+12 -2

cmd/appview/serve.go

reviewed

··· 420 420 }, 421 421 )).Methods("GET") 422 422 423 423 + // Manifest detail API endpoint 424 424 + router.Handle("/api/manifests/{handle}/{repository}/{digest}", middleware.OptionalAuth(sessionStore, database)( 425 425 + &uihandlers.ManifestDetailHandler{ 426 426 + DB: readOnlyDB, 427 427 + Directory: oauthApp.Directory(), 428 428 + }, 429 429 + )).Methods("GET") 430 430 + 423 431 router.Handle("/u/{handle}", middleware.OptionalAuth(sessionStore, database)( 424 432 &uihandlers.UserPageHandler{ 425 433 DB: readOnlyDB, ··· 453 461 }).Methods("POST") 454 462 455 463 authRouter.Handle("/api/images/{repository}/tags/{tag}", &uihandlers.DeleteTagHandler{ 456 456 - DB: database, 464 464 + DB: database, 465 465 + Refresher: refresher, 457 466 }).Methods("DELETE") 458 467 459 468 authRouter.Handle("/api/images/{repository}/manifests/{digest}", &uihandlers.DeleteManifestHandler{ 460 460 - DB: database, 469 469 + DB: database, 470 470 + Refresher: refresher, 461 471 }).Methods("DELETE") 462 472 463 473 // Device approval page (authenticated)

+71 -3

lexicons/io/atcr/manifest.json

reviewed

··· 8 8 "key": "tid", 9 9 "record": { 10 10 "type": "object", 11 11 - "required": ["repository", "digest", "mediaType", "schemaVersion", "config", "layers", "holdEndpoint", "createdAt"], 11 11 + "required": ["repository", "digest", "mediaType", "schemaVersion", "holdEndpoint", "createdAt"], 12 12 "properties": { 13 13 "repository": { 14 14 "type": "string", ··· 29 29 "description": "OCI media type", 30 30 "knownValues": [ 31 31 "application/vnd.oci.image.manifest.v1+json", 32 32 - "application/vnd.docker.distribution.manifest.v2+json" 32 32 + "application/vnd.docker.distribution.manifest.v2+json", 33 33 + "application/vnd.oci.image.index.v1+json", 34 34 + "application/vnd.docker.distribution.manifest.list.v2+json" 33 35 ] 34 36 }, 35 37 "schemaVersion": { ··· 47 49 "type": "ref", 48 50 "ref": "#blobReference" 49 51 }, 50 50 - "description": "Filesystem layers" 52 52 + "description": "Filesystem layers (for image manifests)" 53 53 + }, 54 54 + "manifests": { 55 55 + "type": "array", 56 56 + "items": { 57 57 + "type": "ref", 58 58 + "ref": "#manifestReference" 59 59 + }, 60 60 + "description": "Referenced manifests (for manifest lists/indexes)" 51 61 }, 52 62 "annotations": { 53 63 "type": "object", ··· 98 108 "annotations": { 99 109 "type": "object", 100 110 "description": "Optional metadata" 111 111 + } 112 112 + } 113 113 + }, 114 114 + "manifestReference": { 115 115 + "type": "object", 116 116 + "description": "Reference to a manifest in a manifest list/index", 117 117 + "required": ["mediaType", "size", "digest"], 118 118 + "properties": { 119 119 + "mediaType": { 120 120 + "type": "string", 121 121 + "description": "Media type of the referenced manifest" 122 122 + }, 123 123 + "size": { 124 124 + "type": "integer", 125 125 + "description": "Size in bytes" 126 126 + }, 127 127 + "digest": { 128 128 + "type": "string", 129 129 + "description": "Content digest (e.g., 'sha256:...')" 130 130 + }, 131 131 + "platform": { 132 132 + "type": "ref", 133 133 + "ref": "#platform", 134 134 + "description": "Platform information for this manifest" 135 135 + }, 136 136 + "annotations": { 137 137 + "type": "object", 138 138 + "description": "Optional metadata" 139 139 + } 140 140 + } 141 141 + }, 142 142 + "platform": { 143 143 + "type": "object", 144 144 + "description": "Platform information describing OS and architecture", 145 145 + "required": ["architecture", "os"], 146 146 + "properties": { 147 147 + "architecture": { 148 148 + "type": "string", 149 149 + "description": "CPU architecture (e.g., 'amd64', 'arm64', 'arm')" 150 150 + }, 151 151 + "os": { 152 152 + "type": "string", 153 153 + "description": "Operating system (e.g., 'linux', 'windows', 'darwin')" 154 154 + }, 155 155 + "osVersion": { 156 156 + "type": "string", 157 157 + "description": "Optional OS version" 158 158 + }, 159 159 + "osFeatures": { 160 160 + "type": "array", 161 161 + "items": { 162 162 + "type": "string" 163 163 + }, 164 164 + "description": "Optional OS features" 165 165 + }, 166 166 + "variant": { 167 167 + "type": "string", 168 168 + "description": "Optional CPU variant (e.g., 'v7' for ARM)" 101 169 } 102 170 } 103 171 }

+16

pkg/appview/db/migrations/0004_add_manifest_references.yaml

reviewed

··· 1 1 + description: Add manifest_references table for multi-arch manifest support 2 2 + query: | 3 3 + CREATE TABLE IF NOT EXISTS manifest_references ( 4 4 + manifest_id INTEGER NOT NULL, 5 5 + digest TEXT NOT NULL, 6 6 + media_type TEXT NOT NULL, 7 7 + size INTEGER NOT NULL, 8 8 + platform_architecture TEXT, 9 9 + platform_os TEXT, 10 10 + platform_variant TEXT, 11 11 + platform_os_version TEXT, 12 12 + reference_index INTEGER NOT NULL, 13 13 + PRIMARY KEY(manifest_id, reference_index), 14 14 + FOREIGN KEY(manifest_id) REFERENCES manifests(id) ON DELETE CASCADE 15 15 + ); 16 16 + CREATE INDEX IF NOT EXISTS idx_manifest_references_digest ON manifest_references(digest);

+37

pkg/appview/db/models.go

reviewed

··· 40 40 LayerIndex int 41 41 } 42 42 43 43 + // ManifestReference represents a reference to a manifest in a manifest list/index 44 44 + type ManifestReference struct { 45 45 + ManifestID int64 46 46 + Digest string 47 47 + Size int64 48 48 + MediaType string 49 49 + PlatformArchitecture string 50 50 + PlatformOS string 51 51 + PlatformVariant string 52 52 + PlatformOSVersion string 53 53 + ReferenceIndex int 54 54 + } 55 55 + 43 56 // Tag represents a tag pointing to a manifest 44 57 type Tag struct { 45 58 ID int64 ··· 120 133 StarCount int 121 134 PullCount int 122 135 } 136 136 + 137 137 + // PlatformInfo represents platform information (OS/Architecture) 138 138 + type PlatformInfo struct { 139 139 + OS string 140 140 + Architecture string 141 141 + Variant string 142 142 + OSVersion string 143 143 + } 144 144 + 145 145 + // TagWithPlatforms extends Tag with platform information 146 146 + type TagWithPlatforms struct { 147 147 + Tag 148 148 + Platforms []PlatformInfo 149 149 + IsMultiArch bool 150 150 + } 151 151 + 152 152 + // ManifestWithMetadata extends Manifest with tags and platform information 153 153 + type ManifestWithMetadata struct { 154 154 + Manifest 155 155 + Tags []string 156 156 + Platforms []PlatformInfo 157 157 + PlatformCount int 158 158 + IsManifestList bool 159 159 + }

+361 -2

pkg/appview/db/queries.go

reviewed

··· 484 484 return tx.Commit() 485 485 } 486 486 487 487 - // InsertManifest inserts a new manifest record 487 487 + // InsertManifest inserts or updates a manifest record 488 488 + // Uses UPSERT to update labels/annotations if manifest already exists 488 489 func InsertManifest(db *sql.DB, manifest *Manifest) (int64, error) { 489 490 result, err := db.Exec(` 490 490 - INSERT OR IGNORE INTO manifests 491 491 + INSERT INTO manifests 491 492 (did, repository, digest, hold_endpoint, schema_version, media_type, 492 493 config_digest, config_size, created_at, 493 494 title, description, source_url, documentation_url, licenses, icon_url) 494 495 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) 496 496 + ON CONFLICT(did, repository, digest) DO UPDATE SET 497 497 + hold_endpoint = excluded.hold_endpoint, 498 498 + schema_version = excluded.schema_version, 499 499 + media_type = excluded.media_type, 500 500 + config_digest = excluded.config_digest, 501 501 + config_size = excluded.config_size, 502 502 + title = excluded.title, 503 503 + description = excluded.description, 504 504 + source_url = excluded.source_url, 505 505 + documentation_url = excluded.documentation_url, 506 506 + licenses = excluded.licenses, 507 507 + icon_url = excluded.icon_url 495 508 `, manifest.DID, manifest.Repository, manifest.Digest, manifest.HoldEndpoint, 496 509 manifest.SchemaVersion, manifest.MediaType, manifest.ConfigDigest, 497 510 manifest.ConfigSize, manifest.CreatedAt, ··· 532 545 DELETE FROM tags WHERE did = ? AND repository = ? AND tag = ? 533 546 `, did, repository, tag) 534 547 return err 548 548 + } 549 549 + 550 550 + // GetTagsWithPlatforms returns all tags for a repository with platform information 551 551 + // For multi-arch tags, includes all platforms from manifest_references 552 552 + // For single-arch tags, includes the platform info 553 553 + func GetTagsWithPlatforms(db *sql.DB, did, repository string) ([]TagWithPlatforms, error) { 554 554 + rows, err := db.Query(` 555 555 + SELECT 556 556 + t.id, 557 557 + t.did, 558 558 + t.repository, 559 559 + t.tag, 560 560 + t.digest, 561 561 + t.created_at, 562 562 + m.media_type, 563 563 + COALESCE(mr.platform_os, '') as platform_os, 564 564 + COALESCE(mr.platform_architecture, '') as platform_architecture, 565 565 + COALESCE(mr.platform_variant, '') as platform_variant, 566 566 + COALESCE(mr.platform_os_version, '') as platform_os_version 567 567 + FROM tags t 568 568 + JOIN manifests m ON t.digest = m.digest AND t.did = m.did AND t.repository = m.repository 569 569 + LEFT JOIN manifest_references mr ON m.id = mr.manifest_id 570 570 + WHERE t.did = ? AND t.repository = ? 571 571 + ORDER BY t.created_at DESC, mr.reference_index 572 572 + `, did, repository) 573 573 + 574 574 + if err != nil { 575 575 + return nil, err 576 576 + } 577 577 + defer rows.Close() 578 578 + 579 579 + // Group platforms by tag 580 580 + tagMap := make(map[string]*TagWithPlatforms) 581 581 + var tagOrder []string // Preserve order 582 582 + 583 583 + for rows.Next() { 584 584 + var t Tag 585 585 + var mediaType, platformOS, platformArch, platformVariant, platformOSVersion string 586 586 + 587 587 + if err := rows.Scan(&t.ID, &t.DID, &t.Repository, &t.Tag, &t.Digest, &t.CreatedAt, 588 588 + &mediaType, &platformOS, &platformArch, &platformVariant, &platformOSVersion); err != nil { 589 589 + return nil, err 590 590 + } 591 591 + 592 592 + // Get or create TagWithPlatforms 593 593 + tagKey := t.Tag 594 594 + if _, exists := tagMap[tagKey]; !exists { 595 595 + tagMap[tagKey] = &TagWithPlatforms{ 596 596 + Tag: t, 597 597 + Platforms: []PlatformInfo{}, 598 598 + } 599 599 + tagOrder = append(tagOrder, tagKey) 600 600 + } 601 601 + 602 602 + // Add platform info if present 603 603 + if platformOS != "" || platformArch != "" { 604 604 + tagMap[tagKey].Platforms = append(tagMap[tagKey].Platforms, PlatformInfo{ 605 605 + OS: platformOS, 606 606 + Architecture: platformArch, 607 607 + Variant: platformVariant, 608 608 + OSVersion: platformOSVersion, 609 609 + }) 610 610 + } 611 611 + } 612 612 + 613 613 + // Convert map to slice, preserving order and setting IsMultiArch 614 614 + result := make([]TagWithPlatforms, 0, len(tagMap)) 615 615 + for _, tagKey := range tagOrder { 616 616 + tag := tagMap[tagKey] 617 617 + tag.IsMultiArch = len(tag.Platforms) > 1 618 618 + result = append(result, *tag) 619 619 + } 620 620 + 621 621 + return result, nil 535 622 } 536 623 537 624 // DeleteManifest deletes a manifest and its associated layers ··· 617 704 } 618 705 619 706 return layers, nil 707 707 + } 708 708 + 709 709 + // InsertManifestReference inserts a new manifest reference record (for manifest lists/indexes) 710 710 + func InsertManifestReference(db *sql.DB, ref *ManifestReference) error { 711 711 + _, err := db.Exec(` 712 712 + INSERT INTO manifest_references (manifest_id, digest, size, media_type, 713 713 + platform_architecture, platform_os, 714 714 + platform_variant, platform_os_version, 715 715 + reference_index) 716 716 + VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) 717 717 + `, ref.ManifestID, ref.Digest, ref.Size, ref.MediaType, 718 718 + ref.PlatformArchitecture, ref.PlatformOS, 719 719 + ref.PlatformVariant, ref.PlatformOSVersion, 720 720 + ref.ReferenceIndex) 721 721 + return err 722 722 + } 723 723 + 724 724 + // GetManifestReferencesForManifest fetches all manifest references for a manifest list/index 725 725 + func GetManifestReferencesForManifest(db *sql.DB, manifestID int64) ([]ManifestReference, error) { 726 726 + rows, err := db.Query(` 727 727 + SELECT manifest_id, digest, size, media_type, 728 728 + platform_architecture, platform_os, platform_variant, platform_os_version, 729 729 + reference_index 730 730 + FROM manifest_references 731 731 + WHERE manifest_id = ? 732 732 + ORDER BY reference_index 733 733 + `, manifestID) 734 734 + 735 735 + if err != nil { 736 736 + return nil, err 737 737 + } 738 738 + defer rows.Close() 739 739 + 740 740 + var refs []ManifestReference 741 741 + for rows.Next() { 742 742 + var r ManifestReference 743 743 + var arch, os, variant, osVersion sql.NullString 744 744 + if err := rows.Scan(&r.ManifestID, &r.Digest, &r.Size, &r.MediaType, 745 745 + &arch, &os, &variant, &osVersion, 746 746 + &r.ReferenceIndex); err != nil { 747 747 + return nil, err 748 748 + } 749 749 + 750 750 + // Convert nullable strings 751 751 + if arch.Valid { 752 752 + r.PlatformArchitecture = arch.String 753 753 + } 754 754 + if os.Valid { 755 755 + r.PlatformOS = os.String 756 756 + } 757 757 + if variant.Valid { 758 758 + r.PlatformVariant = variant.String 759 759 + } 760 760 + if osVersion.Valid { 761 761 + r.PlatformOSVersion = osVersion.String 762 762 + } 763 763 + 764 764 + refs = append(refs, r) 765 765 + } 766 766 + 767 767 + return refs, nil 768 768 + } 769 769 + 770 770 + // GetTopLevelManifests returns only manifest lists and orphaned single-arch manifests 771 771 + // Filters out platform-specific manifests that are referenced by manifest lists 772 772 + func GetTopLevelManifests(db *sql.DB, did, repository string, limit, offset int) ([]ManifestWithMetadata, error) { 773 773 + rows, err := db.Query(` 774 774 + WITH manifest_list_children AS ( 775 775 + -- Get all digests that are children of manifest lists 776 776 + SELECT DISTINCT mr.digest 777 777 + FROM manifest_references mr 778 778 + JOIN manifests m ON mr.manifest_id = m.id 779 779 + WHERE m.did = ? AND m.repository = ? 780 780 + ) 781 781 + SELECT 782 782 + m.id, m.did, m.repository, m.digest, m.media_type, 783 783 + m.schema_version, m.created_at, m.title, m.description, 784 784 + m.source_url, m.documentation_url, m.licenses, m.icon_url, 785 785 + m.config_digest, m.config_size, m.hold_endpoint, 786 786 + GROUP_CONCAT(DISTINCT t.tag) as tags, 787 787 + COUNT(DISTINCT mr.digest) as platform_count 788 788 + FROM manifests m 789 789 + LEFT JOIN tags t ON m.digest = t.digest AND m.did = t.did AND m.repository = t.repository 790 790 + LEFT JOIN manifest_references mr ON m.id = mr.manifest_id 791 791 + WHERE m.did = ? AND m.repository = ? 792 792 + AND ( 793 793 + -- Include manifest lists 794 794 + m.media_type LIKE '%index%' OR m.media_type LIKE '%manifest.list%' 795 795 + OR 796 796 + -- Include single-arch NOT referenced by any list 797 797 + m.digest NOT IN (SELECT digest FROM manifest_list_children WHERE digest IS NOT NULL) 798 798 + ) 799 799 + GROUP BY m.id 800 800 + ORDER BY m.created_at DESC 801 801 + LIMIT ? OFFSET ? 802 802 + `, did, repository, did, repository, limit, offset) 803 803 + 804 804 + if err != nil { 805 805 + return nil, err 806 806 + } 807 807 + defer rows.Close() 808 808 + 809 809 + var manifests []ManifestWithMetadata 810 810 + for rows.Next() { 811 811 + var m ManifestWithMetadata 812 812 + var tags, title, description, sourceURL, documentationURL, licenses, iconURL, configDigest sql.NullString 813 813 + var configSize sql.NullInt64 814 814 + 815 815 + if err := rows.Scan( 816 816 + &m.ID, &m.DID, &m.Repository, &m.Digest, &m.MediaType, 817 817 + &m.SchemaVersion, &m.CreatedAt, &title, &description, 818 818 + &sourceURL, &documentationURL, &licenses, &iconURL, 819 819 + &configDigest, &configSize, &m.HoldEndpoint, 820 820 + &tags, &m.PlatformCount, 821 821 + ); err != nil { 822 822 + return nil, err 823 823 + } 824 824 + 825 825 + // Set nullable fields 826 826 + if title.Valid { 827 827 + m.Title = title.String 828 828 + } 829 829 + if description.Valid { 830 830 + m.Description = description.String 831 831 + } 832 832 + if sourceURL.Valid { 833 833 + m.SourceURL = sourceURL.String 834 834 + } 835 835 + if documentationURL.Valid { 836 836 + m.DocumentationURL = documentationURL.String 837 837 + } 838 838 + if licenses.Valid { 839 839 + m.Licenses = licenses.String 840 840 + } 841 841 + if iconURL.Valid { 842 842 + m.IconURL = iconURL.String 843 843 + } 844 844 + if configDigest.Valid { 845 845 + m.ConfigDigest = configDigest.String 846 846 + } 847 847 + if configSize.Valid { 848 848 + m.ConfigSize = configSize.Int64 849 849 + } 850 850 + 851 851 + // Parse tags 852 852 + if tags.Valid && tags.String != "" { 853 853 + m.Tags = strings.Split(tags.String, ",") 854 854 + } 855 855 + 856 856 + // Determine if manifest list 857 857 + m.IsManifestList = strings.Contains(m.MediaType, "index") || strings.Contains(m.MediaType, "manifest.list") 858 858 + 859 859 + manifests = append(manifests, m) 860 860 + } 861 861 + 862 862 + return manifests, nil 863 863 + } 864 864 + 865 865 + // GetManifestDetail returns a manifest with full platform details and tags 866 866 + func GetManifestDetail(db *sql.DB, did, repository, digest string) (*ManifestWithMetadata, error) { 867 867 + // First, get the manifest and its tags 868 868 + var m ManifestWithMetadata 869 869 + var tags, title, description, sourceURL, documentationURL, licenses, iconURL, configDigest sql.NullString 870 870 + var configSize sql.NullInt64 871 871 + 872 872 + err := db.QueryRow(` 873 873 + SELECT 874 874 + m.id, m.did, m.repository, m.digest, m.media_type, 875 875 + m.schema_version, m.created_at, m.title, m.description, 876 876 + m.source_url, m.documentation_url, m.licenses, m.icon_url, 877 877 + m.config_digest, m.config_size, m.hold_endpoint, 878 878 + GROUP_CONCAT(DISTINCT t.tag) as tags 879 879 + FROM manifests m 880 880 + LEFT JOIN tags t ON m.digest = t.digest AND m.did = t.did AND m.repository = t.repository 881 881 + WHERE m.did = ? AND m.repository = ? AND m.digest = ? 882 882 + GROUP BY m.id 883 883 + `, did, repository, digest).Scan( 884 884 + &m.ID, &m.DID, &m.Repository, &m.Digest, &m.MediaType, 885 885 + &m.SchemaVersion, &m.CreatedAt, &title, &description, 886 886 + &sourceURL, &documentationURL, &licenses, &iconURL, 887 887 + &configDigest, &configSize, &m.HoldEndpoint, 888 888 + &tags, 889 889 + ) 890 890 + 891 891 + if err != nil { 892 892 + if err == sql.ErrNoRows { 893 893 + return nil, fmt.Errorf("manifest not found") 894 894 + } 895 895 + return nil, err 896 896 + } 897 897 + 898 898 + // Set nullable fields 899 899 + if title.Valid { 900 900 + m.Title = title.String 901 901 + } 902 902 + if description.Valid { 903 903 + m.Description = description.String 904 904 + } 905 905 + if sourceURL.Valid { 906 906 + m.SourceURL = sourceURL.String 907 907 + } 908 908 + if documentationURL.Valid { 909 909 + m.DocumentationURL = documentationURL.String 910 910 + } 911 911 + if licenses.Valid { 912 912 + m.Licenses = licenses.String 913 913 + } 914 914 + if iconURL.Valid { 915 915 + m.IconURL = iconURL.String 916 916 + } 917 917 + if configDigest.Valid { 918 918 + m.ConfigDigest = configDigest.String 919 919 + } 920 920 + if configSize.Valid { 921 921 + m.ConfigSize = configSize.Int64 922 922 + } 923 923 + 924 924 + // Parse tags 925 925 + if tags.Valid && tags.String != "" { 926 926 + m.Tags = strings.Split(tags.String, ",") 927 927 + } 928 928 + 929 929 + // Determine if manifest list 930 930 + m.IsManifestList = strings.Contains(m.MediaType, "index") || strings.Contains(m.MediaType, "manifest.list") 931 931 + 932 932 + // If this is a manifest list, get platform details 933 933 + if m.IsManifestList { 934 934 + platforms, err := db.Query(` 935 935 + SELECT 936 936 + mr.platform_os, 937 937 + mr.platform_architecture, 938 938 + mr.platform_variant, 939 939 + mr.platform_os_version 940 940 + FROM manifest_references mr 941 941 + WHERE mr.manifest_id = ? 942 942 + ORDER BY mr.reference_index 943 943 + `, m.ID) 944 944 + 945 945 + if err != nil { 946 946 + return nil, err 947 947 + } 948 948 + defer platforms.Close() 949 949 + 950 950 + m.Platforms = []PlatformInfo{} 951 951 + for platforms.Next() { 952 952 + var p PlatformInfo 953 953 + var os, arch, variant, osVersion sql.NullString 954 954 + 955 955 + if err := platforms.Scan(&os, &arch, &variant, &osVersion); err != nil { 956 956 + return nil, err 957 957 + } 958 958 + 959 959 + if os.Valid { 960 960 + p.OS = os.String 961 961 + } 962 962 + if arch.Valid { 963 963 + p.Architecture = arch.String 964 964 + } 965 965 + if variant.Valid { 966 966 + p.Variant = variant.String 967 967 + } 968 968 + if osVersion.Valid { 969 969 + p.OSVersion = osVersion.String 970 970 + } 971 971 + 972 972 + m.Platforms = append(m.Platforms, p) 973 973 + } 974 974 + 975 975 + m.PlatformCount = len(m.Platforms) 976 976 + } 977 977 + 978 978 + return &m, nil 620 979 } 621 980 622 981 // GetFirehoseCursor retrieves the current firehose cursor

