A container registry that uses the AT Protocol for manifest storage and S3 for blob storage.
atcr.io
docker
container
atproto
go
refactor how annotations are stored. add ability to create bsky profile for hold user
+1080
-693
+9
-2
cmd/hold/main.go
+9
-2
cmd/hold/main.go
···
43
43
log.Fatalf("Failed to initialize embedded PDS: %v", err)
44
44
}
45
45
46
-
// Bootstrap PDS with captain record and hold owner as first crew member
47
-
if err := holdPDS.Bootstrap(ctx, cfg.Registration.OwnerDID, cfg.Server.Public, cfg.Registration.AllowAllCrew); err != nil {
46
+
// Create storage driver from config (needed for bootstrap profile avatar)
47
+
driver, err := factory.Create(ctx, cfg.Storage.Type(), cfg.Storage.Parameters())
48
+
if err != nil {
49
+
log.Fatalf("failed to create storage driver: %v", err)
50
+
return
51
+
}
52
+
53
+
// Bootstrap PDS with captain record, hold owner as first crew member, and profile
54
+
if err := holdPDS.Bootstrap(ctx, driver, cfg.Registration.OwnerDID, cfg.Server.Public, cfg.Registration.AllowAllCrew, cfg.Registration.ProfileAvatarURL); err != nil {
48
55
log.Fatalf("Failed to bootstrap PDS: %v", err)
49
56
}
50
57
+1
-127
docs/ANNOTATIONS_REFACTOR.md
+1
-127
docs/ANNOTATIONS_REFACTOR.md
···
61
61
62
62
## Migration Strategy
63
63
64
-
### Migration File: `0004_refactor_annotations_table.yaml`
65
-
66
-
```yaml
67
-
description: Migrate manifest annotations to separate table
68
-
query: |
69
-
-- Step 1: Create new annotations table
70
-
CREATE TABLE IF NOT EXISTS repository_annotations (
71
-
did TEXT NOT NULL,
72
-
repository TEXT NOT NULL,
73
-
key TEXT NOT NULL,
74
-
value TEXT NOT NULL,
75
-
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
76
-
PRIMARY KEY(did, repository, key),
77
-
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
78
-
);
79
-
CREATE INDEX IF NOT EXISTS idx_repository_annotations_did_repo ON repository_annotations(did, repository);
80
-
CREATE INDEX IF NOT EXISTS idx_repository_annotations_key ON repository_annotations(key);
81
-
82
-
-- Step 2: Migrate existing data from manifests to annotations
83
-
-- For each repository, use the most recent manifest with non-empty data
84
-
INSERT OR REPLACE INTO repository_annotations (did, repository, key, value, updated_at)
85
-
SELECT
86
-
m.did,
87
-
m.repository,
88
-
'org.opencontainers.image.title' as key,
89
-
m.title as value,
90
-
m.created_at as updated_at
91
-
FROM manifests m
92
-
WHERE m.title IS NOT NULL AND m.title != ''
93
-
AND m.created_at = (
94
-
SELECT MAX(created_at) FROM manifests m2
95
-
WHERE m2.did = m.did AND m2.repository = m.repository
96
-
AND m2.title IS NOT NULL AND m2.title != ''
97
-
);
98
-
99
-
INSERT OR REPLACE INTO repository_annotations (did, repository, key, value, updated_at)
100
-
SELECT m.did, m.repository, 'org.opencontainers.image.description', m.description, m.created_at
101
-
FROM manifests m
102
-
WHERE m.description IS NOT NULL AND m.description != ''
103
-
AND m.created_at = (
104
-
SELECT MAX(created_at) FROM manifests m2
105
-
WHERE m2.did = m.did AND m2.repository = m.repository
106
-
AND m2.description IS NOT NULL AND m2.description != ''
107
-
);
108
-
109
-
INSERT OR REPLACE INTO repository_annotations (did, repository, key, value, updated_at)
110
-
SELECT m.did, m.repository, 'org.opencontainers.image.source', m.source_url, m.created_at
111
-
FROM manifests m
112
-
WHERE m.source_url IS NOT NULL AND m.source_url != ''
113
-
AND m.created_at = (
114
-
SELECT MAX(created_at) FROM manifests m2
115
-
WHERE m2.did = m.did AND m2.repository = m.repository
116
-
AND m2.source_url IS NOT NULL AND m2.source_url != ''
117
-
);
118
-
119
-
INSERT OR REPLACE INTO repository_annotations (did, repository, key, value, updated_at)
120
-
SELECT m.did, m.repository, 'org.opencontainers.image.documentation', m.documentation_url, m.created_at
121
-
FROM manifests m
122
-
WHERE m.documentation_url IS NOT NULL AND m.documentation_url != ''
123
-
AND m.created_at = (
124
-
SELECT MAX(created_at) FROM manifests m2
125
-
WHERE m2.did = m.did AND m2.repository = m.repository
126
-
AND m2.documentation_url IS NOT NULL AND m2.documentation_url != ''
127
-
);
128
-
129
-
INSERT OR REPLACE INTO repository_annotations (did, repository, key, value, updated_at)
130
-
SELECT m.did, m.repository, 'org.opencontainers.image.licenses', m.licenses, m.created_at
131
-
FROM manifests m
132
-
WHERE m.licenses IS NOT NULL AND m.licenses != ''
133
-
AND m.created_at = (
134
-
SELECT MAX(created_at) FROM manifests m2
135
-
WHERE m2.did = m.did AND m2.repository = m.repository
136
-
AND m2.licenses IS NOT NULL AND m2.licenses != ''
137
-
);
138
-
139
-
INSERT OR REPLACE INTO repository_annotations (did, repository, key, value, updated_at)
140
-
SELECT m.did, m.repository, 'io.atcr.icon', m.icon_url, m.created_at
141
-
FROM manifests m
142
-
WHERE m.icon_url IS NOT NULL AND m.icon_url != ''
143
-
AND m.created_at = (
144
-
SELECT MAX(created_at) FROM manifests m2
145
-
WHERE m2.did = m.did AND m2.repository = m.repository
146
-
AND m2.icon_url IS NOT NULL AND m2.icon_url != ''
147
-
);
148
-
149
-
INSERT OR REPLACE INTO repository_annotations (did, repository, key, value, updated_at)
150
-
SELECT m.did, m.repository, 'io.atcr.readme', m.readme_url, m.created_at
151
-
FROM manifests m
152
-
WHERE m.readme_url IS NOT NULL AND m.readme_url != ''
153
-
AND m.created_at = (
154
-
SELECT MAX(created_at) FROM manifests m2
155
-
WHERE m2.did = m.did AND m2.repository = m.repository
156
-
AND m2.readme_url IS NOT NULL AND m2.readme_url != ''
157
-
);
158
-
159
-
-- Step 3: Drop old columns from manifests table
160
-
-- SQLite requires recreating table to drop columns
161
-
CREATE TABLE manifests_new (
162
-
id INTEGER PRIMARY KEY AUTOINCREMENT,
163
-
did TEXT NOT NULL,
164
-
repository TEXT NOT NULL,
165
-
digest TEXT NOT NULL,
166
-
hold_endpoint TEXT NOT NULL,
167
-
schema_version INTEGER NOT NULL,
168
-
media_type TEXT NOT NULL,
169
-
config_digest TEXT,
170
-
config_size INTEGER,
171
-
created_at TIMESTAMP NOT NULL,
172
-
UNIQUE(did, repository, digest),
173
-
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
174
-
);
175
-
176
-
-- Copy data to new table
177
-
INSERT INTO manifests_new
178
-
SELECT id, did, repository, digest, hold_endpoint, schema_version, media_type,
179
-
config_digest, config_size, created_at
180
-
FROM manifests;
181
-
182
-
-- Replace old table
183
-
DROP TABLE manifests;
184
-
ALTER TABLE manifests_new RENAME TO manifests;
185
-
186
-
-- Recreate indexes
187
-
CREATE INDEX IF NOT EXISTS idx_manifests_did_repo ON manifests(did, repository);
188
-
CREATE INDEX IF NOT EXISTS idx_manifests_created_at ON manifests(created_at DESC);
189
-
CREATE INDEX IF NOT EXISTS idx_manifests_digest ON manifests(digest);
190
-
```
64
+
There is no need to migrate data to this new table via sql. on startup, backfill will re-populate the new table with existing annotations.
191
65
192
66
## Code Changes
193
67
+218
docs/HOLD_ENDPOINT_TESTS.md
+218
docs/HOLD_ENDPOINT_TESTS.md
···
1
+
# Hold Service Endpoint Testing Guide
2
+
3
+
## Quick Reference
4
+
5
+
Your hold service: `http://172.28.0.3:8080`
6
+
7
+
Default DID format for local testing: `did:web:172.28.0.3%3A8080` (URL-encoded `did:web:172.28.0.3:8080`)
8
+
9
+
## Individual cURL Commands
10
+
11
+
### 1. List Repositories
12
+
```bash
13
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.sync.listRepos" | jq .
