

       12
       14
        
       )

     
···

       31
       33
        
       	// TODO: this seems wrong. should be a way to get the entire request url i believe, but this will work for now

     

       32
       34
        
       	dpopProof, err := s.oauthProvider.DpopManager.CheckProof(e.Request().Method, "https://"+s.config.Hostname+e.Request().URL.String(), e.Request().Header, nil)

     

       33
       35
        
       	if err != nil {

     

       36
       36
       +
       		if errors.Is(err, dpop.ErrUseDpopNonce) {

     

       37
       37
       +
       			nonce := s.oauthProvider.NextNonce()

     

       38
       38
       +
       			if nonce != "" {

     

       39
       39
       +
       				e.Response().Header().Set("DPoP-Nonce", nonce)

     

       40
       40
       +
       				e.Response().Header().Add("access-control-expose-headers", "DPoP-Nonce")

     

       41
       41
       +
       			}

     

       42
       42
       +
       			return e.JSON(400, map[string]string{

     

       43
       43
       +
       				"error": "use_dpop_nonce",

     

       44
       44
       +
       			})

     

       45
       45
       +
       		}

     

       34
       46
        
       		s.logger.Error("error getting dpop proof", "error", err)

     

       35
       35
       -
       		return helpers.InputError(e, to.StringPtr(err.Error()))

     

       47
       47
       +
       		return helpers.InputError(e, nil)

     

       36
       48
        
       	}

     

       37
       49
        
       

     

       38
       50
        
       	client, clientAuth, err := s.oauthProvider.AuthenticateClient(e.Request().Context(), parRequest.AuthenticateClientRequestBase, dpopProof, &provider.AuthenticateClientOptions{

     
···

       41
       53
        
       		AllowMissingDpopProof: true,

     

       42
       54
        
       	})

     

       43
       55
        
       	if err != nil {

     

       44
       44
       -
       		s.logger.Error("error authenticating client", "error", err)

     

       56
       56
       +
       		s.logger.Error("error authenticating client", "client_id", parRequest.ClientID, "error", err)

     

       45
       57
        
       		return helpers.InputError(e, to.StringPtr(err.Error()))

     

       46
       58
        
       	}

     

       47
       59

+18 -12

server/handle_oauth_token.go

···

       4
       4
        
       	"bytes"

     

       5
       5
        
       	"crypto/sha256"

     

       6
       6
        
       	"encoding/base64"

     

       7
       7
       +
       	"errors"

     

       7
       8
        
       	"fmt"

     

       8
       9
        
       	"slices"

     

       9
       10
        
       	"time"

     
···

       13
       14
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       14
       15
        
       	"github.com/haileyok/cocoon/oauth"

     

       15
       16
        
       	"github.com/haileyok/cocoon/oauth/constants"

     

       17
       17
       +
       	"github.com/haileyok/cocoon/oauth/dpop"

     

       16
       18
        
       	"github.com/haileyok/cocoon/oauth/provider"

     

       17
       19
        
       	"github.com/labstack/echo/v4"

     

       18
       20
        
       )

     
···

       44
       46
        
       

     

       45
       47
        
       	proof, err := s.oauthProvider.DpopManager.CheckProof(e.Request().Method, e.Request().URL.String(), e.Request().Header, nil)

     

       46
       48
        
       	if err != nil {

     

       49
       49
       +
       		if errors.Is(err, dpop.ErrUseDpopNonce) {

     

       50
       50
       +
       			nonce := s.oauthProvider.NextNonce()

     

       51
       51
       +
       			if nonce != "" {

     

       52
       52
       +
       				e.Response().Header().Set("DPoP-Nonce", nonce)

     

       53
       53
       +
       				e.Response().Header().Add("access-control-expose-headers", "DPoP-Nonce")

     

       54
       54
       +
       			}

     

       55
       55
       +
       			return e.JSON(400, map[string]string{

     

       56
       56
       +
       				"error": "use_dpop_nonce",

     

       57
       57
       +
       			})

     

       58
       58
       +
       		}

     

       47
       59
        
       		s.logger.Error("error getting dpop proof", "error", err)

     

       48
       48
       -
       		return helpers.InputError(e, to.StringPtr(err.Error()))

     

       60
       60
       +
       		return helpers.InputError(e, nil)

     

       49
       61
        
       	}

     

       50
       62
        
       

     

       51
       63
        
       	client, clientAuth, err := s.oauthProvider.AuthenticateClient(e.Request().Context(), req.AuthenticateClientRequestBase, proof, &provider.AuthenticateClientOptions{

     

       52
       64
        
       		AllowMissingDpopProof: true,

     

       53
       65
        
       	})

     

       54
       66
        
       	if err != nil {

     

       55
       55
       -
       		s.logger.Error("error authenticating client", "error", err)

     

       67
       67
       +
       		s.logger.Error("error authenticating client", "client_id", req.ClientID, "error", err)

     

       56
       68
        
       		return helpers.InputError(e, to.StringPtr(err.Error()))

     

       57
       69
        
       	}

     

       58
       70
        
       

     
···

       157
       169
        
       			Code:         *authReq.Code,

     

       158
       170
        
       			Token:        accessString,

     

       159
       171
        
       			RefreshToken: refreshToken,

     

       172
       172
       +
       			Ip:           authReq.Ip,

     

       160
       173
        
       		}, nil).Error; err != nil {

     

       161
       174
        
       			s.logger.Error("error creating token in db", "error", err)

     

       162
       175
        
       			return helpers.ServerError(e, nil)

     
···

       203
       216
        
       			return helpers.InputError(e, to.StringPtr("dpop proof does not match expected jkt"))

     

       204
       217
        
       		}

     

       205
       218
        
       

     

       206
       206
       -
       		sessionLifetime := constants.PublicClientSessionLifetime

     

       207
       207
       -
       		refreshLifetime := constants.PublicClientRefreshLifetime

     

       208
       208
       -
       		if clientAuth.Method != "none" {

     

       209
       209
       -
       			sessionLifetime = constants.ConfidentialClientSessionLifetime

     

       210
       210
       -
       			refreshLifetime = constants.ConfidentialClientRefreshLifetime

     

       211
       211
       -
       		}

     

       219
       219
       +
       		ageRes := oauth.GetSessionAgeFromToken(oauthToken)

     

       212
       220
        
       

     

       213
       213
       -
       		sessionAge := time.Since(oauthToken.CreatedAt)

     

       214
       214
       -
       		if sessionAge > sessionLifetime {

     

       221
       221
       +
       		if ageRes.SessionExpired {

     

       215
       222
        
       			return helpers.InputError(e, to.StringPtr("Session expired"))

     

       216
       223
        
       		}

     

       217
       224
        
       

     

       218
       218
       -
       		refreshAge := time.Since(oauthToken.UpdatedAt)

     

       219
       219
       -
       		if refreshAge > refreshLifetime {

     

       225
       225
       +
       		if ageRes.RefreshExpired {

     

       220
       226
        
       			return helpers.InputError(e, to.StringPtr("Refresh token expired"))

     

       221
       227
        
       		}

     

       222
       228

+43 -18

server/handle_proxy.go

···

       17
       17
        
       	secp256k1secec "gitlab.com/yawning/secp256k1-voi/secec"

     

       18
       18
        
       )

     

       19
       19
        
       

     

       20
       20
       -
       func (s *Server) handleProxy(e echo.Context) error {

     

       21
       21
       -
       	repo, isAuthed := e.Get("repo").(*models.RepoActor)

     

       22
       22
       -
       

     

       23
       23
       -
       	pts := strings.Split(e.Request().URL.Path, "/")

     

       24
       24
       -
       	if len(pts) != 3 {

     

       25
       25
       -
       		return fmt.Errorf("incorrect number of parts")

     

       26
       26
       -
       	}

     

       27
       27
       -
       

     

       20
       20
       +
       func (s *Server) getAtprotoProxyEndpointFromRequest(e echo.Context) (string, string, error) {

     

       28
       21
        
       	svc := e.Request().Header.Get("atproto-proxy")

     

       29
       29
       -
       	if svc == "" {

     

       30
       30
       -
       		svc = "did:web:api.bsky.app#bsky_appview" // TODO: should be a config var probably

     

       22
       22
       +
       	if svc == "" && s.config.FallbackProxy != "" {

     

       23
       23
       +
       		svc = s.config.FallbackProxy

     

       31
       24
        
       	}

     

       32
       25
        
       

     

       33
       26
        
       	svcPts := strings.Split(svc, "#")

     

       34
       27
        
       	if len(svcPts) != 2 {

     

       35
       35
       -
       		return fmt.Errorf("invalid service header")

     

       28
       28
       +
       		return "", "", fmt.Errorf("invalid service header")

     

       36
       29
        
       	}

     

       37
       30
        
       

     

       38
       31
        
       	svcDid := svcPts[0]

     
···

       40
       33
        
       

     

       41
       34
        
       	doc, err := s.passport.FetchDoc(e.Request().Context(), svcDid)

     

       42
       35
        
       	if err != nil {

     

       43
       43
       -
       		return err

     

       36
       36
       +
       		return "", "", err

     

       44
       37
        
       	}

     

       45
       38
        
       

     

       46
       39
        
       	var endpoint string

     
···

       50
       43
        
       		}

     

       51
       44
        
       	}

     

       52
       45
        
       

     

       46
       46
       +
       	return endpoint, svcDid, nil

     

       47
       47
       +
       }

     

       48
       48
       +
       

     

       49
       49
       +
       func (s *Server) handleProxy(e echo.Context) error {

     

       50
       50
       +
       	lgr := s.logger.With("handler", "handleProxy")

     

       51
       51
       +
       

     

       52
       52
       +
       	repo, isAuthed := e.Get("repo").(*models.RepoActor)

     

       53
       53
       +
       

     

       54
       54
       +
       	pts := strings.Split(e.Request().URL.Path, "/")

     

       55
       55
       +
       	if len(pts) != 3 {

     

       56
       56
       +
       		return fmt.Errorf("incorrect number of parts")

     

       57
       57
       +
       	}

     

       58
       58
       +
       

     

       59
       59
       +
       	endpoint, svcDid, err := s.getAtprotoProxyEndpointFromRequest(e)

     

       60
       60
       +
       	if err != nil {

     

       61
       61
       +
       		lgr.Error("could not get atproto proxy", "error", err)

     

       62
       62
       +
       		return helpers.ServerError(e, nil)

     

       63
       63
       +
       	}

     

       64
       64
       +
       

     

       53
       65
        
       	requrl := e.Request().URL

     

       54
       66
        
       	requrl.Host = strings.TrimPrefix(endpoint, "https://")

     

       55
       67
        
       	requrl.Scheme = "https"

     
···

       78
       90
        
       		}

     

       79
       91
        
       		hj, err := json.Marshal(header)

     

       80
       92
        
       		if err != nil {

     

       81
       81
       -
       			s.logger.Error("error marshaling header", "error", err)

     

       93
       93
       +
       			lgr.Error("error marshaling header", "error", err)

     

       82
       94
        
       			return helpers.ServerError(e, nil)

     

       83
       95
        
       		}

     

       84
       96
        
       

     

       85
       97
        
       		encheader := strings.TrimRight(base64.RawURLEncoding.EncodeToString(hj), "=")

     

       86
       98
        
       

     

       99
       99
       +
       		// When proxying app.bsky.feed.getFeed the token is actually issued for the

     

       100
       100
       +
       		// underlying feed generator and the app view passes it on. This allows the

     

       101
       101
       +
       		// getFeed implementation to pass in the desired lxm and aud for the token

     

       102
       102
       +
       		// and then just delegate to the general proxying logic

     

       103
       103
       +
       		lxm, proxyTokenLxmExists := e.Get("proxyTokenLxm").(string)

     

       104
       104
       +
       		if !proxyTokenLxmExists || lxm == "" {

     

       105
       105
       +
       			lxm = pts[2]

     

       106
       106
       +
       		}

     

       107
       107
       +
       		aud, proxyTokenAudExists := e.Get("proxyTokenAud").(string)

     

       108
       108
       +
       		if !proxyTokenAudExists || aud == "" {

     

       109
       109
       +
       			aud = svcDid

     

       110
       110
       +
       		}

     

       111
       111
       +
       

     

       87
       112
        
       		payload := map[string]any{

     

       88
       113
        
       			"iss": repo.Repo.Did,

     

       89
       89
       -
       			"aud": svcDid,

     

       90
       90
       -
       			"lxm": pts[2],

     

       114
       114
       +
       			"aud": aud,

     

       115
       115
       +
       			"lxm": lxm,

     

       91
       116
        
       			"jti": uuid.NewString(),

     

       92
       117
        
       			"exp": time.Now().Add(1 * time.Minute).UTC().Unix(),

     

       93
       118
        
       		}

     

       94
       119
        
       		pj, err := json.Marshal(payload)

     

       95
       120
        
       		if err != nil {

     

       96
       96
       -
       			s.logger.Error("error marashaling payload", "error", err)

     

       121
       121
       +
       			lgr.Error("error marashaling payload", "error", err)

     

       97
       122
        
       			return helpers.ServerError(e, nil)

     

       98
       123
        
       		}

     

       99
       124
        
       

     
···

       104
       129
        
       

     

       105
       130
        
       		sk, err := secp256k1secec.NewPrivateKey(repo.SigningKey)

     

       106
       131
        
       		if err != nil {

     

       107
       107
       -
       			s.logger.Error("can't load private key", "error", err)

     

       132
       132
       +
       			lgr.Error("can't load private key", "error", err)

     

       108
       133
        
       			return err

     

       109
       134
        
       		}

     

       110
       135
        
       

     

       111
       136
        
       		R, S, _, err := sk.SignRaw(rand.Reader, hash[:])

     

       112
       137
        
       		if err != nil {

     

       113
       113
       -
       			s.logger.Error("error signing", "error", err)

     

       138
       138
       +
       			lgr.Error("error signing", "error", err)

     

       114
       139
        
       		}

     

       115
       140
        
       

     

       116
       141
        
       		rBytes := R.Bytes()

+35

server/handle_proxy_get_feed.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       5
       5
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       6
       6
       +
       	"github.com/bluesky-social/indigo/api/bsky"

     

       7
       7
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/xrpc"

     

       9
       9
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       10
       10
       +
       	"github.com/labstack/echo/v4"

     

       11
       11
       +
       )

     

       12
       12
       +
       

     

       13
       13
       +
       func (s *Server) handleProxyBskyFeedGetFeed(e echo.Context) error {

     

       14
       14
       +
       	feedUri, err := syntax.ParseATURI(e.QueryParam("feed"))

     

       15
       15
       +
       	if err != nil {

     

       16
       16
       +
       		return helpers.InputError(e, to.StringPtr("invalid feed uri"))

     

       17
       17
       +
       	}

     

       18
       18
       +
       

     

       19
       19
       +
       	appViewEndpoint, _, err := s.getAtprotoProxyEndpointFromRequest(e)

     

       20
       20
       +
       	if err != nil {

     

       21
       21
       +
       		e.Logger().Error("could not get atproto proxy", "error", err)

     

       22
       22
       +
       		return helpers.ServerError(e, nil)

     

       23
       23
       +
       	}

     

       24
       24
       +
       

     

       25
       25
       +
       	appViewClient := xrpc.Client{

     

       26
       26
       +
       		Host: appViewEndpoint,

     

       27
       27
       +
       	}

     

       28
       28
       +
       	feedRecord, err := atproto.RepoGetRecord(e.Request().Context(), &appViewClient, "", feedUri.Collection().String(), feedUri.Authority().String(), feedUri.RecordKey().String())

     

       29
       29
       +
       	feedGeneratorDid := feedRecord.Value.Val.(*bsky.FeedGenerator).Did

     

       30
       30
       +
       

     

       31
       31
       +
       	e.Set("proxyTokenLxm", "app.bsky.feed.getFeedSkeleton")

     

       32
       32
       +
       	e.Set("proxyTokenAud", feedGeneratorDid)

     

       33
       33
       +
       

     

       34
       34
       +
       	return s.handleProxy(e)

     

       35
       35
       +
       }

+2 -2

server/handle_repo_get_record.go

···

       1
       1
        
       package server

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"github.com/bluesky-social/indigo/atproto/data"

     

       4
       4
       +
       	"github.com/bluesky-social/indigo/atproto/atdata"

     

       5
       5
        
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       6
       6
        
       	"github.com/haileyok/cocoon/models"

     

       7
       7
        
       	"github.com/labstack/echo/v4"

     
···

       37
       37
        
       		return err

     

       38
       38
        
       	}

     

       39
       39
        
       

     

       40
       40
       -
       	val, err := data.UnmarshalCBOR(record.Value)

     

       40
       40
       +
       	val, err := atdata.UnmarshalCBOR(record.Value)

     

       41
       41
        
       	if err != nil {

     

       42
       42
        
       		return s.handleProxy(e) // TODO: this should be getting handled like...if we don't find it in the db. why doesn't it throw error up there?