+15

pkg/appview/db/schema.go

reviewed

··· 68 68 ); 69 69 CREATE INDEX IF NOT EXISTS idx_layers_digest ON layers(digest); 70 70 71 71 + CREATE TABLE IF NOT EXISTS manifest_references ( 72 72 + manifest_id INTEGER NOT NULL, 73 73 + digest TEXT NOT NULL, 74 74 + media_type TEXT NOT NULL, 75 75 + size INTEGER NOT NULL, 76 76 + platform_architecture TEXT, 77 77 + platform_os TEXT, 78 78 + platform_variant TEXT, 79 79 + platform_os_version TEXT, 80 80 + reference_index INTEGER NOT NULL, 81 81 + PRIMARY KEY(manifest_id, reference_index), 82 82 + FOREIGN KEY(manifest_id) REFERENCES manifests(id) ON DELETE CASCADE 83 83 + ); 84 84 + CREATE INDEX IF NOT EXISTS idx_manifest_references_digest ON manifest_references(digest); 85 85 + 71 86 CREATE TABLE IF NOT EXISTS tags ( 72 87 id INTEGER PRIMARY KEY AUTOINCREMENT, 73 88 did TEXT NOT NULL,

+37

pkg/appview/handlers/api.go

reviewed

··· 223 223 json.NewEncoder(w).Encode(stats) 224 224 } 225 225 226 226 + // ManifestDetailHandler returns detailed manifest information including platforms 227 227 + type ManifestDetailHandler struct { 228 228 + DB *sql.DB 229 229 + Directory identity.Directory 230 230 + } 231 231 + 232 232 + func (h *ManifestDetailHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { 233 233 + // Extract parameters 234 234 + vars := mux.Vars(r) 235 235 + handle := vars["handle"] 236 236 + repository := vars["repository"] 237 237 + digest := vars["digest"] 238 238 + 239 239 + // Resolve owner's handle to DID 240 240 + ownerDID, err := resolveIdentityToDID(r.Context(), h.Directory, handle) 241 241 + if err != nil { 242 242 + http.Error(w, "Failed to resolve handle", http.StatusBadRequest) 243 243 + return 244 244 + } 245 245 + 246 246 + // Get manifest detail from database 247 247 + manifest, err := db.GetManifestDetail(h.DB, ownerDID, repository, digest) 248 248 + if err != nil { 249 249 + if err.Error() == "manifest not found" { 250 250 + http.Error(w, "Manifest not found", http.StatusNotFound) 251 251 + return 252 252 + } 253 253 + log.Printf("GetManifestDetail error: %v", err) 254 254 + http.Error(w, "Failed to fetch manifest", http.StatusInternalServerError) 255 255 + return 256 256 + } 257 257 + 258 258 + // Return manifest as JSON 259 259 + w.Header().Set("Content-Type", "application/json") 260 260 + json.NewEncoder(w).Encode(manifest) 261 261 + } 262 262 + 226 263 // resolveIdentityToDID is a helper function that resolves a handle or DID to a DID 227 264 func resolveIdentityToDID(ctx context.Context, directory identity.Directory, identityStr string) (string, error) { 228 265 // Parse as AT identifier (handle or DID)

+47 -6

pkg/appview/handlers/images.go

reviewed

··· 2 2 3 3 import ( 4 4 "database/sql" 5 5 + "fmt" 5 6 "net/http" 7 7 + "strings" 6 8 7 9 "atcr.io/pkg/appview/db" 8 10 "atcr.io/pkg/appview/middleware" 11 11 + "atcr.io/pkg/atproto" 12 12 + "atcr.io/pkg/auth/oauth" 9 13 "github.com/gorilla/mux" 10 14 ) 11 15 12 16 // DeleteTagHandler handles deleting a tag 13 17 type DeleteTagHandler struct { 14 14 - DB *sql.DB 15 15 - // TODO: Add ATProto client for deleting from PDS 18 18 + DB *sql.DB 19 19 + Refresher *oauth.Refresher 16 20 } 17 21 18 22 func (h *DeleteTagHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { ··· 26 30 repo := vars["repository"] 27 31 tag := vars["tag"] 28 32 29 29 - // TODO: Delete from PDS via ATProto client 33 33 + // Get OAuth session for the authenticated user 34 34 + session, err := h.Refresher.GetSession(r.Context(), user.DID) 35 35 + if err != nil { 36 36 + http.Error(w, fmt.Sprintf("Failed to get OAuth session: %v", err), http.StatusUnauthorized) 37 37 + return 38 38 + } 39 39 + 40 40 + // Create ATProto client with OAuth credentials 41 41 + apiClient := session.APIClient() 42 42 + pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient) 43 43 + 44 44 + // Compute rkey for tag record (repository_tag with slashes replaced) 45 45 + rkey := fmt.Sprintf("%s_%s", repo, tag) 46 46 + rkey = strings.ReplaceAll(rkey, "/", "-") 47 47 + 48 48 + // Delete from PDS first 49 49 + if err := pdsClient.DeleteRecord(r.Context(), atproto.TagCollection, rkey); err != nil { 50 50 + http.Error(w, fmt.Sprintf("Failed to delete tag from PDS: %v", err), http.StatusInternalServerError) 51 51 + return 52 52 + } 30 53 31 54 // Delete from cache 32 55 if err := db.DeleteTag(h.DB, user.DID, repo, tag); err != nil { ··· 40 63 41 64 // DeleteManifestHandler handles deleting a manifest 42 65 type DeleteManifestHandler struct { 43 43 - DB *sql.DB 44 44 - // TODO: Add ATProto client for deleting from PDS 66 66 + DB *sql.DB 67 67 + Refresher *oauth.Refresher 45 68 } 46 69 47 70 func (h *DeleteManifestHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { ··· 67 90 return 68 91 } 69 92 70 70 - // TODO: Delete from PDS via ATProto client 93 93 + // Get OAuth session for the authenticated user 94 94 + session, err := h.Refresher.GetSession(r.Context(), user.DID) 95 95 + if err != nil { 96 96 + http.Error(w, fmt.Sprintf("Failed to get OAuth session: %v", err), http.StatusUnauthorized) 97 97 + return 98 98 + } 99 99 + 100 100 + // Create ATProto client with OAuth credentials 101 101 + apiClient := session.APIClient() 102 102 + pdsClient := atproto.NewClientWithIndigoClient(user.PDSEndpoint, user.DID, apiClient) 103 103 + 104 104 + // Compute rkey for manifest record (digest without "sha256:" prefix) 105 105 + rkey := strings.TrimPrefix(digest, "sha256:") 106 106 + 107 107 + // Delete from PDS first 108 108 + if err := pdsClient.DeleteRecord(r.Context(), atproto.ManifestCollection, rkey); err != nil { 109 109 + http.Error(w, fmt.Sprintf("Failed to delete manifest from PDS: %v", err), http.StatusInternalServerError) 110 110 + return 111 111 + } 71 112 72 113 // Delete from cache 73 114 if err := db.DeleteManifest(h.DB, user.DID, repo, digest); err != nil {

+26 -8

pkg/appview/handlers/repository.go

reviewed

··· 40 40 return 41 41 } 42 42 43 43 - // Fetch repository data 44 44 - repo, err := db.GetRepository(h.DB, owner.DID, repository) 43 43 + // Fetch tags with platform information 44 44 + tagsWithPlatforms, err := db.GetTagsWithPlatforms(h.DB, owner.DID, repository) 45 45 + if err != nil { 46 46 + http.Error(w, err.Error(), http.StatusInternalServerError) 47 47 + return 48 48 + } 49 49 + 50 50 + // Fetch top-level manifests (filters out platform-specific manifests) 51 51 + manifests, err := db.GetTopLevelManifests(h.DB, owner.DID, repository, 50, 0) 45 52 if err != nil { 46 53 http.Error(w, err.Error(), http.StatusInternalServerError) 47 54 return 48 55 } 49 56 50 50 - if repo == nil || len(repo.Manifests) == 0 { 57 57 + if len(tagsWithPlatforms) == 0 && len(manifests) == 0 { 51 58 http.Error(w, "Repository not found", http.StatusNotFound) 52 59 return 53 60 } 54 61 62 62 + // Create repository summary 63 63 + repo := &db.Repository{ 64 64 + Name: repository, 65 65 + TagCount: len(tagsWithPlatforms), 66 66 + ManifestCount: len(manifests), 67 67 + } 68 68 + 55 69 // Fetch star count 56 70 stats, err := db.GetRepositoryStats(h.DB, owner.DID, repository) 57 71 if err != nil { ··· 86 100 87 101 data := struct { 88 102 PageData 89 89 - Owner *db.User // Repository owner 90 90 - Repository *db.Repository 91 91 - StarCount int 92 92 - IsStarred bool 93 93 - IsOwner bool // Whether current user owns this repository 103 103 + Owner *db.User // Repository owner 104 104 + Repository *db.Repository // Repository summary 105 105 + Tags []db.TagWithPlatforms // Tags with platform info 106 106 + Manifests []db.ManifestWithMetadata // Top-level manifests only 107 107 + StarCount int 108 108 + IsStarred bool 109 109 + IsOwner bool // Whether current user owns this repository 94 110 }{ 95 111 PageData: NewPageData(r, h.RegistryURL), 96 112 Owner: owner, 97 113 Repository: repo, 114 114 + Tags: tagsWithPlatforms, 115 115 + Manifests: manifests, 98 116 StarCount: stats.StarCount, 99 117 IsStarred: isStarred, 100 118 IsOwner: isOwner,

+58 -16

pkg/appview/jetstream/backfill.go

reviewed

··· 308 308 iconURL = manifestRecord.Annotations["io.atcr.icon"] 309 309 } 310 310 311 311 - // Insert manifest 312 312 - manifestID, err := db.InsertManifest(b.db, &db.Manifest{ 311 311 + // Detect manifest type 312 312 + isManifestList := len(manifestRecord.Manifests) > 0 313 313 + 314 314 + // Prepare manifest for insertion 315 315 + manifest := &db.Manifest{ 313 316 DID: did, 314 317 Repository: manifestRecord.Repository, 315 318 Digest: manifestRecord.Digest, 316 319 MediaType: manifestRecord.MediaType, 317 320 SchemaVersion: manifestRecord.SchemaVersion, 318 318 - ConfigDigest: manifestRecord.Config.Digest, 319 319 - ConfigSize: manifestRecord.Config.Size, 320 321 HoldEndpoint: manifestRecord.HoldEndpoint, 321 322 CreatedAt: manifestRecord.CreatedAt, 322 323 Title: title, ··· 325 326 DocumentationURL: documentationURL, 326 327 Licenses: licenses, 327 328 IconURL: iconURL, 328 328 - }) 329 329 + } 330 330 + 331 331 + // Set config fields only for image manifests (not manifest lists) 332 332 + if !isManifestList && manifestRecord.Config != nil { 333 333 + manifest.ConfigDigest = manifestRecord.Config.Digest 334 334 + manifest.ConfigSize = manifestRecord.Config.Size 335 335 + } 336 336 + 337 337 + // Insert manifest 338 338 + manifestID, err := db.InsertManifest(b.db, manifest) 329 339 if err != nil { 330 340 // Skip if already exists 331 341 if strings.Contains(err.Error(), "UNIQUE constraint failed") { ··· 334 344 return fmt.Errorf("failed to insert manifest: %w", err) 335 345 } 336 346 337 337 - // Insert layers 338 338 - for i, layer := range manifestRecord.Layers { 339 339 - if err := db.InsertLayer(b.db, &db.Layer{ 340 340 - ManifestID: manifestID, 341 341 - Digest: layer.Digest, 342 342 - MediaType: layer.MediaType, 343 343 - Size: layer.Size, 344 344 - LayerIndex: i, 345 345 - }); err != nil { 346 346 - // Continue on error - layer might already exist 347 347 - continue 347 347 + if isManifestList { 348 348 + // Insert manifest references (for manifest lists/indexes) 349 349 + for i, ref := range manifestRecord.Manifests { 350 350 + platformArch := "" 351 351 + platformOS := "" 352 352 + platformVariant := "" 353 353 + platformOSVersion := "" 354 354 + 355 355 + if ref.Platform != nil { 356 356 + platformArch = ref.Platform.Architecture 357 357 + platformOS = ref.Platform.OS 358 358 + platformVariant = ref.Platform.Variant 359 359 + platformOSVersion = ref.Platform.OSVersion 360 360 + } 361 361 + 362 362 + if err := db.InsertManifestReference(b.db, &db.ManifestReference{ 363 363 + ManifestID: manifestID, 364 364 + Digest: ref.Digest, 365 365 + MediaType: ref.MediaType, 366 366 + Size: ref.Size, 367 367 + PlatformArchitecture: platformArch, 368 368 + PlatformOS: platformOS, 369 369 + PlatformVariant: platformVariant, 370 370 + PlatformOSVersion: platformOSVersion, 371 371 + ReferenceIndex: i, 372 372 + }); err != nil { 373 373 + // Continue on error - reference might already exist 374 374 + continue 375 375 + } 376 376 + } 377 377 + } else { 378 378 + // Insert layers (for image manifests) 379 379 + for i, layer := range manifestRecord.Layers { 380 380 + if err := db.InsertLayer(b.db, &db.Layer{ 381 381 + ManifestID: manifestID, 382 382 + Digest: layer.Digest, 383 383 + MediaType: layer.MediaType, 384 384 + Size: layer.Size, 385 385 + LayerIndex: i, 386 386 + }); err != nil { 387 387 + // Continue on error - layer might already exist 388 388 + continue 389 389 + } 348 390 } 349 391 } 350 392

+58 -16

pkg/appview/jetstream/worker.go

reviewed

··· 452 452 iconURL = manifestRecord.Annotations["io.atcr.icon"] 453 453 } 454 454 455 455 - // Insert manifest 456 456 - manifestID, err := db.InsertManifest(w.db, &db.Manifest{ 455 455 + // Detect manifest type 456 456 + isManifestList := len(manifestRecord.Manifests) > 0 457 457 + 458 458 + // Prepare manifest for insertion 459 459 + manifest := &db.Manifest{ 457 460 DID: commit.DID, 458 461 Repository: manifestRecord.Repository, 459 462 Digest: manifestRecord.Digest, 460 463 MediaType: manifestRecord.MediaType, 461 464 SchemaVersion: manifestRecord.SchemaVersion, 462 462 - ConfigDigest: manifestRecord.Config.Digest, 463 463 - ConfigSize: manifestRecord.Config.Size, 464 465 HoldEndpoint: manifestRecord.HoldEndpoint, 465 466 CreatedAt: manifestRecord.CreatedAt, 466 467 Title: title, ··· 469 470 DocumentationURL: documentationURL, 470 471 Licenses: licenses, 471 472 IconURL: iconURL, 472 472 - }) 473 473 + } 474 474 + 475 475 + // Set config fields only for image manifests (not manifest lists) 476 476 + if !isManifestList && manifestRecord.Config != nil { 477 477 + manifest.ConfigDigest = manifestRecord.Config.Digest 478 478 + manifest.ConfigSize = manifestRecord.Config.Size 479 479 + } 480 480 + 481 481 + // Insert manifest 482 482 + manifestID, err := db.InsertManifest(w.db, manifest) 473 483 if err != nil { 474 484 return fmt.Errorf("failed to insert manifest: %w", err) 475 485 } 476 486 477 477 - // Insert layers 478 478 - for i, layer := range manifestRecord.Layers { 479 479 - if err := db.InsertLayer(w.db, &db.Layer{ 480 480 - ManifestID: manifestID, 481 481 - Digest: layer.Digest, 482 482 - MediaType: layer.MediaType, 483 483 - Size: layer.Size, 484 484 - LayerIndex: i, 485 485 - }); err != nil { 486 486 - // Continue on error - layer might already exist 487 487 - continue 487 487 + if isManifestList { 488 488 + // Insert manifest references (for manifest lists/indexes) 489 489 + for i, ref := range manifestRecord.Manifests { 490 490 + platformArch := "" 491 491 + platformOS := "" 492 492 + platformVariant := "" 493 493 + platformOSVersion := "" 494 494 + 495 495 + if ref.Platform != nil { 496 496 + platformArch = ref.Platform.Architecture 497 497 + platformOS = ref.Platform.OS 498 498 + platformVariant = ref.Platform.Variant 499 499 + platformOSVersion = ref.Platform.OSVersion 500 500 + } 501 501 + 502 502 + if err := db.InsertManifestReference(w.db, &db.ManifestReference{ 503 503 + ManifestID: manifestID, 504 504 + Digest: ref.Digest, 505 505 + MediaType: ref.MediaType, 506 506 + Size: ref.Size, 507 507 + PlatformArchitecture: platformArch, 508 508 + PlatformOS: platformOS, 509 509 + PlatformVariant: platformVariant, 510 510 + PlatformOSVersion: platformOSVersion, 511 511 + ReferenceIndex: i, 512 512 + }); err != nil { 513 513 + // Continue on error - reference might already exist 514 514 + continue 515 515 + } 516 516 + } 517 517 + } else { 518 518 + // Insert layers (for image manifests) 519 519 + for i, layer := range manifestRecord.Layers { 520 520 + if err := db.InsertLayer(w.db, &db.Layer{ 521 521 + ManifestID: manifestID, 522 522 + Digest: layer.Digest, 523 523 + MediaType: layer.MediaType, 524 524 + Size: layer.Size, 525 525 + LayerIndex: i, 526 526 + }); err != nil { 527 527 + // Continue on error - layer might already exist 528 528 + continue 529 529 + } 488 530 } 489 531 } 490 532

+55

pkg/appview/static/css/style.css

reviewed

··· 1049 1049 color: var(--secondary); 1050 1050 } 1051 1051 1052 1052 + /* Multi-architecture badges */ 1053 1053 + .badge-multi { 1054 1054 + display: inline-flex; 1055 1055 + align-items: center; 1056 1056 + padding: 0.25rem 0.6rem; 1057 1057 + font-size: 0.75rem; 1058 1058 + font-weight: 600; 1059 1059 + border-radius: 12px; 1060 1060 + background: var(--primary); 1061 1061 + color: var(--bg); 1062 1062 + white-space: nowrap; 1063 1063 + margin-left: 0.5rem; 1064 1064 + } 1065 1065 + 1066 1066 + .platform-badge { 1067 1067 + display: inline-flex; 1068 1068 + align-items: center; 1069 1069 + padding: 0.2rem 0.5rem; 1070 1070 + font-size: 0.75rem; 1071 1071 + font-weight: 500; 1072 1072 + border-radius: 4px; 1073 1073 + background: var(--code-bg); 1074 1074 + color: var(--fg); 1075 1075 + border: 1px solid var(--border); 1076 1076 + white-space: nowrap; 1077 1077 + font-family: 'Monaco', 'Courier New', monospace; 1078 1078 + } 1079 1079 + 1080 1080 + .platforms-inline { 1081 1081 + display: flex; 1082 1082 + flex-wrap: wrap; 1083 1083 + gap: 0.5rem; 1084 1084 + align-items: center; 1085 1085 + } 1086 1086 + 1087 1087 + .manifest-type { 1088 1088 + display: inline-flex; 1089 1089 + align-items: center; 1090 1090 + gap: 0.35rem; 1091 1091 + font-size: 0.9rem; 1092 1092 + font-weight: 500; 1093 1093 + color: var(--secondary); 1094 1094 + } 1095 1095 + 1096 1096 + .platform-count { 1097 1097 + color: var(--border-dark); 1098 1098 + font-size: 0.85rem; 1099 1099 + font-style: italic; 1100 1100 + } 1101 1101 + 1102 1102 + .text-muted { 1103 1103 + color: var(--border-dark); 1104 1104 + font-style: italic; 1105 1105 + } 1106 1106 + 1052 1107 /* Featured Repositories Section */ 1053 1108 .featured-section { 1054 1109 margin-bottom: 3rem;

+5 -4

pkg/appview/storage/proxy_blob_store.go

reviewed

··· 12 12 "sync" 13 13 "time" 14 14 15 15 + "atcr.io/pkg/atproto" 15 16 "github.com/distribution/distribution/v3" 16 17 "github.com/opencontainers/go-digest" 17 18 ) ··· 508 509 return "", err 509 510 } 510 511 511 511 - url := fmt.Sprintf("%s/xrpc/io.atcr.hold.initiateUpload", p.holdURL) 512 512 + url := fmt.Sprintf("%s%s", p.holdURL, atproto.HoldInitiateUpload) 512 513 req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body)) 513 514 if err != nil { 514 515 return "", err ··· 556 557 return nil, err 557 558 } 558 559 559 559 - url := fmt.Sprintf("%s/xrpc/io.atcr.hold.getPartUploadUrl", p.holdURL) 560 560 + url := fmt.Sprintf("%s%s", p.holdURL, atproto.HoldGetPartUploadUrl) 560 561 req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body)) 561 562 if err != nil { 562 563 return nil, err ··· 606 607 return err 607 608 } 608 609 609 609 - url := fmt.Sprintf("%s/xrpc/io.atcr.hold.completeUpload", p.holdURL) 610 610 + url := fmt.Sprintf("%s%s", p.holdURL, atproto.HoldCompleteUpload) 610 611 req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body)) 611 612 if err != nil { 612 613 return err ··· 639 640 return err 640 641 } 641 642 642 642 - url := fmt.Sprintf("%s/xrpc/io.atcr.hold.abortUpload", p.holdURL) 643 643 + url := fmt.Sprintf("%s%s", p.holdURL, atproto.HoldAbortUpload) 643 644 req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body)) 644 645 if err != nil { 645 646 return err