14
+
```
15
+
16
+
**Expected response:**
17
+
```json
18
+
{
19
+
"repos": [
20
+
{
21
+
"did": "did:web:172.28.0.3%3A8080",
22
+
"head": "...",
23
+
"rev": "..."
24
+
}
25
+
]
26
+
}
27
+
```
28
+
29
+
### 2. Describe Repository
30
+
```bash
31
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.repo.describeRepo?repo=did:web:172.28.0.3%3A8080" | jq .
32
+
```
33
+
34
+
**Expected response:**
35
+
```json
36
+
{
37
+
"did": "did:web:172.28.0.3%3A8080",
38
+
"handle": "172.28.0.3:8080",
39
+
"didDoc": {...},
40
+
"collections": ["io.atcr.hold.captain", "io.atcr.hold.crew"]
41
+
}
42
+
```
43
+
44
+
### 3. Get Repository (CAR file)
45
+
```bash
46
+
# Download entire repo as CAR file
47
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.sync.getRepo?did=did:web:172.28.0.3%3A8080" -o repo.car
48
+
49
+
# Get repo diff since revision
50
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.sync.getRepo?did=did:web:172.28.0.3%3A8080&since=abc123" -o repo-diff.car
51
+
```
52
+
53
+
**Expected response:** Binary CAR (Content Addressable aRchive) file
54
+
55
+
### 4. List Captain Records
56
+
```bash
57
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.repo.listRecords?repo=did:web:172.28.0.3%3A8080&collection=io.atcr.hold.captain" | jq .
58
+
```
59
+
60
+
**Expected response:**
61
+
```json
62
+
{
63
+
"records": [
64
+
{
65
+
"uri": "at://did:web:172.28.0.3%3A8080/io.atcr.hold.captain/self",
66
+
"cid": "...",
67
+
"value": {
68
+
"$type": "io.atcr.hold.captain",
69
+
"allowAllCrew": true,
70
+
"public": false,
71
+
"createdAt": "2025-10-22T..."
72
+
}
73
+
}
74
+
]
75
+
}
76
+
```
77
+
78
+
### 5. List Crew Records
79
+
```bash
80
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.repo.listRecords?repo=did:web:172.28.0.3%3A8080&collection=io.atcr.hold.crew" | jq .
81
+
```
82
+
83
+
**Expected response:**
84
+
```json
85
+
{
86
+
"records": [
87
+
{
88
+
"uri": "at://did:web:172.28.0.3%3A8080/io.atcr.hold.crew/{rkey}",
89
+
"cid": "...",
90
+
"value": {
91
+
"$type": "io.atcr.hold.crew",
92
+
"did": "did:plc:...",
93
+
"permissions": ["blob:read", "blob:write"],
94
+
"createdAt": "2025-10-22T..."
95
+
}
96
+
}
97
+
]
98
+
}
99
+
```
100
+
101
+
### 6. Get Specific Record
102
+
```bash
103
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.repo.getRecord?repo=did:web:172.28.0.3%3A8080&collection=io.atcr.hold.captain&rkey=self" | jq .
104
+
```
105
+
106
+
### 7. Get Blob
107
+
```bash
108
+
# Replace with actual CID from your hold
109
+
curl -s "http://172.28.0.3:8080/xrpc/com.atproto.sync.getBlob?did=did:web:172.28.0.3%3A8080&cid=bafyreiabc123..." | jq .
110
+
```
111
+
112
+
**Expected response (for OCI blobs):**
113
+
```json
114
+
{
115
+
"url": "https://s3.amazonaws.com/bucket/path?presigned-params...",
116
+
"expiresAt": "2025-10-22T12:15:00Z"
117
+
}
118
+
```
119
+
120
+
### 8. Subscribe to Repository Events (WebSocket)
121
+
122
+
Using **websocat** (recommended):
123
+
```bash
124
+
# Install: cargo install websocat
125
+
websocat "ws://172.28.0.3:8080/xrpc/com.atproto.sync.subscribeRepos"
126
+
```
127
+
128
+
Using **wscat**:
129
+
```bash
130
+
# Install: npm install -g wscat
131
+
wscat -c "ws://172.28.0.3:8080/xrpc/com.atproto.sync.subscribeRepos"
132
+
```
133
+
134
+
Using **curl** (HTTP upgrade - may not work with all servers):
135
+
```bash
136
+
curl -i -N \
137
+
-H "Connection: Upgrade" \
138
+
-H "Upgrade: websocket" \
139
+
-H "Sec-WebSocket-Version: 13" \
140
+
-H "Sec-WebSocket-Key: $(echo -n "test" | base64)" \
141
+
"http://172.28.0.3:8080/xrpc/com.atproto.sync.subscribeRepos"
142
+
```
143
+
144
+
**Expected response:** Stream of CBOR-encoded events (commits, identities, handles, etc.)
145
+
146
+
## DID Resolution
147
+
148
+
### Get DID Document
149
+
```bash
150
+
curl -s "http://172.28.0.3:8080/.well-known/did.json" | jq .
151
+
```
152
+
153
+
**Expected response:**
154
+
```json
155
+
{
156
+
"@context": ["https://www.w3.org/ns/did/v1"],
157
+
"id": "did:web:172.28.0.3%3A8080",
158
+
"service": [
159
+
{
160
+
"id": "#atproto_pds",
161
+
"type": "AtprotoPersonalDataServer",
162
+
"serviceEndpoint": "http://172.28.0.3:8080"
163
+
}
164
+
]
165
+
}
166
+
```
167
+
168
+
### Get DID from Handle
169
+
```bash
170
+
curl -s "http://172.28.0.3:8080/.well-known/atproto-did"
171
+
```
172
+
173
+
**Expected response:** Plain text DID
174
+
```
175
+
did:web:172.28.0.3%3A8080
176
+
```
177
+
178
+
## Running the Test Script
179
+
180
+
```bash
181
+
# Default (uses 172.28.0.3:8080)
182
+
./test-hold-endpoints.sh
183
+
184
+
# Custom hold URL
185
+
./test-hold-endpoints.sh "http://localhost:8080"
186
+
187
+
# Custom hold URL and DID
188
+
./test-hold-endpoints.sh "http://localhost:8080" "did:web:localhost%3A8080"
189
+
```
190
+
191
+
## Troubleshooting
192
+
193
+
### "Connection refused"
194
+
- Ensure hold service is running: `docker ps` or check process
195
+
- Verify IP address: `docker inspect <container> | grep IPAddress`
196
+
197
+
### "Empty response" or "404 Not Found"
198
+
- Check hold service logs for errors
199
+
- Verify DID format (use URL-encoded version with `%3A` for `:`)
200
+
- Ensure hold has been initialized (should have captain record)
201
+
202
+
### WebSocket connection fails
203
+
- Install websocat: `cargo install websocat`
204
+
- Or install wscat: `npm install -g wscat`
205
+
- WebSocket endpoints only work with proper WS clients, not regular curl
206
+
207
+
### "No records found"
208
+
- Captain record created on hold startup if `HOLD_OWNER` is set
209
+
- Crew records created when users call `io.atcr.hold.requestCrew`
210
+
- Blobs only exist after pushing container images
211
+
212
+
## Next Steps
213
+
214
+
After verifying these endpoints work:
215
+
1. Test OCI upload endpoints (requires authentication)
216
+
2. Push a real container image to create blob data
217
+
3. Test blob retrieval with real CIDs
218
+
4. Monitor WebSocket events during pushes
+78
pkg/appview/db/annotations.go
+78
pkg/appview/db/annotations.go
···
1
+
package db
2
+
3
+
import (
4
+
"database/sql"
5
+
"time"
6
+
)
7
+
8
+
// GetRepositoryAnnotations retrieves all annotations for a repository
9
+
func GetRepositoryAnnotations(db *sql.DB, did, repository string) (map[string]string, error) {
10
+
rows, err := db.Query(`
11
+
SELECT key, value
12
+
FROM repository_annotations
13
+
WHERE did = ? AND repository = ?
14
+
`, did, repository)
15
+
if err != nil {
16
+
return nil, err
17
+
}
18
+
defer rows.Close()
19
+
20
+
annotations := make(map[string]string)
21
+
for rows.Next() {
22
+
var key, value string
23
+
if err := rows.Scan(&key, &value); err != nil {
24
+
return nil, err
25
+
}
26
+
annotations[key] = value
27
+
}
28
+
29
+
return annotations, rows.Err()
30
+
}
31
+
32
+
// UpsertRepositoryAnnotations replaces all annotations for a repository
33
+
// Only called when manifest has at least one non-empty annotation
34
+
func UpsertRepositoryAnnotations(db *sql.DB, did, repository string, annotations map[string]string) error {
35
+
tx, err := db.Begin()
36
+
if err != nil {
37
+
return err
38
+
}
39
+
defer tx.Rollback()
40
+
41
+
// Delete existing annotations
42
+
_, err = tx.Exec(`
43
+
DELETE FROM repository_annotations
44
+
WHERE did = ? AND repository = ?