     

       43
       43
        
       	}

+112

server/handle_repo_list_missing_blobs.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"strconv"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/bluesky-social/indigo/atproto/atdata"

     

       8
       8
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       9
       9
       +
       	"github.com/haileyok/cocoon/models"

     

       10
       10
       +
       	"github.com/ipfs/go-cid"

     

       11
       11
       +
       	"github.com/labstack/echo/v4"

     

       12
       12
       +
       )

     

       13
       13
       +
       

     

       14
       14
       +
       type ComAtprotoRepoListMissingBlobsResponse struct {

     

       15
       15
       +
       	Cursor *string                                    `json:"cursor,omitempty"`

     

       16
       16
       +
       	Blobs  []ComAtprotoRepoListMissingBlobsRecordBlob `json:"blobs"`

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       type ComAtprotoRepoListMissingBlobsRecordBlob struct {

     

       20
       20
       +
       	Cid       string `json:"cid"`

     

       21
       21
       +
       	RecordUri string `json:"recordUri"`

     

       22
       22
       +
       }

     

       23
       23
       +
       

     

       24
       24
       +
       func (s *Server) handleListMissingBlobs(e echo.Context) error {

     

       25
       25
       +
       	urepo := e.Get("repo").(*models.RepoActor)

     

       26
       26
       +
       

     

       27
       27
       +
       	limitStr := e.QueryParam("limit")

     

       28
       28
       +
       	cursor := e.QueryParam("cursor")

     

       29
       29
       +
       

     

       30
       30
       +
       	limit := 500

     

       31
       31
       +
       	if limitStr != "" {

     

       32
       32
       +
       		if l, err := strconv.Atoi(limitStr); err == nil && l > 0 && l <= 1000 {

     

       33
       33
       +
       			limit = l

     

       34
       34
       +
       		}

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	var records []models.Record

     

       38
       38
       +
       	if err := s.db.Raw("SELECT * FROM records WHERE did = ?", nil, urepo.Repo.Did).Scan(&records).Error; err != nil {

     

       39
       39
       +
       		s.logger.Error("failed to get records for listMissingBlobs", "error", err)

     

       40
       40
       +
       		return helpers.ServerError(e, nil)

     

       41
       41
       +
       	}

     

       42
       42
       +
       

     

       43
       43
       +
       	type blobRef struct {

     

       44
       44
       +
       		cid       cid.Cid

     

       45
       45
       +
       		recordUri string

     

       46
       46
       +
       	}

     

       47
       47
       +
       	var allBlobRefs []blobRef

     

       48
       48
       +
       

     

       49
       49
       +
       	for _, rec := range records {

     

       50
       50
       +
       		blobs := getBlobsFromRecord(rec.Value)

     

       51
       51
       +
       		recordUri := fmt.Sprintf("at://%s/%s/%s", urepo.Repo.Did, rec.Nsid, rec.Rkey)

     

       52
       52
       +
       		for _, b := range blobs {

     

       53
       53
       +
       			allBlobRefs = append(allBlobRefs, blobRef{cid: cid.Cid(b.Ref), recordUri: recordUri})

     

       54
       54
       +
       		}

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	missingBlobs := make([]ComAtprotoRepoListMissingBlobsRecordBlob, 0)

     

       58
       58
       +
       	seenCids := make(map[string]bool)

     

       59
       59
       +
       

     

       60
       60
       +
       	for _, ref := range allBlobRefs {

     

       61
       61
       +
       		cidStr := ref.cid.String()

     

       62
       62
       +
       

     

       63
       63
       +
       		if seenCids[cidStr] {

     

       64
       64
       +
       			continue

     

       65
       65
       +
       		}

     

       66
       66
       +
       

     

       67
       67
       +
       		if cursor != "" && cidStr <= cursor {

     

       68
       68
       +
       			continue

     

       69
       69
       +
       		}

     

       70
       70
       +
       

     

       71
       71
       +
       		var count int64

     

       72
       72
       +
       		if err := s.db.Raw("SELECT COUNT(*) FROM blobs WHERE did = ? AND cid = ?", nil, urepo.Repo.Did, ref.cid.Bytes()).Scan(&count).Error; err != nil {

     

       73
       73
       +
       			continue

     

       74
       74
       +
       		}

     

       75
       75
       +
       

     

       76
       76
       +
       		if count == 0 {

     

       77
       77
       +
       			missingBlobs = append(missingBlobs, ComAtprotoRepoListMissingBlobsRecordBlob{

     

       78
       78
       +
       				Cid:       cidStr,

     

       79
       79
       +
       				RecordUri: ref.recordUri,

     

       80
       80
       +
       			})

     

       81
       81
       +
       			seenCids[cidStr] = true

     

       82
       82
       +
       

     

       83
       83
       +
       			if len(missingBlobs) >= limit {

     

       84
       84
       +
       				break

     

       85
       85
       +
       			}

     

       86
       86
       +
       		}

     

       87
       87
       +
       	}

     

       88
       88
       +
       

     

       89
       89
       +
       	var nextCursor *string

     

       90
       90
       +
       	if len(missingBlobs) > 0 && len(missingBlobs) >= limit {

     

       91
       91
       +
       		lastCid := missingBlobs[len(missingBlobs)-1].Cid

     

       92
       92
       +
       		nextCursor = &lastCid

     

       93
       93
       +
       	}

     

       94
       94
       +
       

     

       95
       95
       +
       	return e.JSON(200, ComAtprotoRepoListMissingBlobsResponse{

     

       96
       96
       +
       		Cursor: nextCursor,

     

       97
       97
       +
       		Blobs:  missingBlobs,

     

       98
       98
       +
       	})

     

       99
       99
       +
       }

     

       100
       100
       +
       

     

       101
       101
       +
       func getBlobsFromRecord(data []byte) []atdata.Blob {

     

       102
       102
       +
       	if len(data) == 0 {

     

       103
       103
       +
       		return nil

     

       104
       104
       +
       	}

     

       105
       105
       +
       

     

       106
       106
       +
       	decoded, err := atdata.UnmarshalCBOR(data)

     

       107
       107
       +
       	if err != nil {

     

       108
       108
       +
       		return nil

     

       109
       109
       +
       	}

     

       110
       110
       +
       

     

       111
       111
       +
       	return atdata.ExtractBlobs(decoded)

     

       112
       112
       +
       }

+2 -2

server/handle_repo_list_records.go

···

       4
       4
        
       	"strconv"

     

       5
       5
        
       

     

       6
       6
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       7
       7
       -
       	"github.com/bluesky-social/indigo/atproto/data"

     

       7
       7
       +
       	"github.com/bluesky-social/indigo/atproto/atdata"

     

       8
       8
        
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       9
       9
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       10
       10
        
       	"github.com/haileyok/cocoon/models"

     
···

       100
       100
        
       

     

       101
       101
        
       	items := []ComAtprotoRepoListRecordsRecordItem{}

     

       102
       102
        
       	for _, r := range records {

     

       103
       103
       -
       		val, err := data.UnmarshalCBOR(r.Value)

     

       103
       103
       +
       		val, err := atdata.UnmarshalCBOR(r.Value)

     

       104
       104
        
       		if err != nil {

     

       105
       105
        
       			return err

     

       106
       106
        
       		}

+2 -2

server/handle_repo_list_repos.go

···

       37
       37
        
       			Did:    r.Did,

     

       38
       38
        
       			Head:   c.String(),

     

       39
       39
        
       			Rev:    r.Rev,

     

       40
       40
       -
       			Active: true,

     

       41
       41
       -
       			Status: nil,

     

       40
       40
       +
       			Active: r.Active(),

     

       41
       41
       +
       			Status: r.Status(),

     

       42
       42
        
       		})

     

       43
       43
        
       	}

     

       44
       44

+50 -8

server/handle_repo_upload_blob.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"bytes"

     

       5
       5
       +
       	"fmt"

     

       5
       6
        
       	"io"

     

       6
       7
        
       

     

       8
       8
       +
       	"github.com/aws/aws-sdk-go/aws"

     

       9
       9
       +
       	"github.com/aws/aws-sdk-go/aws/credentials"

     

       10
       10
       +
       	"github.com/aws/aws-sdk-go/aws/session"

     

       11
       11
       +
       	"github.com/aws/aws-sdk-go/service/s3"

     

       7
       12
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       13
        
       	"github.com/haileyok/cocoon/models"

     

       9
       14
        
       	"github.com/ipfs/go-cid"

     
···

       34
       39
        
       		mime = "application/octet-stream"

     

       35
       40
        
       	}

     

       36
       41
        
       

     

       42
       42
       +
       	storage := "sqlite"

     

       43
       43
       +
       	s3Upload := s.s3Config != nil && s.s3Config.BlobstoreEnabled

     

       44
       44
       +
       	if s3Upload {

     

       45
       45
       +
       		storage = "s3"

     

       46
       46
       +
       	}

     

       37
       47
        
       	blob := models.Blob{

     

       38
       48
        
       		Did:       urepo.Repo.Did,

     

       39
       49
        
       		RefCount:  0,

     

       40
       50
        
       		CreatedAt: s.repoman.clock.Next().String(),

     

       51
       51
       +
       		Storage:   storage,

     

       41
       52
        
       	}

     

       42
       53
        
       

     

       43
       54
        
       	if err := s.db.Create(&blob, nil).Error; err != nil {

     
···

       66
       77
        
       		read += n

     

       67
       78
        
       		fulldata.Write(data)

     

       68
       79
        
       

     

       69
       69
       -
       		blobPart := models.BlobPart{

     

       70
       70
       -
       			BlobID: blob.ID,

     

       71
       71
       -
       			Idx:    part,

     

       72
       72
       -
       			Data:   data,

     

       73
       73
       -
       		}

     

       80
       80
       +
       		if !s3Upload {

     

       81
       81
       +
       			blobPart := models.BlobPart{

     

       82
       82
       +
       				BlobID: blob.ID,

     

       83
       83
       +
       				Idx:    part,

     

       84
       84
       +
       				Data:   data,

     

       85
       85
       +
       			}

     

       74
       86
        
       

     

       75
       75
       -
       		if err := s.db.Create(&blobPart, nil).Error; err != nil {

     

       76
       76
       -
       			s.logger.Error("error adding blob part to db", "error", err)

     

       77
       77
       -
       			return helpers.ServerError(e, nil)

     

       87
       87
       +
       			if err := s.db.Create(&blobPart, nil).Error; err != nil {

     

       88
       88
       +
       				s.logger.Error("error adding blob part to db", "error", err)

     

       89
       89
       +
       				return helpers.ServerError(e, nil)

     

       90
       90
       +
       			}

     

       78
       91
        
       		}

     

       79
       92
        
       		part++

     

       80
       93
        
       

     
···

       87
       100
        
       	if err != nil {

     

       88
       101
        
       		s.logger.Error("error creating cid prefix", "error", err)

     

       89
       102
        
       		return helpers.ServerError(e, nil)

     

       103
       103
       +
       	}

     

       104
       104
       +
       

     

       105
       105
       +
       	if s3Upload {

     

       106
       106
       +
       		config := &aws.Config{

     

       107
       107
       +
       			Region:      aws.String(s.s3Config.Region),

     

       108
       108
       +
       			Credentials: credentials.NewStaticCredentials(s.s3Config.AccessKey, s.s3Config.SecretKey, ""),

     

       109
       109
       +
       		}

     

       110
       110
       +
       

     

       111
       111
       +
       		if s.s3Config.Endpoint != "" {

     

       112
       112
       +
       			config.Endpoint = aws.String(s.s3Config.Endpoint)

     

       113
       113
       +
       			config.S3ForcePathStyle = aws.Bool(true)

     

       114
       114
       +
       		}

     

       115
       115
       +
       

     

       116
       116
       +
       		sess, err := session.NewSession(config)

     

       117
       117
       +
       		if err != nil {

     

       118
       118
       +
       			s.logger.Error("error creating aws session", "error", err)

     

       119
       119
       +
       			return helpers.ServerError(e, nil)

     

       120
       120
       +
       		}

     

       121
       121
       +
       

     

       122
       122
       +
       		svc := s3.New(sess)

     

       123
       123
       +
       

     

       124
       124
       +
       		if _, err := svc.PutObject(&s3.PutObjectInput{

     

       125
       125
       +
       			Bucket: aws.String(s.s3Config.Bucket),

     

       126
       126
       +
       			Key:    aws.String(fmt.Sprintf("blobs/%s/%s", urepo.Repo.Did, c.String())),

     

       127
       127
       +
       			Body:   bytes.NewReader(fulldata.Bytes()),

     

       128
       128
       +
       		}); err != nil {

     

       129
       129
       +
       			s.logger.Error("error uploading blob to s3", "error", err)

     

       130
       130
       +
       			return helpers.ServerError(e, nil)

     

       131
       131
       +
       		}

     

       90
       132
        
       	}

     

       91
       133
        
       

     

       92
       134
        
       	if err := s.db.Exec("UPDATE blobs SET cid = ? WHERE id = ?", nil, c.Bytes(), blob.ID).Error; err != nil {

+45

server/handle_server_activate_account.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/events"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/util"

     

       10
       10
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       11
       11
       +
       	"github.com/haileyok/cocoon/models"

     

       12
       12
       +
       	"github.com/labstack/echo/v4"

     

       13
       13
       +
       )

     

       14
       14
       +
       

     

       15
       15
       +
       type ComAtprotoServerActivateAccountRequest struct {

     

       16
       16
       +
       	// NOTE: this implementation will not pay attention to this value

     

       17
       17
       +
       	DeleteAfter time.Time `json:"deleteAfter"`

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       func (s *Server) handleServerActivateAccount(e echo.Context) error {

     

       21
       21
       +
       	var req ComAtprotoServerDeactivateAccountRequest

     

       22
       22
       +
       	if err := e.Bind(&req); err != nil {

     

       23
       23
       +
       		s.logger.Error("error binding", "error", err)

     

       24
       24
       +
       		return helpers.ServerError(e, nil)

     

       25
       25
       +
       	}

     

       26
       26
       +
       

     

       27
       27
       +
       	urepo := e.Get("repo").(*models.RepoActor)

     

       28
       28
       +
       

     

       29
       29
       +
       	if err := s.db.Exec("UPDATE repos SET deactivated = ? WHERE did = ?", nil, false, urepo.Repo.Did).Error; err != nil {

     

       30
       30
       +
       		s.logger.Error("error updating account status to deactivated", "error", err)

     

       31
       31
       +
       		return helpers.ServerError(e, nil)

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       35
       35
       +
       		RepoAccount: &atproto.SyncSubscribeRepos_Account{

     

       36
       36
       +
       			Active: true,

     

       37
       37
       +
       			Did:    urepo.Repo.Did,

     

       38
       38
       +
       			Status: nil,

     

       39
       39
       +
       			Seq:    time.Now().UnixMicro(), // TODO: bad puppy

     

       40
       40
       +
       			Time:   time.Now().Format(util.ISO8601),

     

       41
       41
       +
       		},

     

       42
       42
       +
       	})

     

       43
       43
       +
       

     

       44
       44
       +
       	return e.NoContent(200)

     

       45
       45
       +
       }

+2 -2

server/handle_server_confirm_email.go

···

       28
       28
        
       	}

     

       29
       29
        
       

     

       30
       30
        
       	if urepo.EmailVerificationCode == nil || urepo.EmailVerificationCodeExpiresAt == nil {

     

       31
       31
       -
       		return helpers.InputError(e, to.StringPtr("ExpiredToken"))

     

       31
       31
       +
       		return helpers.ExpiredTokenError(e)

     

       32
       32
        
       	}

     

       33
       33
        
       

     

       34
       34
        
       	if *urepo.EmailVerificationCode != req.Token {

     
···

       36
       36
        
       	}

     

       37
       37
        
       

     

       38
       38
        
       	if time.Now().UTC().After(*urepo.EmailVerificationCodeExpiresAt) {

     

       39
       39
       -
       		return helpers.InputError(e, to.StringPtr("ExpiredToken"))

     

       39
       39
       +
       		return helpers.ExpiredTokenError(e)

     

       40
       40
        
       	}

     

       41
       41
        
       

     

       42
       42
        
       	now := time.Now().UTC()

+95 -63

server/handle_server_create_account.go

···

       9
       9
        
       

     

       10
       10
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       11
       11
        
       	"github.com/bluesky-social/indigo/api/atproto"

     

       12
       12
       -
       	"github.com/bluesky-social/indigo/atproto/crypto"

     

       13
       13
       -
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       12
       12
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       14
       13
        
       	"github.com/bluesky-social/indigo/events"

     

       15
       14
        
       	"github.com/bluesky-social/indigo/repo"

     

       16
       15
        
       	"github.com/bluesky-social/indigo/util"

     

       17
       17
       -
       	"github.com/haileyok/cocoon/blockstore"

     

       18
       16
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       19
       17
        
       	"github.com/haileyok/cocoon/models"

     

       20
       18
        
       	"github.com/labstack/echo/v4"

     
···

       27
       25
        
       	Handle     string  `json:"handle" validate:"required,atproto-handle"`

     

       28
       26
        
       	Did        *string `json:"did" validate:"atproto-did"`

     

       29
       27
        
       	Password   string  `json:"password" validate:"required"`

     

       30
       30
       -
       	InviteCode string  `json:"inviteCode" validate:"required"`

     

       28
       28
       +
       	InviteCode string  `json:"inviteCode" validate:"omitempty"`

     

       31
       29
        
       }

     

       32
       30
        
       

     

       33
       31
        
       type ComAtprotoServerCreateAccountResponse struct {

     
···

       40
       38
        
       func (s *Server) handleCreateAccount(e echo.Context) error {

     

       41
       39
        
       	var request ComAtprotoServerCreateAccountRequest

     

       42
       40
        
       

     

       43
       43
       -
       	var signupDid string

     

       44
       44
       -
       	customDidHeader := e.Request().Header.Get("authorization")

     

       45
       45
       -
       	if customDidHeader != "" {

     

       46
       46
       -
       		pts := strings.Split(customDidHeader, " ")

     

       47
       47
       -
       		if len(pts) != 2 {

     

       48
       48
       -
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       49
       49
       -
       		}

     

       50
       50
       -
       

     

       51
       51
       -
       		_, err := syntax.ParseDID(pts[1])

     

       52
       52
       -
       		if err != nil {

     

       53
       53
       -
       			return helpers.InputError(e, to.StringPtr("InvalidDid"))

     

       54
       54
       -
       		}

     

       55
       55
       -
       

     

       56
       56
       -
       		signupDid = pts[1]

     

       57
       57
       -
       	}

     

       58
       58
       -
       

     

       59
       41
        
       	if err := e.Bind(&request); err != nil {

     

       60
       42
        
       		s.logger.Error("error receiving request", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       61
       43
        
       		return helpers.ServerError(e, nil)

     
···

       86
       68
        
       			}

     

       87
       69
        
       		}

     

       88
       70
        
       	}

     

       71
       71
       +
       	

     

       72
       72
       +
       	var signupDid string

     

       73
       73
       +
       	if request.Did != nil {

     

       74
       74
       +
       		signupDid = *request.Did;

     

       75
       75
       +
       		

     

       76
       76
       +
       		token := strings.TrimSpace(strings.Replace(e.Request().Header.Get("authorization"), "Bearer ", "", 1))

     

       77
       77
       +
       		if token == "" {

     

       78
       78
       +
       			return helpers.UnauthorizedError(e, to.StringPtr("must authenticate to use an existing did"))

     

       79
       79
       +
       		}

     

       80
       80
       +
       		authDid, err := s.validateServiceAuth(e.Request().Context(), token, "com.atproto.server.createAccount")

     

       81
       81
       +
       

     

       82
       82
       +
       		if err != nil {

     

       83
       83
       +
       			s.logger.Warn("error validating authorization token", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       84
       84
       +
       			return helpers.UnauthorizedError(e, to.StringPtr("invalid authorization token"))

     

       85
       85
       +
       		}

     

       86
       86
       +
       

     

       87
       87
       +
       		if authDid != signupDid {

     

       88
       88
       +
       			return helpers.ForbiddenError(e, to.StringPtr("auth did did not match signup did"))

     

       89
       89
       +
       		}

     

       90
       90
       +
       	}

     

       89
       91
        
       

     

       90
       92
        
       	// see if the handle is already taken

     

       91
       91
       -
       	_, err := s.getActorByHandle(request.Handle)

     

       93
       93
       +
       	actor, err := s.getActorByHandle(request.Handle)

     

       92
       94
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       93
       95
        
       		s.logger.Error("error looking up handle in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       94
       96
        
       		return helpers.ServerError(e, nil)

     

       95
       97
        
       	}

     

       96
       96
       -
       	if err == nil {

     