+326

pkg/appview/storage/proxy_blob_store_test.go

reviewed

··· 2 2 3 3 import ( 4 4 "context" 5 5 + "encoding/json" 5 6 "net/http" 6 7 "net/http/httptest" 7 8 "strings" 8 9 "testing" 9 10 "time" 11 11 + 12 12 + "atcr.io/pkg/atproto" 13 13 + "github.com/opencontainers/go-digest" 10 14 ) 11 15 12 16 // TestGetServiceToken_CachingLogic tests the token caching mechanism ··· 343 347 } 344 348 } 345 349 } 350 350 + 351 351 + // TestCompleteMultipartUpload_JSONFormat verifies the JSON request format sent to hold service 352 352 + // This test would have caught the "partNumber" vs "part_number" bug 353 353 + func TestCompleteMultipartUpload_JSONFormat(t *testing.T) { 354 354 + var capturedBody map[string]any 355 355 + 356 356 + // Mock hold service that captures the request body 357 357 + holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 358 358 + if !strings.Contains(r.URL.Path, atproto.HoldCompleteUpload) { 359 359 + t.Errorf("Wrong endpoint called: %s", r.URL.Path) 360 360 + } 361 361 + 362 362 + // Capture request body 363 363 + var body map[string]any 364 364 + if err := json.NewDecoder(r.Body).Decode(&body); err != nil { 365 365 + t.Errorf("Failed to decode request body: %v", err) 366 366 + } 367 367 + capturedBody = body 368 368 + 369 369 + w.Header().Set("Content-Type", "application/json") 370 370 + w.WriteHeader(http.StatusOK) 371 371 + w.Write([]byte(`{}`)) 372 372 + })) 373 373 + defer holdServer.Close() 374 374 + 375 375 + // Create store with mocked hold URL 376 376 + ctx := &RegistryContext{ 377 377 + DID: "did:plc:test", 378 378 + HoldDID: "did:web:hold.example.com", 379 379 + PDSEndpoint: "https://pds.example.com", 380 380 + Repository: "test-repo", 381 381 + } 382 382 + store := NewProxyBlobStore(ctx) 383 383 + store.holdURL = holdServer.URL 384 384 + 385 385 + // Setup token cache to avoid auth errors 386 386 + globalServiceTokensMu.Lock() 387 387 + globalServiceTokens["did:plc:test:did:web:hold.example.com"] = &serviceTokenEntry{ 388 388 + token: "test-token", 389 389 + expiresAt: time.Now().Add(50 * time.Second), 390 390 + } 391 391 + globalServiceTokensMu.Unlock() 392 392 + 393 393 + // Call completeMultipartUpload 394 394 + parts := []CompletedPart{ 395 395 + {PartNumber: 1, ETag: "etag-1"}, 396 396 + {PartNumber: 2, ETag: "etag-2"}, 397 397 + } 398 398 + err := store.completeMultipartUpload(context.Background(), "sha256:abc123", "upload-id-xyz", parts) 399 399 + if err != nil { 400 400 + t.Fatalf("completeMultipartUpload failed: %v", err) 401 401 + } 402 402 + 403 403 + // Verify JSON format 404 404 + if capturedBody == nil { 405 405 + t.Fatal("No request body was captured") 406 406 + } 407 407 + 408 408 + // Check top-level fields 409 409 + if uploadID, ok := capturedBody["uploadId"].(string); !ok || uploadID != "upload-id-xyz" { 410 410 + t.Errorf("Expected uploadId='upload-id-xyz', got %v", capturedBody["uploadId"]) 411 411 + } 412 412 + if digest, ok := capturedBody["digest"].(string); !ok || digest != "sha256:abc123" { 413 413 + t.Errorf("Expected digest='sha256:abc123', got %v", capturedBody["digest"]) 414 414 + } 415 415 + 416 416 + // Check parts array 417 417 + partsArray, ok := capturedBody["parts"].([]any) 418 418 + if !ok { 419 419 + t.Fatalf("Expected parts to be array, got %T", capturedBody["parts"]) 420 420 + } 421 421 + if len(partsArray) != 2 { 422 422 + t.Fatalf("Expected 2 parts, got %d", len(partsArray)) 423 423 + } 424 424 + 425 425 + // Verify first part has "part_number" (not "partNumber") 426 426 + part0, ok := partsArray[0].(map[string]any) 427 427 + if !ok { 428 428 + t.Fatalf("Expected part to be object, got %T", partsArray[0]) 429 429 + } 430 430 + 431 431 + // THIS IS THE KEY CHECK - would have caught the bug 432 432 + if _, hasPartNumber := part0["partNumber"]; hasPartNumber { 433 433 + t.Error("Found 'partNumber' (camelCase) - should be 'part_number' (snake_case)") 434 434 + } 435 435 + if partNum, ok := part0["part_number"].(float64); !ok || int(partNum) != 1 { 436 436 + t.Errorf("Expected part_number=1, got %v", part0["part_number"]) 437 437 + } 438 438 + if etag, ok := part0["etag"].(string); !ok || etag != "etag-1" { 439 439 + t.Errorf("Expected etag='etag-1', got %v", part0["etag"]) 440 440 + } 441 441 + } 442 442 + 443 443 + // TestGet_UsesPresignedURLDirectly verifies that Get() doesn't add auth headers to presigned URLs 444 444 + // This test would have caught the presigned URL authentication bug 445 445 + func TestGet_UsesPresignedURLDirectly(t *testing.T) { 446 446 + blobData := []byte("test blob content") 447 447 + var s3ReceivedAuthHeader string 448 448 + 449 449 + // Mock S3 server that rejects requests with Authorization header 450 450 + s3Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 451 451 + s3ReceivedAuthHeader = r.Header.Get("Authorization") 452 452 + 453 453 + // Presigned URLs should NOT have Authorization header 454 454 + if s3ReceivedAuthHeader != "" { 455 455 + t.Errorf("S3 received Authorization header: %s (should be empty for presigned URLs)", s3ReceivedAuthHeader) 456 456 + w.WriteHeader(http.StatusForbidden) 457 457 + w.Write([]byte(`<?xml version="1.0"?><Error><Code>SignatureDoesNotMatch</Code></Error>`)) 458 458 + return 459 459 + } 460 460 + 461 461 + // Return blob data 462 462 + w.WriteHeader(http.StatusOK) 463 463 + w.Write(blobData) 464 464 + })) 465 465 + defer s3Server.Close() 466 466 + 467 467 + // Mock hold service that returns presigned S3 URL 468 468 + holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 469 469 + // Return presigned URL pointing to S3 server 470 470 + w.Header().Set("Content-Type", "application/json") 471 471 + w.WriteHeader(http.StatusOK) 472 472 + resp := map[string]string{ 473 473 + "url": s3Server.URL + "/blob?X-Amz-Signature=fake-signature", 474 474 + } 475 475 + json.NewEncoder(w).Encode(resp) 476 476 + })) 477 477 + defer holdServer.Close() 478 478 + 479 479 + // Create store 480 480 + ctx := &RegistryContext{ 481 481 + DID: "did:plc:test", 482 482 + HoldDID: "did:web:hold.example.com", 483 483 + PDSEndpoint: "https://pds.example.com", 484 484 + Repository: "test-repo", 485 485 + } 486 486 + store := NewProxyBlobStore(ctx) 487 487 + store.holdURL = holdServer.URL 488 488 + 489 489 + // Setup token cache 490 490 + globalServiceTokensMu.Lock() 491 491 + globalServiceTokens["did:plc:test:did:web:hold.example.com"] = &serviceTokenEntry{ 492 492 + token: "test-token", 493 493 + expiresAt: time.Now().Add(50 * time.Second), 494 494 + } 495 495 + globalServiceTokensMu.Unlock() 496 496 + 497 497 + // Call Get() 498 498 + dgst := digest.FromBytes(blobData) 499 499 + retrieved, err := store.Get(context.Background(), dgst) 500 500 + if err != nil { 501 501 + t.Fatalf("Get() failed: %v", err) 502 502 + } 503 503 + 504 504 + // Verify correct data was retrieved 505 505 + if string(retrieved) != string(blobData) { 506 506 + t.Errorf("Expected data=%s, got %s", string(blobData), string(retrieved)) 507 507 + } 508 508 + 509 509 + // Verify S3 received NO Authorization header 510 510 + if s3ReceivedAuthHeader != "" { 511 511 + t.Errorf("S3 should not receive Authorization header for presigned URLs, got: %s", s3ReceivedAuthHeader) 512 512 + } 513 513 + } 514 514 + 515 515 + // TestOpen_UsesPresignedURLDirectly verifies that Open() doesn't add auth headers to presigned URLs 516 516 + // This test would have caught the presigned URL authentication bug 517 517 + func TestOpen_UsesPresignedURLDirectly(t *testing.T) { 518 518 + blobData := []byte("test blob stream content") 519 519 + var s3ReceivedAuthHeader string 520 520 + 521 521 + // Mock S3 server 522 522 + s3Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 523 523 + s3ReceivedAuthHeader = r.Header.Get("Authorization") 524 524 + 525 525 + // Presigned URLs should NOT have Authorization header 526 526 + if s3ReceivedAuthHeader != "" { 527 527 + t.Errorf("S3 received Authorization header: %s (should be empty)", s3ReceivedAuthHeader) 528 528 + w.WriteHeader(http.StatusForbidden) 529 529 + return 530 530 + } 531 531 + 532 532 + w.WriteHeader(http.StatusOK) 533 533 + w.Write(blobData) 534 534 + })) 535 535 + defer s3Server.Close() 536 536 + 537 537 + // Mock hold service 538 538 + holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 539 539 + w.Header().Set("Content-Type", "application/json") 540 540 + w.WriteHeader(http.StatusOK) 541 541 + json.NewEncoder(w).Encode(map[string]string{ 542 542 + "url": s3Server.URL + "/blob?X-Amz-Signature=fake", 543 543 + }) 544 544 + })) 545 545 + defer holdServer.Close() 546 546 + 547 547 + // Create store 548 548 + ctx := &RegistryContext{ 549 549 + DID: "did:plc:test", 550 550 + HoldDID: "did:web:hold.example.com", 551 551 + PDSEndpoint: "https://pds.example.com", 552 552 + Repository: "test-repo", 553 553 + } 554 554 + store := NewProxyBlobStore(ctx) 555 555 + store.holdURL = holdServer.URL 556 556 + 557 557 + // Setup token cache 558 558 + globalServiceTokensMu.Lock() 559 559 + globalServiceTokens["did:plc:test:did:web:hold.example.com"] = &serviceTokenEntry{ 560 560 + token: "test-token", 561 561 + expiresAt: time.Now().Add(50 * time.Second), 562 562 + } 563 563 + globalServiceTokensMu.Unlock() 564 564 + 565 565 + // Call Open() 566 566 + dgst := digest.FromBytes(blobData) 567 567 + reader, err := store.Open(context.Background(), dgst) 568 568 + if err != nil { 569 569 + t.Fatalf("Open() failed: %v", err) 570 570 + } 571 571 + defer reader.Close() 572 572 + 573 573 + // Verify S3 received NO Authorization header 574 574 + if s3ReceivedAuthHeader != "" { 575 575 + t.Errorf("S3 should not receive Authorization header for presigned URLs, got: %s", s3ReceivedAuthHeader) 576 576 + } 577 577 + } 578 578 + 579 579 + // TestMultipartEndpoints_CorrectURLs verifies all multipart XRPC endpoints use correct URLs 580 580 + // This would have caught the old com.atproto.repo.uploadBlob vs new io.atcr.hold.* endpoints 581 581 + func TestMultipartEndpoints_CorrectURLs(t *testing.T) { 582 582 + tests := []struct { 583 583 + name string 584 584 + testFunc func(*ProxyBlobStore) error 585 585 + expectedPath string 586 586 + }{ 587 587 + { 588 588 + name: "startMultipartUpload", 589 589 + testFunc: func(store *ProxyBlobStore) error { 590 590 + _, err := store.startMultipartUpload(context.Background(), "sha256:test") 591 591 + return err 592 592 + }, 593 593 + expectedPath: atproto.HoldInitiateUpload, 594 594 + }, 595 595 + { 596 596 + name: "getPartUploadInfo", 597 597 + testFunc: func(store *ProxyBlobStore) error { 598 598 + _, err := store.getPartUploadInfo(context.Background(), "sha256:test", "upload-123", 1) 599 599 + return err 600 600 + }, 601 601 + expectedPath: atproto.HoldGetPartUploadUrl, 602 602 + }, 603 603 + { 604 604 + name: "completeMultipartUpload", 605 605 + testFunc: func(store *ProxyBlobStore) error { 606 606 + parts := []CompletedPart{{PartNumber: 1, ETag: "etag1"}} 607 607 + return store.completeMultipartUpload(context.Background(), "sha256:test", "upload-123", parts) 608 608 + }, 609 609 + expectedPath: atproto.HoldCompleteUpload, 610 610 + }, 611 611 + { 612 612 + name: "abortMultipartUpload", 613 613 + testFunc: func(store *ProxyBlobStore) error { 614 614 + return store.abortMultipartUpload(context.Background(), "sha256:test", "upload-123") 615 615 + }, 616 616 + expectedPath: atproto.HoldAbortUpload, 617 617 + }, 618 618 + } 619 619 + 620 620 + for _, tt := range tests { 621 621 + t.Run(tt.name, func(t *testing.T) { 622 622 + var capturedPath string 623 623 + 624 624 + // Mock hold service that captures request path 625 625 + holdServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 626 626 + capturedPath = r.URL.Path 627 627 + 628 628 + // Return success response 629 629 + w.Header().Set("Content-Type", "application/json") 630 630 + w.WriteHeader(http.StatusOK) 631 631 + resp := map[string]string{ 632 632 + "uploadId": "test-upload-id", 633 633 + "url": "https://s3.example.com/presigned", 634 634 + } 635 635 + json.NewEncoder(w).Encode(resp) 636 636 + })) 637 637 + defer holdServer.Close() 638 638 + 639 639 + // Create store 640 640 + ctx := &RegistryContext{ 641 641 + DID: "did:plc:test", 642 642 + HoldDID: "did:web:hold.example.com", 643 643 + PDSEndpoint: "https://pds.example.com", 644 644 + Repository: "test-repo", 645 645 + } 646 646 + store := NewProxyBlobStore(ctx) 647 647 + store.holdURL = holdServer.URL 648 648 + 649 649 + // Setup token cache 650 650 + globalServiceTokensMu.Lock() 651 651 + globalServiceTokens["did:plc:test:did:web:hold.example.com"] = &serviceTokenEntry{ 652 652 + token: "test-token", 653 653 + expiresAt: time.Now().Add(50 * time.Second), 654 654 + } 655 655 + globalServiceTokensMu.Unlock() 656 656 + 657 657 + // Call the function 658 658 + _ = tt.testFunc(store) // Ignore error, we just care about the URL 659 659 + 660 660 + // Verify correct endpoint was called 661 661 + if capturedPath != tt.expectedPath { 662 662 + t.Errorf("Expected endpoint %s, got %s", tt.expectedPath, capturedPath) 663 663 + } 664 664 + 665 665 + // Verify it's NOT the old endpoint 666 666 + if strings.Contains(capturedPath, "com.atproto.repo.uploadBlob") { 667 667 + t.Error("Still using old com.atproto.repo.uploadBlob endpoint!") 668 668 + } 669 669 + }) 670 670 + } 671 671 + }

+68 -25

pkg/appview/templates/pages/repository.html

reviewed

··· 64 64 <!-- Pull Command --> 65 65 <div class="pull-command-section"> 66 66 <h3>Pull this image</h3> 67 67 - {{ if .Repository.Tags }} 68 68 - {{ $firstTag := index .Repository.Tags 0 }} 67 67 + {{ if .Tags }} 68 68 + {{ $firstTag := index .Tags 0 }} 69 69 <div class="push-command"> 70 70 - <code class="pull-command">docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ $firstTag.Tag }}</code> 71 71 - <button class="copy-btn" onclick="copyToClipboard('docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ $firstTag.Tag }}')"> 70 70 + <code class="pull-command">docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ $firstTag.Tag.Tag }}</code> 71 71 + <button class="copy-btn" onclick="copyToClipboard('docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ $firstTag.Tag.Tag }}')"> 72 72 Copy 73 73 </button> 74 74 </div> ··· 86 86 <!-- Tags Section --> 87 87 <div class="repo-section"> 88 88 <h2>Tags</h2> 89 89 - {{ if .Repository.Tags }} 89 89 + {{ if .Tags }} 90 90 <div class="tags-list"> 91 91 - {{ range .Repository.Tags }} 92 92 - <div class="tag-item" id="tag-{{ .Tag }}"> 91 91 + {{ range .Tags }} 92 92 + <div class="tag-item" id="tag-{{ .Tag.Tag }}"> 93 93 <div class="tag-item-header"> 94 94 - <span class="tag-name-large">{{ .Tag }}</span> 94 94 + <div> 95 95 + <span class="tag-name-large">{{ .Tag.Tag }}</span> 96 96 + {{ if .IsMultiArch }} 97 97 + <span class="badge-multi">Multi-arch</span> 98 98 + {{ end }} 99 99 + </div> 95 100 <div style="display: flex; gap: 1rem; align-items: center;"> 96 96 - <time class="tag-timestamp" datetime="{{ .CreatedAt.Format "2006-01-02T15:04:05Z07:00" }}"> 97 97 - {{ timeAgo .CreatedAt }} 101 101 + <time class="tag-timestamp" datetime="{{ .Tag.CreatedAt.Format "2006-01-02T15:04:05Z07:00" }}"> 102 102 + {{ timeAgo .Tag.CreatedAt }} 98 103 </time> 99 104 {{ if $.IsOwner }} 100 105 <button class="delete-btn" 101 101 - hx-delete="/api/images/{{ $.Repository.Name }}/tags/{{ .Tag }}" 102 102 - hx-confirm="Delete tag {{ .Tag }}?" 103 103 - hx-target="#tag-{{ .Tag }}" 106 106 + hx-delete="/api/images/{{ $.Repository.Name }}/tags/{{ .Tag.Tag }}" 107 107 + hx-confirm="Delete tag {{ .Tag.Tag }}?" 108 108 + hx-target="#tag-{{ .Tag.Tag }}" 104 109 hx-swap="outerHTML"> 105 110 🗑️ 106 111 </button> ··· 108 113 </div> 109 114 </div> 110 115 <div class="tag-item-details"> 111 111 - <code class="digest">{{ .Digest }}</code> 116 116 + <div style="display: flex; justify-content: space-between; align-items: center;"> 117 117 + <code class="digest">{{ .Tag.Digest }}</code> 118 118 + {{ if .Platforms }} 119 119 + <div class="platforms-inline"> 120 120 + {{ range .Platforms }} 121 121 + <span class="platform-badge">{{ .OS }}/{{ .Architecture }}{{ if .Variant }}/{{ .Variant }}{{ end }}</span> 122 122 + {{ end }} 123 123 + </div> 124 124 + {{ end }} 125 125 + </div> 112 126 </div> 113 127 <div class="push-command"> 114 114 - <code class="pull-command">docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ .Tag }}</code> 115 115 - <button class="copy-btn" onclick="copyToClipboard('docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ .Tag }}')"> 128 128 + <code class="pull-command">docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ .Tag.Tag }}</code> 129 129 + <button class="copy-btn" onclick="copyToClipboard('docker pull {{ $.RegistryURL }}/{{ $.Owner.Handle }}/{{ $.Repository.Name }}:{{ .Tag.Tag }}')"> 116 130 Copy 117 131 </button> 118 132 </div> ··· 127 141 <!-- Manifests Section --> 128 142 <div class="repo-section"> 129 143 <h2>Manifests</h2> 130 130 - {{ if .Repository.Manifests }} 144 144 + {{ if .Manifests }} 131 145 <div class="manifests-list"> 132 132 - {{ range .Repository.Manifests }} 133 133 - <div class="manifest-item"> 146 146 + {{ range .Manifests }} 147 147 + <div class="manifest-item" id="manifest-{{ sanitizeID .Manifest.Digest }}"> 134 148 <div class="manifest-item-header"> 135 135 - <code class="manifest-digest">{{ .Digest }}</code> 136 136 - <time datetime="{{ .CreatedAt.Format "2006-01-02T15:04:05Z07:00" }}"> 137 137 - {{ timeAgo .CreatedAt }} 138 138 - </time> 149 149 + <div> 150 150 + {{ if .IsManifestList }} 151 151 + <span class="manifest-type">📦 Multi-arch</span> 152 152 + {{ else }} 153 153 + <span class="manifest-type">📄 Image</span> 154 154 + {{ end }} 155 155 + <code class="manifest-digest">{{ .Manifest.Digest }}</code> 156 156 + </div> 157 157 + <div style="display: flex; gap: 1rem; align-items: center;"> 158 158 + <time datetime="{{ .Manifest.CreatedAt.Format "2006-01-02T15:04:05Z07:00" }}"> 159 159 + {{ timeAgo .Manifest.CreatedAt }} 160 160 + </time> 161 161 + {{ if $.IsOwner }} 162 162 + <button class="delete-btn" 163 163 + hx-delete="/api/images/{{ $.Repository.Name }}/manifests/{{ .Manifest.Digest }}" 164 164 + hx-confirm="Delete manifest {{ .Manifest.Digest }}? This cannot be undone." 165 165 + hx-target="#manifest-{{ sanitizeID .Manifest.Digest }}" 166 166 + hx-swap="outerHTML"> 167 167 + 🗑️ 168 168 + </button> 169 169 + {{ end }} 170 170 + </div> 139 171 </div> 140 172 <div class="manifest-item-details"> 141 141 - <span class="manifest-detail-label">Storage:</span> 142 142 - <span>{{ .HoldEndpoint }}</span> 173 173 + <div style="display: flex; justify-content: space-between; align-items: center;"> 174 174 + <div> 175 175 + {{ if .Tags }} 176 176 + <span class="manifest-detail-label">Tags:</span> 177 177 + {{ range $index, $tag := .Tags }}{{ if $index }}, {{ end }}{{ $tag }}{{ end }} 178 178 + {{ else }} 179 179 + <span class="text-muted">(untagged)</span> 180 180 + {{ end }} 181 181 + </div> 182 182 + {{ if .IsManifestList }} 183 183 + <span class="platform-count">{{ .PlatformCount }} platforms</span> 184 184 + {{ end }} 185 185 + </div> 143 186 </div> 144 187 </div> 145 188 {{ end }}

+7

pkg/appview/ui.go

reviewed

··· 6 6 "html/template" 7 7 "io/fs" 8 8 "net/http" 9 9 + "strings" 9 10 "time" 10 11 ) 11 12 ··· 76 77 return s[len(prefix):] 77 78 } 78 79 return s 80 80 + }, 81 81 + 82 82 + "sanitizeID": func(s string) string { 83 83 + // Replace colons with dashes to make valid CSS selectors 84 84 + // e.g., "sha256:abc123" becomes "sha256-abc123" 85 85 + return strings.ReplaceAll(s, ":", "-") 79 86 }, 80 87 } 81 88

+76

pkg/appview/ui_test.go

reviewed

··· 437 437 } 438 438 } 439 439 440 440 + func TestSanitizeID(t *testing.T) { 441 441 + tests := []struct { 442 442 + name string 443 443 + input string 444 444 + expected string 445 445 + }{ 446 446 + { 447 447 + name: "digest with colon", 448 448 + input: "sha256:abc123", 449 449 + expected: "sha256-abc123", 450 450 + }, 451 451 + { 452 452 + name: "full digest", 453 453 + input: "sha256:f1c8f6a4b7e9d2c0a3f5b8e1d4c7a0b3e6f9c2d5a8b1e4f7c0d3a6b9e2f5c8a1", 454 454 + expected: "sha256-f1c8f6a4b7e9d2c0a3f5b8e1d4c7a0b3e6f9c2d5a8b1e4f7c0d3a6b9e2f5c8a1", 455 455 + }, 456 456 + { 457 457 + name: "multiple colons", 458 458 + input: "sha256:abc:def:ghi", 459 459 + expected: "sha256-abc-def-ghi", 460 460 + }, 461 461 + { 462 462 + name: "no colons", 463 463 + input: "abcdef123456", 464 464 + expected: "abcdef123456", 465 465 + }, 466 466 + { 467 467 + name: "empty string", 468 468 + input: "", 469 469 + expected: "", 470 470 + }, 471 471 + { 472 472 + name: "only colon", 473 473 + input: ":", 474 474 + expected: "-", 475 475 + }, 476 476 + { 477 477 + name: "leading colon", 478 478 + input: ":abc", 479 479 + expected: "-abc", 480 480 + }, 481 481 + { 482 482 + name: "trailing colon", 483 483 + input: "abc:", 484 484 + expected: "abc-", 485 485 + }, 486 486 + } 487 487 + 488 488 + for _, tt := range tests { 489 489 + t.Run(tt.name, func(t *testing.T) { 490 490 + // Get fresh template for each test case 491 491 + tmpl, err := Templates() 492 492 + if err != nil { 493 493 + t.Fatalf("Templates() error = %v", err) 494 494 + } 495 495 + 496 496 + templateStr := `{{ sanitizeID . }}` 497 497 + buf := new(bytes.Buffer) 498 498 + temp, err := tmpl.New("test").Parse(templateStr) 499 499 + if err != nil { 500 500 + t.Fatalf("Failed to parse template: %v", err) 501 501 + } 502 502 + 503 503 + err = temp.Execute(buf, tt.input) 504 504 + if err != nil { 505 505 + t.Fatalf("Failed to execute template: %v", err) 506 506 + } 507 507 + 508 508 + got := buf.String() 509 509 + if got != tt.expected { 510 510 + t.Errorf("sanitizeID(%q) = %q, want %q", tt.input, got, tt.expected) 511 511 + } 512 512 + }) 513 513 + } 514 514 + } 515 515 + 440 516 func TestTemplates(t *testing.T) { 441 517 tmpl, err := Templates() 442 518 if err != nil {