45
+
`, did, repository)
46
+
if err != nil {
47
+
return err
48
+
}
49
+
50
+
// Insert new annotations
51
+
stmt, err := tx.Prepare(`
52
+
INSERT INTO repository_annotations (did, repository, key, value, updated_at)
53
+
VALUES (?, ?, ?, ?, ?)
54
+
`)
55
+
if err != nil {
56
+
return err
57
+
}
58
+
defer stmt.Close()
59
+
60
+
now := time.Now()
61
+
for key, value := range annotations {
62
+
_, err = stmt.Exec(did, repository, key, value, now)
63
+
if err != nil {
64
+
return err
65
+
}
66
+
}
67
+
68
+
return tx.Commit()
69
+
}
70
+
71
+
// DeleteRepositoryAnnotations removes all annotations for a repository
72
+
func DeleteRepositoryAnnotations(db *sql.DB, did, repository string) error {
73
+
_, err := db.Exec(`
74
+
DELETE FROM repository_annotations
75
+
WHERE did = ? AND repository = ?
76
+
`, did, repository)
77
+
return err
78
+
}
+6
-45
pkg/appview/db/migrations/0003_add_readme_url_to_manifests.yaml
+6
-45
pkg/appview/db/migrations/0003_add_readme_url_to_manifests.yaml
···
1
-
description: Add readme_url column to manifests table (idempotent - handles both fresh and existing databases)
1
+
description: Add readme_url to manifests (obsolete - kept for migration history)
2
2
query: |
3
-
-- Idempotent migration: adds readme_url column if it doesn't exist
4
-
-- Works for both fresh installs (where schema.sql created it) and existing databases
5
-
6
-
-- Create temp table with new schema
7
-
CREATE TABLE manifests_temp (
8
-
id INTEGER PRIMARY KEY AUTOINCREMENT,
9
-
did TEXT NOT NULL,
10
-
repository TEXT NOT NULL,
11
-
digest TEXT NOT NULL,
12
-
hold_endpoint TEXT NOT NULL,
13
-
schema_version INTEGER NOT NULL,
14
-
media_type TEXT NOT NULL,
15
-
config_digest TEXT,
16
-
config_size INTEGER,
17
-
created_at TIMESTAMP NOT NULL,
18
-
title TEXT,
19
-
description TEXT,
20
-
source_url TEXT,
21
-
documentation_url TEXT,
22
-
licenses TEXT,
23
-
icon_url TEXT,
24
-
readme_url TEXT,
25
-
UNIQUE(did, repository, digest),
26
-
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
27
-
);
28
-
29
-
-- Copy data from existing manifests table
30
-
-- Use INSERT OR IGNORE to handle case where table is already correct
31
-
INSERT OR IGNORE INTO manifests_temp
32
-
SELECT id, did, repository, digest, hold_endpoint, schema_version, media_type,
33
-
config_digest, config_size, created_at, title, description, source_url,
34
-
documentation_url, licenses, icon_url,
35
-
NULL as readme_url -- Will be NULL for existing data
36
-
FROM manifests;
37
-
38
-
-- Only proceed with table swap if we actually copied data
39
-
-- (manifests_temp will be empty if manifests table already has readme_url)
40
-
DROP TABLE IF EXISTS manifests;
41
-
ALTER TABLE manifests_temp RENAME TO manifests;
42
-
43
-
-- Recreate indexes
44
-
CREATE INDEX IF NOT EXISTS idx_manifests_did_repo ON manifests(did, repository);
45
-
CREATE INDEX IF NOT EXISTS idx_manifests_created_at ON manifests(created_at DESC);
46
-
CREATE INDEX IF NOT EXISTS idx_manifests_digest ON manifests(digest);
3
+
-- This migration is obsolete. The readme_url and other annotations
4
+
-- are now stored in the repository_annotations table (see schema.sql).
5
+
-- Backfill will populate annotation data from PDS records.
6
+
-- This migration is kept as a no-op to maintain migration history.
7
+
SELECT 1;
+35
pkg/appview/db/migrations/0004_remove_annotation_columns_from_manifests.yaml
+35
pkg/appview/db/migrations/0004_remove_annotation_columns_from_manifests.yaml
···
1
+
description: Remove annotation columns from manifests table
2
+
query: |
3
+
-- Drop annotation columns from manifests table (if they exist)
4
+
-- Annotations are now stored in repository_annotations table
5
+
-- SQLite doesn't support DROP COLUMN IF EXISTS, so we recreate the table
6
+
7
+
-- Create new manifests table without annotation columns
8
+
CREATE TABLE IF NOT EXISTS manifests_new (
9
+
id INTEGER PRIMARY KEY AUTOINCREMENT,
10
+
did TEXT NOT NULL,
11
+
repository TEXT NOT NULL,
12
+
digest TEXT NOT NULL,
13
+
hold_endpoint TEXT NOT NULL,
14
+
schema_version INTEGER NOT NULL,
15
+
media_type TEXT NOT NULL,
16
+
config_digest TEXT,
17
+
config_size INTEGER,
18
+
created_at TIMESTAMP NOT NULL,
19
+
UNIQUE(did, repository, digest),
20
+
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
21
+
);
22
+
23
+
-- Copy data (only core fields, annotation columns are dropped)
24
+
INSERT INTO manifests_new (id, did, repository, digest, hold_endpoint, schema_version, media_type, config_digest, config_size, created_at)
25
+
SELECT id, did, repository, digest, hold_endpoint, schema_version, media_type, config_digest, config_size, created_at
26
+
FROM manifests;
27
+
28
+
-- Swap tables
29
+
DROP TABLE manifests;
30
+
ALTER TABLE manifests_new RENAME TO manifests;
31
+
32
+
-- Recreate indexes
33
+
CREATE INDEX IF NOT EXISTS idx_manifests_did_repo ON manifests(did, repository);
34
+
CREATE INDEX IF NOT EXISTS idx_manifests_created_at ON manifests(created_at DESC);
35
+
CREATE INDEX IF NOT EXISTS idx_manifests_digest ON manifests(digest);
+12
-21
pkg/appview/db/models.go
+12
-21
pkg/appview/db/models.go
···
13
13
14
14
// Manifest represents an OCI manifest stored in the cache
15
15
type Manifest struct {
16
-
ID int64
17
-
DID string
18
-
Repository string
19
-
Digest string
20
-
HoldEndpoint string
21
-
SchemaVersion int
22
-
MediaType string
23
-
ConfigDigest string
24
-
ConfigSize int64
25
-
CreatedAt time.Time
26
-
Title string
27
-
Description string
28
-
SourceURL string
29
-
DocumentationURL string
30
-
Licenses string
31
-
IconURL string
32
-
ReadmeURL string
33
-
PlatformOS string // UNUSED: Reserved for future use, always NULL
34
-
PlatformArchitecture string // UNUSED: Reserved for future use, always NULL
35
-
PlatformVariant string // UNUSED: Reserved for future use, always NULL
36
-
PlatformOSVersion string // UNUSED: Reserved for future use, always NULL
16
+
ID int64
17
+
DID string
18
+
Repository string
19
+
Digest string
20
+
HoldEndpoint string
21
+
SchemaVersion int
22
+
MediaType string
23
+
ConfigDigest string
24
+
ConfigSize int64
25
+
CreatedAt time.Time
26
+
// Annotations removed - now stored in repository_annotations table
37
27
}
38
28
39
29
// Layer represents a layer in a manifest
···
100
90
Licenses string
101
91
IconURL string
102
92
ReadmeURL string
93
+
Version string
103
94
}
104
95
105
96
// RepositoryStats represents statistics for a repository
+72
-258
pkg/appview/db/queries.go
+72
-258
pkg/appview/db/queries.go
···
39
39
t.repository,
40
40
t.tag,
41
41
t.digest,
42
-
COALESCE(m.title, ''),
43
-
COALESCE(m.description, ''),
44
-
COALESCE(m.icon_url, ''),
42
+
COALESCE((SELECT value FROM repository_annotations WHERE did = u.did AND repository = t.repository AND key = 'org.opencontainers.image.title'), ''),
43
+
COALESCE((SELECT value FROM repository_annotations WHERE did = u.did AND repository = t.repository AND key = 'org.opencontainers.image.description'), ''),
44
+
COALESCE((SELECT value FROM repository_annotations WHERE did = u.did AND repository = t.repository AND key = 'io.atcr.icon'), ''),
45
45
COALESCE(rs.pull_count, 0),
46
46
COALESCE((SELECT COUNT(*) FROM stars WHERE owner_did = u.did AND repository = t.repository), 0),
47
47
t.created_at,
···
94
94
return pushes, total, nil
95
95
}
96
96
97
-
// SearchPushes searches for pushes matching the query across handles, DIDs, repositories, and manifest annotations
97
+
// SearchPushes searches for pushes matching the query across handles, DIDs, repositories, and annotations
98
98
func SearchPushes(db *sql.DB, query string, limit, offset int) ([]Push, int, error) {
99
99
// Escape LIKE wildcards so they're treated literally
100
100
query = escapeLikePattern(query)
···
109
109
t.repository,
110
110
t.tag,
111
111
t.digest,
112
-
COALESCE(m.title, ''),
113
-
COALESCE(m.description, ''),
114
-
COALESCE(m.icon_url, ''),
112
+
COALESCE((SELECT value FROM repository_annotations WHERE did = u.did AND repository = t.repository AND key = 'org.opencontainers.image.title'), ''),
113
+
COALESCE((SELECT value FROM repository_annotations WHERE did = u.did AND repository = t.repository AND key = 'org.opencontainers.image.description'), ''),
114
+
COALESCE((SELECT value FROM repository_annotations WHERE did = u.did AND repository = t.repository AND key = 'io.atcr.icon'), ''),
115
115
COALESCE(rs.pull_count, 0),
116
116
COALESCE((SELECT COUNT(*) FROM stars WHERE owner_did = u.did AND repository = t.repository), 0),
117
117
t.created_at,
···
123
123
WHERE u.handle LIKE ? ESCAPE '\'
124
124
OR u.did = ?