       98
       98
       +
       	if err == nil && actor.Did != signupDid {

     

       97
       99
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       98
       100
        
       	}

     

       99
       101
        
       

     

       100
       100
       -
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != "" {

     

       102
       102
       +
       	if did, err := s.passport.ResolveHandle(e.Request().Context(), request.Handle); err == nil && did != signupDid {

     

       101
       103
        
       		return helpers.InputError(e, to.StringPtr("HandleNotAvailable"))

     

       102
       104
        
       	}

     

       103
       105
        
       

     

       104
       106
        
       	var ic models.InviteCode

     

       105
       105
       -
       	if err := s.db.Raw("SELECT * FROM invite_codes WHERE code = ?", nil, request.InviteCode).Scan(&ic).Error; err != nil {

     

       106
       106
       -
       		if err == gorm.ErrRecordNotFound {

     

       107
       107
       +
       	if s.config.RequireInvite {

     

       108
       108
       +
       		if strings.TrimSpace(request.InviteCode) == "" {

     

       107
       109
        
       			return helpers.InputError(e, to.StringPtr("InvalidInviteCode"))

     

       108
       110
        
       		}

     

       109
       109
       -
       		s.logger.Error("error getting invite code from db", "error", err)

     

       110
       110
       -
       		return helpers.ServerError(e, nil)

     

       111
       111
       -
       	}

     

       111
       111
       +
       

     

       112
       112
       +
       		if err := s.db.Raw("SELECT * FROM invite_codes WHERE code = ?", nil, request.InviteCode).Scan(&ic).Error; err != nil {

     

       113
       113
       +
       			if err == gorm.ErrRecordNotFound {

     

       114
       114
       +
       				return helpers.InputError(e, to.StringPtr("InvalidInviteCode"))

     

       115
       115
       +
       			}

     

       116
       116
       +
       			s.logger.Error("error getting invite code from db", "error", err)

     

       117
       117
       +
       			return helpers.ServerError(e, nil)

     

       118
       118
       +
       		}

     

       112
       119
        
       

     

       113
       113
       -
       	if ic.RemainingUseCount < 1 {

     

       114
       114
       -
       		return helpers.InputError(e, to.StringPtr("InvalidInviteCode"))

     

       120
       120
       +
       		if ic.RemainingUseCount < 1 {

     

       121
       121
       +
       			return helpers.InputError(e, to.StringPtr("InvalidInviteCode"))

     

       122
       122
       +
       		}

     

       115
       123
        
       	}

     

       116
       124
        
       

     

       117
       125
        
       	// see if the email is already taken

     

       118
       118
       -
       	_, err = s.getRepoByEmail(request.Email)

     

       126
       126
       +
       	existingRepo, err := s.getRepoByEmail(request.Email)

     

       119
       127
        
       	if err != nil && err != gorm.ErrRecordNotFound {

     

       120
       128
        
       		s.logger.Error("error looking up email in db", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       121
       129
        
       		return helpers.ServerError(e, nil)

     

       122
       130
        
       	}

     

       123
       123
       -
       	if err == nil {

     

       131
       131
       +
       	if err == nil && existingRepo.Did != signupDid {

     

       124
       132
        
       		return helpers.InputError(e, to.StringPtr("EmailNotAvailable"))

     

       125
       133
        
       	}

     

       126
       134
        
       

     

       127
       135
        
       	// TODO: unsupported domains

     

       128
       136
        
       

     

       129
       129
       -
       	k, err := crypto.GeneratePrivateKeyK256()

     

       130
       130
       -
       	if err != nil {

     

       131
       131
       -
       		s.logger.Error("error creating signing key", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       132
       132
       -
       		return helpers.ServerError(e, nil)

     

       137
       137
       +
       	var k *atcrypto.PrivateKeyK256

     

       138
       138
       +
       

     

       139
       139
       +
       	if signupDid != "" {

     

       140
       140
       +
       		reservedKey, err := s.getReservedKey(signupDid)

     

       141
       141
       +
       		if err != nil {

     

       142
       142
       +
       			s.logger.Error("error looking up reserved key", "error", err)

     

       143
       143
       +
       		}

     

       144
       144
       +
       		if reservedKey != nil {

     

       145
       145
       +
       			k, err = atcrypto.ParsePrivateBytesK256(reservedKey.PrivateKey)

     

       146
       146
       +
       			if err != nil {

     

       147
       147
       +
       				s.logger.Error("error parsing reserved key", "error", err)

     

       148
       148
       +
       				k = nil

     

       149
       149
       +
       			} else {

     

       150
       150
       +
       				defer func() {

     

       151
       151
       +
       					if delErr := s.deleteReservedKey(reservedKey.KeyDid, reservedKey.Did); delErr != nil {

     

       152
       152
       +
       						s.logger.Error("error deleting reserved key", "error", delErr)

     

       153
       153
       +
       					}

     

       154
       154
       +
       				}()

     

       155
       155
       +
       			}

     

       156
       156
       +
       		}

     

       157
       157
       +
       	}

     

       158
       158
       +
       

     

       159
       159
       +
       	if k == nil {

     

       160
       160
       +
       		k, err = atcrypto.GeneratePrivateKeyK256()

     

       161
       161
       +
       		if err != nil {

     

       162
       162
       +
       			s.logger.Error("error creating signing key", "endpoint", "com.atproto.server.createAccount", "error", err)

     

       163
       163
       +
       			return helpers.ServerError(e, nil)

     

       164
       164
       +
       		}

     

       133
       165
        
       	}

     

       134
       166
        
       

     

       135
       167
        
       	if signupDid == "" {

     
···

       161
       193
        
       		SigningKey:            k.Bytes(),

     

       162
       194
        
       	}

     

       163
       195
        
       

     

       164
       164
       -
       	actor := models.Actor{

     

       165
       165
       -
       		Did:    signupDid,

     

       166
       166
       -
       		Handle: request.Handle,

     

       167
       167
       -
       	}

     

       196
       196
       +
       	if actor == nil {

     

       197
       197
       +
       		actor = &models.Actor{

     

       198
       198
       +
       			Did:    signupDid,

     

       199
       199
       +
       			Handle: request.Handle,

     

       200
       200
       +
       		}

     

       168
       201
        
       

     

       169
       169
       -
       	if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       170
       170
       -
       		s.logger.Error("error inserting new repo", "error", err)

     

       171
       171
       -
       		return helpers.ServerError(e, nil)

     

       172
       172
       -
       	}

     

       173
       173
       -
       

     

       174
       174
       -
       	if err := s.db.Create(&actor, nil).Error; err != nil {

     

       175
       175
       -
       		s.logger.Error("error inserting new actor", "error", err)

     

       176
       176
       -
       		return helpers.ServerError(e, nil)

     

       202
       202
       +
       		if err := s.db.Create(&urepo, nil).Error; err != nil {

     

       203
       203
       +
       			s.logger.Error("error inserting new repo", "error", err)

     

       204
       204
       +
       			return helpers.ServerError(e, nil)

     

       205
       205
       +
       		}

     

       206
       206
       +
       	

     

       207
       207
       +
       		if err := s.db.Create(&actor, nil).Error; err != nil {

     

       208
       208
       +
       			s.logger.Error("error inserting new actor", "error", err)

     

       209
       209
       +
       			return helpers.ServerError(e, nil)

     

       210
       210
       +
       		}

     

       211
       211
       +
       	} else {

     

       212
       212
       +
       		if err := s.db.Save(&actor, nil).Error; err != nil {

     

       213
       213
       +
       			s.logger.Error("error inserting new actor", "error", err)

     

       214
       214
       +
       			return helpers.ServerError(e, nil)

     

       215
       215
       +
       		}

     

       177
       216
        
       	}

     

       178
       217
        
       

     

       179
       179
       -
       	if customDidHeader == "" {

     

       180
       180
       -
       		bs := blockstore.New(signupDid, s.db)

     

       218
       218
       +
       	if request.Did == nil || *request.Did == "" {

     

       219
       219
       +
       		bs := s.getBlockstore(signupDid)

     

       181
       220
        
       		r := repo.NewRepo(context.TODO(), signupDid, bs)

     

       182
       221
        
       

     

       183
       222
        
       		root, rev, err := r.Commit(context.TODO(), urepo.SignFor)

     
···

       186
       225
        
       			return helpers.ServerError(e, nil)

     

       187
       226
        
       		}

     

       188
       227
        
       

     

       189
       189
       -
       		if err := bs.UpdateRepo(context.TODO(), root, rev); err != nil {

     

       228
       228
       +
       		if err := s.UpdateRepo(context.TODO(), urepo.Did, root, rev); err != nil {

     

       190
       229
        
       			s.logger.Error("error updating repo after commit", "error", err)

     

       191
       230
        
       			return helpers.ServerError(e, nil)

     

       192
       231
        
       		}

     

       193
       232
        
       

     

       194
       233
        
       		s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       195
       195
       -
       			RepoHandle: &atproto.SyncSubscribeRepos_Handle{

     

       196
       196
       -
       				Did:    urepo.Did,

     

       197
       197
       -
       				Handle: request.Handle,

     

       198
       198
       -
       				Seq:    time.Now().UnixMicro(), // TODO: no

     

       199
       199
       -
       				Time:   time.Now().Format(util.ISO8601),

     

       200
       200
       -
       			},

     

       201
       201
       -
       		})

     

       202
       202
       -
       

     

       203
       203
       -
       		s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       204
       234
        
       			RepoIdentity: &atproto.SyncSubscribeRepos_Identity{

     

       205
       235
        
       				Did:    urepo.Did,

     

       206
       236
        
       				Handle: to.StringPtr(request.Handle),

     
···

       210
       240
        
       		})

     

       211
       241
        
       	}

     

       212
       242
        
       

     

       213
       213
       -
       	if err := s.db.Raw("UPDATE invite_codes SET remaining_use_count = remaining_use_count - 1 WHERE code = ?", nil, request.InviteCode).Scan(&ic).Error; err != nil {

     

       214
       214
       -
       		s.logger.Error("error decrementing use count", "error", err)

     

       215
       215
       -
       		return helpers.ServerError(e, nil)

     

       243
       243
       +
       	if s.config.RequireInvite {

     

       244
       244
       +
       		if err := s.db.Raw("UPDATE invite_codes SET remaining_use_count = remaining_use_count - 1 WHERE code = ?", nil, request.InviteCode).Scan(&ic).Error; err != nil {

     

       245
       245
       +
       			s.logger.Error("error decrementing use count", "error", err)

     

       246
       246
       +
       			return helpers.ServerError(e, nil)

     

       247
       247
       +
       		}

     

       216
       248
        
       	}

     

       217
       249
        
       

     

       218
       250
        
       	sess, err := s.createSession(&urepo)

+2 -2

server/handle_server_create_session.go

···

       102
       102
        
       		Email:           repo.Email,

     

       103
       103
        
       		EmailConfirmed:  repo.EmailConfirmedAt != nil,

     

       104
       104
        
       		EmailAuthFactor: false,

     

       105
       105
       -
       		Active:          true, // TODO: eventually do takedowns

     

       106
       106
       -
       		Status:          nil,  // TODO eventually do takedowns

     

       105
       105
       +
       		Active:          repo.Active(),

     

       106
       106
       +
       		Status:          repo.Status(),

     

       107
       107
        
       	})

     

       108
       108
        
       }

+46

server/handle_server_deactivate_account.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/events"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/util"

     

       11
       11
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       12
       12
       +
       	"github.com/haileyok/cocoon/models"

     

       13
       13
       +
       	"github.com/labstack/echo/v4"

     

       14
       14
       +
       )

     

       15
       15
       +
       

     

       16
       16
       +
       type ComAtprotoServerDeactivateAccountRequest struct {

     

       17
       17
       +
       	// NOTE: this implementation will not pay attention to this value

     

       18
       18
       +
       	DeleteAfter time.Time `json:"deleteAfter"`

     

       19
       19
       +
       }

     

       20
       20
       +
       

     

       21
       21
       +
       func (s *Server) handleServerDeactivateAccount(e echo.Context) error {

     

       22
       22
       +
       	var req ComAtprotoServerDeactivateAccountRequest

     

       23
       23
       +
       	if err := e.Bind(&req); err != nil {

     

       24
       24
       +
       		s.logger.Error("error binding", "error", err)

     

       25
       25
       +
       		return helpers.ServerError(e, nil)

     

       26
       26
       +
       	}

     

       27
       27
       +
       

     

       28
       28
       +
       	urepo := e.Get("repo").(*models.RepoActor)

     

       29
       29
       +
       

     

       30
       30
       +
       	if err := s.db.Exec("UPDATE repos SET deactivated = ? WHERE did = ?", nil, true, urepo.Repo.Did).Error; err != nil {

     

       31
       31
       +
       		s.logger.Error("error updating account status to deactivated", "error", err)

     

       32
       32
       +
       		return helpers.ServerError(e, nil)

     

       33
       33
       +
       	}

     

       34
       34
       +
       

     

       35
       35
       +
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       36
       36
       +
       		RepoAccount: &atproto.SyncSubscribeRepos_Account{

     

       37
       37
       +
       			Active: false,

     

       38
       38
       +
       			Did:    urepo.Repo.Did,

     

       39
       39
       +
       			Status: to.StringPtr("deactivated"),

     

       40
       40
       +
       			Seq:    time.Now().UnixMicro(), // TODO: bad puppy

     

       41
       41
       +
       			Time:   time.Now().Format(util.ISO8601),

     

       42
       42
       +
       		},

     

       43
       43
       +
       	})

     

       44
       44
       +
       

     

       45
       45
       +
       	return e.NoContent(200)

     

       46
       46
       +
       }

+145

server/handle_server_delete_account.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/api/atproto"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/events"

     

       10
       10
       +
       	"github.com/bluesky-social/indigo/util"

     

       11
       11
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       12
       12
       +
       	"github.com/labstack/echo/v4"

     

       13
       13
       +
       	"golang.org/x/crypto/bcrypt"

     

       14
       14
       +
       )

     

       15
       15
       +
       

     

       16
       16
       +
       type ComAtprotoServerDeleteAccountRequest struct {

     

       17
       17
       +
       	Did      string `json:"did" validate:"required"`

     

       18
       18
       +
       	Password string `json:"password" validate:"required"`

     

       19
       19
       +
       	Token    string `json:"token" validate:"required"`

     

       20
       20
       +
       }

     

       21
       21
       +
       

     

       22
       22
       +
       func (s *Server) handleServerDeleteAccount(e echo.Context) error {

     

       23
       23
       +
       	var req ComAtprotoServerDeleteAccountRequest

     

       24
       24
       +
       	if err := e.Bind(&req); err != nil {

     

       25
       25
       +
       		s.logger.Error("error binding", "error", err)

     

       26
       26
       +
       		return helpers.ServerError(e, nil)

     

       27
       27
       +
       	}

     

       28
       28
       +
       

     

       29
       29
       +
       	if err := e.Validate(&req); err != nil {

     

       30
       30
       +
       		s.logger.Error("error validating", "error", err)

     

       31
       31
       +
       		return helpers.ServerError(e, nil)

     

       32
       32
       +
       	}

     

       33
       33
       +
       

     

       34
       34
       +
       	urepo, err := s.getRepoActorByDid(req.Did)

     

       35
       35
       +
       	if err != nil {

     

       36
       36
       +
       		s.logger.Error("error getting repo", "error", err)

     

       37
       37
       +
       		return echo.NewHTTPError(400, "account not found")

     

       38
       38
       +
       	}

     

       39
       39
       +
       

     

       40
       40
       +
       	if err := bcrypt.CompareHashAndPassword([]byte(urepo.Repo.Password), []byte(req.Password)); err != nil {

     

       41
       41
       +
       		s.logger.Error("password mismatch", "error", err)

     

       42
       42
       +
       		return echo.NewHTTPError(401, "Invalid did or password")

     

       43
       43
       +
       	}

     

       44
       44
       +
       

     

       45
       45
       +
       	if urepo.Repo.AccountDeleteCode == nil || urepo.Repo.AccountDeleteCodeExpiresAt == nil {

     

       46
       46
       +
       		s.logger.Error("no deletion token found for account")

     

       47
       47
       +
       		return echo.NewHTTPError(400, map[string]interface{}{

     

       48
       48
       +
       			"error":   "InvalidToken",

     

       49
       49
       +
       			"message": "Token is invalid",

     

       50
       50
       +
       		})

     

       51
       51
       +
       	}

     

       52
       52
       +
       

     

       53
       53
       +
       	if *urepo.Repo.AccountDeleteCode != req.Token {

     

       54
       54
       +
       		s.logger.Error("deletion token mismatch")

     

       55
       55
       +
       		return echo.NewHTTPError(400, map[string]interface{}{

     

       56
       56
       +
       			"error":   "InvalidToken",

     

       57
       57
       +
       			"message": "Token is invalid",

     

       58
       58
       +
       		})

     

       59
       59
       +
       	}

     

       60
       60
       +
       

     

       61
       61
       +
       	if time.Now().UTC().After(*urepo.Repo.AccountDeleteCodeExpiresAt) {

     

       62
       62
       +
       		s.logger.Error("deletion token expired")

     

       63
       63
       +
       		return echo.NewHTTPError(400, map[string]interface{}{

     

       64
       64
       +
       			"error":   "ExpiredToken",

     

       65
       65
       +
       			"message": "Token is expired",

     

       66
       66
       +
       		})

     

       67
       67
       +
       	}

     

       68
       68
       +
       

     

       69
       69
       +
       	tx := s.db.BeginDangerously()

     

       70
       70
       +
       	if tx.Error != nil {

     

       71
       71
       +
       		s.logger.Error("error starting transaction", "error", tx.Error)

     

       72
       72
       +
       		return helpers.ServerError(e, nil)

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	if err := tx.Exec("DELETE FROM blocks WHERE did = ?", nil, req.Did).Error; err != nil {

     

       76
       76
       +
       		tx.Rollback()

     

       77
       77
       +
       		s.logger.Error("error deleting blocks", "error", err)

     

       78
       78
       +
       		return helpers.ServerError(e, nil)

     

       79
       79
       +
       	}

     

       80
       80
       +
       

     

       81
       81
       +
       	if err := tx.Exec("DELETE FROM records WHERE did = ?", nil, req.Did).Error; err != nil {

     

       82
       82
       +
       		tx.Rollback()

     

       83
       83
       +
       		s.logger.Error("error deleting records", "error", err)

     

       84
       84
       +
       		return helpers.ServerError(e, nil)

     

       85
       85
       +
       	}

     

       86
       86
       +
       

     

       87
       87
       +
       	if err := tx.Exec("DELETE FROM blobs WHERE did = ?", nil, req.Did).Error; err != nil {

     

       88
       88
       +
       		tx.Rollback()

     

       89
       89
       +
       		s.logger.Error("error deleting blobs", "error", err)

     