+693

pkg/atproto/client_test.go

reviewed

··· 1 1 + package atproto 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "encoding/json" 6 6 + "net/http" 7 7 + "net/http/httptest" 8 8 + "strings" 9 9 + "testing" 10 10 + "time" 11 11 + ) 12 12 + 13 13 + // TestNewClient verifies client initialization with Basic Auth 14 14 + func TestNewClient(t *testing.T) { 15 15 + client := NewClient("https://pds.example.com", "did:plc:test123", "token123") 16 16 + 17 17 + if client.pdsEndpoint != "https://pds.example.com" { 18 18 + t.Errorf("pdsEndpoint = %v, want https://pds.example.com", client.pdsEndpoint) 19 19 + } 20 20 + if client.did != "did:plc:test123" { 21 21 + t.Errorf("did = %v, want did:plc:test123", client.did) 22 22 + } 23 23 + if client.accessToken != "token123" { 24 24 + t.Errorf("accessToken = %v, want token123", client.accessToken) 25 25 + } 26 26 + if client.useIndigoClient { 27 27 + t.Error("useIndigoClient should be false for Basic Auth client") 28 28 + } 29 29 + } 30 30 + 31 31 + // TestPutRecord tests storing a record in ATProto 32 32 + func TestPutRecord(t *testing.T) { 33 33 + tests := []struct { 34 34 + name string 35 35 + collection string 36 36 + rkey string 37 37 + record interface{} 38 38 + serverResponse string 39 39 + serverStatus int 40 40 + wantErr bool 41 41 + checkFunc func(*testing.T, *Record) 42 42 + }{ 43 43 + { 44 44 + name: "successful put", 45 45 + collection: ManifestCollection, 46 46 + rkey: "abc123", 47 47 + record: map[string]string{ 48 48 + "$type": ManifestCollection, 49 49 + "test": "value", 50 50 + }, 51 51 + serverResponse: `{"uri":"at://did:plc:test123/io.atcr.manifest/abc123","cid":"bafytest"}`, 52 52 + serverStatus: http.StatusOK, 53 53 + wantErr: false, 54 54 + checkFunc: func(t *testing.T, r *Record) { 55 55 + if r.URI != "at://did:plc:test123/io.atcr.manifest/abc123" { 56 56 + t.Errorf("URI = %v, want at://did:plc:test123/io.atcr.manifest/abc123", r.URI) 57 57 + } 58 58 + if r.CID != "bafytest" { 59 59 + t.Errorf("CID = %v, want bafytest", r.CID) 60 60 + } 61 61 + }, 62 62 + }, 63 63 + { 64 64 + name: "server error", 65 65 + collection: ManifestCollection, 66 66 + rkey: "abc123", 67 67 + record: map[string]string{"test": "value"}, 68 68 + serverResponse: `{"error":"InvalidRequest"}`, 69 69 + serverStatus: http.StatusBadRequest, 70 70 + wantErr: true, 71 71 + }, 72 72 + } 73 73 + 74 74 + for _, tt := range tests { 75 75 + t.Run(tt.name, func(t *testing.T) { 76 76 + // Create test server 77 77 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 78 78 + // Verify request method 79 79 + if r.Method != "POST" { 80 80 + t.Errorf("Method = %v, want POST", r.Method) 81 81 + } 82 82 + 83 83 + // Verify path 84 84 + expectedPath := "/xrpc/com.atproto.repo.putRecord" 85 85 + if r.URL.Path != expectedPath { 86 86 + t.Errorf("Path = %v, want %v", r.URL.Path, expectedPath) 87 87 + } 88 88 + 89 89 + // Verify Authorization header 90 90 + auth := r.Header.Get("Authorization") 91 91 + if !strings.HasPrefix(auth, "Bearer ") { 92 92 + t.Errorf("Authorization header missing or malformed: %v", auth) 93 93 + } 94 94 + 95 95 + // Verify request body 96 96 + var body map[string]interface{} 97 97 + if err := json.NewDecoder(r.Body).Decode(&body); err != nil { 98 98 + t.Errorf("Failed to decode request body: %v", err) 99 99 + } 100 100 + 101 101 + if body["repo"] != "did:plc:test123" { 102 102 + t.Errorf("repo = %v, want did:plc:test123", body["repo"]) 103 103 + } 104 104 + if body["collection"] != tt.collection { 105 105 + t.Errorf("collection = %v, want %v", body["collection"], tt.collection) 106 106 + } 107 107 + if body["rkey"] != tt.rkey { 108 108 + t.Errorf("rkey = %v, want %v", body["rkey"], tt.rkey) 109 109 + } 110 110 + 111 111 + // Send response 112 112 + w.WriteHeader(tt.serverStatus) 113 113 + w.Write([]byte(tt.serverResponse)) 114 114 + })) 115 115 + defer server.Close() 116 116 + 117 117 + // Create client pointing to test server 118 118 + client := NewClient(server.URL, "did:plc:test123", "test-token") 119 119 + 120 120 + // Call PutRecord 121 121 + result, err := client.PutRecord(context.Background(), tt.collection, tt.rkey, tt.record) 122 122 + 123 123 + // Check error 124 124 + if (err != nil) != tt.wantErr { 125 125 + t.Errorf("PutRecord() error = %v, wantErr %v", err, tt.wantErr) 126 126 + return 127 127 + } 128 128 + 129 129 + // Run check function if provided 130 130 + if !tt.wantErr && tt.checkFunc != nil { 131 131 + tt.checkFunc(t, result) 132 132 + } 133 133 + }) 134 134 + } 135 135 + } 136 136 + 137 137 + // TestGetRecord tests retrieving a record from ATProto 138 138 + func TestGetRecord(t *testing.T) { 139 139 + tests := []struct { 140 140 + name string 141 141 + collection string 142 142 + rkey string 143 143 + serverResponse string 144 144 + serverStatus int 145 145 + wantErr bool 146 146 + wantNotFound bool 147 147 + checkFunc func(*testing.T, *Record) 148 148 + }{ 149 149 + { 150 150 + name: "successful get", 151 151 + collection: ManifestCollection, 152 152 + rkey: "abc123", 153 153 + serverResponse: `{"uri":"at://did:plc:test123/io.atcr.manifest/abc123","cid":"bafytest","value":{"$type":"io.atcr.manifest","repository":"myapp"}}`, 154 154 + serverStatus: http.StatusOK, 155 155 + wantErr: false, 156 156 + checkFunc: func(t *testing.T, r *Record) { 157 157 + if r.URI != "at://did:plc:test123/io.atcr.manifest/abc123" { 158 158 + t.Errorf("URI = %v, want at://did:plc:test123/io.atcr.manifest/abc123", r.URI) 159 159 + } 160 160 + 161 161 + var value map[string]interface{} 162 162 + if err := json.Unmarshal(r.Value, &value); err != nil { 163 163 + t.Errorf("Failed to unmarshal value: %v", err) 164 164 + } 165 165 + 166 166 + if value["$type"] != ManifestCollection { 167 167 + t.Errorf("value.$type = %v, want %v", value["$type"], ManifestCollection) 168 168 + } 169 169 + }, 170 170 + }, 171 171 + { 172 172 + name: "record not found - 404", 173 173 + collection: ManifestCollection, 174 174 + rkey: "notfound", 175 175 + serverResponse: ``, 176 176 + serverStatus: http.StatusNotFound, 177 177 + wantErr: true, 178 178 + wantNotFound: true, 179 179 + }, 180 180 + { 181 181 + name: "record not found - error message", 182 182 + collection: ManifestCollection, 183 183 + rkey: "notfound", 184 184 + serverResponse: `{"error":"RecordNotFound","message":"Record not found"}`, 185 185 + serverStatus: http.StatusBadRequest, 186 186 + wantErr: true, 187 187 + wantNotFound: true, 188 188 + }, 189 189 + } 190 190 + 191 191 + for _, tt := range tests { 192 192 + t.Run(tt.name, func(t *testing.T) { 193 193 + // Create test server 194 194 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 195 195 + // Verify request method 196 196 + if r.Method != "GET" { 197 197 + t.Errorf("Method = %v, want GET", r.Method) 198 198 + } 199 199 + 200 200 + // Verify path 201 201 + expectedPath := "/xrpc/com.atproto.repo.getRecord" 202 202 + if r.URL.Path != expectedPath { 203 203 + t.Errorf("Path = %v, want %v", r.URL.Path, expectedPath) 204 204 + } 205 205 + 206 206 + // Verify query parameters 207 207 + query := r.URL.Query() 208 208 + if query.Get("repo") != "did:plc:test123" { 209 209 + t.Errorf("repo = %v, want did:plc:test123", query.Get("repo")) 210 210 + } 211 211 + if query.Get("collection") != tt.collection { 212 212 + t.Errorf("collection = %v, want %v", query.Get("collection"), tt.collection) 213 213 + } 214 214 + if query.Get("rkey") != tt.rkey { 215 215 + t.Errorf("rkey = %v, want %v", query.Get("rkey"), tt.rkey) 216 216 + } 217 217 + 218 218 + // Send response 219 219 + w.WriteHeader(tt.serverStatus) 220 220 + w.Write([]byte(tt.serverResponse)) 221 221 + })) 222 222 + defer server.Close() 223 223 + 224 224 + // Create client pointing to test server 225 225 + client := NewClient(server.URL, "did:plc:test123", "test-token") 226 226 + 227 227 + // Call GetRecord 228 228 + result, err := client.GetRecord(context.Background(), tt.collection, tt.rkey) 229 229 + 230 230 + // Check error 231 231 + if (err != nil) != tt.wantErr { 232 232 + t.Errorf("GetRecord() error = %v, wantErr %v", err, tt.wantErr) 233 233 + return 234 234 + } 235 235 + 236 236 + // Check for ErrRecordNotFound 237 237 + if tt.wantNotFound && err != ErrRecordNotFound { 238 238 + t.Errorf("Expected ErrRecordNotFound, got %v", err) 239 239 + } 240 240 + 241 241 + // Run check function if provided 242 242 + if !tt.wantErr && tt.checkFunc != nil { 243 243 + tt.checkFunc(t, result) 244 244 + } 245 245 + }) 246 246 + } 247 247 + } 248 248 + 249 249 + // TestDeleteRecord tests deleting a record from ATProto 250 250 + func TestDeleteRecord(t *testing.T) { 251 251 + tests := []struct { 252 252 + name string 253 253 + collection string 254 254 + rkey string 255 255 + serverResponse string 256 256 + serverStatus int 257 257 + wantErr bool 258 258 + }{ 259 259 + { 260 260 + name: "successful delete", 261 261 + collection: ManifestCollection, 262 262 + rkey: "abc123", 263 263 + serverResponse: `{}`, 264 264 + serverStatus: http.StatusOK, 265 265 + wantErr: false, 266 266 + }, 267 267 + { 268 268 + name: "server error", 269 269 + collection: ManifestCollection, 270 270 + rkey: "abc123", 271 271 + serverResponse: `{"error":"InvalidRequest"}`, 272 272 + serverStatus: http.StatusBadRequest, 273 273 + wantErr: true, 274 274 + }, 275 275 + } 276 276 + 277 277 + for _, tt := range tests { 278 278 + t.Run(tt.name, func(t *testing.T) { 279 279 + // Create test server 280 280 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 281 281 + // Verify request method 282 282 + if r.Method != "POST" { 283 283 + t.Errorf("Method = %v, want POST", r.Method) 284 284 + } 285 285 + 286 286 + // Verify path 287 287 + expectedPath := "/xrpc/com.atproto.repo.deleteRecord" 288 288 + if r.URL.Path != expectedPath { 289 289 + t.Errorf("Path = %v, want %v", r.URL.Path, expectedPath) 290 290 + } 291 291 + 292 292 + // Verify request body 293 293 + var body map[string]interface{} 294 294 + if err := json.NewDecoder(r.Body).Decode(&body); err != nil { 295 295 + t.Errorf("Failed to decode request body: %v", err) 296 296 + } 297 297 + 298 298 + if body["repo"] != "did:plc:test123" { 299 299 + t.Errorf("repo = %v, want did:plc:test123", body["repo"]) 300 300 + } 301 301 + if body["collection"] != tt.collection { 302 302 + t.Errorf("collection = %v, want %v", body["collection"], tt.collection) 303 303 + } 304 304 + if body["rkey"] != tt.rkey { 305 305 + t.Errorf("rkey = %v, want %v", body["rkey"], tt.rkey) 306 306 + } 307 307 + 308 308 + // Send response 309 309 + w.WriteHeader(tt.serverStatus) 310 310 + w.Write([]byte(tt.serverResponse)) 311 311 + })) 312 312 + defer server.Close() 313 313 + 314 314 + // Create client pointing to test server 315 315 + client := NewClient(server.URL, "did:plc:test123", "test-token") 316 316 + 317 317 + // Call DeleteRecord 318 318 + err := client.DeleteRecord(context.Background(), tt.collection, tt.rkey) 319 319 + 320 320 + // Check error 321 321 + if (err != nil) != tt.wantErr { 322 322 + t.Errorf("DeleteRecord() error = %v, wantErr %v", err, tt.wantErr) 323 323 + } 324 324 + }) 325 325 + } 326 326 + } 327 327 + 328 328 + // TestListRecords tests listing records in a collection 329 329 + func TestListRecords(t *testing.T) { 330 330 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 331 331 + // Verify query parameters 332 332 + query := r.URL.Query() 333 333 + if query.Get("repo") != "did:plc:test123" { 334 334 + t.Errorf("repo = %v, want did:plc:test123", query.Get("repo")) 335 335 + } 336 336 + if query.Get("collection") != ManifestCollection { 337 337 + t.Errorf("collection = %v, want %v", query.Get("collection"), ManifestCollection) 338 338 + } 339 339 + if query.Get("limit") != "10" { 340 340 + t.Errorf("limit = %v, want 10", query.Get("limit")) 341 341 + } 342 342 + 343 343 + // Send response 344 344 + response := `{ 345 345 + "records": [ 346 346 + {"uri":"at://did:plc:test123/io.atcr.manifest/abc1","cid":"bafytest1","value":{"$type":"io.atcr.manifest"}}, 347 347 + {"uri":"at://did:plc:test123/io.atcr.manifest/abc2","cid":"bafytest2","value":{"$type":"io.atcr.manifest"}} 348 348 + ] 349 349 + }` 350 350 + w.WriteHeader(http.StatusOK) 351 351 + w.Write([]byte(response)) 352 352 + })) 353 353 + defer server.Close() 354 354 + 355 355 + client := NewClient(server.URL, "did:plc:test123", "test-token") 356 356 + records, err := client.ListRecords(context.Background(), ManifestCollection, 10) 357 357 + if err != nil { 358 358 + t.Fatalf("ListRecords() error = %v", err) 359 359 + } 360 360 + 361 361 + if len(records) != 2 { 362 362 + t.Errorf("len(records) = %v, want 2", len(records)) 363 363 + } 364 364 + 365 365 + if records[0].URI != "at://did:plc:test123/io.atcr.manifest/abc1" { 366 366 + t.Errorf("records[0].URI = %v", records[0].URI) 367 367 + } 368 368 + } 369 369 + 370 370 + // TestUploadBlob tests uploading a blob to PDS 371 371 + func TestUploadBlob(t *testing.T) { 372 372 + blobData := []byte("test blob content") 373 373 + mimeType := "application/octet-stream" 374 374 + 375 375 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 376 376 + // Verify request 377 377 + if r.Method != "POST" { 378 378 + t.Errorf("Method = %v, want POST", r.Method) 379 379 + } 380 380 + 381 381 + if r.URL.Path != "/xrpc/com.atproto.repo.uploadBlob" { 382 382 + t.Errorf("Path = %v, want /xrpc/com.atproto.repo.uploadBlob", r.URL.Path) 383 383 + } 384 384 + 385 385 + if r.Header.Get("Content-Type") != mimeType { 386 386 + t.Errorf("Content-Type = %v, want %v", r.Header.Get("Content-Type"), mimeType) 387 387 + } 388 388 + 389 389 + // Send response 390 390 + response := `{ 391 391 + "blob": { 392 392 + "$type": "blob", 393 393 + "ref": {"$link": "bafytest123"}, 394 394 + "mimeType": "application/octet-stream", 395 395 + "size": 17 396 396 + } 397 397 + }` 398 398 + w.WriteHeader(http.StatusOK) 399 399 + w.Write([]byte(response)) 400 400 + })) 401 401 + defer server.Close() 402 402 + 403 403 + client := NewClient(server.URL, "did:plc:test123", "test-token") 404 404 + blobRef, err := client.UploadBlob(context.Background(), blobData, mimeType) 405 405 + if err != nil { 406 406 + t.Fatalf("UploadBlob() error = %v", err) 407 407 + } 408 408 + 409 409 + if blobRef.Type != "blob" { 410 410 + t.Errorf("Type = %v, want blob", blobRef.Type) 411 411 + } 412 412 + 413 413 + if blobRef.Ref.Link != "bafytest123" { 414 414 + t.Errorf("Ref.Link = %v, want bafytest123", blobRef.Ref.Link) 415 415 + } 416 416 + 417 417 + if blobRef.Size != 17 { 418 418 + t.Errorf("Size = %v, want 17", blobRef.Size) 419 419 + } 420 420 + } 421 421 + 422 422 + // TestGetBlob tests downloading a blob from PDS 423 423 + func TestGetBlob(t *testing.T) { 424 424 + tests := []struct { 425 425 + name string 426 426 + cid string 427 427 + serverResponse string 428 428 + contentType string 429 429 + wantData []byte 430 430 + wantErr bool 431 431 + }{ 432 432 + { 433 433 + name: "raw blob response", 434 434 + cid: "bafytest123", 435 435 + serverResponse: "test blob content", 436 436 + contentType: "application/octet-stream", 437 437 + wantData: []byte("test blob content"), 438 438 + wantErr: false, 439 439 + }, 440 440 + { 441 441 + name: "JSON-wrapped blob (Bluesky PDS format)", 442 442 + cid: "bafytest123", 443 443 + serverResponse: `"dGVzdCBibG9iIGNvbnRlbnQ="`, // base64 of "test blob content" 444 444 + contentType: "application/json", 445 445 + wantData: []byte("test blob content"), 446 446 + wantErr: false, 447 447 + }, 448 448 + { 449 449 + name: "blob not found", 450 450 + cid: "notfound", 451 451 + serverResponse: "", 452 452 + contentType: "text/plain", 453 453 + wantData: nil, 454 454 + wantErr: true, 455 455 + }, 456 456 + } 457 457 + 458 458 + for _, tt := range tests { 459 459 + t.Run(tt.name, func(t *testing.T) { 460 460 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 461 461 + // Verify query parameters 462 462 + query := r.URL.Query() 463 463 + if query.Get("did") != "did:plc:test123" { 464 464 + t.Errorf("did = %v, want did:plc:test123", query.Get("did")) 465 465 + } 466 466 + if query.Get("cid") != tt.cid { 467 467 + t.Errorf("cid = %v, want %v", query.Get("cid"), tt.cid) 468 468 + } 469 469 + 470 470 + // Send response 471 471 + if tt.wantErr { 472 472 + w.WriteHeader(http.StatusNotFound) 473 473 + } else { 474 474 + w.Header().Set("Content-Type", tt.contentType) 475 475 + w.WriteHeader(http.StatusOK) 476 476 + w.Write([]byte(tt.serverResponse)) 477 477 + } 478 478 + })) 479 479 + defer server.Close() 480 480 + 481 481 + client := NewClient(server.URL, "did:plc:test123", "test-token") 482 482 + data, err := client.GetBlob(context.Background(), tt.cid) 483 483 + 484 484 + if (err != nil) != tt.wantErr { 485 485 + t.Errorf("GetBlob() error = %v, wantErr %v", err, tt.wantErr) 486 486 + return 487 487 + } 488 488 + 489 489 + if !tt.wantErr && string(data) != string(tt.wantData) { 490 490 + t.Errorf("GetBlob() data = %v, want %v", string(data), string(tt.wantData)) 491 491 + } 492 492 + }) 493 493 + } 494 494 + } 495 495 + 496 496 + // TestBlobCDNURL tests CDN URL construction 497 497 + func TestBlobCDNURL(t *testing.T) { 498 498 + tests := []struct { 499 499 + name string 500 500 + didOrHandle string 501 501 + cid string 502 502 + want string 503 503 + }{ 504 504 + { 505 505 + name: "with DID", 506 506 + didOrHandle: "did:plc:alice123", 507 507 + cid: "bafytest123", 508 508 + want: "https://imgs.blue/did:plc:alice123/bafytest123", 509 509 + }, 510 510 + { 511 511 + name: "with handle", 512 512 + didOrHandle: "alice.bsky.social", 513 513 + cid: "bafytest456", 514 514 + want: "https://imgs.blue/alice.bsky.social/bafytest456", 515 515 + }, 516 516 + } 517 517 + 518 518 + for _, tt := range tests { 519 519 + t.Run(tt.name, func(t *testing.T) { 520 520 + got := BlobCDNURL(tt.didOrHandle, tt.cid) 521 521 + if got != tt.want { 522 522 + t.Errorf("BlobCDNURL() = %v, want %v", got, tt.want) 523 523 + } 524 524 + }) 525 525 + } 526 526 + } 527 527 + 528 528 + // TestFetchDIDDocument tests fetching and parsing DID documents 529 529 + func TestFetchDIDDocument(t *testing.T) { 530 530 + tests := []struct { 531 531 + name string 532 532 + serverResponse string 533 533 + serverStatus int 534 534 + wantErr bool 535 535 + checkFunc func(*testing.T, *DIDDocument) 536 536 + }{ 537 537 + { 538 538 + name: "valid DID document", 539 539 + serverResponse: `{ 540 540 + "@context": ["https://www.w3.org/ns/did/v1"], 541 541 + "id": "did:web:example.com", 542 542 + "service": [ 543 543 + { 544 544 + "id": "#atproto_pds", 545 545 + "type": "AtprotoPersonalDataServer", 546 546 + "serviceEndpoint": "https://pds.example.com" 547 547 + } 548 548 + ] 549 549 + }`, 550 550 + serverStatus: http.StatusOK, 551 551 + wantErr: false, 552 552 + checkFunc: func(t *testing.T, doc *DIDDocument) { 553 553 + if doc.ID != "did:web:example.com" { 554 554 + t.Errorf("ID = %v, want did:web:example.com", doc.ID) 555 555 + } 556 556 + if len(doc.Service) != 1 { 557 557 + t.Fatalf("len(Service) = %v, want 1", len(doc.Service)) 558 558 + } 559 559 + if doc.Service[0].Type != "AtprotoPersonalDataServer" { 560 560 + t.Errorf("Service[0].Type = %v", doc.Service[0].Type) 561 561 + } 562 562 + if doc.Service[0].ServiceEndpoint != "https://pds.example.com" { 563 563 + t.Errorf("Service[0].ServiceEndpoint = %v", doc.Service[0].ServiceEndpoint) 564 564 + } 565 565 + }, 566 566 + }, 567 567 + { 568 568 + name: "404 not found", 569 569 + serverResponse: "", 570 570 + serverStatus: http.StatusNotFound, 571 571 + wantErr: true, 572 572 + }, 573 573 + { 574 574 + name: "invalid JSON", 575 575 + serverResponse: "not json", 576 576 + serverStatus: http.StatusOK, 577 577 + wantErr: true, 578 578 + }, 579 579 + } 580 580 + 581 581 + for _, tt := range tests { 582 582 + t.Run(tt.name, func(t *testing.T) { 583 583 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 584 584 + w.WriteHeader(tt.serverStatus) 585 585 + w.Write([]byte(tt.serverResponse)) 586 586 + })) 587 587 + defer server.Close() 588 588 + 589 589 + client := NewClient("https://pds.example.com", "did:plc:test123", "") 590 590 + doc, err := client.FetchDIDDocument(context.Background(), server.URL) 591 591 + 592 592 + if (err != nil) != tt.wantErr { 593 593 + t.Errorf("FetchDIDDocument() error = %v, wantErr %v", err, tt.wantErr) 594 594 + return 595 595 + } 596 596 + 597 597 + if !tt.wantErr && tt.checkFunc != nil { 598 598 + tt.checkFunc(t, doc) 599 599 + } 600 600 + }) 601 601 + } 602 602 + } 603 603 + 604 604 + // TestClientWithEmptyToken tests that client doesn't set auth header with empty token 605 605 + func TestClientWithEmptyToken(t *testing.T) { 606 606 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 607 607 + auth := r.Header.Get("Authorization") 608 608 + if auth != "" { 609 609 + t.Errorf("Authorization header should not be set with empty token, got: %v", auth) 610 610 + } 611 611 + 612 612 + response := `{"uri":"at://did:plc:test123/io.atcr.manifest/abc123","cid":"bafytest","value":{}}` 613 613 + w.WriteHeader(http.StatusOK) 614 614 + w.Write([]byte(response)) 615 615 + })) 616 616 + defer server.Close() 617 617 + 618 618 + // Create client with empty token 619 619 + client := NewClient(server.URL, "did:plc:test123", "") 620 620 + 621 621 + // Make request - should not include Authorization header 622 622 + _, err := client.GetRecord(context.Background(), ManifestCollection, "abc123") 623 623 + if err != nil { 624 624 + t.Fatalf("GetRecord() error = %v", err) 625 625 + } 626 626 + } 627 627 + 628 628 + // TestListRecordsForRepo tests listing records for a specific repository 629 629 + func TestListRecordsForRepo(t *testing.T) { 630 630 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 631 631 + query := r.URL.Query() 632 632 + if query.Get("repo") != "did:plc:alice123" { 633 633 + t.Errorf("repo = %v, want did:plc:alice123", query.Get("repo")) 634 634 + } 635 635 + if query.Get("collection") != ManifestCollection { 636 636 + t.Errorf("collection = %v, want %v", query.Get("collection"), ManifestCollection) 637 637 + } 638 638 + if query.Get("limit") != "50" { 639 639 + t.Errorf("limit = %v, want 50", query.Get("limit")) 640 640 + } 641 641 + if query.Get("cursor") != "cursor123" { 642 642 + t.Errorf("cursor = %v, want cursor123", query.Get("cursor")) 643 643 + } 644 644 + 645 645 + response := `{ 646 646 + "records": [ 647 647 + {"uri":"at://did:plc:alice123/io.atcr.manifest/abc1","cid":"bafytest1","value":{}} 648 648 + ], 649 649 + "cursor": "nextcursor456" 650 650 + }` 651 651 + w.WriteHeader(http.StatusOK) 652 652 + w.Write([]byte(response)) 653 653 + })) 654 654 + defer server.Close() 655 655 + 656 656 + client := NewClient(server.URL, "did:plc:test123", "test-token") 657 657 + records, cursor, err := client.ListRecordsForRepo(context.Background(), "did:plc:alice123", ManifestCollection, 50, "cursor123") 658 658 + 659 659 + if err != nil { 660 660 + t.Fatalf("ListRecordsForRepo() error = %v", err) 661 661 + } 662 662 + 663 663 + if len(records) != 1 { 664 664 + t.Errorf("len(records) = %v, want 1", len(records)) 665 665 + } 666 666 + 667 667 + if cursor != "nextcursor456" { 668 668 + t.Errorf("cursor = %v, want nextcursor456", cursor) 669 669 + } 670 670 + } 671 671 + 672 672 + // TestContextCancellation tests that client respects context cancellation 673 673 + func TestContextCancellation(t *testing.T) { 674 674 + // Create a server that sleeps for a while 675 675 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 676 676 + time.Sleep(100 * time.Millisecond) 677 677 + w.WriteHeader(http.StatusOK) 678 678 + w.Write([]byte(`{}`)) 679 679 + })) 680 680 + defer server.Close() 681 681 + 682 682 + client := NewClient(server.URL, "did:plc:test123", "test-token") 683 683 + 684 684 + // Create a context that gets canceled immediately 685 685 + ctx, cancel := context.WithCancel(context.Background()) 686 686 + cancel() // Cancel immediately 687 687 + 688 688 + // Request should fail with context canceled error 689 689 + _, err := client.GetRecord(ctx, ManifestCollection, "abc123") 690 690 + if err == nil { 691 691 + t.Error("Expected error due to context cancellation, got nil") 692 692 + } 693 693 + }