125
125
OR t.repository LIKE ? ESCAPE '\'
126
-
OR m.title LIKE ? ESCAPE '\'
127
-
OR m.description LIKE ? ESCAPE '\'
126
+
OR EXISTS (
127
+
SELECT 1 FROM repository_annotations ra
128
+
WHERE ra.did = u.did AND ra.repository = t.repository
129
+
AND ra.value LIKE ? ESCAPE '\'
130
+
)
128
131
ORDER BY t.created_at DESC
129
132
LIMIT ? OFFSET ?
130
133
`
131
134
132
-
rows, err := db.Query(sqlQuery, searchPattern, query, searchPattern, searchPattern, searchPattern, limit, offset)
135
+
rows, err := db.Query(sqlQuery, searchPattern, query, searchPattern, searchPattern, limit, offset)
133
136
if err != nil {
134
137
return nil, 0, err
135
138
}
···
153
156
WHERE u.handle LIKE ? ESCAPE '\'
154
157
OR u.did = ?
155
158
OR t.repository LIKE ? ESCAPE '\'
156
-
OR m.title LIKE ? ESCAPE '\'
157
-
OR m.description LIKE ? ESCAPE '\'
159
+
OR EXISTS (
160
+
SELECT 1 FROM repository_annotations ra
161
+
WHERE ra.did = u.did AND ra.repository = t.repository
162
+
AND ra.value LIKE ? ESCAPE '\'
163
+
)
158
164
`
159
165
160
166
var total int
161
-
if err := db.QueryRow(countQuery, searchPattern, query, searchPattern, searchPattern, searchPattern).Scan(&total); err != nil {
167
+
if err := db.QueryRow(countQuery, searchPattern, query, searchPattern, searchPattern).Scan(&total); err != nil {
162
168
return nil, 0, err
163
169
}
164
170
···
242
248
// Get manifests for this repo
243
249
manifestRows, err := db.Query(`
244
250
SELECT id, digest, hold_endpoint, schema_version, media_type,
245
-
config_digest, config_size, created_at,
246
-
title, description, source_url, documentation_url, licenses, icon_url
251
+
config_digest, config_size, created_at
247
252
FROM manifests
248
253
WHERE did = ? AND repository = ?
249
254
ORDER BY created_at DESC
···
258
263
m.DID = did
259
264
m.Repository = r.Name
260
265
261
-
// Use sql.NullString for nullable annotation fields
262
-
var title, description, sourceURL, documentationURL, licenses, iconURL sql.NullString
263
-
264
266
if err := manifestRows.Scan(&m.ID, &m.Digest, &m.HoldEndpoint, &m.SchemaVersion,
265
-
&m.MediaType, &m.ConfigDigest, &m.ConfigSize, &m.CreatedAt,
266
-
&title, &description, &sourceURL, &documentationURL, &licenses, &iconURL); err != nil {
267
+
&m.MediaType, &m.ConfigDigest, &m.ConfigSize, &m.CreatedAt); err != nil {
267
268
manifestRows.Close()
268
269
return nil, err
269
270
}
270
271
271
-
// Convert NullString to string
272
-
if title.Valid {
273
-
m.Title = title.String
274
-
}
275
-
if description.Valid {
276
-
m.Description = description.String
277
-
}
278
-
if sourceURL.Valid {
279
-
m.SourceURL = sourceURL.String
280
-
}
281
-
if documentationURL.Valid {
282
-
m.DocumentationURL = documentationURL.String
283
-
}
284
-
if licenses.Valid {
285
-
m.Licenses = licenses.String
286
-
}
287
-
if iconURL.Valid {
288
-
m.IconURL = iconURL.String
289
-
}
290
-
291
272
r.Manifests = append(r.Manifests, m)
292
273
}
293
274
manifestRows.Close()
294
275
295
-
// Aggregate repository-level annotations from most recent manifest
296
-
if len(r.Manifests) > 0 {
297
-
latest := r.Manifests[0]
298
-
r.Title = latest.Title
299
-
r.Description = latest.Description
300
-
r.SourceURL = latest.SourceURL
301
-
r.DocumentationURL = latest.DocumentationURL
302
-
r.Licenses = latest.Licenses
303
-
r.IconURL = latest.IconURL
276
+
// Fetch repository-level annotations from annotations table
277
+
annotations, err := GetRepositoryAnnotations(db, did, r.Name)
278
+
if err != nil {
279
+
return nil, err
304
280
}
305
281
282
+
r.Title = annotations["org.opencontainers.image.title"]
283
+
r.Description = annotations["org.opencontainers.image.description"]
284
+
r.SourceURL = annotations["org.opencontainers.image.source"]
285
+
r.DocumentationURL = annotations["org.opencontainers.image.documentation"]
286
+
r.Licenses = annotations["org.opencontainers.image.licenses"]
287
+
r.IconURL = annotations["io.atcr.icon"]
288
+
r.ReadmeURL = annotations["io.atcr.readme"]
289
+
306
290
repos = append(repos, r)
307
291
}
308
292
309
293
return repos, nil
310
294
}
311
295
312
-
// GetRepositoryMetadata retrieves metadata for a repository from its most recent manifest
313
-
// Prioritizes manifests with non-empty metadata fields
314
-
func GetRepositoryMetadata(db *sql.DB, did string, repository string) (title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL string, err error) {
315
-
var titleNull, descriptionNull, sourceURLNull, documentationURLNull, licensesNull, iconURLNull, readmeURLNull sql.NullString
316
-
317
-
// Try to find a manifest with metadata first (prefer manifests with any non-empty annotation field)
318
-
err = db.QueryRow(`
319
-
SELECT title, description, source_url, documentation_url, licenses, icon_url, readme_url
320
-
FROM manifests
321
-
WHERE did = ? AND repository = ?
322
-
AND (
323
-
(title IS NOT NULL AND title != '')
324
-
OR (description IS NOT NULL AND description != '')
325
-
OR (source_url IS NOT NULL AND source_url != '')
326
-
OR (documentation_url IS NOT NULL AND documentation_url != '')
327
-
OR (licenses IS NOT NULL AND licenses != '')
328
-
OR (icon_url IS NOT NULL AND icon_url != '')
329
-
OR (readme_url IS NOT NULL AND readme_url != '')
330
-
)
331
-
ORDER BY created_at DESC
332
-
LIMIT 1
333
-
`, did, repository).Scan(&titleNull, &descriptionNull, &sourceURLNull, &documentationURLNull, &licensesNull, &iconURLNull, &readmeURLNull)
334
-
335
-
// If no manifest with metadata found, fall back to latest manifest (any type)
336
-
if err == sql.ErrNoRows {
337
-
err = db.QueryRow(`
338
-
SELECT title, description, source_url, documentation_url, licenses, icon_url, readme_url
339
-
FROM manifests
340
-
WHERE did = ? AND repository = ?