       90
       90
       +
       		return helpers.ServerError(e, nil)

     

       91
       91
       +
       	}

     

       92
       92
       +
       

     

       93
       93
       +
       	if err := tx.Exec("DELETE FROM tokens WHERE did = ?", nil, req.Did).Error; err != nil {

     

       94
       94
       +
       		tx.Rollback()

     

       95
       95
       +
       		s.logger.Error("error deleting tokens", "error", err)

     

       96
       96
       +
       		return helpers.ServerError(e, nil)

     

       97
       97
       +
       	}

     

       98
       98
       +
       

     

       99
       99
       +
       	if err := tx.Exec("DELETE FROM refresh_tokens WHERE did = ?", nil, req.Did).Error; err != nil {

     

       100
       100
       +
       		tx.Rollback()

     

       101
       101
       +
       		s.logger.Error("error deleting refresh tokens", "error", err)

     

       102
       102
       +
       		return helpers.ServerError(e, nil)

     

       103
       103
       +
       	}

     

       104
       104
       +
       

     

       105
       105
       +
       	if err := tx.Exec("DELETE FROM reserved_keys WHERE did = ?", nil, req.Did).Error; err != nil {

     

       106
       106
       +
       		tx.Rollback()

     

       107
       107
       +
       		s.logger.Error("error deleting reserved keys", "error", err)

     

       108
       108
       +
       		return helpers.ServerError(e, nil)

     

       109
       109
       +
       	}

     

       110
       110
       +
       

     

       111
       111
       +
       	if err := tx.Exec("DELETE FROM invite_codes WHERE did = ?", nil, req.Did).Error; err != nil {

     

       112
       112
       +
       		tx.Rollback()

     

       113
       113
       +
       		s.logger.Error("error deleting invite codes", "error", err)

     

       114
       114
       +
       		return helpers.ServerError(e, nil)

     

       115
       115
       +
       	}

     

       116
       116
       +
       

     

       117
       117
       +
       	if err := tx.Exec("DELETE FROM actors WHERE did = ?", nil, req.Did).Error; err != nil {

     

       118
       118
       +
       		tx.Rollback()

     

       119
       119
       +
       		s.logger.Error("error deleting actor", "error", err)

     

       120
       120
       +
       		return helpers.ServerError(e, nil)

     

       121
       121
       +
       	}

     

       122
       122
       +
       

     

       123
       123
       +
       	if err := tx.Exec("DELETE FROM repos WHERE did = ?", nil, req.Did).Error; err != nil {

     

       124
       124
       +
       		tx.Rollback()

     

       125
       125
       +
       		s.logger.Error("error deleting repo", "error", err)

     

       126
       126
       +
       		return helpers.ServerError(e, nil)

     

       127
       127
       +
       	}

     

       128
       128
       +
       

     

       129
       129
       +
       	if err := tx.Commit().Error; err != nil {

     

       130
       130
       +
       		s.logger.Error("error committing transaction", "error", err)

     

       131
       131
       +
       		return helpers.ServerError(e, nil)

     

       132
       132
       +
       	}

     

       133
       133
       +
       

     

       134
       134
       +
       	s.evtman.AddEvent(context.TODO(), &events.XRPCStreamEvent{

     

       135
       135
       +
       		RepoAccount: &atproto.SyncSubscribeRepos_Account{

     

       136
       136
       +
       			Active: false,

     

       137
       137
       +
       			Did:    req.Did,

     

       138
       138
       +
       			Status: to.StringPtr("deleted"),

     

       139
       139
       +
       			Seq:    time.Now().UnixMicro(),

     

       140
       140
       +
       			Time:   time.Now().Format(util.ISO8601),

     

       141
       141
       +
       		},

     

       142
       142
       +
       	})

     

       143
       143
       +
       

     

       144
       144
       +
       	return e.NoContent(200)

     

       145
       145
       +
       }

+1 -1

server/handle_server_describe_server.go

···

       22
       22
        
       

     

       23
       23
        
       func (s *Server) handleDescribeServer(e echo.Context) error {

     

       24
       24
        
       	return e.JSON(200, ComAtprotoServerDescribeServerResponse{

     

       25
       25
       -
       		InviteCodeRequired:        true,

     

       25
       25
       +
       		InviteCodeRequired:        s.config.RequireInvite,

     

       26
       26
        
       		PhoneVerificationRequired: false,

     

       27
       27
        
       		AvailableUserDomains:      []string{"." + s.config.Hostname}, // TODO: more

     

       28
       28
        
       		Links: ComAtprotoServerDescribeServerResponseLinks{

+17 -8

server/handle_server_get_service_auth.go

···

       19
       19
        
       

     

       20
       20
        
       type ServerGetServiceAuthRequest struct {

     

       21
       21
        
       	Aud string `query:"aud" validate:"required,atproto-did"`

     

       22
       22
       -
       	Exp int64  `query:"exp"`

     

       23
       23
       -
       	Lxm string `query:"lxm" validate:"required,atproto-nsid"`

     

       22
       22
       +
       	// exp should be a float, as some clients will send a non-integer expiration

     

       23
       23
       +
       	Exp float64 `query:"exp"`

     

       24
       24
       +
       	Lxm string  `query:"lxm"`

     

       24
       25
        
       }

     

       25
       26
        
       

     

       26
       27
        
       func (s *Server) handleServerGetServiceAuth(e echo.Context) error {

     
···

       34
       35
        
       		return helpers.InputError(e, nil)

     

       35
       36
        
       	}

     

       36
       37
        
       

     

       38
       38
       +
       	exp := int64(req.Exp)

     

       37
       39
        
       	now := time.Now().Unix()

     

       38
       38
       -
       	if req.Exp == 0 {

     

       39
       39
       -
       		req.Exp = now + 60 // default

     

       40
       40
       +
       	if exp == 0 {

     

       41
       41
       +
       		exp = now + 60 // default

     

       40
       42
        
       	}

     

       41
       43
        
       

     

       42
       44
        
       	if req.Lxm == "com.atproto.server.getServiceAuth" {

     

       43
       45
        
       		return helpers.InputError(e, to.StringPtr("may not generate auth tokens recursively"))

     

       44
       46
        
       	}

     

       45
       47
        
       

     

       46
       46
       -
       	maxExp := now + (60 * 30)

     

       47
       47
       -
       	if req.Exp > maxExp {

     

       48
       48
       +
       	var maxExp int64

     

       49
       49
       +
       	if req.Lxm != "" {

     

       50
       50
       +
       		maxExp = now + (60 * 60)

     

       51
       51
       +
       	} else {

     

       52
       52
       +
       		maxExp = now + 60

     

       53
       53
       +
       	}

     

       54
       54
       +
       	if exp > maxExp {

     

       48
       55
        
       		return helpers.InputError(e, to.StringPtr("expiration too big. smoller please"))

     

       49
       56
        
       	}

     

       50
       57
        
       

     
···

       66
       73
        
       	payload := map[string]any{

     

       67
       74
        
       		"iss": repo.Repo.Did,

     

       68
       75
        
       		"aud": req.Aud,

     

       69
       69
       -
       		"lxm": req.Lxm,

     

       70
       76
        
       		"jti": uuid.NewString(),

     

       71
       71
       -
       		"exp": req.Exp,

     

       77
       77
       +
       		"exp": exp,

     

       72
       78
        
       		"iat": now,

     

       79
       79
       +
       	}

     

       80
       80
       +
       	if req.Lxm != "" {

     

       81
       81
       +
       		payload["lxm"] = req.Lxm

     

       73
       82
        
       	}

     

       74
       83
        
       	pj, err := json.Marshal(payload)

     

       75
       84
        
       	if err != nil {

+2 -2

server/handle_server_get_session.go

···

       24
       24
        
       		Email:           repo.Email,

     

       25
       25
        
       		EmailConfirmed:  repo.EmailConfirmedAt != nil,

     

       26
       26
        
       		EmailAuthFactor: false, // TODO: todo todo

     

       27
       27
       -
       		Active:          true,

     

       28
       28
       -
       		Status:          nil,

     

       27
       27
       +
       		Active:          repo.Active(),

     

       28
       28
       +
       		Status:          repo.Status(),

     

       29
       29
        
       	})

     

       30
       30
        
       }

+2 -2

server/handle_server_refresh_session.go

···

       40
       40
        
       		RefreshJwt: sess.RefreshToken,

     

       41
       41
        
       		Handle:     repo.Handle,

     

       42
       42
        
       		Did:        repo.Repo.Did,

     

       43
       43
       -
       		Active:     true,

     

       44
       44
       -
       		Status:     nil,

     

       43
       43
       +
       		Active:     repo.Active(),

     

       44
       44
       +
       		Status:     repo.Status(),

     

       45
       45
        
       	})

     

       46
       46
        
       }

+49

server/handle_server_request_account_delete.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"fmt"

     

       5
       5
       +
       	"time"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       8
       +
       	"github.com/haileyok/cocoon/models"

     

       9
       9
       +
       	"github.com/labstack/echo/v4"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       func (s *Server) handleServerRequestAccountDelete(e echo.Context) error {

     

       13
       13
       +
       	urepo := e.Get("repo").(*models.RepoActor)

     

       14
       14
       +
       

     

       15
       15
       +
       	token := fmt.Sprintf("%s-%s", helpers.RandomVarchar(5), helpers.RandomVarchar(5))

     

       16
       16
       +
       	expiresAt := time.Now().UTC().Add(15 * time.Minute)

     

       17
       17
       +
       

     

       18
       18
       +
       	if err := s.db.Exec("UPDATE repos SET account_delete_code = ?, account_delete_code_expires_at = ? WHERE did = ?", nil, token, expiresAt, urepo.Repo.Did).Error; err != nil {

     

       19
       19
       +
       		s.logger.Error("error setting deletion token", "error", err)

     

       20
       20
       +
       		return helpers.ServerError(e, nil)

     

       21
       21
       +
       	}

     

       22
       22
       +
       

     

       23
       23
       +
       	if urepo.Email != "" {

     

       24
       24
       +
       		if err := s.sendAccountDeleteEmail(urepo.Email, urepo.Actor.Handle, token); err != nil {

     

       25
       25
       +
       			s.logger.Error("error sending account deletion email", "error", err)

     

       26
       26
       +
       		}

     

       27
       27
       +
       	}

     

       28
       28
       +
       

     

       29
       29
       +
       	return e.NoContent(200)

     

       30
       30
       +
       }

     

       31
       31
       +
       

     

       32
       32
       +
       func (s *Server) sendAccountDeleteEmail(email, handle, token string) error {

     

       33
       33
       +
       	if s.mail == nil {

     

       34
       34
       +
       		return nil

     

       35
       35
       +
       	}

     

       36
       36
       +
       

     

       37
       37
       +
       	s.mailLk.Lock()

     

       38
       38
       +
       	defer s.mailLk.Unlock()

     

       39
       39
       +
       

     

       40
       40
       +
       	s.mail.To(email)

     

       41
       41
       +
       	s.mail.Subject("Account Deletion Request for " + s.config.Hostname)

     

       42
       42
       +
       	s.mail.Plain().Set(fmt.Sprintf("Hello %s. Your account deletion code is %s. This code will expire in fifteen minutes. If you did not request this, please ignore this email.", handle, token))

     

       43
       43
       +
       

     

       44
       44
       +
       	if err := s.mail.Send(); err != nil {

     

       45
       45
       +
       		return err

     

       46
       46
       +
       	}

     

       47
       47
       +
       

     

       48
       48
       +
       	return nil

     

       49
       49
       +
       }

+95

server/handle_server_reserve_signing_key.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"time"

     

       5
       5
       +
       

     

       6
       6
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       7
       7
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       8
       +
       	"github.com/haileyok/cocoon/models"

     

       9
       9
       +
       	"github.com/labstack/echo/v4"

     

       10
       10
       +
       )

     

       11
       11
       +
       

     

       12
       12
       +
       type ServerReserveSigningKeyRequest struct {

     

       13
       13
       +
       	Did *string `json:"did"`

     

       14
       14
       +
       }

     

       15
       15
       +
       

     

       16
       16
       +
       type ServerReserveSigningKeyResponse struct {

     

       17
       17
       +
       	SigningKey string `json:"signingKey"`

     

       18
       18
       +
       }

     

       19
       19
       +
       

     

       20
       20
       +
       func (s *Server) handleServerReserveSigningKey(e echo.Context) error {

     

       21
       21
       +
       	var req ServerReserveSigningKeyRequest

     

       22
       22
       +
       	if err := e.Bind(&req); err != nil {

     

       23
       23
       +
       		s.logger.Error("could not bind reserve signing key request", "error", err)

     

       24
       24
       +
       		return helpers.ServerError(e, nil)

     

       25
       25
       +
       	}

     

       26
       26
       +
       

     

       27
       27
       +
       	if req.Did != nil && *req.Did != "" {

     

       28
       28
       +
       		var existing models.ReservedKey

     

       29
       29
       +
       		if err := s.db.Raw("SELECT * FROM reserved_keys WHERE did = ?", nil, *req.Did).Scan(&existing).Error; err == nil && existing.KeyDid != "" {

     

       30
       30
       +
       			return e.JSON(200, ServerReserveSigningKeyResponse{

     

       31
       31
       +
       				SigningKey: existing.KeyDid,

     

       32
       32
       +
       			})

     

       33
       33
       +
       		}

     

       34
       34
       +
       	}

     

       35
       35
       +
       

     

       36
       36
       +
       	k, err := atcrypto.GeneratePrivateKeyK256()

     

       37
       37
       +
       	if err != nil {

     

       38
       38
       +
       		s.logger.Error("error creating signing key", "endpoint", "com.atproto.server.reserveSigningKey", "error", err)

     

       39
       39
       +
       		return helpers.ServerError(e, nil)

     

       40
       40
       +
       	}

     

       41
       41
       +
       

     

       42
       42
       +
       	pubKey, err := k.PublicKey()

     

       43
       43
       +
       	if err != nil {

     

       44
       44
       +
       		s.logger.Error("error getting public key", "endpoint", "com.atproto.server.reserveSigningKey", "error", err)

     

       45
       45
       +
       		return helpers.ServerError(e, nil)

     

       46
       46
       +
       	}

     

       47
       47
       +
       

     

       48
       48
       +
       	keyDid := pubKey.DIDKey()

     

       49
       49
       +
       

     

       50
       50
       +
       	reservedKey := models.ReservedKey{

     

       51
       51
       +
       		KeyDid:     keyDid,

     

       52
       52
       +
       		Did:        req.Did,

     

       53
       53
       +
       		PrivateKey: k.Bytes(),

     

       54
       54
       +
       		CreatedAt:  time.Now(),

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	if err := s.db.Create(&reservedKey, nil).Error; err != nil {

     

       58
       58
       +
       		s.logger.Error("error storing reserved key", "endpoint", "com.atproto.server.reserveSigningKey", "error", err)

     

       59
       59
       +
       		return helpers.ServerError(e, nil)

     

       60
       60
       +
       	}

     

       61
       61
       +
       

     

       62
       62
       +
       	s.logger.Info("reserved signing key", "keyDid", keyDid, "forDid", req.Did)

     

       63
       63
       +
       

     

       64
       64
       +
       	return e.JSON(200, ServerReserveSigningKeyResponse{

     

       65
       65
       +
       		SigningKey: keyDid,

     

       66
       66
       +
       	})

     

       67
       67
       +
       }

     

       68
       68
       +
       

     

       69
       69
       +
       func (s *Server) getReservedKey(keyDidOrDid string) (*models.ReservedKey, error) {

     

       70
       70
       +
       	var reservedKey models.ReservedKey

     

       71
       71
       +
       

     

       72
       72
       +
       	if err := s.db.Raw("SELECT * FROM reserved_keys WHERE key_did = ?", nil, keyDidOrDid).Scan(&reservedKey).Error; err == nil && reservedKey.KeyDid != "" {

     

       73
       73
       +
       		return &reservedKey, nil

     

       74
       74
       +
       	}

     

       75
       75
       +
       

     

       76
       76
       +
       	if err := s.db.Raw("SELECT * FROM reserved_keys WHERE did = ?", nil, keyDidOrDid).Scan(&reservedKey).Error; err == nil && reservedKey.KeyDid != "" {

     

       77
       77
       +
       		return &reservedKey, nil

     

       78
       78
       +
       	}

     

       79
       79
       +
       

     

       80
       80
       +
       	return nil, nil

     

       81
       81
       +
       }

     

       82
       82
       +
       

     

       83
       83
       +
       func (s *Server) deleteReservedKey(keyDid string, did *string) error {

     

       84
       84
       +
       	if err := s.db.Exec("DELETE FROM reserved_keys WHERE key_did = ?", nil, keyDid).Error; err != nil {

     

       85
       85
       +
       		return err

     

       86
       86
       +
       	}

     

       87
       87
       +
       

     

       88
       88
       +
       	if did != nil && *did != "" {

     

       89
       89
       +
       		if err := s.db.Exec("DELETE FROM reserved_keys WHERE did = ?", nil, *did).Error; err != nil {

     

       90
       90
       +
       			return err

     

       91
       91
       +
       		}

     

       92
       92
       +
       	}

     

       93
       93
       +
       

     

       94
       94
       +
       	return nil

     

       95
       95
       +
       }

+2 -2

server/handle_server_reset_password.go

···

       33
       33
        
       	}

     

       34
       34
        
       

     

       35
       35
        
       	if *urepo.PasswordResetCode != req.Token {

     

       36
       36
       -
       		return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       36
       36
       +
       		return helpers.InvalidTokenError(e)

     

       37
       37
        
       	}

     

       38
       38
        
       

     

       39
       39
        
       	if time.Now().UTC().After(*urepo.PasswordResetCodeExpiresAt) {

     

       40
       40
       -
       		return helpers.InputError(e, to.StringPtr("ExpiredToken"))

     

       40
       40
       +
       		return helpers.ExpiredTokenError(e)

     

       41
       41
        
       	}

     

       42
       42
        
       

     

       43
       43
        
       	hash, err := bcrypt.GenerateFromPassword([]byte(req.Password), 10)

+3 -4

server/handle_server_update_email.go

···

       3
       3
        
       import (

     

       4
       4
        
       	"time"

     

       5
       5
        
       

     

       6
       6
       -
       	"github.com/Azure/go-autorest/autorest/to"

     

       7
       6
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       8
       7
        
       	"github.com/haileyok/cocoon/models"

     

       9
       8
        
       	"github.com/labstack/echo/v4"

     
···

       29
       28
        
       	}

     

       30
       29
        
       

     

       31
       30
        
       	if urepo.EmailUpdateCode == nil || urepo.EmailUpdateCodeExpiresAt == nil {

     

       32
       32
       -
       		return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       31
       31
       +
       		return helpers.InvalidTokenError(e)

     

       33
       32
        
       	}

     

       34
       33
        
       

     