+139

pkg/atproto/endpoints.go

reviewed

··· 1 1 + // Package xrpc provides constants for XRPC endpoint paths used throughout ATCR. 2 2 + // 3 3 + // This package serves as a single source of truth for all XRPC endpoint URLs, 4 4 + // preventing typos and making refactoring easier. All endpoint paths follow the 5 5 + // XRPC/Lexicon naming convention: /xrpc/{namespace}.{method} 6 6 + package atproto 7 7 + 8 8 + // Hold service multipart upload endpoints (io.atcr.hold.*) 9 9 + // 10 10 + // These endpoints handle OCI blob uploads to hold services (BYOS storage). 11 11 + const ( 12 12 + // HoldInitiateUpload starts a new multipart upload session. 13 13 + // Method: POST 14 14 + // Request: {"digest": "sha256:..."} 15 15 + // Response: {"uploadId": "..."} 16 16 + HoldInitiateUpload = "/xrpc/io.atcr.hold.initiateUpload" 17 17 + 18 18 + // HoldGetPartUploadUrl gets a presigned URL or endpoint info for uploading a specific part. 19 19 + // Method: POST 20 20 + // Request: {"uploadId": "...", "partNumber": 1} 21 21 + // Response: {"url": "...", "method": "PUT", "headers": {...}} 22 22 + HoldGetPartUploadUrl = "/xrpc/io.atcr.hold.getPartUploadUrl" 23 23 + 24 24 + // HoldUploadPart handles direct buffered part uploads (alternative to presigned URLs). 25 25 + // Method: PUT 26 26 + // Headers: X-Upload-Id, X-Part-Number 27 27 + // Body: raw part data 28 28 + // Response: {"etag": "..."} 29 29 + HoldUploadPart = "/xrpc/io.atcr.hold.uploadPart" 30 30 + 31 31 + // HoldCompleteUpload finalizes a multipart upload and moves blob to final location. 32 32 + // Method: POST 33 33 + // Request: {"uploadId": "...", "digest": "sha256:...", "parts": [{...}]} 34 34 + // Response: {"status": "completed", "digest": "..."} 35 35 + HoldCompleteUpload = "/xrpc/io.atcr.hold.completeUpload" 36 36 + 37 37 + // HoldAbortUpload cancels a multipart upload and cleans up temporary data. 38 38 + // Method: POST 39 39 + // Request: {"uploadId": "..."} 40 40 + // Response: {"status": "aborted"} 41 41 + HoldAbortUpload = "/xrpc/io.atcr.hold.abortUpload" 42 42 + ) 43 43 + 44 44 + // Hold service crew management endpoints (io.atcr.hold.*) 45 45 + // 46 46 + // These endpoints manage access control for hold services via crew membership. 47 47 + const ( 48 48 + // HoldRequestCrew requests crew membership for a hold service. 49 49 + // Method: POST 50 50 + // Request: OAuth-authenticated request with DPoP 51 51 + // Response: {"status": "pending"|"approved"} 52 52 + HoldRequestCrew = "/xrpc/io.atcr.hold.requestCrew" 53 53 + 54 54 + // Future: HoldDelegateAccess = "/xrpc/io.atcr.hold.delegateAccess" 55 55 + ) 56 56 + 57 57 + // ATProto sync endpoints (com.atproto.sync.*) 58 58 + // 59 59 + // Standard AT Protocol synchronization endpoints for PDS interoperability. 60 60 + const ( 61 61 + // SyncGetBlob retrieves a blob (or presigned URL) from a repository. 62 62 + // Method: GET 63 63 + // Query: did={did}&cid={cid}&method={GET|HEAD} 64 64 + // Response: {"url": "..."} or blob data 65 65 + SyncGetBlob = "/xrpc/com.atproto.sync.getBlob" 66 66 + 67 67 + // SyncGetRepo downloads a full repository or diff as a CAR file. 68 68 + // Method: GET 69 69 + // Query: did={did}&since={rev} 70 70 + // Response: CAR file (application/vnd.ipld.car) 71 71 + SyncGetRepo = "/xrpc/com.atproto.sync.getRepo" 72 72 + 73 73 + // SyncListRepos lists all repositories on a PDS. 74 74 + // Method: GET 75 75 + // Response: {"repos": [{...}]} 76 76 + SyncListRepos = "/xrpc/com.atproto.sync.listRepos" 77 77 + 78 78 + // SyncSubscribeRepos subscribes to real-time repository events via WebSocket. 79 79 + // Method: GET (WebSocket upgrade) 80 80 + // Response: Stream of #commit events 81 81 + SyncSubscribeRepos = "/xrpc/com.atproto.sync.subscribeRepos" 82 82 + 83 83 + // SyncRequestCrawl requests a relay to crawl a PDS. 84 84 + // Method: POST 85 85 + // Request: {"hostname": "hold01.atcr.io"} 86 86 + // Response: {} 87 87 + SyncRequestCrawl = "/xrpc/com.atproto.sync.requestCrawl" 88 88 + ) 89 89 + 90 90 + // ATProto server endpoints (com.atproto.server.*) 91 91 + // 92 92 + // Standard AT Protocol server management and authentication endpoints. 93 93 + const ( 94 94 + // ServerGetServiceAuth gets a service auth token for inter-service communication. 95 95 + // Method: GET 96 96 + // Query: aud={serviceDID}&lxm={lexicon} 97 97 + // Response: {"token": "..."} 98 98 + ServerGetServiceAuth = "/xrpc/com.atproto.server.getServiceAuth" 99 99 + 100 100 + // ServerDescribeServer returns server metadata and capabilities. 101 101 + // Method: GET 102 102 + // Response: {"did": "...", "availableUserDomains": [...]} 103 103 + ServerDescribeServer = "/xrpc/com.atproto.server.describeServer" 104 104 + ) 105 105 + 106 106 + // ATProto repo endpoints (com.atproto.repo.*) 107 107 + // 108 108 + // Standard AT Protocol repository management endpoints. 109 109 + const ( 110 110 + // RepoDescribeRepo describes a repository's structure and metadata. 111 111 + // Method: GET 112 112 + // Query: repo={did} 113 113 + // Response: {"did": "...", "handle": "...", "collections": [...]} 114 114 + RepoDescribeRepo = "/xrpc/com.atproto.repo.describeRepo" 115 115 + 116 116 + // RepoDeleteRecord deletes a record from a repository. 117 117 + // Method: POST 118 118 + // Query: repo={did}&collection={collection}&rkey={key} 119 119 + // Response: {} 120 120 + RepoDeleteRecord = "/xrpc/com.atproto.repo.deleteRecord" 121 121 + 122 122 + // RepoUploadBlob uploads a blob to a repository (standard ATProto endpoint). 123 123 + // Method: POST 124 124 + // Body: blob data 125 125 + // Response: {"blob": {"$type": "blob", "ref": {...}, "mimeType": "...", "size": ...}} 126 126 + // Note: For OCI container layer uploads, ATCR uses io.atcr.hold.* multipart endpoints instead. 127 127 + RepoUploadBlob = "/xrpc/com.atproto.repo.uploadBlob" 128 128 + ) 129 129 + 130 130 + // ATProto identity endpoints (com.atproto.identity.*) 131 131 + // 132 132 + // Standard AT Protocol identity resolution endpoints. 133 133 + const ( 134 134 + // IdentityResolveHandle resolves a handle to a DID. 135 135 + // Method: GET 136 136 + // Query: handle={handle} 137 137 + // Response: {"did": "did:plc:..."} 138 138 + IdentityResolveHandle = "/xrpc/com.atproto.identity.resolveHandle" 139 139 + )

+88 -16

pkg/atproto/lexicon.go

reviewed

··· 68 68 // SchemaVersion is the OCI schema version (typically 2) 69 69 SchemaVersion int `json:"schemaVersion"` 70 70 71 71 - // Config references the image configuration blob 72 72 - Config BlobReference `json:"config"` 71 71 + // Config references the image configuration blob (for image manifests) 72 72 + // Nil for manifest lists/indexes 73 73 + Config *BlobReference `json:"config,omitempty"` 73 74 74 74 - // Layers references the filesystem layers 75 75 - Layers []BlobReference `json:"layers"` 75 75 + // Layers references the filesystem layers (for image manifests) 76 76 + // Empty for manifest lists/indexes 77 77 + Layers []BlobReference `json:"layers,omitempty"` 78 78 + 79 79 + // Manifests references other manifests (for manifest lists/indexes) 80 80 + // Empty for image manifests 81 81 + Manifests []ManifestReference `json:"manifests,omitempty"` 76 82 77 83 // Annotations contains arbitrary metadata 78 84 Annotations map[string]string `json:"annotations,omitempty"` ··· 106 112 Annotations map[string]string `json:"annotations,omitempty"` 107 113 } 108 114 115 115 + // ManifestReference represents a reference to a manifest in a manifest list/index 116 116 + type ManifestReference struct { 117 117 + // MediaType of the referenced manifest 118 118 + MediaType string `json:"mediaType"` 119 119 + 120 120 + // Digest is the content digest (e.g., "sha256:abc123...") 121 121 + Digest string `json:"digest"` 122 122 + 123 123 + // Size in bytes 124 124 + Size int64 `json:"size"` 125 125 + 126 126 + // Platform describes the platform/architecture this manifest is for 127 127 + Platform *Platform `json:"platform,omitempty"` 128 128 + 129 129 + // Annotations for the manifest reference 130 130 + Annotations map[string]string `json:"annotations,omitempty"` 131 131 + } 132 132 + 133 133 + // Platform describes the platform (OS/architecture) for a manifest 134 134 + type Platform struct { 135 135 + // Architecture is the CPU architecture (e.g., "amd64", "arm64", "arm") 136 136 + Architecture string `json:"architecture"` 137 137 + 138 138 + // OS is the operating system (e.g., "linux", "windows", "darwin") 139 139 + OS string `json:"os"` 140 140 + 141 141 + // OSVersion is the optional OS version 142 142 + OSVersion string `json:"os.version,omitempty"` 143 143 + 144 144 + // OSFeatures is an optional list of OS features 145 145 + OSFeatures []string `json:"os.features,omitempty"` 146 146 + 147 147 + // Variant is the optional CPU variant (e.g., "v7" for ARM) 148 148 + Variant string `json:"variant,omitempty"` 149 149 + } 150 150 + 109 151 // NewManifestRecord creates a new manifest record from OCI manifest JSON 110 152 func NewManifestRecord(repository, digest string, ociManifest []byte) (*ManifestRecord, error) { 111 153 // Parse the OCI manifest 112 154 var ociData struct { 113 155 SchemaVersion int `json:"schemaVersion"` 114 156 MediaType string `json:"mediaType"` 115 115 - Config json.RawMessage `json:"config"` 116 116 - Layers []json.RawMessage `json:"layers"` 157 157 + Config json.RawMessage `json:"config,omitempty"` 158 158 + Layers []json.RawMessage `json:"layers,omitempty"` 159 159 + Manifests []json.RawMessage `json:"manifests,omitempty"` 117 160 Subject json.RawMessage `json:"subject,omitempty"` 118 161 Annotations map[string]string `json:"annotations,omitempty"` 119 162 } ··· 122 165 return nil, err 123 166 } 124 167 168 168 + // Detect manifest type based on media type 169 169 + isManifestList := strings.Contains(ociData.MediaType, "manifest.list") || 170 170 + strings.Contains(ociData.MediaType, "image.index") 171 171 + 172 172 + // Validate: must have either (config+layers) OR (manifests), never both 173 173 + hasImageFields := len(ociData.Config) > 0 || len(ociData.Layers) > 0 174 174 + hasIndexFields := len(ociData.Manifests) > 0 175 175 + 176 176 + if hasImageFields && hasIndexFields { 177 177 + return nil, fmt.Errorf("manifest cannot have both image fields (config/layers) and index fields (manifests)") 178 178 + } 179 179 + if !hasImageFields && !hasIndexFields { 180 180 + return nil, fmt.Errorf("manifest must have either image fields (config/layers) or index fields (manifests)") 181 181 + } 182 182 + 125 183 record := &ManifestRecord{ 126 184 Type: ManifestCollection, 127 185 Repository: repository, ··· 133 191 CreatedAt: time.Now(), 134 192 } 135 193 136 136 - // Parse config 137 137 - if err := json.Unmarshal(ociData.Config, &record.Config); err != nil { 138 138 - return nil, err 139 139 - } 194 194 + if isManifestList { 195 195 + // Parse manifest list/index 196 196 + record.Manifests = make([]ManifestReference, len(ociData.Manifests)) 197 197 + for i, m := range ociData.Manifests { 198 198 + if err := json.Unmarshal(m, &record.Manifests[i]); err != nil { 199 199 + return nil, fmt.Errorf("failed to parse manifest reference %d: %w", i, err) 200 200 + } 201 201 + } 202 202 + } else { 203 203 + // Parse image manifest 204 204 + if len(ociData.Config) > 0 { 205 205 + var config BlobReference 206 206 + if err := json.Unmarshal(ociData.Config, &config); err != nil { 207 207 + return nil, fmt.Errorf("failed to parse config: %w", err) 208 208 + } 209 209 + record.Config = &config 210 210 + } 140 211 141 141 - // Parse layers 142 142 - record.Layers = make([]BlobReference, len(ociData.Layers)) 143 143 - for i, layer := range ociData.Layers { 144 144 - if err := json.Unmarshal(layer, &record.Layers[i]); err != nil { 145 145 - return nil, err 212 212 + // Parse layers 213 213 + record.Layers = make([]BlobReference, len(ociData.Layers)) 214 214 + for i, layer := range ociData.Layers { 215 215 + if err := json.Unmarshal(layer, &record.Layers[i]); err != nil { 216 216 + return nil, fmt.Errorf("failed to parse layer %d: %w", i, err) 217 217 + } 146 218 } 147 219 } 148 220 149 149 - // Parse subject if present 221 221 + // Parse subject if present (works for both types) 150 222 if len(ociData.Subject) > 0 { 151 223 var subject BlobReference 152 224 if err := json.Unmarshal(ociData.Subject, &subject); err != nil {

+112

pkg/atproto/lexicon_test.go

reviewed

··· 49 49 } 50 50 }` 51 51 52 52 + manifestList := `{ 53 53 + "schemaVersion": 2, 54 54 + "mediaType": "application/vnd.oci.image.index.v1+json", 55 55 + "manifests": [ 56 56 + { 57 57 + "mediaType": "application/vnd.oci.image.manifest.v1+json", 58 58 + "digest": "sha256:amd64manifest", 59 59 + "size": 1000, 60 60 + "platform": { 61 61 + "architecture": "amd64", 62 62 + "os": "linux" 63 63 + } 64 64 + }, 65 65 + { 66 66 + "mediaType": "application/vnd.oci.image.manifest.v1+json", 67 67 + "digest": "sha256:arm64manifest", 68 68 + "size": 1100, 69 69 + "platform": { 70 70 + "architecture": "arm64", 71 71 + "os": "linux", 72 72 + "variant": "v8" 73 73 + } 74 74 + } 75 75 + ] 76 76 + }` 77 77 + 78 78 + invalidBothFields := `{ 79 79 + "schemaVersion": 2, 80 80 + "mediaType": "application/vnd.oci.image.index.v1+json", 81 81 + "config": { 82 82 + "mediaType": "application/vnd.oci.image.config.v1+json", 83 83 + "digest": "sha256:config123", 84 84 + "size": 1234 85 85 + }, 86 86 + "layers": [], 87 87 + "manifests": [ 88 88 + { 89 89 + "mediaType": "application/vnd.oci.image.manifest.v1+json", 90 90 + "digest": "sha256:amd64manifest", 91 91 + "size": 1000 92 92 + } 93 93 + ] 94 94 + }` 95 95 + 96 96 + invalidNoFields := `{ 97 97 + "schemaVersion": 2, 98 98 + "mediaType": "application/vnd.oci.image.manifest.v1+json" 99 99 + }` 100 100 + 52 101 tests := []struct { 53 102 name string 54 103 repository string ··· 135 184 repository: "myapp", 136 185 digest: "sha256:abc123", 137 186 ociManifest: `{"schemaVersion": 2, "mediaType": "test", "config": "not-an-object", "layers": []}`, 187 187 + wantErr: true, 188 188 + }, 189 189 + { 190 190 + name: "valid manifest list (multi-arch)", 191 191 + repository: "myapp", 192 192 + digest: "sha256:multiarch", 193 193 + ociManifest: manifestList, 194 194 + wantErr: false, 195 195 + checkFunc: func(t *testing.T, record *ManifestRecord) { 196 196 + if record.MediaType != "application/vnd.oci.image.index.v1+json" { 197 197 + t.Errorf("MediaType = %v, want application/vnd.oci.image.index.v1+json", record.MediaType) 198 198 + } 199 199 + if record.Config != nil { 200 200 + t.Error("Config should be nil for manifest list") 201 201 + } 202 202 + if len(record.Layers) != 0 { 203 203 + t.Errorf("Layers should be empty for manifest list, got %d", len(record.Layers)) 204 204 + } 205 205 + if len(record.Manifests) != 2 { 206 206 + t.Fatalf("Manifests should have 2 entries, got %d", len(record.Manifests)) 207 207 + } 208 208 + 209 209 + // Check first manifest (amd64) 210 210 + if record.Manifests[0].Digest != "sha256:amd64manifest" { 211 211 + t.Errorf("Manifests[0].Digest = %v, want sha256:amd64manifest", record.Manifests[0].Digest) 212 212 + } 213 213 + if record.Manifests[0].Size != 1000 { 214 214 + t.Errorf("Manifests[0].Size = %v, want 1000", record.Manifests[0].Size) 215 215 + } 216 216 + if record.Manifests[0].Platform == nil { 217 217 + t.Fatal("Manifests[0].Platform should not be nil") 218 218 + } 219 219 + if record.Manifests[0].Platform.Architecture != "amd64" { 220 220 + t.Errorf("Platform.Architecture = %v, want amd64", record.Manifests[0].Platform.Architecture) 221 221 + } 222 222 + if record.Manifests[0].Platform.OS != "linux" { 223 223 + t.Errorf("Platform.OS = %v, want linux", record.Manifests[0].Platform.OS) 224 224 + } 225 225 + 226 226 + // Check second manifest (arm64) 227 227 + if record.Manifests[1].Digest != "sha256:arm64manifest" { 228 228 + t.Errorf("Manifests[1].Digest = %v, want sha256:arm64manifest", record.Manifests[1].Digest) 229 229 + } 230 230 + if record.Manifests[1].Platform.Architecture != "arm64" { 231 231 + t.Errorf("Platform.Architecture = %v, want arm64", record.Manifests[1].Platform.Architecture) 232 232 + } 233 233 + if record.Manifests[1].Platform.Variant != "v8" { 234 234 + t.Errorf("Platform.Variant = %v, want v8", record.Manifests[1].Platform.Variant) 235 235 + } 236 236 + }, 237 237 + }, 238 238 + { 239 239 + name: "invalid: both image and index fields", 240 240 + repository: "myapp", 241 241 + digest: "sha256:invalid", 242 242 + ociManifest: invalidBothFields, 243 243 + wantErr: true, 244 244 + }, 245 245 + { 246 246 + name: "invalid: neither image nor index fields", 247 247 + repository: "myapp", 248 248 + digest: "sha256:invalid", 249 249 + ociManifest: invalidNoFields, 138 250 wantErr: true, 139 251 }, 140 252 }

+5 -1

pkg/atproto/manifest_store.go

reviewed

··· 142 142 manifestRecord.HoldEndpoint = s.holdEndpoint // Legacy reference (URL) for backward compat 143 143 144 144 // Extract Dockerfile labels from config blob and add to annotations 145 145 - if s.blobStore != nil && manifestRecord.Config.Digest != "" { 145 145 + // Only for image manifests (not manifest lists which don't have config blobs) 146 146 + isManifestList := strings.Contains(manifestRecord.MediaType, "manifest.list") || 147 147 + strings.Contains(manifestRecord.MediaType, "image.index") 148 148 + 149 149 + if !isManifestList && s.blobStore != nil && manifestRecord.Config != nil && manifestRecord.Config.Digest != "" { 146 150 labels, err := s.extractConfigLabels(ctx, manifestRecord.Config.Digest) 147 151 if err != nil { 148 152 // Log error but don't fail the push - labels are optional