341
-
ORDER BY created_at DESC
342
-
LIMIT 1
343
-
`, did, repository).Scan(&titleNull, &descriptionNull, &sourceURLNull, &documentationURLNull, &licensesNull, &iconURLNull, &readmeURLNull)
344
-
}
345
-
346
-
if err == sql.ErrNoRows {
347
-
// No manifests found - return empty strings
348
-
return "", "", "", "", "", "", "", nil
349
-
}
350
-
if err != nil {
351
-
return "", "", "", "", "", "", "", err
352
-
}
353
-
354
-
// Convert NullString to string
355
-
if titleNull.Valid {
356
-
title = titleNull.String
357
-
}
358
-
if descriptionNull.Valid {
359
-
description = descriptionNull.String
360
-
}
361
-
if sourceURLNull.Valid {
362
-
sourceURL = sourceURLNull.String
363
-
}
364
-
if documentationURLNull.Valid {
365
-
documentationURL = documentationURLNull.String
366
-
}
367
-
if licensesNull.Valid {
368
-
licenses = licensesNull.String
369
-
}
370
-
if iconURLNull.Valid {
371
-
iconURL = iconURLNull.String
372
-
}
373
-
if readmeURLNull.Valid {
374
-
readmeURL = readmeURLNull.String
375
-
}
376
-
377
-
return title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL, nil
296
+
// GetRepositoryMetadata retrieves metadata for a repository from annotations table
297
+
// Returns a map of annotation key -> value for easy access in templates and handlers
298
+
func GetRepositoryMetadata(db *sql.DB, did string, repository string) (map[string]string, error) {
299
+
return GetRepositoryAnnotations(db, did, repository)
378
300
}
379
301
380
302
// GetUserByDID retrieves a user by DID
···
555
477
}
556
478
557
479
// InsertManifest inserts or updates a manifest record
558
-
// Uses UPSERT to update labels/annotations if manifest already exists
480
+
// Uses UPSERT to update core metadata if manifest already exists
559
481
// Returns the manifest ID (works correctly for both insert and update)
482
+
// Note: Annotations are stored separately in repository_annotations table
560
483
func InsertManifest(db *sql.DB, manifest *Manifest) (int64, error) {
561
484
_, err := db.Exec(`
562
485
INSERT INTO manifests
563
486
(did, repository, digest, hold_endpoint, schema_version, media_type,
564
-
config_digest, config_size, created_at,
565
-
title, description, source_url, documentation_url, licenses, icon_url, readme_url)
566
-
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
487
+
config_digest, config_size, created_at)
488
+
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
567
489
ON CONFLICT(did, repository, digest) DO UPDATE SET
568
490
hold_endpoint = excluded.hold_endpoint,
569
491
schema_version = excluded.schema_version,
570
492
media_type = excluded.media_type,
571
493
config_digest = excluded.config_digest,
572
-
config_size = excluded.config_size,
573
-
title = excluded.title,
574
-
description = excluded.description,
575
-
source_url = excluded.source_url,
576
-
documentation_url = excluded.documentation_url,
577
-
licenses = excluded.licenses,
578
-
icon_url = excluded.icon_url,
579
-
readme_url = excluded.readme_url
494
+
config_size = excluded.config_size
580
495
`, manifest.DID, manifest.Repository, manifest.Digest, manifest.HoldEndpoint,
581
496
manifest.SchemaVersion, manifest.MediaType, manifest.ConfigDigest,
582
-
manifest.ConfigSize, manifest.CreatedAt,
583
-
manifest.Title, manifest.Description, manifest.SourceURL,
584
-
manifest.DocumentationURL, manifest.Licenses, manifest.IconURL, manifest.ReadmeURL)
497
+
manifest.ConfigSize, manifest.CreatedAt)
585
498
586
499
if err != nil {
587
500
return 0, err
···
719
632
}
720
633
721
634
// GetManifest fetches a single manifest by digest
635
+
// Note: Annotations are stored separately in repository_annotations table
722
636
func GetManifest(db *sql.DB, digest string) (*Manifest, error) {
723
637
var m Manifest
724
-
725
-
// Use sql.NullString for nullable annotation fields
726
-
var title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL sql.NullString
727
638
728
639
err := db.QueryRow(`
729
640
SELECT id, did, repository, digest, hold_endpoint, schema_version,
730
-
media_type, config_digest, config_size, created_at,
731
-
title, description, source_url, documentation_url, licenses, icon_url, readme_url
641
+
media_type, config_digest, config_size, created_at
732
642
FROM manifests
733
643
WHERE digest = ?
734
644
`, digest).Scan(&m.ID, &m.DID, &m.Repository, &m.Digest, &m.HoldEndpoint,
735
645
&m.SchemaVersion, &m.MediaType, &m.ConfigDigest, &m.ConfigSize,
736
-
&m.CreatedAt,
737
-
&title, &description, &sourceURL, &documentationURL, &licenses, &iconURL, &readmeURL)
646
+
&m.CreatedAt)
738
647
739
648
if err != nil {
740
649
return nil, err
741
650
}
742
651
743
-
// Convert NullString to string
744
-
if title.Valid {
745
-
m.Title = title.String
746
-
}
747
-
if description.Valid {
748
-
m.Description = description.String
749
-
}
750
-
if sourceURL.Valid {
751
-
m.SourceURL = sourceURL.String
752
-
}
753
-
if documentationURL.Valid {
754
-
m.DocumentationURL = documentationURL.String
755
-
}
756
-
if licenses.Valid {
757
-
m.Licenses = licenses.String
758
-
}
759
-
if iconURL.Valid {
760
-
m.IconURL = iconURL.String
761
-
}
762
-
if readmeURL.Valid {
763
-
m.ReadmeURL = readmeURL.String
764
-
}
765
-
766
652
return &m, nil
767
653
}
768
654
···
855
741
856
742
// GetTopLevelManifests returns only manifest lists and orphaned single-arch manifests
857
743
// Filters out platform-specific manifests that are referenced by manifest lists
744
+
// Note: Annotations are stored separately in repository_annotations table - use GetRepositoryMetadata to fetch them
858
745
func GetTopLevelManifests(db *sql.DB, did, repository string, limit, offset int) ([]ManifestWithMetadata, error) {
859
746
rows, err := db.Query(`
860
747
WITH manifest_list_children AS (
···
866
753
)
867
754
SELECT
868
755
m.id, m.did, m.repository, m.digest, m.media_type,
869
-
m.schema_version, m.created_at, m.title, m.description,
870
-
m.source_url, m.documentation_url, m.licenses, m.icon_url,
756
+
m.schema_version, m.created_at,
871
757
m.config_digest, m.config_size, m.hold_endpoint,
872
758
GROUP_CONCAT(DISTINCT t.tag) as tags,
873
759
COUNT(DISTINCT mr.digest) as platform_count
···
895
781
var manifests []ManifestWithMetadata
896
782
for rows.Next() {
897
783
var m ManifestWithMetadata
898
-
var tags, title, description, sourceURL, documentationURL, licenses, iconURL, configDigest sql.NullString
784
+
var tags, configDigest sql.NullString
899
785
var configSize sql.NullInt64
900
786
901
787
if err := rows.Scan(
902
788
&m.ID, &m.DID, &m.Repository, &m.Digest, &m.MediaType,
903
-
&m.SchemaVersion, &m.CreatedAt, &title, &description,
904
-
&sourceURL, &documentationURL, &licenses, &iconURL,
789
+
&m.SchemaVersion, &m.CreatedAt,
905
790
&configDigest, &configSize, &m.HoldEndpoint,
906
791
&tags, &m.PlatformCount,
907
792
); err != nil {
···
909
794
}
910
795
911
796
// Set nullable fields
912
-
if title.Valid {
913
-
m.Title = title.String
914
-
}
915
-
if description.Valid {
916
-
m.Description = description.String
917
-
}
918
-
if sourceURL.Valid {
919
-
m.SourceURL = sourceURL.String
920
-
}
921
-
if documentationURL.Valid {
922
-
m.DocumentationURL = documentationURL.String
923
-
}
924
-
if licenses.Valid {
925
-
m.Licenses = licenses.String
926
-
}
927
-
if iconURL.Valid {
928
-
m.IconURL = iconURL.String
929
-
}
930
797
if configDigest.Valid {
931
798
m.ConfigDigest = configDigest.String
932
799
}
···
998
865
}
999
866
1000
867
// GetManifestDetail returns a manifest with full platform details and tags
868
+
// Note: Annotations are stored separately in repository_annotations table - use GetRepositoryMetadata to fetch them
1001
869
func GetManifestDetail(db *sql.DB, did, repository, digest string) (*ManifestWithMetadata, error) {
1002
870
// First, get the manifest and its tags
1003
871
var m ManifestWithMetadata
1004
-
var tags, title, description, sourceURL, documentationURL, licenses, iconURL, configDigest sql.NullString
872
+
var tags, configDigest sql.NullString
1005
873
var configSize sql.NullInt64
1006
874
1007
875
err := db.QueryRow(`
1008
876
SELECT
1009
877
m.id, m.did, m.repository, m.digest, m.media_type,
1010
-
m.schema_version, m.created_at, m.title, m.description,
1011
-
m.source_url, m.documentation_url, m.licenses, m.icon_url,
878
+
m.schema_version, m.created_at,
1012
879
m.config_digest, m.config_size, m.hold_endpoint,
1013
880
GROUP_CONCAT(DISTINCT t.tag) as tags
1014
881
FROM manifests m
···
1017
884
GROUP BY m.id
1018
885
`, did, repository, digest).Scan(
1019
886
&m.ID, &m.DID, &m.Repository, &m.Digest, &m.MediaType,
1020
-
&m.SchemaVersion, &m.CreatedAt, &title, &description,
1021
-
&sourceURL, &documentationURL, &licenses, &iconURL,
887
+
&m.SchemaVersion, &m.CreatedAt,
1022
888
&configDigest, &configSize, &m.HoldEndpoint,
1023
889
&tags,
1024
890
)
···
1031
897
}
1032
898
1033
899
// Set nullable fields
1034
-
if title.Valid {
1035
-
m.Title = title.String
1036
-
}
1037
-
if description.Valid {
1038
-
m.Description = description.String
1039
-
}
1040
-
if sourceURL.Valid {
1041
-
m.SourceURL = sourceURL.String
1042
-
}
1043
-
if documentationURL.Valid {
1044
-
m.DocumentationURL = documentationURL.String
1045
-
}
1046
-
if licenses.Valid {
1047
-
m.Licenses = licenses.String
1048
-
}
1049
-
if iconURL.Valid {
1050
-
m.IconURL = iconURL.String
1051
-
}
1052
900
if configDigest.Valid {
1053
901
m.ConfigDigest = configDigest.String
1054
902
}
···
1303
1151
// Get manifests for this repo
1304
1152
manifestRows, err := db.Query(`
1305
1153
SELECT id, digest, hold_endpoint, schema_version, media_type,
1306
-
config_digest, config_size, created_at,
1307
-
title, description, source_url, documentation_url, licenses, icon_url
1154
+
config_digest, config_size, created_at
1308
1155
FROM manifests
1309
1156
WHERE did = ? AND repository = ?