       35
       34
        
       	if *urepo.EmailUpdateCode != req.Token {

     

       36
       36
       -
       		return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       35
       35
       +
       		return helpers.InvalidTokenError(e)

     

       37
       36
        
       	}

     

       38
       37
        
       

     

       39
       38
        
       	if time.Now().UTC().After(*urepo.EmailUpdateCodeExpiresAt) {

     

       40
       40
       -
       		return helpers.InputError(e, to.StringPtr("ExpiredToken"))

     

       39
       39
       +
       		return helpers.ExpiredTokenError(e)

     

       41
       40
        
       	}

     

       42
       41
        
       

     

       43
       42
        
       	if err := s.db.Exec("UPDATE repos SET email_update_code = NULL, email_update_code_expires_at = NULL, email_confirmed_at = NULL,  email = ? WHERE did = ?", nil, req.Email, urepo.Repo.Did).Error; err != nil {

+91 -8

server/handle_sync_get_blob.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"bytes"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"io"

     

       5
       7
        
       

     

       8
       8
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       9
       9
       +
       	"github.com/aws/aws-sdk-go/aws"

     

       10
       10
       +
       	"github.com/aws/aws-sdk-go/aws/credentials"

     

       11
       11
       +
       	"github.com/aws/aws-sdk-go/aws/session"

     

       12
       12
       +
       	"github.com/aws/aws-sdk-go/service/s3"

     

       6
       13
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       7
       14
        
       	"github.com/haileyok/cocoon/models"

     

       8
       15
        
       	"github.com/ipfs/go-cid"

     
···

       25
       32
        
       		return helpers.InputError(e, nil)

     

       26
       33
        
       	}

     

       27
       34
        
       

     

       35
       35
       +
       	urepo, err := s.getRepoActorByDid(did)

     

       36
       36
       +
       	if err != nil {

     

       37
       37
       +
       		s.logger.Error("could not find user for requested blob", "error", err)

     

       38
       38
       +
       		return helpers.InputError(e, nil)

     

       39
       39
       +
       	}

     

       40
       40
       +
       

     

       41
       41
       +
       	status := urepo.Status()

     

       42
       42
       +
       	if status != nil {

     

       43
       43
       +
       		if *status == "deactivated" {

     

       44
       44
       +
       			return helpers.InputError(e, to.StringPtr("RepoDeactivated"))

     

       45
       45
       +
       		}

     

       46
       46
       +
       	}

     

       47
       47
       +
       

     

       28
       48
        
       	var blob models.Blob

     

       29
       49
        
       	if err := s.db.Raw("SELECT * FROM blobs WHERE did = ? AND cid = ?", nil, did, c.Bytes()).Scan(&blob).Error; err != nil {

     

       30
       50
        
       		s.logger.Error("error looking up blob", "error", err)

     
···

       33
       53
        
       

     

       34
       54
        
       	buf := new(bytes.Buffer)

     

       35
       55
        
       

     

       36
       36
       -
       	var parts []models.BlobPart

     

       37
       37
       -
       	if err := s.db.Raw("SELECT * FROM blob_parts WHERE blob_id = ? ORDER BY idx", nil, blob.ID).Scan(&parts).Error; err != nil {

     

       38
       38
       -
       		s.logger.Error("error getting blob parts", "error", err)

     

       39
       39
       -
       		return helpers.ServerError(e, nil)

     

       40
       40
       -
       	}

     

       56
       56
       +
       	if blob.Storage == "sqlite" {

     

       57
       57
       +
       		var parts []models.BlobPart

     

       58
       58
       +
       		if err := s.db.Raw("SELECT * FROM blob_parts WHERE blob_id = ? ORDER BY idx", nil, blob.ID).Scan(&parts).Error; err != nil {

     

       59
       59
       +
       			s.logger.Error("error getting blob parts", "error", err)

     

       60
       60
       +
       			return helpers.ServerError(e, nil)

     

       61
       61
       +
       		}

     

       62
       62
       +
       

     

       63
       63
       +
       		// TODO: we can just stream this, don't need to make a buffer

     

       64
       64
       +
       		for _, p := range parts {

     

       65
       65
       +
       			buf.Write(p.Data)

     

       66
       66
       +
       		}

     

       67
       67
       +
       	} else if blob.Storage == "s3" {

     

       68
       68
       +
       		if !(s.s3Config != nil && s.s3Config.BlobstoreEnabled) {

     

       69
       69
       +
       			s.logger.Error("s3 storage disabled")

     

       70
       70
       +
       			return helpers.ServerError(e, nil)

     

       71
       71
       +
       		}

     

       72
       72
       +
       

     

       73
       73
       +
       		blobKey := fmt.Sprintf("blobs/%s/%s", urepo.Repo.Did, c.String())

     

       74
       74
       +
       

     

       75
       75
       +
       		if s.s3Config.CDNUrl != "" {

     

       76
       76
       +
       			redirectUrl := fmt.Sprintf("%s/%s", s.s3Config.CDNUrl, blobKey)

     

       77
       77
       +
       			return e.Redirect(302, redirectUrl)

     

       78
       78
       +
       		}

     

       79
       79
       +
       

     

       80
       80
       +
       		config := &aws.Config{

     

       81
       81
       +
       			Region:      aws.String(s.s3Config.Region),

     

       82
       82
       +
       			Credentials: credentials.NewStaticCredentials(s.s3Config.AccessKey, s.s3Config.SecretKey, ""),

     

       83
       83
       +
       		}

     

       84
       84
       +
       

     

       85
       85
       +
       		if s.s3Config.Endpoint != "" {

     

       86
       86
       +
       			config.Endpoint = aws.String(s.s3Config.Endpoint)

     

       87
       87
       +
       			config.S3ForcePathStyle = aws.Bool(true)

     

       88
       88
       +
       		}

     

       89
       89
       +
       

     

       90
       90
       +
       		sess, err := session.NewSession(config)

     

       91
       91
       +
       		if err != nil {

     

       92
       92
       +
       			s.logger.Error("error creating aws session", "error", err)

     

       93
       93
       +
       			return helpers.ServerError(e, nil)

     

       94
       94
       +
       		}

     

       95
       95
       +
       

     

       96
       96
       +
       		svc := s3.New(sess)

     

       97
       97
       +
       		if result, err := svc.GetObject(&s3.GetObjectInput{

     

       98
       98
       +
       			Bucket: aws.String(s.s3Config.Bucket),

     

       99
       99
       +
       			Key:    aws.String(blobKey),

     

       100
       100
       +
       		}); err != nil {

     

       101
       101
       +
       			s.logger.Error("error getting blob from s3", "error", err)

     

       102
       102
       +
       			return helpers.ServerError(e, nil)

     

       103
       103
       +
       		} else {

     

       104
       104
       +
       			read := 0

     

       105
       105
       +
       			part := 0

     

       106
       106
       +
       			partBuf := make([]byte, 0x10000)

     

       107
       107
       +
       

     

       108
       108
       +
       			for {

     

       109
       109
       +
       				n, err := io.ReadFull(result.Body, partBuf)

     

       110
       110
       +
       				if err == io.ErrUnexpectedEOF || err == io.EOF {

     

       111
       111
       +
       					if n == 0 {

     

       112
       112
       +
       						break

     

       113
       113
       +
       					}

     

       114
       114
       +
       				} else if err != nil && err != io.ErrUnexpectedEOF {

     

       115
       115
       +
       					s.logger.Error("error reading blob", "error", err)

     

       116
       116
       +
       					return helpers.ServerError(e, nil)

     

       117
       117
       +
       				}

     

       41
       118
        
       

     

       42
       42
       -
       	// TODO: we can just stream this, don't need to make a buffer

     

       43
       43
       -
       	for _, p := range parts {

     

       44
       44
       -
       		buf.Write(p.Data)

     

       119
       119
       +
       				data := partBuf[:n]

     

       120
       120
       +
       				read += n

     

       121
       121
       +
       				buf.Write(data)

     

       122
       122
       +
       				part++

     

       123
       123
       +
       			}

     

       124
       124
       +
       		}

     

       125
       125
       +
       	} else {

     

       126
       126
       +
       		s.logger.Error("unknown storage", "storage", blob.Storage)

     

       127
       127
       +
       		return helpers.ServerError(e, nil)

     

       45
       128
        
       	}

     

       46
       129
        
       

     

       47
       130
        
       	e.Response().Header().Set(echo.HeaderContentDisposition, "attachment; filename="+c.String())

+14 -12

server/handle_sync_get_blocks.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"bytes"

     

       5
       5
       -
       	"context"

     

       6
       6
       -
       	"strings"

     

       7
       5
        
       

     

       8
       6
        
       	"github.com/bluesky-social/indigo/carstore"

     

       9
       9
       -
       	"github.com/haileyok/cocoon/blockstore"

     

       10
       7
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       11
       8
        
       	"github.com/ipfs/go-cid"

     

       12
       9
        
       	cbor "github.com/ipfs/go-ipld-cbor"

     
···

       14
       11
        
       	"github.com/labstack/echo/v4"

     

       15
       12
        
       )

     

       16
       13
        
       

     

       14
       14
       +
       type ComAtprotoSyncGetBlocksRequest struct {

     

       15
       15
       +
       	Did  string   `query:"did"`

     

       16
       16
       +
       	Cids []string `query:"cids"`

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       17
       19
        
       func (s *Server) handleGetBlocks(e echo.Context) error {

     

       18
       18
       -
       	did := e.QueryParam("did")

     

       19
       19
       -
       	cidsstr := e.QueryParam("cids")

     

       20
       20
       -
       	if did == "" {

     

       20
       20
       +
       	ctx := e.Request().Context()

     

       21
       21
       +
       

     

       22
       22
       +
       	var req ComAtprotoSyncGetBlocksRequest

     

       23
       23
       +
       	if err := e.Bind(&req); err != nil {

     

       21
       24
        
       		return helpers.InputError(e, nil)

     

       22
       25
        
       	}

     

       23
       26
        
       

     

       24
       24
       -
       	cidstrs := strings.Split(cidsstr, ",")

     

       25
       25
       -
       	cids := []cid.Cid{}

     

       27
       27
       +
       	var cids []cid.Cid

     

       26
       28
        
       

     

       27
       27
       -
       	for _, cs := range cidstrs {

     

       29
       29
       +
       	for _, cs := range req.Cids {

     

       28
       30
        
       		c, err := cid.Cast([]byte(cs))

     

       29
       31
        
       		if err != nil {

     

       30
       32
        
       			return err

     
···

       33
       35
        
       		cids = append(cids, c)

     

       34
       36
        
       	}

     

       35
       37
        
       

     

       36
       36
       -
       	urepo, err := s.getRepoActorByDid(did)

     

       38
       38
       +
       	urepo, err := s.getRepoActorByDid(req.Did)

     

       37
       39
        
       	if err != nil {

     

       38
       40
        
       		return helpers.ServerError(e, nil)

     

       39
       41
        
       	}

     
···

       54
       56
        
       		return helpers.ServerError(e, nil)

     

       55
       57
        
       	}

     

       56
       58
        
       

     

       57
       57
       -
       	bs := blockstore.New(urepo.Repo.Did, s.db)

     

       59
       59
       +
       	bs := s.getBlockstore(urepo.Repo.Did)

     

       58
       60
        
       

     

       59
       61
        
       	for _, c := range cids {

     

       60
       60
       -
       		b, err := bs.Get(context.TODO(), c)

     

       62
       62
       +
       		b, err := bs.Get(ctx, c)

     

       61
       63
        
       		if err != nil {

     

       62
       64
        
       			return err

     

       63
       65
        
       		}

+2 -2

server/handle_sync_get_repo_status.go

···

       26
       26
        
       

     

       27
       27
        
       	return e.JSON(200, ComAtprotoSyncGetRepoStatusResponse{

     

       28
       28
        
       		Did:    urepo.Repo.Did,

     

       29
       29
       -
       		Active: true,

     

       30
       30
       -
       		Status: nil,

     

       29
       29
       +
       		Active: urepo.Active(),

     

       30
       30
       +
       		Status: urepo.Status(),

     

       31
       31
        
       		Rev:    &urepo.Rev,

     

       32
       32
        
       	})

     

       33
       33
        
       }

+14

server/handle_sync_list_blobs.go

···

       1
       1
        
       package server

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"github.com/Azure/go-autorest/autorest/to"

     

       4
       5
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       5
       6
        
       	"github.com/haileyok/cocoon/models"

     

       6
       7
        
       	"github.com/ipfs/go-cid"

     
···

       33
       34
        
       		cursorquery = "AND created_at < ?"

     

       34
       35
        
       	}

     

       35
       36
        
       	params = append(params, limit)

     

       37
       37
       +
       

     

       38
       38
       +
       	urepo, err := s.getRepoActorByDid(did)

     

       39
       39
       +
       	if err != nil {

     

       40
       40
       +
       		s.logger.Error("could not find user for requested blobs", "error", err)

     

       41
       41
       +
       		return helpers.InputError(e, nil)

     

       42
       42
       +
       	}

     

       43
       43
       +
       

     

       44
       44
       +
       	status := urepo.Status()

     

       45
       45
       +
       	if status != nil {

     

       46
       46
       +
       		if *status == "deactivated" {

     

       47
       47
       +
       			return helpers.InputError(e, to.StringPtr("RepoDeactivated"))

     

       48
       48
       +
       		}

     

       49
       49
       +
       	}

     

       36
       50
        
       

     

       37
       51
        
       	var blobs []models.Blob

     

       38
       52
        
       	if err := s.db.Raw("SELECT * FROM blobs WHERE did = ? "+cursorquery+" ORDER BY created_at DESC LIMIT ?", nil, params...).Scan(&blobs).Error; err != nil {

+31 -29

server/handle_sync_subscribe_repos.go

···

       1
       1
        
       package server

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       -
       	"fmt"

     

       5
       5
       -
       	"net/http"

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"time"

     

       6
       6
        
       

     

       7
       7
        
       	"github.com/bluesky-social/indigo/events"

     

       8
       8
        
       	"github.com/bluesky-social/indigo/lex/util"

     
···

       10
       10
        
       	"github.com/labstack/echo/v4"

     

       11
       11
        
       )

     

       12
       12
        
       

     

       13
       13
       -
       var upgrader = websocket.Upgrader{

     

       14
       14
       -
       	ReadBufferSize:  1024,

     

       15
       15
       -
       	WriteBufferSize: 1024,

     

       16
       16
       -
       	CheckOrigin: func(r *http.Request) bool {

     

       17
       17
       -
       		return true

     

       18
       18
       -
       	},

     

       19
       19
       -
       }

     

       13
       13
       +
       func (s *Server) handleSyncSubscribeRepos(e echo.Context) error {

     

       14
       14
       +
       	ctx := e.Request().Context()

     

       15
       15
       +
       	logger := s.logger.With("component", "subscribe-repos-websocket")

     

       20
       16
        
       

     

       21
       21
       -
       func (s *Server) handleSyncSubscribeRepos(e echo.Context) error {

     

       22
       17
        
       	conn, err := websocket.Upgrade(e.Response().Writer, e.Request(), e.Response().Header(), 1<<10, 1<<10)

     

       23
       18
        
       	if err != nil {

     

       19
       19
       +
       		logger.Error("unable to establish websocket with relay", "err", err)

     

       24
       20
        
       		return err

     

       25
       21
        
       	}

     

       26
       22
        
       

     

       27
       27
       -
       	s.logger.Info("new connection", "ua", e.Request().UserAgent())

     

       28
       28
       -
       

     

       29
       29
       -
       	ctx := e.Request().Context()

     

       30
       30
       -
       

     

       31
       23
        
       	ident := e.RealIP() + "-" + e.Request().UserAgent()

     

       24
       24
       +
       	logger = logger.With("ident", ident)

     

       25
       25
       +
       	logger.Info("new connection established")

     

       32
       26
        
       

     

       33
       27
        
       	evts, cancel, err := s.evtman.Subscribe(ctx, ident, func(evt *events.XRPCStreamEvent) bool {

     

       34
       28
        
       		return true

     
···

       42
       36
        
       	for evt := range evts {

     

       43
       37
        
       		wc, err := conn.NextWriter(websocket.BinaryMessage)

     

       44
       38
        
       		if err != nil {

     

       45
       45
       -
       			return err

     

       39
       39
       +
       			logger.Error("error writing message to relay", "err", err)

     

       40
       40
       +
       			break

     

       46
       41
        
       		}

     

       47
       42
        
       

     

       48
       48
       -
       		var obj util.CBOR

     

       43
       43
       +
       		if ctx.Err() != nil {

     

       44
       44
       +
       			logger.Error("context error", "err", err)

     

       45
       45
       +
       			break

     

       46
       46
       +
       		}

     

       49
       47
        
       

     

       48
       48
       +
       		var obj util.CBOR

     

       50
       49
        
       		switch {

     

       51
       50
        
       		case evt.Error != nil:

     

       52
       51
        
       			header.Op = events.EvtKindErrorFrame

     
···

       54
       53
        
       		case evt.RepoCommit != nil:

     

       55
       54
        
       			header.MsgType = "#commit"

     

       56
       55
        
       			obj = evt.RepoCommit

     

       57
       57
       -
       		case evt.RepoHandle != nil:

     

       58
       58
       -
       			header.MsgType = "#handle"

     

       59
       59
       -
       			obj = evt.RepoHandle

     

       60
       56
        
       		case evt.RepoIdentity != nil:

     

       61
       57
        
       			header.MsgType = "#identity"

     

       62
       58
        
       			obj = evt.RepoIdentity

     
···

       66
       62
        
       		case evt.RepoInfo != nil:

     

       67
       63
        
       			header.MsgType = "#info"

     

       68
       64
        
       			obj = evt.RepoInfo

     

       69
       69
       -
       		case evt.RepoMigrate != nil:

     

       70
       70
       -
       			header.MsgType = "#migrate"

     

       71
       71
       -
       			obj = evt.RepoMigrate

     

       72
       72
       -
       		case evt.RepoTombstone != nil:

     

       73
       73
       -
       			header.MsgType = "#tombstone"

     

       74
       74
       -
       			obj = evt.RepoTombstone

     

       75
       65
        
       		default:

     

       76
       76
       -
       			return fmt.Errorf("unrecognized event kind")

     

       66
       66
       +
       			logger.Warn("unrecognized event kind")

     

       67
       67
       +
       			return nil

     

       77
       68
        
       		}

     

       78
       69
        
       

     

       79
       70
        
       		if err := header.MarshalCBOR(wc); err != nil {

     

       80
       80
       -
       			return fmt.Errorf("failed to write header: %w", err)

     

       71
       71
       +
       			logger.Error("failed to write header to relay", "err", err)

     

       72
       72
       +
       			break

     

       81
       73
        
       		}

     

       82
       74
        
       

     

       83
       75
        
       		if err := obj.MarshalCBOR(wc); err != nil {

     

       84
       84
       -
       			return fmt.Errorf("failed to write event: %w", err)

     

       76
       76
       +
       			logger.Error("failed to write event to relay", "err", err)

     

       77
       77
       +
       			break

     

       85
       78
        
       		}

     

       86
       79
        
       

     

       87
       80
        
       		if err := wc.Close(); err != nil {

     

       88
       88
       -
       			return fmt.Errorf("failed to flush-close our event write: %w", err)

     

       81
       81
       +
       			logger.Error("failed to flush-close our event write", "err", err)

     

       82
       82
       +
       			break

     

       89
       83
        
       		}

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	// we should tell the relay to request a new crawl at this point if we got disconnected

     

       87
       87
       +
       	// use a new context since the old one might be cancelled at this point

     

       88
       88
       +
       	ctx, cancel = context.WithTimeout(context.Background(), 10*time.Second)

     

       89
       89
       +
       	defer cancel()

     

       90
       90
       +
       	if err := s.requestCrawl(ctx); err != nil {

     

       91
       91
       +
       		logger.Error("error requesting crawls", "err", err)

     

       90
       92
        
       	}

     

       91
       93
        
       

     

       92
       94
        
       	return nil

+33

server/handle_well_known.go

···

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
        
       	"fmt"

     

       5
       5
       +
       	"strings"

     

       5
       6
        
       

     

       6
       7
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       8
       8
       +
       	"github.com/haileyok/cocoon/internal/helpers"

     

       7
       9
        
       	"github.com/labstack/echo/v4"

     

       10
       10
       +
       	"gorm.io/gorm"

     

       8
       11
        
       )

     

       9
       12
        
       

     

       10
       13
        
       var (

     
···

       61
       64
        
       			},

     

       62
       65
        
       		},

     

       63
       66
        
       	})

     

       67
       67
       +
       }

     

       68
       68
       +
       

     

       69
       69
       +
       func (s *Server) handleAtprotoDid(e echo.Context) error {

     

       70
       70
       +
       	host := e.Request().Host

     

       71
       71
       +
       	if host == "" {

     

       72
       72
       +
       		return helpers.InputError(e, to.StringPtr("Invalid handle."))