+518

pkg/atproto/manifest_store_test.go

reviewed

··· 1 1 + package atproto 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "encoding/json" 6 6 + "io" 7 7 + "net/http" 8 8 + "testing" 9 9 + 10 10 + "github.com/distribution/distribution/v3" 11 11 + "github.com/opencontainers/go-digest" 12 12 + ) 13 13 + 14 14 + // mockDatabaseMetrics is a mock implementation of DatabaseMetrics interface 15 15 + type mockDatabaseMetrics struct { 16 16 + pushCalls []pushCall 17 17 + pullCalls []pullCall 18 18 + } 19 19 + 20 20 + type pushCall struct { 21 21 + did string 22 22 + repository string 23 23 + } 24 24 + 25 25 + type pullCall struct { 26 26 + did string 27 27 + repository string 28 28 + } 29 29 + 30 30 + func (m *mockDatabaseMetrics) IncrementPushCount(did, repository string) error { 31 31 + m.pushCalls = append(m.pushCalls, pushCall{did: did, repository: repository}) 32 32 + return nil 33 33 + } 34 34 + 35 35 + func (m *mockDatabaseMetrics) IncrementPullCount(did, repository string) error { 36 36 + m.pullCalls = append(m.pullCalls, pullCall{did: did, repository: repository}) 37 37 + return nil 38 38 + } 39 39 + 40 40 + // mockBlobStore is a minimal mock of distribution.BlobStore for testing 41 41 + type mockBlobStore struct { 42 42 + blobs map[digest.Digest][]byte 43 43 + } 44 44 + 45 45 + func newMockBlobStore() *mockBlobStore { 46 46 + return &mockBlobStore{ 47 47 + blobs: make(map[digest.Digest][]byte), 48 48 + } 49 49 + } 50 50 + 51 51 + func (m *mockBlobStore) Get(ctx context.Context, dgst digest.Digest) ([]byte, error) { 52 52 + data, ok := m.blobs[dgst] 53 53 + if !ok { 54 54 + return nil, nil // Simplified: return nil for not found 55 55 + } 56 56 + return data, nil 57 57 + } 58 58 + 59 59 + // Implement remaining methods to satisfy distribution.BlobStore interface 60 60 + func (m *mockBlobStore) Put(ctx context.Context, mediaType string, p []byte) (distribution.Descriptor, error) { 61 61 + dgst := digest.FromBytes(p) 62 62 + m.blobs[dgst] = p 63 63 + return distribution.Descriptor{Digest: dgst, Size: int64(len(p)), MediaType: mediaType}, nil 64 64 + } 65 65 + 66 66 + func (m *mockBlobStore) Create(ctx context.Context, options ...distribution.BlobCreateOption) (distribution.BlobWriter, error) { 67 67 + return nil, nil // Not needed for current tests 68 68 + } 69 69 + 70 70 + func (m *mockBlobStore) Resume(ctx context.Context, id string) (distribution.BlobWriter, error) { 71 71 + return nil, nil // Not needed for current tests 72 72 + } 73 73 + 74 74 + func (m *mockBlobStore) ServeBlob(ctx context.Context, w http.ResponseWriter, r *http.Request, dgst digest.Digest) error { 75 75 + return nil // Not needed for current tests 76 76 + } 77 77 + 78 78 + func (m *mockBlobStore) Stat(ctx context.Context, dgst digest.Digest) (distribution.Descriptor, error) { 79 79 + data, ok := m.blobs[dgst] 80 80 + if !ok { 81 81 + return distribution.Descriptor{}, distribution.ErrBlobUnknown 82 82 + } 83 83 + return distribution.Descriptor{Digest: dgst, Size: int64(len(data))}, nil 84 84 + } 85 85 + 86 86 + func (m *mockBlobStore) Delete(ctx context.Context, dgst digest.Digest) error { 87 87 + delete(m.blobs, dgst) 88 88 + return nil 89 89 + } 90 90 + 91 91 + func (m *mockBlobStore) Open(ctx context.Context, dgst digest.Digest) (io.ReadSeekCloser, error) { 92 92 + return nil, nil // Not needed for current tests 93 93 + } 94 94 + 95 95 + // mockATProtoClient mocks the ATProto client for testing 96 96 + type mockATProtoClient struct { 97 97 + records map[string]map[string]interface{} // collection -> rkey -> record 98 98 + blobs map[string][]byte // cid -> blob data 99 99 + } 100 100 + 101 101 + func newMockATProtoClient() *mockATProtoClient { 102 102 + return &mockATProtoClient{ 103 103 + records: make(map[string]map[string]interface{}), 104 104 + blobs: make(map[string][]byte), 105 105 + } 106 106 + } 107 107 + 108 108 + // TestDigestToRKey tests digest to record key conversion 109 109 + func TestDigestToRKey(t *testing.T) { 110 110 + tests := []struct { 111 111 + name string 112 112 + digest digest.Digest 113 113 + want string 114 114 + }{ 115 115 + { 116 116 + name: "sha256 digest", 117 117 + digest: "sha256:abc123def456", 118 118 + want: "abc123def456", 119 119 + }, 120 120 + { 121 121 + name: "sha512 digest", 122 122 + digest: "sha512:xyz789", 123 123 + want: "xyz789", 124 124 + }, 125 125 + } 126 126 + 127 127 + for _, tt := range tests { 128 128 + t.Run(tt.name, func(t *testing.T) { 129 129 + got := digestToRKey(tt.digest) 130 130 + if got != tt.want { 131 131 + t.Errorf("digestToRKey() = %v, want %v", got, tt.want) 132 132 + } 133 133 + }) 134 134 + } 135 135 + } 136 136 + 137 137 + // TestRepositoryTagToRKey tests repository+tag to record key conversion 138 138 + func TestRepositoryTagToRKey(t *testing.T) { 139 139 + tests := []struct { 140 140 + name string 141 141 + repository string 142 142 + tag string 143 143 + want string 144 144 + }{ 145 145 + { 146 146 + name: "simple repo and tag", 147 147 + repository: "myapp", 148 148 + tag: "latest", 149 149 + want: "myapp_latest", 150 150 + }, 151 151 + { 152 152 + name: "repo with namespace", 153 153 + repository: "org/myapp", 154 154 + tag: "v1.0.0", 155 155 + want: "org-myapp_v1.0.0", 156 156 + }, 157 157 + { 158 158 + name: "tag with underscore", 159 159 + repository: "myapp", 160 160 + tag: "test_tag", 161 161 + want: "myapp_test_tag", 162 162 + }, 163 163 + { 164 164 + name: "deep namespace", 165 165 + repository: "a/b/c/myapp", 166 166 + tag: "prod", 167 167 + want: "a-b-c-myapp_prod", 168 168 + }, 169 169 + } 170 170 + 171 171 + for _, tt := range tests { 172 172 + t.Run(tt.name, func(t *testing.T) { 173 173 + got := repositoryTagToRKey(tt.repository, tt.tag) 174 174 + if got != tt.want { 175 175 + t.Errorf("repositoryTagToRKey() = %v, want %v", got, tt.want) 176 176 + } 177 177 + }) 178 178 + } 179 179 + } 180 180 + 181 181 + // TestRKeyToRepositoryTag tests converting record key back to repository and tag 182 182 + func TestRKeyToRepositoryTag(t *testing.T) { 183 183 + tests := []struct { 184 184 + name string 185 185 + rkey string 186 186 + wantRepository string 187 187 + wantTag string 188 188 + }{ 189 189 + { 190 190 + name: "simple key", 191 191 + rkey: "myapp_latest", 192 192 + wantRepository: "myapp", 193 193 + wantTag: "latest", 194 194 + }, 195 195 + { 196 196 + name: "namespaced repo", 197 197 + rkey: "org-myapp_v1.0.0", 198 198 + wantRepository: "org/myapp", 199 199 + wantTag: "v1.0.0", 200 200 + }, 201 201 + { 202 202 + name: "tag with underscore (splits on last underscore)", 203 203 + rkey: "myapp_test_tag", 204 204 + wantRepository: "myapp_test", 205 205 + wantTag: "tag", 206 206 + }, 207 207 + { 208 208 + name: "deep namespace", 209 209 + rkey: "a-b-c-myapp_prod", 210 210 + wantRepository: "a/b/c/myapp", 211 211 + wantTag: "prod", 212 212 + }, 213 213 + { 214 214 + name: "no underscore - all tag", 215 215 + rkey: "latest", 216 216 + wantRepository: "", 217 217 + wantTag: "latest", 218 218 + }, 219 219 + } 220 220 + 221 221 + for _, tt := range tests { 222 222 + t.Run(tt.name, func(t *testing.T) { 223 223 + gotRepo, gotTag := RKeyToRepositoryTag(tt.rkey) 224 224 + if gotRepo != tt.wantRepository { 225 225 + t.Errorf("RKeyToRepositoryTag() repository = %v, want %v", gotRepo, tt.wantRepository) 226 226 + } 227 227 + if gotTag != tt.wantTag { 228 228 + t.Errorf("RKeyToRepositoryTag() tag = %v, want %v", gotTag, tt.wantTag) 229 229 + } 230 230 + }) 231 231 + } 232 232 + } 233 233 + 234 234 + // TestRepositoryTagRoundTrip tests that converting to rkey and back preserves values 235 235 + // Note: Tags with underscores cannot be perfectly round-tripped since we use underscore as separator 236 236 + func TestRepositoryTagRoundTrip(t *testing.T) { 237 237 + tests := []struct { 238 238 + repository string 239 239 + tag string 240 240 + }{ 241 241 + {"myapp", "latest"}, 242 242 + {"org/myapp", "v1.0.0"}, 243 243 + {"a/b/c/myapp", "prod"}, 244 244 + // Note: Tags with underscores are excluded - they cannot round-trip correctly 245 245 + // because underscore is used as the separator between repository and tag 246 246 + } 247 247 + 248 248 + for _, tt := range tests { 249 249 + t.Run(tt.repository+":"+tt.tag, func(t *testing.T) { 250 250 + rkey := repositoryTagToRKey(tt.repository, tt.tag) 251 251 + gotRepo, gotTag := RKeyToRepositoryTag(rkey) 252 252 + 253 253 + if gotRepo != tt.repository { 254 254 + t.Errorf("Round trip failed: repository = %v, want %v", gotRepo, tt.repository) 255 255 + } 256 256 + if gotTag != tt.tag { 257 257 + t.Errorf("Round trip failed: tag = %v, want %v", gotTag, tt.tag) 258 258 + } 259 259 + }) 260 260 + } 261 261 + } 262 262 + 263 263 + // TestNewManifestStore tests creating a new manifest store 264 264 + func TestNewManifestStore(t *testing.T) { 265 265 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 266 266 + blobStore := newMockBlobStore() 267 267 + db := &mockDatabaseMetrics{} 268 268 + 269 269 + store := NewManifestStore( 270 270 + client, 271 271 + "myapp", 272 272 + "https://hold.example.com", 273 273 + "did:web:hold.example.com", 274 274 + "did:plc:alice123", 275 275 + blobStore, 276 276 + db, 277 277 + ) 278 278 + 279 279 + if store.repository != "myapp" { 280 280 + t.Errorf("repository = %v, want myapp", store.repository) 281 281 + } 282 282 + if store.holdEndpoint != "https://hold.example.com" { 283 283 + t.Errorf("holdEndpoint = %v, want https://hold.example.com", store.holdEndpoint) 284 284 + } 285 285 + if store.holdDID != "did:web:hold.example.com" { 286 286 + t.Errorf("holdDID = %v, want did:web:hold.example.com", store.holdDID) 287 287 + } 288 288 + if store.did != "did:plc:alice123" { 289 289 + t.Errorf("did = %v, want did:plc:alice123", store.did) 290 290 + } 291 291 + } 292 292 + 293 293 + // TestManifestStore_GetLastFetchedHoldDID tests tracking last fetched hold DID 294 294 + func TestManifestStore_GetLastFetchedHoldDID(t *testing.T) { 295 295 + tests := []struct { 296 296 + name string 297 297 + manifestHoldDID string 298 298 + manifestHoldURL string 299 299 + expectedLastFetched string 300 300 + }{ 301 301 + { 302 302 + name: "prefers HoldDID", 303 303 + manifestHoldDID: "did:web:hold01.atcr.io", 304 304 + manifestHoldURL: "https://hold01.atcr.io", 305 305 + expectedLastFetched: "did:web:hold01.atcr.io", 306 306 + }, 307 307 + { 308 308 + name: "falls back to HoldEndpoint URL conversion", 309 309 + manifestHoldDID: "", 310 310 + manifestHoldURL: "https://hold02.atcr.io", 311 311 + expectedLastFetched: "did:web:hold02.atcr.io", 312 312 + }, 313 313 + { 314 314 + name: "empty hold references", 315 315 + manifestHoldDID: "", 316 316 + manifestHoldURL: "", 317 317 + expectedLastFetched: "", 318 318 + }, 319 319 + } 320 320 + 321 321 + for _, tt := range tests { 322 322 + t.Run(tt.name, func(t *testing.T) { 323 323 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 324 324 + store := NewManifestStore(client, "myapp", "", "", "did:plc:test123", nil, nil) 325 325 + 326 326 + // Simulate what happens in Get() when parsing a manifest record 327 327 + var manifestRecord ManifestRecord 328 328 + manifestRecord.HoldDID = tt.manifestHoldDID 329 329 + manifestRecord.HoldEndpoint = tt.manifestHoldURL 330 330 + 331 331 + // Mimic the hold DID extraction logic from Get() 332 332 + if manifestRecord.HoldDID != "" { 333 333 + store.lastFetchedHoldDID = manifestRecord.HoldDID 334 334 + } else if manifestRecord.HoldEndpoint != "" { 335 335 + store.lastFetchedHoldDID = ResolveHoldDIDFromURL(manifestRecord.HoldEndpoint) 336 336 + } 337 337 + 338 338 + got := store.GetLastFetchedHoldDID() 339 339 + if got != tt.expectedLastFetched { 340 340 + t.Errorf("GetLastFetchedHoldDID() = %v, want %v", got, tt.expectedLastFetched) 341 341 + } 342 342 + }) 343 343 + } 344 344 + } 345 345 + 346 346 + // TestRawManifest tests the rawManifest implementation 347 347 + func TestRawManifest(t *testing.T) { 348 348 + mediaType := "application/vnd.oci.image.manifest.v1+json" 349 349 + payload := []byte(`{"schemaVersion":2}`) 350 350 + 351 351 + manifest := &rawManifest{ 352 352 + mediaType: mediaType, 353 353 + payload: payload, 354 354 + } 355 355 + 356 356 + // Test Payload() 357 357 + gotMediaType, gotPayload, err := manifest.Payload() 358 358 + if err != nil { 359 359 + t.Fatalf("Payload() error = %v", err) 360 360 + } 361 361 + 362 362 + if gotMediaType != mediaType { 363 363 + t.Errorf("Payload() mediaType = %v, want %v", gotMediaType, mediaType) 364 364 + } 365 365 + 366 366 + if string(gotPayload) != string(payload) { 367 367 + t.Errorf("Payload() payload = %v, want %v", string(gotPayload), string(payload)) 368 368 + } 369 369 + 370 370 + // Test References() - should return nil for now 371 371 + refs := manifest.References() 372 372 + if refs != nil { 373 373 + t.Errorf("References() = %v, want nil", refs) 374 374 + } 375 375 + } 376 376 + 377 377 + // TestExtractConfigLabels tests extracting labels from image config 378 378 + func TestExtractConfigLabels(t *testing.T) { 379 379 + // Create a mock config blob 380 380 + configJSON := map[string]interface{}{ 381 381 + "config": map[string]interface{}{ 382 382 + "Labels": map[string]string{ 383 383 + "org.opencontainers.image.version": "1.0.0", 384 384 + "org.opencontainers.image.authors": "test@example.com", 385 385 + "custom.label": "value", 386 386 + }, 387 387 + }, 388 388 + } 389 389 + configData, _ := json.Marshal(configJSON) 390 390 + 391 391 + // Create blob store with config 392 392 + blobStore := newMockBlobStore() 393 393 + configDigest := digest.FromBytes(configData) 394 394 + blobStore.blobs[configDigest] = configData 395 395 + 396 396 + // Create manifest store 397 397 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 398 398 + store := NewManifestStore(client, "myapp", "", "", "did:plc:test123", blobStore, nil) 399 399 + 400 400 + // Extract labels 401 401 + labels, err := store.extractConfigLabels(context.Background(), configDigest.String()) 402 402 + if err != nil { 403 403 + t.Fatalf("extractConfigLabels() error = %v", err) 404 404 + } 405 405 + 406 406 + // Verify labels 407 407 + expectedLabels := map[string]string{ 408 408 + "org.opencontainers.image.version": "1.0.0", 409 409 + "org.opencontainers.image.authors": "test@example.com", 410 410 + "custom.label": "value", 411 411 + } 412 412 + 413 413 + if len(labels) != len(expectedLabels) { 414 414 + t.Errorf("len(labels) = %v, want %v", len(labels), len(expectedLabels)) 415 415 + } 416 416 + 417 417 + for key, expectedValue := range expectedLabels { 418 418 + if labels[key] != expectedValue { 419 419 + t.Errorf("labels[%s] = %v, want %v", key, labels[key], expectedValue) 420 420 + } 421 421 + } 422 422 + } 423 423 + 424 424 + // TestExtractConfigLabels_NoLabels tests handling config without labels 425 425 + func TestExtractConfigLabels_NoLabels(t *testing.T) { 426 426 + // Config without Labels field 427 427 + configJSON := map[string]interface{}{ 428 428 + "config": map[string]interface{}{}, 429 429 + } 430 430 + configData, _ := json.Marshal(configJSON) 431 431 + 432 432 + blobStore := newMockBlobStore() 433 433 + configDigest := digest.FromBytes(configData) 434 434 + blobStore.blobs[configDigest] = configData 435 435 + 436 436 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 437 437 + store := NewManifestStore(client, "myapp", "", "", "did:plc:test123", blobStore, nil) 438 438 + 439 439 + labels, err := store.extractConfigLabels(context.Background(), configDigest.String()) 440 440 + if err != nil { 441 441 + t.Fatalf("extractConfigLabels() error = %v", err) 442 442 + } 443 443 + 444 444 + // Should return empty map (or nil) 445 445 + if labels != nil && len(labels) != 0 { 446 446 + t.Errorf("extractConfigLabels() should return empty/nil for config without labels, got %v", labels) 447 447 + } 448 448 + } 449 449 + 450 450 + // TestExtractConfigLabels_InvalidDigest tests error handling for invalid digest 451 451 + func TestExtractConfigLabels_InvalidDigest(t *testing.T) { 452 452 + blobStore := newMockBlobStore() 453 453 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 454 454 + store := NewManifestStore(client, "myapp", "", "", "did:plc:test123", blobStore, nil) 455 455 + 456 456 + _, err := store.extractConfigLabels(context.Background(), "invalid-digest") 457 457 + if err == nil { 458 458 + t.Error("extractConfigLabels() should return error for invalid digest") 459 459 + } 460 460 + } 461 461 + 462 462 + // TestExtractConfigLabels_InvalidJSON tests handling of malformed config JSON 463 463 + func TestExtractConfigLabels_InvalidJSON(t *testing.T) { 464 464 + // Invalid JSON 465 465 + configData := []byte("not valid json") 466 466 + 467 467 + blobStore := newMockBlobStore() 468 468 + configDigest := digest.FromBytes(configData) 469 469 + blobStore.blobs[configDigest] = configData 470 470 + 471 471 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 472 472 + store := NewManifestStore(client, "myapp", "", "", "did:plc:test123", blobStore, nil) 473 473 + 474 474 + _, err := store.extractConfigLabels(context.Background(), configDigest.String()) 475 475 + if err == nil { 476 476 + t.Error("extractConfigLabels() should return error for invalid JSON") 477 477 + } 478 478 + } 479 479 + 480 480 + // TestManifestStore_WithMetrics tests that metrics are tracked 481 481 + func TestManifestStore_WithMetrics(t *testing.T) { 482 482 + db := &mockDatabaseMetrics{} 483 483 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 484 484 + store := NewManifestStore( 485 485 + client, 486 486 + "myapp", 487 487 + "https://hold.example.com", 488 488 + "did:web:hold.example.com", 489 489 + "did:plc:alice123", 490 490 + nil, 491 491 + db, 492 492 + ) 493 493 + 494 494 + if store.database != db { 495 495 + t.Error("ManifestStore should store database reference") 496 496 + } 497 497 + 498 498 + // Note: Actual metrics tracking happens in Put() and Get() which require 499 499 + // full mock setup. The important thing is that the database is wired up. 500 500 + } 501 501 + 502 502 + // TestManifestStore_WithoutMetrics tests that nil database is acceptable 503 503 + func TestManifestStore_WithoutMetrics(t *testing.T) { 504 504 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 505 505 + store := NewManifestStore( 506 506 + client, 507 507 + "myapp", 508 508 + "https://hold.example.com", 509 509 + "did:web:hold.example.com", 510 510 + "did:plc:alice123", 511 511 + nil, 512 512 + nil, // nil database 513 513 + ) 514 514 + 515 515 + if store.database != nil { 516 516 + t.Error("ManifestStore should accept nil database") 517 517 + } 518 518 + }