1310
1157
ORDER BY created_at DESC
···
1319
1166
m.DID = did
1320
1167
m.Repository = repository
1321
1168
1322
-
// Use sql.NullString for nullable annotation fields
1323
-
var title, description, sourceURL, documentationURL, licenses, iconURL sql.NullString
1324
-
1325
1169
if err := manifestRows.Scan(&m.ID, &m.Digest, &m.HoldEndpoint, &m.SchemaVersion,
1326
-
&m.MediaType, &m.ConfigDigest, &m.ConfigSize, &m.CreatedAt,
1327
-
&title, &description, &sourceURL, &documentationURL, &licenses, &iconURL); err != nil {
1170
+
&m.MediaType, &m.ConfigDigest, &m.ConfigSize, &m.CreatedAt); err != nil {
1328
1171
manifestRows.Close()
1329
1172
return nil, err
1330
-
}
1331
-
1332
-
// Convert NullString to string
1333
-
if title.Valid {
1334
-
m.Title = title.String
1335
-
}
1336
-
if description.Valid {
1337
-
m.Description = description.String
1338
-
}
1339
-
if sourceURL.Valid {
1340
-
m.SourceURL = sourceURL.String
1341
-
}
1342
-
if documentationURL.Valid {
1343
-
m.DocumentationURL = documentationURL.String
1344
-
}
1345
-
if licenses.Valid {
1346
-
m.Licenses = licenses.String
1347
-
}
1348
-
if iconURL.Valid {
1349
-
m.IconURL = iconURL.String
1350
1173
}
1351
1174
1352
1175
r.Manifests = append(r.Manifests, m)
1353
1176
}
1354
1177
manifestRows.Close()
1355
1178
1356
-
// Aggregate repository-level annotations from most recent manifest
1357
-
if len(r.Manifests) > 0 {
1358
-
latest := r.Manifests[0]
1359
-
r.Title = latest.Title
1360
-
r.Description = latest.Description
1361
-
r.SourceURL = latest.SourceURL
1362
-
r.DocumentationURL = latest.DocumentationURL
1363
-
r.Licenses = latest.Licenses
1364
-
r.IconURL = latest.IconURL
1179
+
// Fetch repository-level annotations from annotations table
1180
+
annotations, err := GetRepositoryAnnotations(db, did, repository)
1181
+
if err != nil {
1182
+
return nil, err
1365
1183
}
1184
+
1185
+
r.Title = annotations["org.opencontainers.image.title"]
1186
+
r.Description = annotations["org.opencontainers.image.description"]
1187
+
r.SourceURL = annotations["org.opencontainers.image.source"]
1188
+
r.DocumentationURL = annotations["org.opencontainers.image.documentation"]
1189
+
r.Licenses = annotations["org.opencontainers.image.licenses"]
1190
+
r.IconURL = annotations["io.atcr.icon"]
1191
+
r.ReadmeURL = annotations["io.atcr.readme"]
1366
1192
1367
1193
return &r, nil
1368
1194
}
···
1648
1474
m.did,
1649
1475
u.handle,
1650
1476
m.repository,
1651
-
m.title,
1652
-
m.description,
1653
-
m.icon_url,
1477
+
COALESCE((SELECT value FROM repository_annotations WHERE did = m.did AND repository = m.repository AND key = 'org.opencontainers.image.title'), ''),
1478
+
COALESCE((SELECT value FROM repository_annotations WHERE did = m.did AND repository = m.repository AND key = 'org.opencontainers.image.description'), ''),
1479
+
COALESCE((SELECT value FROM repository_annotations WHERE did = m.did AND repository = m.repository AND key = 'io.atcr.icon'), ''),
1654
1480
rs.pull_count,
1655
1481
rs.star_count
1656
1482
FROM latest_manifests lm
···
1670
1496
var featured []FeaturedRepository
1671
1497
for rows.Next() {
1672
1498
var f FeaturedRepository
1673
-
var title, description, iconURL sql.NullString
1674
1499
1675
1500
if err := rows.Scan(&f.OwnerDID, &f.OwnerHandle, &f.Repository,
1676
-
&title, &description, &iconURL, &f.PullCount, &f.StarCount); err != nil {
1501
+
&f.Title, &f.Description, &f.IconURL, &f.PullCount, &f.StarCount); err != nil {
1677
1502
return nil, err
1678
-
}
1679
-
1680
-
// Convert NullString to string
1681
-
if title.Valid {
1682
-
f.Title = title.String
1683
-
}
1684
-
if description.Valid {
1685
-
f.Description = description.String
1686
-
}
1687
-
if iconURL.Valid {
1688
-
f.IconURL = iconURL.String
1689
1503
}
1690
1504
1691
1505
featured = append(featured, f)
+156
-90
pkg/appview/db/queries_test.go
+156
-90
pkg/appview/db/queries_test.go
···
25
25
t.Fatalf("Failed to insert user: %v", err)
26
26
}
27
27
28
-
// Test 1: No manifests - should return empty strings
29
-
title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL, err := GetRepositoryMetadata(db, testUser.DID, "nonexistent")
28
+
// Test 1: No manifests - should return empty map
29
+
metadata, err := GetRepositoryMetadata(db, testUser.DID, "nonexistent")
30
30
if err != nil {
31
31
t.Fatalf("Expected no error for nonexistent repo, got: %v", err)
32
32
}
33
-
if title != "" || description != "" || sourceURL != "" || documentationURL != "" || licenses != "" || iconURL != "" || readmeURL != "" {
34
-
t.Error("Expected all empty strings for nonexistent repository")
33
+
if len(metadata) != 0 {
34
+
t.Errorf("Expected empty map for nonexistent repository, got %d entries", len(metadata))
35
35
}
36
36
37
-
// Test 2: Insert manifest with metadata
37
+
// Test 2: Insert manifest and annotations
38
38
_, err = db.Exec(`
39
-
INSERT INTO manifests (did, repository, digest, hold_endpoint, schema_version, media_type, created_at,
40
-
title, description, source_url, documentation_url, licenses, icon_url)
41
-
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
39
+
INSERT INTO manifests (did, repository, digest, hold_endpoint, schema_version, media_type, created_at)
40
+
VALUES (?, ?, ?, ?, ?, ?, ?)