     

       73
       73
       +
       	}

     

       74
       74
       +
       

     

       75
       75
       +
       	host = strings.Split(host, ":")[0]

     

       76
       76
       +
       	host = strings.ToLower(strings.TrimSpace(host))

     

       77
       77
       +
       

     

       78
       78
       +
       	if host == s.config.Hostname {

     

       79
       79
       +
       		return e.String(200, s.config.Did)

     

       80
       80
       +
       	}

     

       81
       81
       +
       

     

       82
       82
       +
       	suffix := "." + s.config.Hostname

     

       83
       83
       +
       	if !strings.HasSuffix(host, suffix) {

     

       84
       84
       +
       		return e.NoContent(404)

     

       85
       85
       +
       	}

     

       86
       86
       +
       

     

       87
       87
       +
       	actor, err := s.getActorByHandle(host)

     

       88
       88
       +
       	if err != nil {

     

       89
       89
       +
       		if err == gorm.ErrRecordNotFound {

     

       90
       90
       +
       			return e.NoContent(404)

     

       91
       91
       +
       		}

     

       92
       92
       +
       		s.logger.Error("error looking up actor by handle", "error", err)

     

       93
       93
       +
       		return helpers.ServerError(e, nil)

     

       94
       94
       +
       	}

     

       95
       95
       +
       

     

       96
       96
       +
       	return e.String(200, actor.Did)

     

       64
       97
        
       }

     

       65
       98
        
       

     

       66
       99
        
       func (s *Server) handleOauthProtectedResource(e echo.Context) error {

+19

server/mail.go

···

       40
       40
        
       	return nil

     

       41
       41
        
       }

     

       42
       42
        
       

     

       43
       43
       +
       func (s *Server) sendPlcTokenReset(email, handle, code string) error {

     

       44
       44
       +
       	if s.mail == nil {

     

       45
       45
       +
       		return nil

     

       46
       46
       +
       	}

     

       47
       47
       +
       

     

       48
       48
       +
       	s.mailLk.Lock()

     

       49
       49
       +
       	defer s.mailLk.Unlock()

     

       50
       50
       +
       

     

       51
       51
       +
       	s.mail.To(email)

     

       52
       52
       +
       	s.mail.Subject("PLC token for " + s.config.Hostname)

     

       53
       53
       +
       	s.mail.Plain().Set(fmt.Sprintf("Hello %s. Your PLC operation code is %s. This code will expire in ten minutes.", handle, code))

     

       54
       54
       +
       

     

       55
       55
       +
       	if err := s.mail.Send(); err != nil {

     

       56
       56
       +
       		return err

     

       57
       57
       +
       	}

     

       58
       58
       +
       

     

       59
       59
       +
       	return nil

     

       60
       60
       +
       }

     

       61
       61
       +
       

     

       43
       62
        
       func (s *Server) sendEmailUpdate(email, handle, code string) error {

     

       44
       63
        
       	if s.mail == nil {

     

       45
       64
        
       		return nil

+26 -13

server/middleware.go

···

       3
       3
        
       import (

     

       4
       4
        
       	"crypto/sha256"

     

       5
       5
        
       	"encoding/base64"

     

       6
       6
       +
       	"errors"

     

       6
       7
        
       	"fmt"

     

       7
       8
        
       	"strings"

     

       8
       9
        
       	"time"

     
···

       11
       12
        
       	"github.com/golang-jwt/jwt/v4"

     

       12
       13
        
       	"github.com/haileyok/cocoon/internal/helpers"

     

       13
       14
        
       	"github.com/haileyok/cocoon/models"

     

       15
       15
       +
       	"github.com/haileyok/cocoon/oauth/dpop"

     

       14
       16
        
       	"github.com/haileyok/cocoon/oauth/provider"

     

       15
       17
        
       	"github.com/labstack/echo/v4"

     

       16
       18
        
       	"gitlab.com/yawning/secp256k1-voi"

     
···

       54
       56
        
       		token, _, err := new(jwt.Parser).ParseUnverified(tokenstr, jwt.MapClaims{})

     

       55
       57
        
       		claims, ok := token.Claims.(jwt.MapClaims)

     

       56
       58
        
       		if !ok {

     

       57
       57
       -
       			return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       59
       59
       +
       			return helpers.InvalidTokenError(e)

     

       58
       60
        
       		}

     

       59
       61
        
       

     

       60
       62
        
       		var did string

     
···

       93
       95
        
       			})

     

       94
       96
        
       			if err != nil {

     

       95
       97
        
       				s.logger.Error("error parsing jwt", "error", err)

     

       96
       96
       -
       				// NOTE: https://github.com/bluesky-social/atproto/discussions/3319

     

       97
       97
       -
       				return e.JSON(400, map[string]string{"error": "ExpiredToken", "message": "token has expired"})

     

       98
       98
       +
       				return helpers.ExpiredTokenError(e)

     

       98
       99
        
       			}

     

       99
       100
        
       

     

       100
       101
        
       			if !token.Valid {

     

       101
       101
       -
       				return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       102
       102
       +
       				return helpers.InvalidTokenError(e)

     

       102
       103
        
       			}

     

       103
       104
        
       		} else {

     

       104
       105
        
       			kpts := strings.Split(tokenstr, ".")

     
···

       143
       144
        
       		scope, _ := claims["scope"].(string)

     

       144
       145
        
       

     

       145
       146
        
       		if isRefresh && scope != "com.atproto.refresh" {

     

       146
       146
       -
       			return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       147
       147
       +
       			return helpers.InvalidTokenError(e)

     

       147
       148
        
       		} else if !hasLxm && !isRefresh && scope != "com.atproto.access" {

     

       148
       148
       -
       			return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       149
       149
       +
       			return helpers.InvalidTokenError(e)

     

       149
       150
        
       		}

     

       150
       151
        
       

     

       151
       152
        
       		table := "tokens"

     
···

       160
       161
        
       			var result Result

     

       161
       162
        
       			if err := s.db.Raw("SELECT EXISTS(SELECT 1 FROM "+table+" WHERE token = ?) AS found", nil, tokenstr).Scan(&result).Error; err != nil {

     

       162
       163
        
       				if err == gorm.ErrRecordNotFound {

     

       163
       163
       -
       					return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       164
       164
       +
       					return helpers.InvalidTokenError(e)

     

       164
       165
        
       				}

     

       165
       166
        
       

     

       166
       167
        
       				s.logger.Error("error getting token from db", "error", err)

     
···

       168
       169
        
       			}

     

       169
       170
        
       

     

       170
       171
        
       			if !result.Found {

     

       171
       171
       -
       				return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       172
       172
       +
       				return helpers.InvalidTokenError(e)

     

       172
       173
        
       			}

     

       173
       174
        
       		}

     

       174
       175
        
       

     
···

       179
       180
        
       		}

     

       180
       181
        
       

     

       181
       182
        
       		if exp < float64(time.Now().UTC().Unix()) {

     

       182
       182
       -
       			return helpers.InputError(e, to.StringPtr("ExpiredToken"))

     

       183
       183
       +
       			return helpers.ExpiredTokenError(e)

     

       183
       184
        
       		}

     

       184
       185
        
       

     

       185
       186
        
       		if repo == nil {

     
···

       197
       198
        
       		e.Set("token", tokenstr)

     

       198
       199
        
       

     

       199
       200
        
       		if err := next(e); err != nil {

     

       200
       200
       -
       			e.Error(err)

     

       201
       201
       +
       			return helpers.InvalidTokenError(e)

     

       201
       202
        
       		}

     

       202
       203
        
       

     

       203
       204
        
       		return nil

     
···

       230
       231
        
       

     

       231
       232
        
       		proof, err := s.oauthProvider.DpopManager.CheckProof(e.Request().Method, "https://"+s.config.Hostname+e.Request().URL.String(), e.Request().Header, to.StringPtr(accessToken))

     

       232
       233
        
       		if err != nil {

     

       234
       234
       +
       			if errors.Is(err, dpop.ErrUseDpopNonce) {

     

       235
       235
       +
       				e.Response().Header().Set("WWW-Authenticate", `DPoP error="use_dpop_nonce"`)

     

       236
       236
       +
       				e.Response().Header().Add("access-control-expose-headers", "WWW-Authenticate")

     

       237
       237
       +
       				return e.JSON(401, map[string]string{

     

       238
       238
       +
       					"error": "use_dpop_nonce",

     

       239
       239
       +
       				})

     

       240
       240
       +
       			}

     

       233
       241
        
       			s.logger.Error("invalid dpop proof", "error", err)

     

       234
       234
       -
       			return helpers.InputError(e, to.StringPtr(err.Error()))

     

       242
       242
       +
       			return helpers.InputError(e, nil)

     

       235
       243
        
       		}

     

       236
       244
        
       

     

       237
       245
        
       		var oauthToken provider.OauthToken

     
···

       241
       249
        
       		}

     

       242
       250
        
       

     

       243
       251
        
       		if oauthToken.Token == "" {

     

       244
       244
       -
       			return helpers.InputError(e, to.StringPtr("InvalidToken"))

     

       252
       252
       +
       			return helpers.InvalidTokenError(e)

     

       245
       253
        
       		}

     

       246
       254
        
       

     

       247
       255
        
       		if *oauthToken.Parameters.DpopJkt != proof.JKT {

     
···

       250
       258
        
       		}

     

       251
       259
        
       

     

       252
       260
        
       		if time.Now().After(oauthToken.ExpiresAt) {

     

       253
       253
       -
       			return e.JSON(400, map[string]string{"error": "ExpiredToken", "message": "token has expired"})

     

       261
       261
       +
       			e.Response().Header().Set("WWW-Authenticate", `DPoP error="invalid_token", error_description="Token expired"`)

     

       262
       262
       +
       			e.Response().Header().Add("access-control-expose-headers", "WWW-Authenticate")

     

       263
       263
       +
       			return e.JSON(401, map[string]string{

     

       264
       264
       +
       				"error":             "invalid_token",

     

       265
       265
       +
       				"error_description": "Token expired",

     

       266
       266
       +
       			})

     

       254
       267
        
       		}

     

       255
       268
        
       

     

       256
       269
        
       		repo, err := s.getRepoActorByDid(oauthToken.Sub)

+27 -21

server/repo.go

···

       10
       10
        
       

     

       11
       11
        
       	"github.com/Azure/go-autorest/autorest/to"

     

       12
       12
        
       	"github.com/bluesky-social/indigo/api/atproto"

     

       13
       13
       -
       	"github.com/bluesky-social/indigo/atproto/data"

     

       13
       13
       +
       	"github.com/bluesky-social/indigo/atproto/atdata"

     

       14
       14
        
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       15
       15
        
       	"github.com/bluesky-social/indigo/carstore"

     

       16
       16
        
       	"github.com/bluesky-social/indigo/events"

     

       17
       17
        
       	lexutil "github.com/bluesky-social/indigo/lex/util"

     

       18
       18
        
       	"github.com/bluesky-social/indigo/repo"

     

       19
       19
       -
       	"github.com/bluesky-social/indigo/util"

     

       20
       20
       -
       	"github.com/haileyok/cocoon/blockstore"

     

       21
       19
        
       	"github.com/haileyok/cocoon/internal/db"

     

       22
       20
        
       	"github.com/haileyok/cocoon/models"

     

       21
       21
       +
       	"github.com/haileyok/cocoon/recording_blockstore"

     

       23
       22
        
       	blocks "github.com/ipfs/go-block-format"

     

       24
       23
        
       	"github.com/ipfs/go-cid"

     

       25
       24
        
       	cbor "github.com/ipfs/go-ipld-cbor"

     
···

       73
       72
        
       }

     

       74
       73
        
       

     

       75
       74
        
       func (mm *MarshalableMap) MarshalCBOR(w io.Writer) error {

     

       76
       76
       -
       	data, err := data.MarshalCBOR(*mm)

     

       75
       75
       +
       	data, err := atdata.MarshalCBOR(*mm)

     

       77
       76
        
       	if err != nil {

     

       78
       77
        
       		return err

     

       79
       78
        
       	}

     
···

       103
       102
        
       		return nil, err

     

       104
       103
        
       	}

     

       105
       104
        
       

     

       106
       106
       -
       	dbs := blockstore.New(urepo.Did, rm.db)

     

       107
       107
       -
       	r, err := repo.OpenRepo(context.TODO(), dbs, rootcid)

     

       105
       105
       +
       	dbs := rm.s.getBlockstore(urepo.Did)

     

       106
       106
       +
       	bs := recording_blockstore.New(dbs)

     

       107
       107
       +
       	r, err := repo.OpenRepo(context.TODO(), bs, rootcid)

     

       108
       108
        
       

     

       109
       109
        
       	entries := []models.Record{}

     

       110
       110
        
       	var results []ApplyWriteResult

     
···

       133
       133
        
       			if err != nil {

     

       134
       134
        
       				return nil, err

     

       135
       135
        
       			}

     

       136
       136
       -
       			out, err := data.UnmarshalJSON(j)

     

       136
       136
       +
       			out, err := atdata.UnmarshalJSON(j)

     

       137
       137
        
       			if err != nil {

     

       138
       138
        
       				return nil, err

     

       139
       139
        
       			}

     

       140
       140
        
       			mm := MarshalableMap(out)

     

       141
       141
       +
       

     

       142
       142
       +
       			// HACK: if a record doesn't contain a $type, we can manually set it here based on the op's collection

     

       143
       143
       +
       			if mm["$type"] == "" {

     

       144
       144
       +
       				mm["$type"] = op.Collection

     

       145
       145
       +
       			}

     

       146
       146
       +
       

     

       141
       147
        
       			nc, err := r.PutRecord(context.TODO(), op.Collection+"/"+*op.Rkey, &mm)

     

       142
       148
        
       			if err != nil {

     

       143
       149
        
       				return nil, err

     

       144
       150
        
       			}

     

       145
       145
       -
       			d, err := data.MarshalCBOR(mm)

     

       151
       151
       +
       			d, err := atdata.MarshalCBOR(mm)

     

       146
       152
        
       			if err != nil {

     

       147
       153
        
       				return nil, err

     

       148
       154
        
       			}

     
···

       183
       189
        
       			if err != nil {

     

       184
       190
        
       				return nil, err

     

       185
       191
        
       			}

     

       186
       186
       -
       			out, err := data.UnmarshalJSON(j)

     

       192
       192
       +
       			out, err := atdata.UnmarshalJSON(j)

     

       187
       193
        
       			if err != nil {

     

       188
       194
        
       				return nil, err

     

       189
       195
        
       			}

     
···

       192
       198
        
       			if err != nil {

     

       193
       199
        
       				return nil, err

     

       194
       200
        
       			}

     

       195
       195
       -
       			d, err := data.MarshalCBOR(mm)

     

       201
       201
       +
       			d, err := atdata.MarshalCBOR(mm)

     

       196
       202
        
       			if err != nil {

     

       197
       203
        
       				return nil, err

     

       198
       204
        
       			}

     
···

       274
       280
        
       		}

     

       275
       281
        
       	}

     

       276
       282
        
       

     

       277
       277
       -
       	for _, op := range dbs.GetLog() {

     

       283
       283
       +
       	for _, op := range bs.GetWriteLog() {

     

       278
       284
        
       		if _, err := carstore.LdWrite(buf, op.Cid().Bytes(), op.RawData()); err != nil {

     

       279
       285
        
       			return nil, err

     

       280
       286
        
       		}

     
···

       318
       324
        
       			Rev:    rev,

     

       319
       325
        
       			Since:  &urepo.Rev,

     

       320
       326
        
       			Commit: lexutil.LexLink(newroot),

     

       321
       321
       -
       			Time:   time.Now().Format(util.ISO8601),

     

       327
       327
       +
       			Time:   time.Now().Format(time.RFC3339Nano),

     

       322
       328
        
       			Ops:    ops,

     

       323
       329
        
       			TooBig: false,

     

       324
       330
        
       		},

     

       325
       331
        
       	})

     

       326
       332
        
       

     

       327
       327
       -
       	if err := dbs.UpdateRepo(context.TODO(), newroot, rev); err != nil {

     

       333
       333
       +
       	if err := rm.s.UpdateRepo(context.TODO(), urepo.Did, newroot, rev); err != nil {

     

       328
       334
        
       		return nil, err

     

       329
       335
        
       	}

     

       330
       336
        
       

     
···

       345
       351
        
       		return cid.Undef, nil, err

     

       346
       352
        
       	}

     

       347
       353
        
       

     

       348
       348
       -
       	dbs := blockstore.New(urepo.Did, rm.db)

     

       349
       349
       -
       	bs := util.NewLoggingBstore(dbs)

     

       354
       354
       +
       	dbs := rm.s.getBlockstore(urepo.Did)