+558

pkg/atproto/profile_test.go

reviewed

··· 1 1 + package atproto 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "encoding/json" 6 6 + "net/http" 7 7 + "net/http/httptest" 8 8 + "strings" 9 9 + "sync" 10 10 + "testing" 11 11 + "time" 12 12 + ) 13 13 + 14 14 + // TestEnsureProfile_Create tests creating a new profile when one doesn't exist 15 15 + func TestEnsureProfile_Create(t *testing.T) { 16 16 + tests := []struct { 17 17 + name string 18 18 + defaultHoldDID string 19 19 + wantNormalized string // Expected defaultHold value after normalization 20 20 + }{ 21 21 + { 22 22 + name: "with DID", 23 23 + defaultHoldDID: "did:web:hold01.atcr.io", 24 24 + wantNormalized: "did:web:hold01.atcr.io", 25 25 + }, 26 26 + { 27 27 + name: "with URL - should normalize to DID", 28 28 + defaultHoldDID: "https://hold01.atcr.io", 29 29 + wantNormalized: "did:web:hold01.atcr.io", 30 30 + }, 31 31 + { 32 32 + name: "empty default hold", 33 33 + defaultHoldDID: "", 34 34 + wantNormalized: "", 35 35 + }, 36 36 + } 37 37 + 38 38 + for _, tt := range tests { 39 39 + t.Run(tt.name, func(t *testing.T) { 40 40 + var createdProfile *SailorProfileRecord 41 41 + 42 42 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 43 43 + // First request: GetRecord (should 404) 44 44 + if r.Method == "GET" { 45 45 + w.WriteHeader(http.StatusNotFound) 46 46 + return 47 47 + } 48 48 + 49 49 + // Second request: PutRecord (create profile) 50 50 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 51 51 + var body map[string]interface{} 52 52 + json.NewDecoder(r.Body).Decode(&body) 53 53 + 54 54 + // Verify profile data 55 55 + recordData := body["record"].(map[string]interface{}) 56 56 + if recordData["$type"] != SailorProfileCollection { 57 57 + t.Errorf("$type = %v, want %v", recordData["$type"], SailorProfileCollection) 58 58 + } 59 59 + 60 60 + // Check defaultHold normalization 61 61 + defaultHold := recordData["defaultHold"] 62 62 + // Handle empty string (may be nil in JSON) 63 63 + defaultHoldStr := "" 64 64 + if defaultHold != nil { 65 65 + defaultHoldStr = defaultHold.(string) 66 66 + } 67 67 + if defaultHoldStr != tt.wantNormalized { 68 68 + t.Errorf("defaultHold = %v, want %v", defaultHoldStr, tt.wantNormalized) 69 69 + } 70 70 + 71 71 + // Store for later verification 72 72 + profileBytes, _ := json.Marshal(recordData) 73 73 + json.Unmarshal(profileBytes, &createdProfile) 74 74 + 75 75 + w.WriteHeader(http.StatusOK) 76 76 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.sailor.profile/self","cid":"bafytest"}`)) 77 77 + return 78 78 + } 79 79 + 80 80 + w.WriteHeader(http.StatusBadRequest) 81 81 + })) 82 82 + defer server.Close() 83 83 + 84 84 + client := NewClient(server.URL, "did:plc:test123", "test-token") 85 85 + err := EnsureProfile(context.Background(), client, tt.defaultHoldDID) 86 86 + 87 87 + if err != nil { 88 88 + t.Fatalf("EnsureProfile() error = %v", err) 89 89 + } 90 90 + 91 91 + // Verify created profile 92 92 + if createdProfile == nil { 93 93 + t.Fatal("Profile was not created") 94 94 + } 95 95 + 96 96 + if createdProfile.Type != SailorProfileCollection { 97 97 + t.Errorf("Type = %v, want %v", createdProfile.Type, SailorProfileCollection) 98 98 + } 99 99 + 100 100 + if createdProfile.DefaultHold != tt.wantNormalized { 101 101 + t.Errorf("DefaultHold = %v, want %v", createdProfile.DefaultHold, tt.wantNormalized) 102 102 + } 103 103 + }) 104 104 + } 105 105 + } 106 106 + 107 107 + // TestEnsureProfile_Exists tests that EnsureProfile doesn't recreate existing profiles 108 108 + func TestEnsureProfile_Exists(t *testing.T) { 109 109 + putRecordCalled := false 110 110 + 111 111 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 112 112 + // GetRecord: profile exists 113 113 + if r.Method == "GET" { 114 114 + response := `{ 115 115 + "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 116 116 + "cid": "bafytest", 117 117 + "value": { 118 118 + "$type": "io.atcr.sailor.profile", 119 119 + "defaultHold": "did:web:hold01.atcr.io", 120 120 + "createdAt": "2025-01-01T00:00:00Z", 121 121 + "updatedAt": "2025-01-01T00:00:00Z" 122 122 + } 123 123 + }` 124 124 + w.WriteHeader(http.StatusOK) 125 125 + w.Write([]byte(response)) 126 126 + return 127 127 + } 128 128 + 129 129 + // PutRecord: should not be called 130 130 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 131 131 + putRecordCalled = true 132 132 + t.Error("PutRecord should not be called when profile exists") 133 133 + } 134 134 + })) 135 135 + defer server.Close() 136 136 + 137 137 + client := NewClient(server.URL, "did:plc:test123", "test-token") 138 138 + err := EnsureProfile(context.Background(), client, "did:web:hold01.atcr.io") 139 139 + 140 140 + if err != nil { 141 141 + t.Fatalf("EnsureProfile() error = %v", err) 142 142 + } 143 143 + 144 144 + if putRecordCalled { 145 145 + t.Error("PutRecord was called when profile already exists") 146 146 + } 147 147 + } 148 148 + 149 149 + // TestGetProfile tests retrieving a user's profile 150 150 + func TestGetProfile(t *testing.T) { 151 151 + tests := []struct { 152 152 + name string 153 153 + serverResponse string 154 154 + serverStatus int 155 155 + wantProfile *SailorProfileRecord 156 156 + wantNil bool 157 157 + wantErr bool 158 158 + expectMigration bool // Whether URL-to-DID migration should happen 159 159 + originalHoldURL string 160 160 + expectedHoldDID string 161 161 + }{ 162 162 + { 163 163 + name: "profile with DID (no migration needed)", 164 164 + serverResponse: `{ 165 165 + "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 166 166 + "value": { 167 167 + "$type": "io.atcr.sailor.profile", 168 168 + "defaultHold": "did:web:hold01.atcr.io", 169 169 + "createdAt": "2025-01-01T00:00:00Z", 170 170 + "updatedAt": "2025-01-01T00:00:00Z" 171 171 + } 172 172 + }`, 173 173 + serverStatus: http.StatusOK, 174 174 + wantNil: false, 175 175 + wantErr: false, 176 176 + expectMigration: false, 177 177 + expectedHoldDID: "did:web:hold01.atcr.io", 178 178 + }, 179 179 + { 180 180 + name: "profile with URL (migration needed)", 181 181 + serverResponse: `{ 182 182 + "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 183 183 + "value": { 184 184 + "$type": "io.atcr.sailor.profile", 185 185 + "defaultHold": "https://hold01.atcr.io", 186 186 + "createdAt": "2025-01-01T00:00:00Z", 187 187 + "updatedAt": "2025-01-01T00:00:00Z" 188 188 + } 189 189 + }`, 190 190 + serverStatus: http.StatusOK, 191 191 + wantNil: false, 192 192 + wantErr: false, 193 193 + expectMigration: true, 194 194 + originalHoldURL: "https://hold01.atcr.io", 195 195 + expectedHoldDID: "did:web:hold01.atcr.io", 196 196 + }, 197 197 + { 198 198 + name: "profile doesn't exist - return nil", 199 199 + serverResponse: "", 200 200 + serverStatus: http.StatusNotFound, 201 201 + wantNil: true, 202 202 + wantErr: false, 203 203 + expectMigration: false, 204 204 + }, 205 205 + { 206 206 + name: "server error", 207 207 + serverResponse: `{"error":"InternalServerError"}`, 208 208 + serverStatus: http.StatusInternalServerError, 209 209 + wantNil: false, 210 210 + wantErr: true, 211 211 + expectMigration: false, 212 212 + }, 213 213 + } 214 214 + 215 215 + for _, tt := range tests { 216 216 + t.Run(tt.name, func(t *testing.T) { 217 217 + // Clear migration locks before each test 218 218 + migrationLocks = sync.Map{} 219 219 + 220 220 + putRecordCalled := false 221 221 + var migrationRequest map[string]interface{} 222 222 + 223 223 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 224 224 + // GetRecord 225 225 + if r.Method == "GET" { 226 226 + w.WriteHeader(tt.serverStatus) 227 227 + w.Write([]byte(tt.serverResponse)) 228 228 + return 229 229 + } 230 230 + 231 231 + // PutRecord (migration) 232 232 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 233 233 + putRecordCalled = true 234 234 + json.NewDecoder(r.Body).Decode(&migrationRequest) 235 235 + w.WriteHeader(http.StatusOK) 236 236 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.sailor.profile/self","cid":"bafytest"}`)) 237 237 + return 238 238 + } 239 239 + })) 240 240 + defer server.Close() 241 241 + 242 242 + client := NewClient(server.URL, "did:plc:test123", "test-token") 243 243 + profile, err := GetProfile(context.Background(), client) 244 244 + 245 245 + if (err != nil) != tt.wantErr { 246 246 + t.Errorf("GetProfile() error = %v, wantErr %v", err, tt.wantErr) 247 247 + return 248 248 + } 249 249 + 250 250 + if tt.wantNil { 251 251 + if profile != nil { 252 252 + t.Errorf("GetProfile() = %v, want nil", profile) 253 253 + } 254 254 + return 255 255 + } 256 256 + 257 257 + if !tt.wantErr { 258 258 + if profile == nil { 259 259 + t.Fatal("GetProfile() returned nil, want profile") 260 260 + } 261 261 + 262 262 + // Check that defaultHold is migrated to DID in returned profile 263 263 + if profile.DefaultHold != tt.expectedHoldDID { 264 264 + t.Errorf("DefaultHold = %v, want %v", profile.DefaultHold, tt.expectedHoldDID) 265 265 + } 266 266 + 267 267 + if tt.expectMigration { 268 268 + // Give goroutine time to execute 269 269 + time.Sleep(50 * time.Millisecond) 270 270 + 271 271 + if !putRecordCalled { 272 272 + t.Error("Expected migration PutRecord to be called") 273 273 + } 274 274 + 275 275 + if migrationRequest != nil { 276 276 + recordData := migrationRequest["record"].(map[string]interface{}) 277 277 + migratedHold := recordData["defaultHold"] 278 278 + if migratedHold != tt.expectedHoldDID { 279 279 + t.Errorf("Migrated defaultHold = %v, want %v", migratedHold, tt.expectedHoldDID) 280 280 + } 281 281 + } 282 282 + } 283 283 + } 284 284 + }) 285 285 + } 286 286 + } 287 287 + 288 288 + // TestGetProfile_MigrationLocking tests that concurrent migrations don't happen 289 289 + func TestGetProfile_MigrationLocking(t *testing.T) { 290 290 + // Clear migration locks 291 291 + migrationLocks = sync.Map{} 292 292 + 293 293 + putRecordCount := 0 294 294 + var mu sync.Mutex 295 295 + 296 296 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 297 297 + // GetRecord - return profile with URL 298 298 + if r.Method == "GET" { 299 299 + response := `{ 300 300 + "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 301 301 + "value": { 302 302 + "$type": "io.atcr.sailor.profile", 303 303 + "defaultHold": "https://hold01.atcr.io", 304 304 + "createdAt": "2025-01-01T00:00:00Z", 305 305 + "updatedAt": "2025-01-01T00:00:00Z" 306 306 + } 307 307 + }` 308 308 + w.WriteHeader(http.StatusOK) 309 309 + w.Write([]byte(response)) 310 310 + return 311 311 + } 312 312 + 313 313 + // PutRecord - count migrations 314 314 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 315 315 + mu.Lock() 316 316 + putRecordCount++ 317 317 + mu.Unlock() 318 318 + 319 319 + // Add small delay to ensure concurrent requests 320 320 + time.Sleep(10 * time.Millisecond) 321 321 + 322 322 + w.WriteHeader(http.StatusOK) 323 323 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.sailor.profile/self","cid":"bafytest"}`)) 324 324 + return 325 325 + } 326 326 + })) 327 327 + defer server.Close() 328 328 + 329 329 + client := NewClient(server.URL, "did:plc:test123", "test-token") 330 330 + 331 331 + // Make 5 concurrent GetProfile calls 332 332 + var wg sync.WaitGroup 333 333 + for i := 0; i < 5; i++ { 334 334 + wg.Add(1) 335 335 + go func() { 336 336 + defer wg.Done() 337 337 + _, err := GetProfile(context.Background(), client) 338 338 + if err != nil { 339 339 + t.Errorf("GetProfile() error = %v", err) 340 340 + } 341 341 + }() 342 342 + } 343 343 + 344 344 + wg.Wait() 345 345 + 346 346 + // Give migrations time to complete 347 347 + time.Sleep(200 * time.Millisecond) 348 348 + 349 349 + // Only one migration should have been persisted due to locking 350 350 + mu.Lock() 351 351 + count := putRecordCount 352 352 + mu.Unlock() 353 353 + 354 354 + if count != 1 { 355 355 + t.Errorf("PutRecord called %d times, want 1 (locking should prevent concurrent migrations)", count) 356 356 + } 357 357 + } 358 358 + 359 359 + // TestUpdateProfile tests updating a user's profile 360 360 + func TestUpdateProfile(t *testing.T) { 361 361 + tests := []struct { 362 362 + name string 363 363 + profile *SailorProfileRecord 364 364 + wantNormalized string // Expected defaultHold after normalization 365 365 + wantErr bool 366 366 + }{ 367 367 + { 368 368 + name: "update with DID", 369 369 + profile: &SailorProfileRecord{ 370 370 + Type: SailorProfileCollection, 371 371 + DefaultHold: "did:web:hold02.atcr.io", 372 372 + CreatedAt: time.Now(), 373 373 + UpdatedAt: time.Now(), 374 374 + }, 375 375 + wantNormalized: "did:web:hold02.atcr.io", 376 376 + wantErr: false, 377 377 + }, 378 378 + { 379 379 + name: "update with URL - should normalize", 380 380 + profile: &SailorProfileRecord{ 381 381 + Type: SailorProfileCollection, 382 382 + DefaultHold: "https://hold02.atcr.io", 383 383 + CreatedAt: time.Now(), 384 384 + UpdatedAt: time.Now(), 385 385 + }, 386 386 + wantNormalized: "did:web:hold02.atcr.io", 387 387 + wantErr: false, 388 388 + }, 389 389 + { 390 390 + name: "clear default hold", 391 391 + profile: &SailorProfileRecord{ 392 392 + Type: SailorProfileCollection, 393 393 + DefaultHold: "", 394 394 + CreatedAt: time.Now(), 395 395 + UpdatedAt: time.Now(), 396 396 + }, 397 397 + wantNormalized: "", 398 398 + wantErr: false, 399 399 + }, 400 400 + } 401 401 + 402 402 + for _, tt := range tests { 403 403 + t.Run(tt.name, func(t *testing.T) { 404 404 + var sentProfile map[string]interface{} 405 405 + 406 406 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 407 407 + if r.Method == "POST" && strings.Contains(r.URL.Path, "putRecord") { 408 408 + var body map[string]interface{} 409 409 + json.NewDecoder(r.Body).Decode(&body) 410 410 + sentProfile = body 411 411 + 412 412 + // Verify rkey is "self" 413 413 + if body["rkey"] != ProfileRKey { 414 414 + t.Errorf("rkey = %v, want %v", body["rkey"], ProfileRKey) 415 415 + } 416 416 + 417 417 + w.WriteHeader(http.StatusOK) 418 418 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.sailor.profile/self","cid":"bafytest"}`)) 419 419 + return 420 420 + } 421 421 + w.WriteHeader(http.StatusBadRequest) 422 422 + })) 423 423 + defer server.Close() 424 424 + 425 425 + client := NewClient(server.URL, "did:plc:test123", "test-token") 426 426 + err := UpdateProfile(context.Background(), client, tt.profile) 427 427 + 428 428 + if (err != nil) != tt.wantErr { 429 429 + t.Errorf("UpdateProfile() error = %v, wantErr %v", err, tt.wantErr) 430 430 + return 431 431 + } 432 432 + 433 433 + if !tt.wantErr { 434 434 + // Verify normalization happened 435 435 + recordData := sentProfile["record"].(map[string]interface{}) 436 436 + defaultHold := recordData["defaultHold"] 437 437 + // Handle empty string (may be nil in JSON) 438 438 + defaultHoldStr := "" 439 439 + if defaultHold != nil { 440 440 + defaultHoldStr = defaultHold.(string) 441 441 + } 442 442 + if defaultHoldStr != tt.wantNormalized { 443 443 + t.Errorf("defaultHold = %v, want %v", defaultHoldStr, tt.wantNormalized) 444 444 + } 445 445 + 446 446 + // Verify normalization also updated the profile object 447 447 + if tt.profile.DefaultHold != tt.wantNormalized { 448 448 + t.Errorf("profile.DefaultHold = %v, want %v (should be updated in-place)", tt.profile.DefaultHold, tt.wantNormalized) 449 449 + } 450 450 + } 451 451 + }) 452 452 + } 453 453 + } 454 454 + 455 455 + // TestProfileRKey tests that profile record key is always "self" 456 456 + func TestProfileRKey(t *testing.T) { 457 457 + if ProfileRKey != "self" { 458 458 + t.Errorf("ProfileRKey = %v, want self", ProfileRKey) 459 459 + } 460 460 + } 461 461 + 462 462 + // TestEnsureProfile_Error tests error handling during profile creation 463 463 + func TestEnsureProfile_Error(t *testing.T) { 464 464 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 465 465 + // GetRecord: profile doesn't exist 466 466 + if r.Method == "GET" { 467 467 + w.WriteHeader(http.StatusNotFound) 468 468 + return 469 469 + } 470 470 + 471 471 + // PutRecord: fail with server error 472 472 + if r.Method == "POST" { 473 473 + w.WriteHeader(http.StatusInternalServerError) 474 474 + w.Write([]byte(`{"error":"InternalServerError"}`)) 475 475 + return 476 476 + } 477 477 + })) 478 478 + defer server.Close() 479 479 + 480 480 + client := NewClient(server.URL, "did:plc:test123", "test-token") 481 481 + err := EnsureProfile(context.Background(), client, "did:web:hold01.atcr.io") 482 482 + 483 483 + if err == nil { 484 484 + t.Error("EnsureProfile() should return error when PutRecord fails") 485 485 + } 486 486 + } 487 487 + 488 488 + // TestGetProfile_InvalidJSON tests handling of invalid profile JSON 489 489 + func TestGetProfile_InvalidJSON(t *testing.T) { 490 490 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 491 491 + response := `{ 492 492 + "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 493 493 + "value": "not-valid-json-object" 494 494 + }` 495 495 + w.WriteHeader(http.StatusOK) 496 496 + w.Write([]byte(response)) 497 497 + })) 498 498 + defer server.Close() 499 499 + 500 500 + client := NewClient(server.URL, "did:plc:test123", "test-token") 501 501 + _, err := GetProfile(context.Background(), client) 502 502 + 503 503 + if err == nil { 504 504 + t.Error("GetProfile() should return error for invalid JSON") 505 505 + } 506 506 + } 507 507 + 508 508 + // TestGetProfile_EmptyDefaultHold tests profile with empty defaultHold 509 509 + func TestGetProfile_EmptyDefaultHold(t *testing.T) { 510 510 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 511 511 + response := `{ 512 512 + "uri": "at://did:plc:test123/io.atcr.sailor.profile/self", 513 513 + "value": { 514 514 + "$type": "io.atcr.sailor.profile", 515 515 + "defaultHold": "", 516 516 + "createdAt": "2025-01-01T00:00:00Z", 517 517 + "updatedAt": "2025-01-01T00:00:00Z" 518 518 + } 519 519 + }` 520 520 + w.WriteHeader(http.StatusOK) 521 521 + w.Write([]byte(response)) 522 522 + })) 523 523 + defer server.Close() 524 524 + 525 525 + client := NewClient(server.URL, "did:plc:test123", "test-token") 526 526 + profile, err := GetProfile(context.Background(), client) 527 527 + 528 528 + if err != nil { 529 529 + t.Fatalf("GetProfile() error = %v", err) 530 530 + } 531 531 + 532 532 + if profile.DefaultHold != "" { 533 533 + t.Errorf("DefaultHold = %v, want empty string", profile.DefaultHold) 534 534 + } 535 535 + } 536 536 + 537 537 + // TestUpdateProfile_ServerError tests error handling in UpdateProfile 538 538 + func TestUpdateProfile_ServerError(t *testing.T) { 539 539 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 540 540 + w.WriteHeader(http.StatusInternalServerError) 541 541 + w.Write([]byte(`{"error":"InternalServerError"}`)) 542 542 + })) 543 543 + defer server.Close() 544 544 + 545 545 + client := NewClient(server.URL, "did:plc:test123", "test-token") 546 546 + profile := &SailorProfileRecord{ 547 547 + Type: SailorProfileCollection, 548 548 + DefaultHold: "did:web:hold01.atcr.io", 549 549 + CreatedAt: time.Now(), 550 550 + UpdatedAt: time.Now(), 551 551 + } 552 552 + 553 553 + err := UpdateProfile(context.Background(), client, profile) 554 554 + 555 555 + if err == nil { 556 556 + t.Error("UpdateProfile() should return error when server fails") 557 557 + } 558 558 + }