42
41
`, testUser.DID, "myapp", "sha256:abc123", "did:web:hold.example.com", 2, "application/vnd.oci.image.manifest.v1+json",
43
-
time.Now().Add(-2*time.Hour),
44
-
"My App", "A cool application", "https://github.com/user/myapp", "https://docs.example.com", "MIT", "https://example.com/icon.png")
42
+
time.Now().Add(-2*time.Hour))
45
43
if err != nil {
46
44
t.Fatalf("Failed to insert manifest: %v", err)
45
+
}
46
+
47
+
// Insert annotations separately
48
+
err = UpsertRepositoryAnnotations(db, testUser.DID, "myapp", map[string]string{
49
+
"org.opencontainers.image.title": "My App",
50
+
"org.opencontainers.image.description": "A cool application",
51
+
"org.opencontainers.image.source": "https://github.com/user/myapp",
52
+
"org.opencontainers.image.documentation": "https://docs.example.com",
53
+
"org.opencontainers.image.licenses": "MIT",
54
+
"io.atcr.icon": "https://example.com/icon.png",
55
+
})
56
+
if err != nil {
57
+
t.Fatalf("Failed to insert annotations: %v", err)
47
58
}
48
59
49
60
// Test 3: Retrieve metadata
50
-
title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL, err = GetRepositoryMetadata(db, testUser.DID, "myapp")
61
+
metadata, err = GetRepositoryMetadata(db, testUser.DID, "myapp")
51
62
if err != nil {
52
63
t.Fatalf("Failed to get repository metadata: %v", err)
53
64
}
54
65
55
-
if title != "My App" {
56
-
t.Errorf("Expected title 'My App', got '%s'", title)
66
+
if metadata["org.opencontainers.image.title"] != "My App" {
67
+
t.Errorf("Expected title 'My App', got '%s'", metadata["org.opencontainers.image.title"])
57
68
}
58
-
if description != "A cool application" {
59
-
t.Errorf("Expected description 'A cool application', got '%s'", description)
69
+
if metadata["org.opencontainers.image.description"] != "A cool application" {
70
+
t.Errorf("Expected description 'A cool application', got '%s'", metadata["org.opencontainers.image.description"])
60
71
}
61
-
if sourceURL != "https://github.com/user/myapp" {
62
-
t.Errorf("Expected sourceURL 'https://github.com/user/myapp', got '%s'", sourceURL)
72
+
if metadata["org.opencontainers.image.source"] != "https://github.com/user/myapp" {
73
+
t.Errorf("Expected sourceURL 'https://github.com/user/myapp', got '%s'", metadata["org.opencontainers.image.source"])
63
74
}
64
-
if documentationURL != "https://docs.example.com" {
65
-
t.Errorf("Expected documentationURL 'https://docs.example.com', got '%s'", documentationURL)
75
+
if metadata["org.opencontainers.image.documentation"] != "https://docs.example.com" {
76
+
t.Errorf("Expected documentationURL 'https://docs.example.com', got '%s'", metadata["org.opencontainers.image.documentation"])
66
77
}
67
-
if licenses != "MIT" {
68
-
t.Errorf("Expected licenses 'MIT', got '%s'", licenses)
78
+
if metadata["org.opencontainers.image.licenses"] != "MIT" {
79
+
t.Errorf("Expected licenses 'MIT', got '%s'", metadata["org.opencontainers.image.licenses"])
69
80
}
70
-
if iconURL != "https://example.com/icon.png" {
71
-
t.Errorf("Expected iconURL 'https://example.com/icon.png', got '%s'", iconURL)
81
+
if metadata["io.atcr.icon"] != "https://example.com/icon.png" {
82
+
t.Errorf("Expected iconURL 'https://example.com/icon.png', got '%s'", metadata["io.atcr.icon"])
72
83
}
73
84
74
-
// Test 4: Insert newer manifest with different metadata
85
+
// Test 4: Insert newer manifest with different annotations
75
86
_, err = db.Exec(`
76
-
INSERT INTO manifests (did, repository, digest, hold_endpoint, schema_version, media_type, created_at,
77
-
title, description, source_url, documentation_url, licenses, icon_url)
78
-
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
87
+
INSERT INTO manifests (did, repository, digest, hold_endpoint, schema_version, media_type, created_at)
88
+
VALUES (?, ?, ?, ?, ?, ?, ?)
79
89
`, testUser.DID, "myapp", "sha256:def456", "did:web:hold.example.com", 2, "application/vnd.oci.image.manifest.v1+json",
80
-
time.Now(), // Most recent
81
-
"My App v2", "An even cooler application", "https://github.com/user/myapp-v2", "https://v2.docs.example.com", "Apache-2.0", "https://example.com/icon-v2.png")
90
+
time.Now()) // Most recent
82
91
if err != nil {
83
92
t.Fatalf("Failed to insert newer manifest: %v", err)
84
93
}
85
94
95
+
// Update annotations with new values (simulates latest manifest having different annotations)
96
+
err = UpsertRepositoryAnnotations(db, testUser.DID, "myapp", map[string]string{
97
+
"org.opencontainers.image.title": "My App v2",
98
+
"org.opencontainers.image.description": "An even cooler application",
99
+
"org.opencontainers.image.source": "https://github.com/user/myapp-v2",
100
+
"org.opencontainers.image.documentation": "https://v2.docs.example.com",
101
+
"org.opencontainers.image.licenses": "Apache-2.0",
102
+
"io.atcr.icon": "https://example.com/icon-v2.png",
103
+
})
104
+
if err != nil {
105
+
t.Fatalf("Failed to update annotations: %v", err)
106
+
}
107
+
86
108
// Test 5: Should return metadata from most recent manifest
87
-
title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL, err = GetRepositoryMetadata(db, testUser.DID, "myapp")
109
+
metadata, err = GetRepositoryMetadata(db, testUser.DID, "myapp")
88
110
if err != nil {
89
111
t.Fatalf("Failed to get repository metadata: %v", err)
90
112
}
91
113
92
-
if title != "My App v2" {
93
-
t.Errorf("Expected title from newest manifest 'My App v2', got '%s'", title)
114
+
if metadata["org.opencontainers.image.title"] != "My App v2" {
115
+
t.Errorf("Expected title from newest manifest 'My App v2', got '%s'", metadata["org.opencontainers.image.title"])
94
116
}
95
-
if description != "An even cooler application" {
96
-
t.Errorf("Expected description from newest manifest, got '%s'", description)
117
+
if metadata["org.opencontainers.image.description"] != "An even cooler application" {
118
+
t.Errorf("Expected description from newest manifest, got '%s'", metadata["org.opencontainers.image.description"])
97
119
}
98
-
if licenses != "Apache-2.0" {
99
-
t.Errorf("Expected licenses 'Apache-2.0', got '%s'", licenses)
120
+
if metadata["org.opencontainers.image.licenses"] != "Apache-2.0" {
121
+
t.Errorf("Expected licenses 'Apache-2.0', got '%s'", metadata["org.opencontainers.image.licenses"])
100
122
}
101
123
102
124
// Test 6: Manifest with NULL metadata fields
···
108
130
t.Fatalf("Failed to insert minimal manifest: %v", err)
109
131
}
110
132
111
-
// Test 7: Should handle NULL fields gracefully
112
-
title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL, err = GetRepositoryMetadata(db, testUser.DID, "minimal-app")
133
+
// Test 7: Should handle missing annotations gracefully
134
+
metadata, err = GetRepositoryMetadata(db, testUser.DID, "minimal-app")
113
135
if err != nil {
114
136
t.Fatalf("Failed to get repository metadata for minimal app: %v", err)
115
137
}
116
138
117
-
if title != "" || description != "" || sourceURL != "" || documentationURL != "" || licenses != "" || iconURL != "" || readmeURL != "" {
118
-
t.Error("Expected all empty strings for manifest with NULL metadata fields")
139
+
if len(metadata) != 0 {
140
+
t.Error("Expected empty map for manifest with no annotations")
119
141
}
120
142
}
121
143
···
139
161
t.Fatalf("Failed to insert user: %v", err)
140
162
}
141
163
142
-
// Test 1: Insert new manifest with all fields populated
164
+
// Test 1: Insert new manifest with core fields
143
165
manifest1 := &Manifest{
144
-
DID: testUser.DID,
145
-
Repository: "myapp",
146
-
Digest: "sha256:abc123",
147
-
HoldEndpoint: "did:web:hold.example.com",
148
-
SchemaVersion: 2,
149
-
MediaType: "application/vnd.oci.image.manifest.v1+json",
150
-
ConfigDigest: "sha256:config123",
151
-
ConfigSize: 1024,
152
-
CreatedAt: time.Now(),
153
-
Title: "My App",
154
-
Description: "A cool application",
155
-
SourceURL: "https://github.com/user/myapp",
156
-
DocumentationURL: "https://docs.example.com",
157
-
Licenses: "MIT",
158
-
IconURL: "https://example.com/icon.png",
159
-
ReadmeURL: "https://github.com/user/myapp/blob/main/README.md",
166
+
DID: testUser.DID,
167
+
Repository: "myapp",
168
+
Digest: "sha256:abc123",
169
+
HoldEndpoint: "did:web:hold.example.com",
170
+
SchemaVersion: 2,
171
+
MediaType: "application/vnd.oci.image.manifest.v1+json",
172
+
ConfigDigest: "sha256:config123",
173
+
ConfigSize: 1024,
174
+
CreatedAt: time.Now(),
160
175
}
161
176
162
177
id1, err := InsertManifest(db, manifest1)
···
167
182