     

       355
       355
       +
       	bs := recording_blockstore.New(dbs)

     

       350
       356
        
       

     

       351
       357
        
       	r, err := repo.OpenRepo(context.TODO(), bs, c)

     

       352
       358
        
       	if err != nil {

     
···

       358
       364
        
       		return cid.Undef, nil, err

     

       359
       365
        
       	}

     

       360
       366
        
       

     

       361
       361
       -
       	return c, bs.GetLoggedBlocks(), nil

     

       367
       367
       +
       	return c, bs.GetReadLog(), nil

     

       362
       368
        
       }

     

       363
       369
        
       

     

       364
       370
        
       func (rm *RepoMan) incrementBlobRefs(urepo models.Repo, cbor []byte) ([]cid.Cid, error) {

     
···

       409
       415
        
       func getBlobCidsFromCbor(cbor []byte) ([]cid.Cid, error) {

     

       410
       416
        
       	var cids []cid.Cid

     

       411
       417
        
       

     

       412
       412
       -
       	decoded, err := data.UnmarshalCBOR(cbor)

     

       418
       418
       +
       	decoded, err := atdata.UnmarshalCBOR(cbor)

     

       413
       419
        
       	if err != nil {

     

       414
       420
        
       		return nil, fmt.Errorf("error unmarshaling cbor: %w", err)

     

       415
       421
        
       	}

     

       416
       422
        
       

     

       417
       417
       -
       	var deepiter func(interface{}) error

     

       418
       418
       -
       	deepiter = func(item interface{}) error {

     

       423
       423
       +
       	var deepiter func(any) error

     

       424
       424
       +
       	deepiter = func(item any) error {

     

       419
       425
        
       		switch val := item.(type) {

     

       420
       420
       -
       		case map[string]interface{}:

     

       426
       426
       +
       		case map[string]any:

     

       421
       427
        
       			if val["$type"] == "blob" {

     

       422
       428
        
       				if ref, ok := val["ref"].(string); ok {

     

       423
       429
        
       					c, err := cid.Parse(ref)

     
···

       430
       436
        
       					return deepiter(v)

     

       431
       437
        
       				}

     

       432
       438
        
       			}

     

       433
       433
       -
       		case []interface{}:

     

       439
       439
       +
       		case []any:

     

       434
       440
        
       			for _, v := range val {

     

       435
       441
        
       				deepiter(v)

     

       436
       442
        
       			}

+132 -34

server/server.go

···

       38
       38
        
       	"github.com/haileyok/cocoon/oauth/dpop"

     

       39
       39
        
       	"github.com/haileyok/cocoon/oauth/provider"

     

       40
       40
        
       	"github.com/haileyok/cocoon/plc"

     

       41
       41
       +
       	"github.com/ipfs/go-cid"

     

       41
       42
        
       	echo_session "github.com/labstack/echo-contrib/session"

     

       42
       43
        
       	"github.com/labstack/echo/v4"

     

       43
       44
        
       	"github.com/labstack/echo/v4/middleware"

     

       44
       45
        
       	slogecho "github.com/samber/slog-echo"

     

       46
       46
       +
       	"gorm.io/driver/postgres"

     

       45
       47
        
       	"gorm.io/driver/sqlite"

     

       46
       48
        
       	"gorm.io/gorm"

     

       47
       49
        
       )

     
···

       51
       53
        
       )

     

       52
       54
        
       

     

       53
       55
        
       type S3Config struct {

     

       54
       54
       -
       	BackupsEnabled bool

     

       55
       55
       -
       	Endpoint       string

     

       56
       56
       -
       	Region         string

     

       57
       57
       -
       	Bucket         string

     

       58
       58
       -
       	AccessKey      string

     

       59
       59
       -
       	SecretKey      string

     

       56
       56
       +
       	BackupsEnabled   bool

     

       57
       57
       +
       	BlobstoreEnabled bool

     

       58
       58
       +
       	Endpoint         string

     

       59
       59
       +
       	Region           string

     

       60
       60
       +
       	Bucket           string

     

       61
       61
       +
       	AccessKey        string

     

       62
       62
       +
       	SecretKey        string

     

       63
       63
       +
       	CDNUrl           string

     

       60
       64
        
       }

     

       61
       65
        
       

     

       62
       66
        
       type Server struct {

     
···

       74
       78
        
       	oauthProvider *provider.Provider

     

       75
       79
        
       	evtman        *events.EventManager

     

       76
       80
        
       	passport      *identity.Passport

     

       81
       81
       +
       	fallbackProxy string

     

       82
       82
       +
       

     

       83
       83
       +
       	lastRequestCrawl time.Time

     

       84
       84
       +
       	requestCrawlMu   sync.Mutex

     

       77
       85
        
       

     

       78
       86
        
       	dbName   string

     

       87
       87
       +
       	dbType   string

     

       79
       88
        
       	s3Config *S3Config

     

       80
       89
        
       }

     

       81
       90
        
       

     

       82
       91
        
       type Args struct {

     

       83
       92
        
       	Addr            string

     

       84
       93
        
       	DbName          string

     

       94
       94
       +
       	DbType          string

     

       95
       95
       +
       	DatabaseURL     string

     

       85
       96
        
       	Logger          *slog.Logger

     

       86
       97
        
       	Version         string

     

       87
       98
        
       	Did             string

     
···

       91
       102
        
       	ContactEmail    string

     

       92
       103
        
       	Relays          []string

     

       93
       104
        
       	AdminPassword   string

     

       105
       105
       +
       	RequireInvite   bool

     

       94
       106
        
       

     

       95
       107
        
       	SmtpUser  string

     

       96
       108
        
       	SmtpPass  string

     
···

       102
       114
        
       	S3Config *S3Config

     

       103
       115
        
       

     

       104
       116
        
       	SessionSecret string

     

       117
       117
       +
       

     

       118
       118
       +
       	BlockstoreVariant BlockstoreVariant

     

       119
       119
       +
       	FallbackProxy     string

     

       105
       120
        
       }

     

       106
       121
        
       

     

       107
       122
        
       type config struct {

     

       108
       108
       -
       	Version        string

     

       109
       109
       -
       	Did            string

     

       110
       110
       -
       	Hostname       string

     

       111
       111
       -
       	ContactEmail   string

     

       112
       112
       -
       	EnforcePeering bool

     

       113
       113
       -
       	Relays         []string

     

       114
       114
       -
       	AdminPassword  string

     

       115
       115
       -
       	SmtpEmail      string

     

       116
       116
       -
       	SmtpName       string

     

       123
       123
       +
       	Version           string

     

       124
       124
       +
       	Did               string

     

       125
       125
       +
       	Hostname          string

     

       126
       126
       +
       	ContactEmail      string

     

       127
       127
       +
       	EnforcePeering    bool

     

       128
       128
       +
       	Relays            []string

     

       129
       129
       +
       	AdminPassword     string

     

       130
       130
       +
       	RequireInvite     bool

     

       131
       131
       +
       	SmtpEmail         string

     

       132
       132
       +
       	SmtpName          string

     

       133
       133
       +
       	BlockstoreVariant BlockstoreVariant

     

       134
       134
       +
       	FallbackProxy     string

     

       117
       135
        
       }

     

       118
       136
        
       

     

       119
       137
        
       type CustomValidator struct {

     
···

       277
       295
        
       		IdleTimeout:  5 * time.Minute,

     

       278
       296
        
       	}

     

       279
       297
        
       

     

       280
       280
       -
       	gdb, err := gorm.Open(sqlite.Open("cocoon.db"), &gorm.Config{})

     

       281
       281
       -
       	if err != nil {

     

       282
       282
       -
       		return nil, err

     

       298
       298
       +
       	dbType := args.DbType

     

       299
       299
       +
       	if dbType == "" {

     

       300
       300
       +
       		dbType = "sqlite"

     

       301
       301
       +
       	}

     

       302
       302
       +
       

     

       303
       303
       +
       	var gdb *gorm.DB

     

       304
       304
       +
       	var err error

     

       305
       305
       +
       	switch dbType {

     

       306
       306
       +
       	case "postgres":

     

       307
       307
       +
       		if args.DatabaseURL == "" {

     

       308
       308
       +
       			return nil, fmt.Errorf("database-url must be set when using postgres")

     

       309
       309
       +
       		}

     

       310
       310
       +
       		gdb, err = gorm.Open(postgres.Open(args.DatabaseURL), &gorm.Config{})

     

       311
       311
       +
       		if err != nil {

     

       312
       312
       +
       			return nil, fmt.Errorf("failed to connect to postgres: %w", err)

     

       313
       313
       +
       		}

     

       314
       314
       +
       		args.Logger.Info("connected to PostgreSQL database")

     

       315
       315
       +
       	default:

     

       316
       316
       +
       		gdb, err = gorm.Open(sqlite.Open(args.DbName), &gorm.Config{})

     

       317
       317
       +
       		if err != nil {

     

       318
       318
       +
       			return nil, fmt.Errorf("failed to open sqlite database: %w", err)

     

       319
       319
       +
       		}

     

       320
       320
       +
       		args.Logger.Info("connected to SQLite database", "path", args.DbName)

     

       283
       321
        
       	}

     

       284
       322
        
       	dbw := db.NewDB(gdb)

     

       285
       323
        
       

     
···

       336
       374
        
       		plcClient:  plcClient,

     

       337
       375
        
       		privateKey: &pkey,

     

       338
       376
        
       		config: &config{

     

       339
       339
       -
       			Version:        args.Version,

     

       340
       340
       -
       			Did:            args.Did,

     

       341
       341
       -
       			Hostname:       args.Hostname,

     

       342
       342
       -
       			ContactEmail:   args.ContactEmail,

     

       343
       343
       -
       			EnforcePeering: false,

     

       344
       344
       -
       			Relays:         args.Relays,

     

       345
       345
       -
       			AdminPassword:  args.AdminPassword,

     

       346
       346
       -
       			SmtpName:       args.SmtpName,

     

       347
       347
       -
       			SmtpEmail:      args.SmtpEmail,

     

       377
       377
       +
       			Version:           args.Version,

     

       378
       378
       +
       			Did:               args.Did,

     

       379
       379
       +
       			Hostname:          args.Hostname,

     

       380
       380
       +
       			ContactEmail:      args.ContactEmail,

     

       381
       381
       +
       			EnforcePeering:    false,

     

       382
       382
       +
       			Relays:            args.Relays,

     

       383
       383
       +
       			AdminPassword:     args.AdminPassword,

     

       384
       384
       +
       			RequireInvite:     args.RequireInvite,

     

       385
       385
       +
       			SmtpName:          args.SmtpName,

     

       386
       386
       +
       			SmtpEmail:         args.SmtpEmail,

     

       387
       387
       +
       			BlockstoreVariant: args.BlockstoreVariant,

     

       388
       388
       +
       			FallbackProxy:     args.FallbackProxy,

     

       348
       389
        
       		},

     

       349
       390
        
       		evtman:   events.NewEventManager(events.NewMemPersister()),

     

       350
       391
        
       		passport: identity.NewPassport(h, identity.NewMemCache(10_000)),

     

       351
       392
        
       

     

       352
       393
        
       		dbName:   args.DbName,

     

       394
       394
       +
       		dbType:   dbType,

     

       353
       395
        
       		s3Config: args.S3Config,

     

       354
       396
        
       

     

       355
       397
        
       		oauthProvider: provider.NewProvider(provider.Args{

     
···

       378
       420
        
       

     

       379
       421
        
       	// TODO: should validate these args

     

       380
       422
        
       	if args.SmtpUser == "" || args.SmtpPass == "" || args.SmtpHost == "" || args.SmtpPort == "" || args.SmtpEmail == "" || args.SmtpName == "" {

     

       381
       381
       -
       		args.Logger.Warn("not enough smpt args were provided. mailing will not work for your server.")

     

       423
       423
       +
       		args.Logger.Warn("not enough smtp args were provided. mailing will not work for your server.")

     

       382
       424
        
       	} else {

     

       383
       425
        
       		mail := mailyak.New(args.SmtpHost+":"+args.SmtpPort, smtp.PlainAuth("", args.SmtpUser, args.SmtpPass, args.SmtpHost))

     

       384
       426
        
       		mail.From(s.config.SmtpEmail)

     
···

       403
       445
        
       	s.echo.GET("/", s.handleRoot)

     

       404
       446
        
       	s.echo.GET("/xrpc/_health", s.handleHealth)

     

       405
       447
        
       	s.echo.GET("/.well-known/did.json", s.handleWellKnown)

     

       448
       448
       +
       	s.echo.GET("/.well-known/atproto-did", s.handleAtprotoDid)

     

       406
       449
        
       	s.echo.GET("/.well-known/oauth-protected-resource", s.handleOauthProtectedResource)

     

       407
       450
        
       	s.echo.GET("/.well-known/oauth-authorization-server", s.handleOauthAuthorizationServer)

     

       408
       451
        
       	s.echo.GET("/robots.txt", s.handleRobots)

     
···

       410
       453
        
       	// public

     

       411
       454
        
       	s.echo.GET("/xrpc/com.atproto.identity.resolveHandle", s.handleResolveHandle)

     

       412
       455
        
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       413
       413
       -
       	s.echo.POST("/xrpc/com.atproto.server.createAccount", s.handleCreateAccount)

     

       414
       456
        
       	s.echo.POST("/xrpc/com.atproto.server.createSession", s.handleCreateSession)

     

       415
       457
        
       	s.echo.GET("/xrpc/com.atproto.server.describeServer", s.handleDescribeServer)

     

       458
       458
       +
       	s.echo.POST("/xrpc/com.atproto.server.reserveSigningKey", s.handleServerReserveSigningKey)

     

       416
       459
        
       

     

       417
       460
        
       	s.echo.GET("/xrpc/com.atproto.repo.describeRepo", s.handleDescribeRepo)

     

       418
       461
        
       	s.echo.GET("/xrpc/com.atproto.sync.listRepos", s.handleListRepos)

     
···

       426
       469
        
       	s.echo.GET("/xrpc/com.atproto.sync.subscribeRepos", s.handleSyncSubscribeRepos)

     

       427
       470
        
       	s.echo.GET("/xrpc/com.atproto.sync.listBlobs", s.handleSyncListBlobs)

     

       428
       471
        
       	s.echo.GET("/xrpc/com.atproto.sync.getBlob", s.handleSyncGetBlob)

     

       472
       472
       +
       

     

       473
       473
       +
       	// labels

     

       474
       474
       +
       	s.echo.GET("/xrpc/com.atproto.label.queryLabels", s.handleLabelQueryLabels)

     

       429
       475
        
       

     

       430
       476
        
       	// account

     

       431
       477
        
       	s.echo.GET("/account", s.handleAccount)

     
···

       447
       493
        
       	s.echo.GET("/xrpc/com.atproto.server.getSession", s.handleGetSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       448
       494
        
       	s.echo.POST("/xrpc/com.atproto.server.refreshSession", s.handleRefreshSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       449
       495
        
       	s.echo.POST("/xrpc/com.atproto.server.deleteSession", s.handleDeleteSession, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       496
       496
       +
       	s.echo.GET("/xrpc/com.atproto.identity.getRecommendedDidCredentials", s.handleGetRecommendedDidCredentials, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       450
       497
        
       	s.echo.POST("/xrpc/com.atproto.identity.updateHandle", s.handleIdentityUpdateHandle, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       498
       498
       +
       	s.echo.POST("/xrpc/com.atproto.identity.requestPlcOperationSignature", s.handleIdentityRequestPlcOperationSignature, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       499
       499
       +
       	s.echo.POST("/xrpc/com.atproto.identity.signPlcOperation", s.handleSignPlcOperation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       500
       500
       +
       	s.echo.POST("/xrpc/com.atproto.identity.submitPlcOperation", s.handleSubmitPlcOperation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       451
       501
        
       	s.echo.POST("/xrpc/com.atproto.server.confirmEmail", s.handleServerConfirmEmail, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       452
       502
        
       	s.echo.POST("/xrpc/com.atproto.server.requestEmailConfirmation", s.handleServerRequestEmailConfirmation, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       453
       503
        
       	s.echo.POST("/xrpc/com.atproto.server.requestPasswordReset", s.handleServerRequestPasswordReset) // AUTH NOT REQUIRED FOR THIS ONE

     
···

       456
       506
        
       	s.echo.POST("/xrpc/com.atproto.server.updateEmail", s.handleServerUpdateEmail, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       457
       507
        
       	s.echo.GET("/xrpc/com.atproto.server.getServiceAuth", s.handleServerGetServiceAuth, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       458
       508
        
       	s.echo.GET("/xrpc/com.atproto.server.checkAccountStatus", s.handleServerCheckAccountStatus, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       509
       509
       +
       	s.echo.POST("/xrpc/com.atproto.server.deactivateAccount", s.handleServerDeactivateAccount, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       510
       510
       +
       	s.echo.POST("/xrpc/com.atproto.server.activateAccount", s.handleServerActivateAccount, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       511
       511
       +
       	s.echo.POST("/xrpc/com.atproto.server.requestAccountDelete", s.handleServerRequestAccountDelete, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       512
       512
       +
       	s.echo.POST("/xrpc/com.atproto.server.deleteAccount", s.handleServerDeleteAccount)

     

       459
       513
        
       

     

       460
       514
        
       	// repo

     

       515
       515
       +
       	s.echo.GET("/xrpc/com.atproto.repo.listMissingBlobs", s.handleListMissingBlobs, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       461
       516
        
       	s.echo.POST("/xrpc/com.atproto.repo.createRecord", s.handleCreateRecord, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       462
       517
        
       	s.echo.POST("/xrpc/com.atproto.repo.putRecord", s.handlePutRecord, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       463
       518
        
       	s.echo.POST("/xrpc/com.atproto.repo.deleteRecord", s.handleDeleteRecord, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     
···

       468
       523
        
       	// stupid silly endpoints

     

       469
       524
        
       	s.echo.GET("/xrpc/app.bsky.actor.getPreferences", s.handleActorGetPreferences, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       470
       525
        
       	s.echo.POST("/xrpc/app.bsky.actor.putPreferences", s.handleActorPutPreferences, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       526
       526
       +
       	s.echo.GET("/xrpc/app.bsky.feed.getFeed", s.handleProxyBskyFeedGetFeed, s.handleLegacySessionMiddleware, s.handleOauthSessionMiddleware)

     

       471
       527
        
       

     

       472
       528
        
       	// admin routes

     

       473
       529
        
       	s.echo.POST("/xrpc/com.atproto.server.createInviteCode", s.handleCreateInviteCode, s.handleAdminMiddleware)

     
···

       493
       549
        
       		&models.Record{},

     

       494
       550
        
       		&models.Blob{},

     

       495
       551
        
       		&models.BlobPart{},

     

       552
       552
       +
       		&models.ReservedKey{},

     