+645

pkg/atproto/tag_store_test.go

reviewed

··· 1 1 + package atproto 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "encoding/json" 6 6 + "net/http" 7 7 + "net/http/httptest" 8 8 + "strings" 9 9 + "testing" 10 10 + 11 11 + "github.com/distribution/distribution/v3" 12 12 + "github.com/opencontainers/go-digest" 13 13 + ) 14 14 + 15 15 + // TestNewTagStore tests creating a new tag store 16 16 + func TestNewTagStore(t *testing.T) { 17 17 + client := NewClient("https://pds.example.com", "did:plc:test123", "token") 18 18 + store := NewTagStore(client, "myapp") 19 19 + 20 20 + if store.repository != "myapp" { 21 21 + t.Errorf("repository = %v, want myapp", store.repository) 22 22 + } 23 23 + if store.client == nil { 24 24 + t.Error("client should not be nil") 25 25 + } 26 26 + } 27 27 + 28 28 + // TestTagStore_Get tests retrieving a tag 29 29 + func TestTagStore_Get(t *testing.T) { 30 30 + tests := []struct { 31 31 + name string 32 32 + tag string 33 33 + serverResponse string 34 34 + serverStatus int 35 35 + wantErr bool 36 36 + wantDigest string 37 37 + }{ 38 38 + { 39 39 + name: "existing tag", 40 40 + tag: "latest", 41 41 + serverResponse: `{ 42 42 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_latest", 43 43 + "cid": "bafytest", 44 44 + "value": { 45 45 + "$type": "io.atcr.tag", 46 46 + "repository": "myapp", 47 47 + "tag": "latest", 48 48 + "manifestDigest": "sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789", 49 49 + "updatedAt": "2025-01-01T00:00:00Z" 50 50 + } 51 51 + }`, 52 52 + serverStatus: http.StatusOK, 53 53 + wantErr: false, 54 54 + wantDigest: "sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789", 55 55 + }, 56 56 + { 57 57 + name: "tag not found", 58 58 + tag: "notfound", 59 59 + serverResponse: "", 60 60 + serverStatus: http.StatusNotFound, 61 61 + wantErr: true, 62 62 + }, 63 63 + } 64 64 + 65 65 + for _, tt := range tests { 66 66 + t.Run(tt.name, func(t *testing.T) { 67 67 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 68 68 + // Verify query parameters 69 69 + query := r.URL.Query() 70 70 + rkey := repositoryTagToRKey("myapp", tt.tag) 71 71 + if query.Get("rkey") != rkey { 72 72 + t.Errorf("rkey = %v, want %v", query.Get("rkey"), rkey) 73 73 + } 74 74 + if query.Get("collection") != TagCollection { 75 75 + t.Errorf("collection = %v, want %v", query.Get("collection"), TagCollection) 76 76 + } 77 77 + 78 78 + w.WriteHeader(tt.serverStatus) 79 79 + w.Write([]byte(tt.serverResponse)) 80 80 + })) 81 81 + defer server.Close() 82 82 + 83 83 + client := NewClient(server.URL, "did:plc:test123", "test-token") 84 84 + store := NewTagStore(client, "myapp") 85 85 + 86 86 + desc, err := store.Get(context.Background(), tt.tag) 87 87 + 88 88 + if (err != nil) != tt.wantErr { 89 89 + t.Errorf("Get() error = %v, wantErr %v", err, tt.wantErr) 90 90 + return 91 91 + } 92 92 + 93 93 + if !tt.wantErr { 94 94 + if desc.Digest.String() != tt.wantDigest { 95 95 + t.Errorf("Digest = %v, want %v", desc.Digest.String(), tt.wantDigest) 96 96 + } 97 97 + if desc.MediaType != "application/vnd.oci.image.manifest.v1+json" { 98 98 + t.Errorf("MediaType = %v", desc.MediaType) 99 99 + } 100 100 + } 101 101 + }) 102 102 + } 103 103 + } 104 104 + 105 105 + // TestTagStore_Get_InvalidDigest tests error handling for invalid digest in tag record 106 106 + func TestTagStore_Get_InvalidDigest(t *testing.T) { 107 107 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 108 108 + response := `{ 109 109 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_latest", 110 110 + "value": { 111 111 + "$type": "io.atcr.tag", 112 112 + "repository": "myapp", 113 113 + "tag": "latest", 114 114 + "manifestDigest": "invalid-digest-format" 115 115 + } 116 116 + }` 117 117 + w.WriteHeader(http.StatusOK) 118 118 + w.Write([]byte(response)) 119 119 + })) 120 120 + defer server.Close() 121 121 + 122 122 + client := NewClient(server.URL, "did:plc:test123", "test-token") 123 123 + store := NewTagStore(client, "myapp") 124 124 + 125 125 + _, err := store.Get(context.Background(), "latest") 126 126 + if err == nil { 127 127 + t.Error("Get() should return error for invalid digest format") 128 128 + } 129 129 + } 130 130 + 131 131 + // TestTagStore_Tag tests creating/updating a tag 132 132 + func TestTagStore_Tag(t *testing.T) { 133 133 + tests := []struct { 134 134 + name string 135 135 + tag string 136 136 + digest digest.Digest 137 137 + serverStatus int 138 138 + wantErr bool 139 139 + }{ 140 140 + { 141 141 + name: "create new tag", 142 142 + tag: "v1.0.0", 143 143 + digest: "sha256:abc123def456", 144 144 + serverStatus: http.StatusOK, 145 145 + wantErr: false, 146 146 + }, 147 147 + { 148 148 + name: "update existing tag", 149 149 + tag: "latest", 150 150 + digest: "sha256:newdigest789", 151 151 + serverStatus: http.StatusOK, 152 152 + wantErr: false, 153 153 + }, 154 154 + { 155 155 + name: "server error", 156 156 + tag: "failed", 157 157 + digest: "sha256:test", 158 158 + serverStatus: http.StatusInternalServerError, 159 159 + wantErr: true, 160 160 + }, 161 161 + } 162 162 + 163 163 + for _, tt := range tests { 164 164 + t.Run(tt.name, func(t *testing.T) { 165 165 + var sentTagRecord *TagRecord 166 166 + 167 167 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 168 168 + if r.Method != "POST" { 169 169 + t.Errorf("Method = %v, want POST", r.Method) 170 170 + } 171 171 + 172 172 + // Parse request body 173 173 + var body map[string]interface{} 174 174 + json.NewDecoder(r.Body).Decode(&body) 175 175 + 176 176 + // Verify rkey 177 177 + expectedRKey := repositoryTagToRKey("myapp", tt.tag) 178 178 + if body["rkey"] != expectedRKey { 179 179 + t.Errorf("rkey = %v, want %v", body["rkey"], expectedRKey) 180 180 + } 181 181 + 182 182 + // Verify collection 183 183 + if body["collection"] != TagCollection { 184 184 + t.Errorf("collection = %v, want %v", body["collection"], TagCollection) 185 185 + } 186 186 + 187 187 + // Parse and verify tag record 188 188 + recordData := body["record"].(map[string]interface{}) 189 189 + recordBytes, _ := json.Marshal(recordData) 190 190 + var tagRecord TagRecord 191 191 + json.Unmarshal(recordBytes, &tagRecord) 192 192 + sentTagRecord = &tagRecord 193 193 + 194 194 + w.WriteHeader(tt.serverStatus) 195 195 + if tt.serverStatus == http.StatusOK { 196 196 + w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.tag/` + expectedRKey + `","cid":"bafytest"}`)) 197 197 + } else { 198 198 + w.Write([]byte(`{"error":"ServerError"}`)) 199 199 + } 200 200 + })) 201 201 + defer server.Close() 202 202 + 203 203 + client := NewClient(server.URL, "did:plc:test123", "test-token") 204 204 + store := NewTagStore(client, "myapp") 205 205 + 206 206 + desc := distribution.Descriptor{ 207 207 + Digest: tt.digest, 208 208 + MediaType: "application/vnd.oci.image.manifest.v1+json", 209 209 + } 210 210 + 211 211 + err := store.Tag(context.Background(), tt.tag, desc) 212 212 + 213 213 + if (err != nil) != tt.wantErr { 214 214 + t.Errorf("Tag() error = %v, wantErr %v", err, tt.wantErr) 215 215 + return 216 216 + } 217 217 + 218 218 + if !tt.wantErr && sentTagRecord != nil { 219 219 + // Verify the tag record 220 220 + if sentTagRecord.Type != TagCollection { 221 221 + t.Errorf("Type = %v, want %v", sentTagRecord.Type, TagCollection) 222 222 + } 223 223 + if sentTagRecord.Repository != "myapp" { 224 224 + t.Errorf("Repository = %v, want myapp", sentTagRecord.Repository) 225 225 + } 226 226 + if sentTagRecord.Tag != tt.tag { 227 227 + t.Errorf("Tag = %v, want %v", sentTagRecord.Tag, tt.tag) 228 228 + } 229 229 + if sentTagRecord.ManifestDigest != tt.digest.String() { 230 230 + t.Errorf("ManifestDigest = %v, want %v", sentTagRecord.ManifestDigest, tt.digest.String()) 231 231 + } 232 232 + } 233 233 + }) 234 234 + } 235 235 + } 236 236 + 237 237 + // TestTagStore_Untag tests removing a tag 238 238 + func TestTagStore_Untag(t *testing.T) { 239 239 + tests := []struct { 240 240 + name string 241 241 + tag string 242 242 + serverStatus int 243 243 + wantErr bool 244 244 + }{ 245 245 + { 246 246 + name: "successful delete", 247 247 + tag: "old-tag", 248 248 + serverStatus: http.StatusOK, 249 249 + wantErr: false, 250 250 + }, 251 251 + { 252 252 + name: "server error", 253 253 + tag: "tag", 254 254 + serverStatus: http.StatusInternalServerError, 255 255 + wantErr: true, 256 256 + }, 257 257 + } 258 258 + 259 259 + for _, tt := range tests { 260 260 + t.Run(tt.name, func(t *testing.T) { 261 261 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 262 262 + // Verify it's a DELETE request (via deleteRecord) 263 263 + if r.Method != "POST" { 264 264 + t.Errorf("Method = %v, want POST", r.Method) 265 265 + } 266 266 + 267 267 + // Parse body to verify delete parameters 268 268 + var body map[string]interface{} 269 269 + json.NewDecoder(r.Body).Decode(&body) 270 270 + 271 271 + expectedRKey := repositoryTagToRKey("myapp", tt.tag) 272 272 + if body["rkey"] != expectedRKey { 273 273 + t.Errorf("rkey = %v, want %v", body["rkey"], expectedRKey) 274 274 + } 275 275 + 276 276 + w.WriteHeader(tt.serverStatus) 277 277 + if tt.serverStatus == http.StatusOK { 278 278 + w.Write([]byte(`{}`)) 279 279 + } else { 280 280 + w.Write([]byte(`{"error":"ServerError"}`)) 281 281 + } 282 282 + })) 283 283 + defer server.Close() 284 284 + 285 285 + client := NewClient(server.URL, "did:plc:test123", "test-token") 286 286 + store := NewTagStore(client, "myapp") 287 287 + 288 288 + err := store.Untag(context.Background(), tt.tag) 289 289 + 290 290 + if (err != nil) != tt.wantErr { 291 291 + t.Errorf("Untag() error = %v, wantErr %v", err, tt.wantErr) 292 292 + } 293 293 + }) 294 294 + } 295 295 + } 296 296 + 297 297 + // TestTagStore_All tests listing all tags for a repository 298 298 + func TestTagStore_All(t *testing.T) { 299 299 + tests := []struct { 300 300 + name string 301 301 + serverResponse string 302 302 + wantTags []string 303 303 + }{ 304 304 + { 305 305 + name: "multiple tags for repository", 306 306 + serverResponse: `{ 307 307 + "records": [ 308 308 + { 309 309 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_latest", 310 310 + "value": { 311 311 + "$type": "io.atcr.tag", 312 312 + "repository": "myapp", 313 313 + "tag": "latest", 314 314 + "manifestDigest": "sha256:abc123" 315 315 + } 316 316 + }, 317 317 + { 318 318 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_v1.0.0", 319 319 + "value": { 320 320 + "$type": "io.atcr.tag", 321 321 + "repository": "myapp", 322 322 + "tag": "v1.0.0", 323 323 + "manifestDigest": "sha256:def456" 324 324 + } 325 325 + }, 326 326 + { 327 327 + "uri": "at://did:plc:test123/io.atcr.tag/apper_latest", 328 328 + "value": { 329 329 + "$type": "io.atcr.tag", 330 330 + "repository": "apper", 331 331 + "tag": "latest", 332 332 + "manifestDigest": "sha256:xyz789" 333 333 + } 334 334 + } 335 335 + ] 336 336 + }`, 337 337 + wantTags: []string{"latest", "v1.0.0"}, 338 338 + }, 339 339 + { 340 340 + name: "no tags", 341 341 + serverResponse: `{ 342 342 + "records": [] 343 343 + }`, 344 344 + wantTags: []string{}, 345 345 + }, 346 346 + } 347 347 + 348 348 + for _, tt := range tests { 349 349 + t.Run(tt.name, func(t *testing.T) { 350 350 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 351 351 + // Verify query parameters 352 352 + query := r.URL.Query() 353 353 + if query.Get("collection") != TagCollection { 354 354 + t.Errorf("collection = %v, want %v", query.Get("collection"), TagCollection) 355 355 + } 356 356 + if query.Get("limit") != "100" { 357 357 + t.Errorf("limit = %v, want 100", query.Get("limit")) 358 358 + } 359 359 + 360 360 + w.WriteHeader(http.StatusOK) 361 361 + w.Write([]byte(tt.serverResponse)) 362 362 + })) 363 363 + defer server.Close() 364 364 + 365 365 + client := NewClient(server.URL, "did:plc:test123", "test-token") 366 366 + store := NewTagStore(client, "myapp") 367 367 + 368 368 + tags, err := store.All(context.Background()) 369 369 + if err != nil { 370 370 + t.Fatalf("All() error = %v", err) 371 371 + } 372 372 + 373 373 + // Sort both slices for comparison (order doesn't matter) 374 374 + if len(tags) != len(tt.wantTags) { 375 375 + t.Errorf("len(tags) = %v, want %v", len(tags), len(tt.wantTags)) 376 376 + } 377 377 + 378 378 + // Check that all expected tags are present 379 379 + tagMap := make(map[string]bool) 380 380 + for _, tag := range tags { 381 381 + tagMap[tag] = true 382 382 + } 383 383 + 384 384 + for _, wantTag := range tt.wantTags { 385 385 + if !tagMap[wantTag] { 386 386 + t.Errorf("Missing expected tag: %v", wantTag) 387 387 + } 388 388 + } 389 389 + }) 390 390 + } 391 391 + } 392 392 + 393 393 + // TestTagStore_All_SkipsInvalidRecords tests that invalid records are skipped 394 394 + func TestTagStore_All_SkipsInvalidRecords(t *testing.T) { 395 395 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 396 396 + response := `{ 397 397 + "records": [ 398 398 + { 399 399 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_latest", 400 400 + "value": { 401 401 + "$type": "io.atcr.tag", 402 402 + "repository": "myapp", 403 403 + "tag": "latest", 404 404 + "manifestDigest": "sha256:abc123" 405 405 + } 406 406 + }, 407 407 + { 408 408 + "uri": "at://did:plc:test123/io.atcr.tag/invalid", 409 409 + "value": "invalid-json-structure" 410 410 + }, 411 411 + { 412 412 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_v1.0.0", 413 413 + "value": { 414 414 + "$type": "io.atcr.tag", 415 415 + "repository": "myapp", 416 416 + "tag": "v1.0.0", 417 417 + "manifestDigest": "sha256:def456" 418 418 + } 419 419 + } 420 420 + ] 421 421 + }` 422 422 + w.WriteHeader(http.StatusOK) 423 423 + w.Write([]byte(response)) 424 424 + })) 425 425 + defer server.Close() 426 426 + 427 427 + client := NewClient(server.URL, "did:plc:test123", "test-token") 428 428 + store := NewTagStore(client, "myapp") 429 429 + 430 430 + tags, err := store.All(context.Background()) 431 431 + if err != nil { 432 432 + t.Fatalf("All() error = %v", err) 433 433 + } 434 434 + 435 435 + // Should return 2 valid tags (invalid record skipped) 436 436 + if len(tags) != 2 { 437 437 + t.Errorf("len(tags) = %v, want 2 (invalid record should be skipped)", len(tags)) 438 438 + } 439 439 + } 440 440 + 441 441 + // TestTagStore_Lookup tests finding tags for a specific digest 442 442 + func TestTagStore_Lookup(t *testing.T) { 443 443 + targetDigest := "sha256:abc123" 444 444 + 445 445 + tests := []struct { 446 446 + name string 447 447 + digest digest.Digest 448 448 + serverResponse string 449 449 + wantTags []string 450 450 + }{ 451 451 + { 452 452 + name: "multiple tags point to same digest", 453 453 + digest: digest.Digest(targetDigest), 454 454 + serverResponse: `{ 455 455 + "records": [ 456 456 + { 457 457 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_latest", 458 458 + "value": { 459 459 + "$type": "io.atcr.tag", 460 460 + "repository": "myapp", 461 461 + "tag": "latest", 462 462 + "manifestDigest": "sha256:abc123" 463 463 + } 464 464 + }, 465 465 + { 466 466 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_v1.0.0", 467 467 + "value": { 468 468 + "$type": "io.atcr.tag", 469 469 + "repository": "myapp", 470 470 + "tag": "v1.0.0", 471 471 + "manifestDigest": "sha256:abc123" 472 472 + } 473 473 + }, 474 474 + { 475 475 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_old", 476 476 + "value": { 477 477 + "$type": "io.atcr.tag", 478 478 + "repository": "myapp", 479 479 + "tag": "old", 480 480 + "manifestDigest": "sha256:differentdigest" 481 481 + } 482 482 + } 483 483 + ] 484 484 + }`, 485 485 + wantTags: []string{"latest", "v1.0.0"}, 486 486 + }, 487 487 + { 488 488 + name: "no tags for digest", 489 489 + digest: "sha256:notfound", 490 490 + serverResponse: `{ 491 491 + "records": [ 492 492 + { 493 493 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_latest", 494 494 + "value": { 495 495 + "$type": "io.atcr.tag", 496 496 + "repository": "myapp", 497 497 + "tag": "latest", 498 498 + "manifestDigest": "sha256:different" 499 499 + } 500 500 + } 501 501 + ] 502 502 + }`, 503 503 + wantTags: []string{}, 504 504 + }, 505 505 + } 506 506 + 507 507 + for _, tt := range tests { 508 508 + t.Run(tt.name, func(t *testing.T) { 509 509 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 510 510 + w.WriteHeader(http.StatusOK) 511 511 + w.Write([]byte(tt.serverResponse)) 512 512 + })) 513 513 + defer server.Close() 514 514 + 515 515 + client := NewClient(server.URL, "did:plc:test123", "test-token") 516 516 + store := NewTagStore(client, "myapp") 517 517 + 518 518 + desc := distribution.Descriptor{ 519 519 + Digest: tt.digest, 520 520 + } 521 521 + 522 522 + tags, err := store.Lookup(context.Background(), desc) 523 523 + if err != nil { 524 524 + t.Fatalf("Lookup() error = %v", err) 525 525 + } 526 526 + 527 527 + if len(tags) != len(tt.wantTags) { 528 528 + t.Errorf("len(tags) = %v, want %v", len(tags), len(tt.wantTags)) 529 529 + } 530 530 + 531 531 + // Check that all expected tags are present 532 532 + tagMap := make(map[string]bool) 533 533 + for _, tag := range tags { 534 534 + tagMap[tag] = true 535 535 + } 536 536 + 537 537 + for _, wantTag := range tt.wantTags { 538 538 + if !tagMap[wantTag] { 539 539 + t.Errorf("Missing expected tag: %v", wantTag) 540 540 + } 541 541 + } 542 542 + }) 543 543 + } 544 544 + } 545 545 + 546 546 + // TestTagStore_Lookup_FiltersByRepository tests that Lookup only returns tags for the correct repository 547 547 + func TestTagStore_Lookup_FiltersByRepository(t *testing.T) { 548 548 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 549 549 + // Return tags from multiple repositories with same digest 550 550 + response := `{ 551 551 + "records": [ 552 552 + { 553 553 + "uri": "at://did:plc:test123/io.atcr.tag/myapp_latest", 554 554 + "value": { 555 555 + "$type": "io.atcr.tag", 556 556 + "repository": "myapp", 557 557 + "tag": "latest", 558 558 + "manifestDigest": "sha256:abc123" 559 559 + } 560 560 + }, 561 561 + { 562 562 + "uri": "at://did:plc:test123/io.atcr.tag/otherapp_latest", 563 563 + "value": { 564 564 + "$type": "io.atcr.tag", 565 565 + "repository": "otherapp", 566 566 + "tag": "latest", 567 567 + "manifestDigest": "sha256:abc123" 568 568 + } 569 569 + } 570 570 + ] 571 571 + }` 572 572 + w.WriteHeader(http.StatusOK) 573 573 + w.Write([]byte(response)) 574 574 + })) 575 575 + defer server.Close() 576 576 + 577 577 + client := NewClient(server.URL, "did:plc:test123", "test-token") 578 578 + store := NewTagStore(client, "myapp") // Looking for "myapp" tags only 579 579 + 580 580 + desc := distribution.Descriptor{ 581 581 + Digest: "sha256:abc123", 582 582 + } 583 583 + 584 584 + tags, err := store.Lookup(context.Background(), desc) 585 585 + if err != nil { 586 586 + t.Fatalf("Lookup() error = %v", err) 587 587 + } 588 588 + 589 589 + // Should only return "latest" from "myapp", not from "otherapp" 590 590 + if len(tags) != 1 { 591 591 + t.Errorf("len(tags) = %v, want 1 (should filter by repository)", len(tags)) 592 592 + } 593 593 + 594 594 + if len(tags) > 0 && tags[0] != "latest" { 595 595 + t.Errorf("tags[0] = %v, want latest", tags[0]) 596 596 + } 597 597 + } 598 598 + 599 599 + // TestTagStore_ListRecordsError tests error handling when ListRecords fails 600 600 + func TestTagStore_ListRecordsError(t *testing.T) { 601 601 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 602 602 + w.WriteHeader(http.StatusInternalServerError) 603 603 + w.Write([]byte(`{"error":"ServerError"}`)) 604 604 + })) 605 605 + defer server.Close() 606 606 + 607 607 + client := NewClient(server.URL, "did:plc:test123", "test-token") 608 608 + store := NewTagStore(client, "myapp") 609 609 + 610 610 + // Test All() 611 611 + _, err := store.All(context.Background()) 612 612 + if err == nil { 613 613 + t.Error("All() should return error when ListRecords fails") 614 614 + } 615 615 + 616 616 + // Test Lookup() 617 617 + desc := distribution.Descriptor{Digest: "sha256:abc123"} 618 618 + _, err = store.Lookup(context.Background(), desc) 619 619 + if err == nil { 620 620 + t.Error("Lookup() should return error when ListRecords fails") 621 621 + } 622 622 + } 623 623 + 624 624 + // TestTagStore_GetErrorTypes tests that Get returns correct error type 625 625 + func TestTagStore_GetErrorTypes(t *testing.T) { 626 626 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 627 627 + w.WriteHeader(http.StatusNotFound) 628 628 + })) 629 629 + defer server.Close() 630 630 + 631 631 + client := NewClient(server.URL, "did:plc:test123", "test-token") 632 632 + store := NewTagStore(client, "myapp") 633 633 + 634 634 + _, err := store.Get(context.Background(), "notfound") 635 635 + 636 636 + // Should return distribution.ErrTagUnknown 637 637 + if err == nil { 638 638 + t.Error("Get() should return error for non-existent tag") 639 639 + } 640 640 + 641 641 + // Check if it's the right error type 642 642 + if !strings.Contains(err.Error(), "unknown tag") && !strings.Contains(err.Error(), "TagUnknown") { 643 643 + t.Errorf("Get() should return ErrTagUnknown, got: %v", err) 644 644 + } 645 645 + }

+6

pkg/auth/oauth/client.go

reviewed

··· 124 124 return []string{ 125 125 "atproto", 126 126 "transition:generic", 127 127 + // Image manifest types (single-arch) 127 128 "blob:application/vnd.oci.image.manifest.v1+json", 128 129 "blob:application/vnd.docker.distribution.manifest.v2+json", 130 130 + // Manifest list/index types (multi-arch) 131 131 + "blob:application/vnd.oci.image.index.v1+json", 132 132 + "blob:application/vnd.docker.distribution.manifest.list.v2+json", 133 133 + // OCI artifact manifests (for cosign signatures, SBOMs, attestations) 134 134 + "blob:application/vnd.cncf.oras.artifact.manifest.v1+json", 129 135 fmt.Sprintf("rpc:com.atproto.repo.getRecord?aud=%s#atcr_hold", did), 130 136 fmt.Sprintf("repo:%s", atproto.ManifestCollection), 131 137 fmt.Sprintf("repo:%s", atproto.TagCollection),

+9 -9

pkg/hold/config_test.go

reviewed

··· 36 36 37 37 func TestLoadConfigFromEnv_Success(t *testing.T) { 38 38 cleanup := setupEnv(t, map[string]string{ 39 39 - "HOLD_PUBLIC_URL": "https://hold.example.com", 40 40 - "HOLD_SERVER_ADDR": ":9000", 41 41 - "HOLD_PUBLIC": "true", 42 42 - "TEST_MODE": "true", 43 43 - "HOLD_OWNER": "did:plc:owner123", 39 39 + "HOLD_PUBLIC_URL": "https://hold.example.com", 40 40 + "HOLD_SERVER_ADDR": ":9000", 41 41 + "HOLD_PUBLIC": "true", 42 42 + "TEST_MODE": "true", 43 43 + "HOLD_OWNER": "did:plc:owner123", 44 44 "HOLD_ALLOW_ALL_CREW": "true", 45 45 - "STORAGE_DRIVER": "filesystem", 46 46 - "STORAGE_ROOT_DIR": "/tmp/test-storage", 47 47 - "HOLD_DATABASE_DIR": "/tmp/test-db", 48 48 - "HOLD_KEY_PATH": "/tmp/test-key.pem", 45 45 + "STORAGE_DRIVER": "filesystem", 46 46 + "STORAGE_ROOT_DIR": "/tmp/test-storage", 47 47 + "HOLD_DATABASE_DIR": "/tmp/test-db", 48 48 + "HOLD_KEY_PATH": "/tmp/test-key.pem", 49 49 }) 50 50 defer cleanup() 51 51

+2 -1

pkg/hold/oci/multipart.go

reviewed

··· 11 11 "sync" 12 12 "time" 13 13 14 14 + "atcr.io/pkg/atproto" 14 15 "github.com/aws/aws-sdk-go/service/s3" 15 16 "github.com/google/uuid" 16 17 ) ··· 292 293 293 294 // Buffered mode: return XRPC endpoint with headers 294 295 return &PartUploadInfo{ 295 295 - URL: fmt.Sprintf("%s/xrpc/io.atcr.hold.uploadPart", h.pds.PublicURL), 296 296 + URL: fmt.Sprintf("%s%s", h.pds.PublicURL, atproto.HoldUploadPart), 296 297 Method: "PUT", 297 298 Headers: map[string]string{ 298 299 "X-Upload-Id": uploadID,

+6 -6

pkg/hold/oci/xrpc.go

reviewed

··· 6 6 "net/http" 7 7 "strconv" 8 8 9 9 + "atcr.io/pkg/atproto" 9 10 "atcr.io/pkg/hold/pds" 10 10 - 11 11 "atcr.io/pkg/s3" 12 12 storagedriver "github.com/distribution/distribution/v3/registry/storage/driver" 13 13 "github.com/go-chi/chi/v5" ··· 41 41 r.Group(func(r chi.Router) { 42 42 r.Use(h.requireBlobWriteAccess) 43 43 44 44 - r.Post("/xrpc/io.atcr.hold.initiateUpload", h.HandleInitiateUpload) 45 45 - r.Post("/xrpc/io.atcr.hold.getPartUploadUrl", h.HandleGetPartUploadUrl) 46 46 - r.Put("/xrpc/io.atcr.hold.uploadPart", h.HandleUploadPart) 47 47 - r.Post("/xrpc/io.atcr.hold.completeUpload", h.HandleCompleteUpload) 48 48 - r.Post("/xrpc/io.atcr.hold.abortUpload", h.HandleAbortUpload) 44 44 + r.Post(atproto.HoldInitiateUpload, h.HandleInitiateUpload) 45 45 + r.Post(atproto.HoldGetPartUploadUrl, h.HandleGetPartUploadUrl) 46 46 + r.Put(atproto.HoldUploadPart, h.HandleUploadPart) 47 47 + r.Post(atproto.HoldCompleteUpload, h.HandleCompleteUpload) 48 48 + r.Post(atproto.HoldAbortUpload, h.HandleAbortUpload) 49 49 }) 50 50 } 51 51