       496
       553
        
       		&provider.OauthToken{},

     

       497
       554
        
       		&provider.OauthAuthorizationRequest{},

     

       498
       555
        
       	)

     
···

       507
       564
        
       

     

       508
       565
        
       	go s.backupRoutine()

     

       509
       566
        
       

     

       567
       567
       +
       	go func() {

     

       568
       568
       +
       		if err := s.requestCrawl(ctx); err != nil {

     

       569
       569
       +
       			s.logger.Error("error requesting crawls", "err", err)

     

       570
       570
       +
       		}

     

       571
       571
       +
       	}()

     

       572
       572
       +
       

     

       573
       573
       +
       	<-ctx.Done()

     

       574
       574
       +
       

     

       575
       575
       +
       	fmt.Println("shut down")

     

       576
       576
       +
       

     

       577
       577
       +
       	return nil

     

       578
       578
       +
       }

     

       579
       579
       +
       

     

       580
       580
       +
       func (s *Server) requestCrawl(ctx context.Context) error {

     

       581
       581
       +
       	logger := s.logger.With("component", "request-crawl")

     

       582
       582
       +
       	s.requestCrawlMu.Lock()

     

       583
       583
       +
       	defer s.requestCrawlMu.Unlock()

     

       584
       584
       +
       

     

       585
       585
       +
       	logger.Info("requesting crawl with configured relays")

     

       586
       586
       +
       

     

       587
       587
       +
       	if time.Now().Sub(s.lastRequestCrawl) <= 1*time.Minute {

     

       588
       588
       +
       		return fmt.Errorf("a crawl request has already been made within the last minute")

     

       589
       589
       +
       	}

     

       590
       590
       +
       

     

       510
       591
        
       	for _, relay := range s.config.Relays {

     

       592
       592
       +
       		logger := logger.With("relay", relay)

     

       593
       593
       +
       		logger.Info("requesting crawl from relay")

     

       511
       594
        
       		cli := xrpc.Client{Host: relay}

     

       512
       512
       -
       		atproto.SyncRequestCrawl(ctx, &cli, &atproto.SyncRequestCrawl_Input{

     

       595
       595
       +
       		if err := atproto.SyncRequestCrawl(ctx, &cli, &atproto.SyncRequestCrawl_Input{

     

       513
       596
        
       			Hostname: s.config.Hostname,

     

       514
       514
       -
       		})

     

       597
       597
       +
       		}); err != nil {

     

       598
       598
       +
       			logger.Error("error requesting crawl", "err", err)

     

       599
       599
       +
       		} else {

     

       600
       600
       +
       			logger.Info("crawl requested successfully")

     

       601
       601
       +
       		}

     

       515
       602
        
       	}

     

       516
       603
        
       

     

       517
       517
       -
       	<-ctx.Done()

     

       518
       518
       -
       

     

       519
       519
       -
       	fmt.Println("shut down")

     

       604
       604
       +
       	s.lastRequestCrawl = time.Now()

     

       520
       605
        
       

     

       521
       606
        
       	return nil

     

       522
       607
        
       }

     

       523
       608
        
       

     

       524
       609
        
       func (s *Server) doBackup() {

     

       610
       610
       +
       	if s.dbType == "postgres" {

     

       611
       611
       +
       		s.logger.Info("skipping S3 backup - PostgreSQL backups should be handled externally (pg_dump, managed database backups, etc.)")

     

       612
       612
       +
       		return

     

       613
       613
       +
       	}

     

       614
       614
       +
       

     

       525
       615
        
       	start := time.Now()

     

       526
       616
        
       

     

       527
       617
        
       	s.logger.Info("beginning backup to s3...")

     
···

       637
       727
        
       		go s.doBackup()

     

       638
       728
        
       	}

     

       639
       729
        
       }

     

       730
       730
       +
       

     

       731
       731
       +
       func (s *Server) UpdateRepo(ctx context.Context, did string, root cid.Cid, rev string) error {

     

       732
       732
       +
       	if err := s.db.Exec("UPDATE repos SET root = ?, rev = ? WHERE did = ?", nil, root.Bytes(), rev, did).Error; err != nil {

     

       733
       733
       +
       		return err

     

       734
       734
       +
       	}

     

       735
       735
       +
       

     

       736
       736
       +
       	return nil

     

       737
       737
       +
       }

+91

server/service_auth.go

···

       1
       1
       +
       package server

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       	"strings"

     

       7
       7
       +
       

     

       8
       8
       +
       	"github.com/bluesky-social/indigo/atproto/atcrypto"

     

       9
       9
       +
       	"github.com/bluesky-social/indigo/atproto/identity"

     

       10
       10
       +
       	atproto_identity "github.com/bluesky-social/indigo/atproto/identity"

     

       11
       11
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       12
       12
       +
       	"github.com/golang-jwt/jwt/v4"

     

       13
       13
       +
       )

     

       14
       14
       +
       

     

       15
       15
       +
       type ES256KSigningMethod struct {

     

       16
       16
       +
       	alg string

     

       17
       17
       +
       }

     

       18
       18
       +
       

     

       19
       19
       +
       func (m *ES256KSigningMethod) Alg() string {

     

       20
       20
       +
       	return m.alg

     

       21
       21
       +
       }

     

       22
       22
       +
       

     

       23
       23
       +
       func (m *ES256KSigningMethod) Verify(signingString string, signature string, key interface{}) error {

     

       24
       24
       +
       	signatureBytes, err := jwt.DecodeSegment(signature)

     

       25
       25
       +
       	if err != nil {

     

       26
       26
       +
       		return err

     

       27
       27
       +
       	}

     

       28
       28
       +
       	return key.(atcrypto.PublicKey).HashAndVerifyLenient([]byte(signingString), signatureBytes)

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       func (m *ES256KSigningMethod) Sign(signingString string, key interface{}) (string, error) {

     

       32
       32
       +
       	return "", fmt.Errorf("unimplemented")

     

       33
       33
       +
       }

     

       34
       34
       +
       

     

       35
       35
       +
       func init() {

     

       36
       36
       +
       	ES256K := ES256KSigningMethod{alg: "ES256K"}

     

       37
       37
       +
       	jwt.RegisterSigningMethod(ES256K.Alg(), func() jwt.SigningMethod {

     

       38
       38
       +
       		return &ES256K

     

       39
       39
       +
       	})

     

       40
       40
       +
       }

     

       41
       41
       +
       

     

       42
       42
       +
       func (s *Server) validateServiceAuth(ctx context.Context, rawToken string, nsid string) (string, error) {

     

       43
       43
       +
       	token := strings.TrimSpace(rawToken)

     

       44
       44
       +
       

     

       45
       45
       +
       	parsedToken, err := jwt.ParseWithClaims(token, jwt.MapClaims{}, func(token *jwt.Token) (interface{}, error) {

     

       46
       46
       +
       		did := syntax.DID(token.Claims.(jwt.MapClaims)["iss"].(string))

     

       47
       47
       +
       		didDoc, err := s.passport.FetchDoc(ctx, did.String());

     

       48
       48
       +
       		if err != nil {

     

       49
       49
       +
       			return nil, fmt.Errorf("unable to resolve did %s: %s", did, err)

     

       50
       50
       +
       		}

     

       51
       51
       +
       

     

       52
       52
       +
       		verificationMethods := make([]atproto_identity.DocVerificationMethod, len(didDoc.VerificationMethods))

     

       53
       53
       +
       		for i, verificationMethod := range didDoc.VerificationMethods {

     

       54
       54
       +
       			verificationMethods[i] = atproto_identity.DocVerificationMethod{

     

       55
       55
       +
       				ID: verificationMethod.Id,

     

       56
       56
       +
       				Type: verificationMethod.Type,

     

       57
       57
       +
       				PublicKeyMultibase: verificationMethod.PublicKeyMultibase,

     

       58
       58
       +
       				Controller: verificationMethod.Controller,

     

       59
       59
       +
       			}

     

       60
       60
       +
       		}

     

       61
       61
       +
       		services := make([]atproto_identity.DocService, len(didDoc.Service))

     

       62
       62
       +
       		for i, service := range didDoc.Service {

     

       63
       63
       +
       			services[i] = atproto_identity.DocService{

     

       64
       64
       +
       				ID: service.Id,

     

       65
       65
       +
       				Type: service.Type,

     

       66
       66
       +
       				ServiceEndpoint: service.ServiceEndpoint,

     

       67
       67
       +
       			}

     

       68
       68
       +
       		}

     

       69
       69
       +
       		parsedIdentity := atproto_identity.ParseIdentity(&identity.DIDDocument{

     

       70
       70
       +
       			DID: did,

     

       71
       71
       +
       			AlsoKnownAs: didDoc.AlsoKnownAs,

     

       72
       72
       +
       			VerificationMethod: verificationMethods,

     

       73
       73
       +
       			Service: services,

     

       74
       74
       +
       		})

     

       75
       75
       +
       

     

       76
       76
       +
       		key, err := parsedIdentity.PublicKey()

     

       77
       77
       +
       		if err != nil {

     

       78
       78
       +
       			return nil, fmt.Errorf("signing key not found for did %s: %s", did, err)

     

       79
       79
       +
       		}

     

       80
       80
       +
       		return key, nil

     

       81
       81
       +
       	})

     

       82
       82
       +
       	if err != nil {

     

       83
       83
       +
       		return "", fmt.Errorf("invalid token: %s", err)

     

       84
       84
       +
       	}

     

       85
       85
       +
       

     

       86
       86
       +
       	claims := parsedToken.Claims.(jwt.MapClaims)

     

       87
       87
       +
       	if claims["lxm"] != nsid {

     

       88
       88
       +
       		return "", fmt.Errorf("bad jwt lexicon method (\"lxm\"). must match: %s", nsid)

     

       89
       89
       +
       	}

     

       90
       90
       +
       	return claims["iss"].(string), nil

     

       91
       91
       +
       }

+5 -4

server/templates/account.html

···

       24
       24
        
             </div>

     

       25
       25
        
             {{ else }} {{ range .Tokens }}

     

       26
       26
        
             <div class="base-container">

     

       27
       27
       -
               <h4>{{ .ClientId }}</h4>

     

       28
       28
       -
               <p>Created: {{ .CreatedAt }}</p>

     

       29
       29
       -
               <p>Updated: {{ .UpdatedAt }}</p>

     

       30
       30
       -
               <p>Expires: {{ .ExpiresAt }}</p>

     

       27
       27
       +
               <h4>{{ .ClientName }}</h4>

     

       28
       28
       +
               <p>Session Age: {{ .Age}}</p>

     

       29
       29
       +
               <p>Last Updated: {{ .LastUpdated }} ago</p>

     

       30
       30
       +
               <p>Expires In: {{ .ExpiresIn }}</p>

     

       31
       31
       +
               <p>IP Address: {{ .Ip }}</p>

     

       31
       32
        
               <form action="/account/revoke" method="post">

     

       32
       33
        
                 <input type="hidden" name="token" value="{{ .Token }}" />

     

       33
       34
        
                 <button type="submit" value="">Revoke</button>

+137

sqlite_blockstore/sqlite_blockstore.go

···

       1
       1
       +
       package sqlite_blockstore

     

       2
       2
       +
       

     

       3
       3
       +
       import (

     

       4
       4
       +
       	"context"

     

       5
       5
       +
       	"fmt"

     

       6
       6
       +
       

     

       7
       7
       +
       	"github.com/bluesky-social/indigo/atproto/syntax"

     

       8
       8
       +
       	"github.com/haileyok/cocoon/internal/db"

     

       9
       9
       +
       	"github.com/haileyok/cocoon/models"

     

       10
       10
       +
       	blocks "github.com/ipfs/go-block-format"

     

       11
       11
       +
       	"github.com/ipfs/go-cid"

     

       12
       12
       +
       	"gorm.io/gorm/clause"

     

       13
       13
       +
       )

     

       14
       14
       +
       

     

       15
       15
       +
       type SqliteBlockstore struct {

     

       16
       16
       +
       	db       *db.DB

     

       17
       17
       +
       	did      string

     

       18
       18
       +
       	readonly bool

     

       19
       19
       +
       	inserts  map[cid.Cid]blocks.Block

     

       20
       20
       +
       }

     

       21
       21
       +
       

     

       22
       22
       +
       func New(did string, db *db.DB) *SqliteBlockstore {

     

       23
       23
       +
       	return &SqliteBlockstore{

     

       24
       24
       +
       		did:      did,

     

       25
       25
       +
       		db:       db,

     

       26
       26
       +
       		readonly: false,

     

       27
       27
       +
       		inserts:  map[cid.Cid]blocks.Block{},

     

       28
       28
       +
       	}

     

       29
       29
       +
       }

     

       30
       30
       +
       

     

       31
       31
       +
       func NewReadOnly(did string, db *db.DB) *SqliteBlockstore {

     

       32
       32
       +
       	return &SqliteBlockstore{

     

       33
       33
       +
       		did:      did,

     

       34
       34
       +
       		db:       db,

     

       35
       35
       +
       		readonly: true,

     

       36
       36
       +
       		inserts:  map[cid.Cid]blocks.Block{},

     

       37
       37
       +
       	}

     

       38
       38
       +
       }

     

       39
       39
       +
       

     

       40
       40
       +
       func (bs *SqliteBlockstore) Get(ctx context.Context, cid cid.Cid) (blocks.Block, error) {

     

       41
       41
       +
       	var block models.Block

     

       42
       42
       +
       

     

       43
       43
       +
       	maybeBlock, ok := bs.inserts[cid]

     

       44
       44
       +
       	if ok {

     

       45
       45
       +
       		return maybeBlock, nil

     

       46
       46
       +
       	}

     

       47
       47
       +
       

     

       48
       48
       +
       	if err := bs.db.Raw("SELECT * FROM blocks WHERE did = ? AND cid = ?", nil, bs.did, cid.Bytes()).Scan(&block).Error; err != nil {

     

       49
       49
       +
       		return nil, err

     

       50
       50
       +
       	}

     

       51
       51
       +
       

     

       52
       52
       +
       	b, err := blocks.NewBlockWithCid(block.Value, cid)

     

       53
       53
       +
       	if err != nil {

     

       54
       54
       +
       		return nil, err

     

       55
       55
       +
       	}

     

       56
       56
       +
       

     

       57
       57
       +
       	return b, nil

     

       58
       58
       +
       }

     

       59
       59
       +
       

     

       60
       60
       +
       func (bs *SqliteBlockstore) Put(ctx context.Context, block blocks.Block) error {

     

       61
       61
       +
       	bs.inserts[block.Cid()] = block

     

       62
       62
       +
       

     

       63
       63
       +
       	if bs.readonly {

     

       64
       64
       +
       		return nil

     

       65
       65
       +
       	}

     

       66
       66
       +
       

     

       67
       67
       +
       	b := models.Block{

     

       68
       68
       +
       		Did:   bs.did,

     

       69
       69
       +
       		Cid:   block.Cid().Bytes(),

     

       70
       70
       +
       		Rev:   syntax.NewTIDNow(0).String(), // TODO: WARN, this is bad. don't do this

     

       71
       71
       +
       		Value: block.RawData(),

     

       72
       72
       +
       	}

     

       73
       73
       +
       

     

       74
       74
       +
       	if err := bs.db.Create(&b, []clause.Expression{clause.OnConflict{

     

       75
       75
       +
       		Columns:   []clause.Column{{Name: "did"}, {Name: "cid"}},

     

       76
       76
       +
       		UpdateAll: true,

     

       77
       77
       +
       	}}).Error; err != nil {

     

       78
       78
       +
       		return err

     

       79
       79
       +
       	}

     

       80
       80
       +
       

     

       81
       81
       +
       	return nil

     

       82
       82
       +
       }

     

       83
       83
       +
       

     

       84
       84
       +
       func (bs *SqliteBlockstore) DeleteBlock(context.Context, cid.Cid) error {

     

       85
       85
       +
       	panic("not implemented")

     

       86
       86
       +
       }

     

       87
       87
       +
       

     

       88
       88
       +
       func (bs *SqliteBlockstore) Has(context.Context, cid.Cid) (bool, error) {

     

       89
       89
       +
       	panic("not implemented")

     

       90
       90
       +
       }

     

       91
       91
       +
       

     

       92
       92
       +
       func (bs *SqliteBlockstore) GetSize(context.Context, cid.Cid) (int, error) {

     

       93
       93
       +
       	panic("not implemented")

     

       94
       94
       +
       }

     

       95
       95
       +
       

     

       96
       96
       +
       func (bs *SqliteBlockstore) PutMany(ctx context.Context, blocks []blocks.Block) error {

     

       97
       97
       +
       	tx := bs.db.BeginDangerously()

     

       98
       98
       +
       

     

       99
       99
       +
       	for _, block := range blocks {

     

       100
       100
       +
       		bs.inserts[block.Cid()] = block

     

       101
       101
       +
       

     

       102
       102
       +
       		if bs.readonly {

     

       103
       103
       +
       			continue

     

       104
       104
       +
       		}

     

       105
       105
       +
       

     

       106
       106
       +
       		b := models.Block{

     

       107
       107
       +
       			Did:   bs.did,

     

       108
       108
       +
       			Cid:   block.Cid().Bytes(),

     

       109
       109
       +
       			Rev:   syntax.NewTIDNow(0).String(), // TODO: WARN, this is bad. don't do this

     

       110
       110
       +
       			Value: block.RawData(),

     

       111
       111
       +
       		}

     

       112
       112
       +
       

     

       113
       113
       +
       		if err := tx.Clauses(clause.OnConflict{

     

       114
       114
       +
       			Columns:   []clause.Column{{Name: "did"}, {Name: "cid"}},

     

       115
       115
       +
       			UpdateAll: true,

     

       116
       116
       +
       		}).Create(&b).Error; err != nil {

     

       117
       117
       +
       			tx.Rollback()

     

       118
       118
       +
       			return err

     

       119
       119
       +
       		}

     

       120
       120
       +
       	}

     

       121
       121
       +
       

     

       122
       122
       +
       	if bs.readonly {

     

       123
       123
       +
       		return nil

     

       124
       124
       +
       	}

     

       125
       125
       +
       

     

       126
       126
       +
       	tx.Commit()

     

       127
       127
       +
       

     

       128
       128
       +
       	return nil

     

       129
       129
       +
       }

     

       130
       130
       +
       

     

       131
       131
       +
       func (bs *SqliteBlockstore) AllKeysChan(ctx context.Context) (<-chan cid.Cid, error) {

     

       132
       132
       +
       	return nil, fmt.Errorf("iteration not allowed on sqlite blockstore")

     

       133
       133
       +
       }

     

       134
       134
       +
       

     

       135
       135
       +
       func (bs *SqliteBlockstore) HashOnRead(enabled bool) {

     

       136
       136
       +
       	panic("not implemented")

     

       137
       137
       +
       }

Compare changes