t.Error("Expected non-zero manifest ID")
168
183
}
169
184
185
+
// Insert annotations separately
186
+
annotations := map[string]string{
187
+
"org.opencontainers.image.title": "My App",
188
+
"org.opencontainers.image.description": "A cool application",
189
+
"org.opencontainers.image.source": "https://github.com/user/myapp",
190
+
"org.opencontainers.image.documentation": "https://docs.example.com",
191
+
"org.opencontainers.image.licenses": "MIT",
192
+
"io.atcr.icon": "https://example.com/icon.png",
193
+
"io.atcr.readme": "https://github.com/user/myapp/blob/main/README.md",
194
+
}
195
+
err = UpsertRepositoryAnnotations(db, testUser.DID, "myapp", annotations)
196
+
if err != nil {
197
+
t.Fatalf("Failed to insert annotations: %v", err)
198
+
}
199
+
170
200
// Verify the manifest was inserted correctly
171
201
retrieved, err := GetManifest(db, manifest1.Digest)
172
202
if err != nil {
···
175
205
if retrieved.ID != id1 {
176
206
t.Errorf("Expected ID %d, got %d", id1, retrieved.ID)
177
207
}
178
-
if retrieved.Title != "My App" {
179
-
t.Errorf("Expected title 'My App', got '%s'", retrieved.Title)
208
+
209
+
// Verify annotations were inserted
210
+
retrievedAnnotations, err := GetRepositoryAnnotations(db, testUser.DID, "myapp")
211
+
if err != nil {
212
+
t.Fatalf("Failed to retrieve annotations: %v", err)
180
213
}
181
-
if retrieved.ReadmeURL != "https://github.com/user/myapp/blob/main/README.md" {
182
-
t.Errorf("Expected readme_url, got '%s'", retrieved.ReadmeURL)
214
+
if retrievedAnnotations["org.opencontainers.image.title"] != "My App" {
215
+
t.Errorf("Expected title 'My App', got '%s'", retrievedAnnotations["org.opencontainers.image.title"])
216
+
}
217
+
if retrievedAnnotations["io.atcr.readme"] != "https://github.com/user/myapp/blob/main/README.md" {
218
+
t.Errorf("Expected readme_url, got '%s'", retrievedAnnotations["io.atcr.readme"])
183
219
}
184
220
185
221
// Test 2: Insert manifest with minimal fields (NULLs for annotations)
···
201
237
t.Error("Expected non-zero manifest ID for minimal manifest")
202
238
}
203
239
204
-
retrieved2, err := GetManifest(db, manifest2.Digest)
240
+
_, err = GetManifest(db, manifest2.Digest)
205
241
if err != nil {
206
242
t.Fatalf("Failed to retrieve minimal manifest: %v", err)
207
243
}
208
-
if retrieved2.Title != "" {
209
-
t.Errorf("Expected empty title for minimal manifest, got '%s'", retrieved2.Title)
244
+
// Verify no annotations exist for minimal manifest
245
+
minimalAnnotations, err := GetRepositoryAnnotations(db, testUser.DID, "minimal")
246
+
if err != nil {
247
+
t.Fatalf("Failed to get minimal annotations: %v", err)
248
+
}
249
+
if len(minimalAnnotations) != 0 {
250
+
t.Errorf("Expected no annotations for minimal manifest, got %d", len(minimalAnnotations))
210
251
}
211
252
212
253
// Test 3: Upsert existing manifest (same DID+repo+digest) - verify UPDATE path
213
254
manifest1Updated := &Manifest{
214
-
DID: testUser.DID,
215
-
Repository: "myapp",
216
-
Digest: "sha256:abc123", // Same digest - should trigger UPDATE
217
-
HoldEndpoint: "did:web:hold2.example.com",
218
-
SchemaVersion: 2,
219
-
MediaType: "application/vnd.oci.image.manifest.v1+json",
220
-
ConfigDigest: "sha256:newconfig",
221
-
ConfigSize: 2048,
222
-
CreatedAt: time.Now(),
223
-
Title: "My App v2",
224
-
Description: "An updated application",
225
-
SourceURL: "https://github.com/user/myapp-v2",
226
-
DocumentationURL: "https://v2.docs.example.com",
227
-
Licenses: "Apache-2.0",
228
-
IconURL: "https://example.com/icon-v2.png",
229
-
ReadmeURL: "https://github.com/user/myapp/blob/v2/README.md",
255
+
DID: testUser.DID,
256
+
Repository: "myapp",
257
+
Digest: "sha256:abc123", // Same digest - should trigger UPDATE
258
+
HoldEndpoint: "did:web:hold2.example.com",
259
+
SchemaVersion: 2,
260
+
MediaType: "application/vnd.oci.image.manifest.v1+json",
261
+
ConfigDigest: "sha256:newconfig",
262
+
ConfigSize: 2048,
263
+
CreatedAt: time.Now(),
230
264
}
231
265
232
266
id3, err := InsertManifest(db, manifest1Updated)
···
238
272
t.Errorf("Expected upsert to return same ID %d, got %d", id1, id3)
239
273
}
240
274
275
+
// Update annotations separately
276
+
updatedAnnotations := map[string]string{
277
+
"org.opencontainers.image.title": "My App v2",
278
+
"org.opencontainers.image.description": "An updated application",
279
+
"org.opencontainers.image.source": "https://github.com/user/myapp-v2",
280
+
"org.opencontainers.image.documentation": "https://v2.docs.example.com",
281
+
"org.opencontainers.image.licenses": "Apache-2.0",
282
+
"io.atcr.icon": "https://example.com/icon-v2.png",
283
+
"io.atcr.readme": "https://github.com/user/myapp/blob/v2/README.md",
284
+
}
285
+
err = UpsertRepositoryAnnotations(db, testUser.DID, "myapp", updatedAnnotations)
286
+
if err != nil {
287
+
t.Fatalf("Failed to update annotations: %v", err)
288
+
}
289
+
241
290
// Verify the manifest was updated
242
291
retrievedUpdated, err := GetManifest(db, manifest1.Digest)
243
292
if err != nil {
244
293
t.Fatalf("Failed to retrieve updated manifest: %v", err)
245
294
}
246
-
if retrievedUpdated.Title != "My App v2" {
247
-
t.Errorf("Expected updated title 'My App v2', got '%s'", retrievedUpdated.Title)
248
-
}
249
295
if retrievedUpdated.HoldEndpoint != "did:web:hold2.example.com" {
250
296
t.Errorf("Expected updated hold_endpoint, got '%s'", retrievedUpdated.HoldEndpoint)
251
297
}
252
-
if retrievedUpdated.ReadmeURL != "https://github.com/user/myapp/blob/v2/README.md" {
253
-
t.Errorf("Expected updated readme_url, got '%s'", retrievedUpdated.ReadmeURL)
298
+
299
+
// Verify annotations were updated
300
+
retrievedUpdatedAnnotations, err := GetRepositoryAnnotations(db, testUser.DID, "myapp")
301
+
if err != nil {
302
+
t.Fatalf("Failed to retrieve updated annotations: %v", err)
303
+
}
304
+
if retrievedUpdatedAnnotations["org.opencontainers.image.title"] != "My App v2" {
305
+
t.Errorf("Expected updated title 'My App v2', got '%s'", retrievedUpdatedAnnotations["org.opencontainers.image.title"])
306
+
}
307
+
if retrievedUpdatedAnnotations["io.atcr.readme"] != "https://github.com/user/myapp/blob/v2/README.md" {
308
+
t.Errorf("Expected updated readme_url, got '%s'", retrievedUpdatedAnnotations["io.atcr.readme"])
254
309
}
255
310
256
311
// Test 4: Verify count - should have 2 manifests (not 3, because one was upserted)
···
404
459
SchemaVersion: 2,
405
460
MediaType: "application/vnd.oci.image.manifest.v1+json",
406
461
CreatedAt: time.Now(),
407
-
Title: "App 1",
408
462
},
409
463
{
410
464
DID: testUser.DID,
···
414
468
SchemaVersion: 2,
415
469
MediaType: "application/vnd.oci.image.manifest.v1+json",
416
470
CreatedAt: time.Now(),
417
-
Title: "App 1 v2",
418
471
},
419
472
{
420
473
DID: testUser.DID,
···
424
477
SchemaVersion: 2,
425
478
MediaType: "application/vnd.oci.image.manifest.v1+json",
426
479
CreatedAt: time.Now(),
427
-
Title: "App 2",
428
480
},
429
481
}
430
482
···
435
487
}
436
488
}
437
489
490
+
// Insert annotations for test manifests
491
+
err = UpsertRepositoryAnnotations(db, testUser.DID, "app1", map[string]string{
492
+
"org.opencontainers.image.title": "App 1",
493
+
})
494
+
if err != nil {
495
+
t.Fatalf("Failed to insert app1 annotations: %v", err)
496
+
}
497
+
err = UpsertRepositoryAnnotations(db, testUser.DID, "app2", map[string]string{
498
+
"org.opencontainers.image.title": "App 2",
499
+
})
500
+
if err != nil {
501
+
t.Fatalf("Failed to insert app2 annotations: %v", err)
502
+
}
503
+
438
504
// Test 1: GetManifest - found
439
505
retrieved, err := GetManifest(db, "sha256:aaa")
440
506
if err != nil {
441
507
t.Fatalf("Failed to get manifest: %v", err)
442
508
}
443
-
if retrieved.Title != "App 1" {
444
-
t.Errorf("Expected title 'App 1', got '%s'", retrieved.Title)
509
+
if retrieved.Digest != "sha256:aaa" {
510
+
t.Errorf("Expected digest 'sha256:aaa', got '%s'", retrieved.Digest)
445
511
}
446
512
447
513
// Test 2: GetManifest - not found
+12
-7
pkg/appview/db/schema.sql
+12
-7
pkg/appview/db/schema.sql
···
28
28
config_digest TEXT,
29
29
config_size INTEGER,
30
30
created_at TIMESTAMP NOT NULL,
31
-
title TEXT,
32
-
description TEXT,
33
-
source_url TEXT,
34
-
documentation_url TEXT,
35
-
licenses TEXT,
36
-
icon_url TEXT,
37
-
readme_url TEXT,
38
31
UNIQUE(did, repository, digest),
39
32
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
40
33
);
41
34
CREATE INDEX IF NOT EXISTS idx_manifests_did_repo ON manifests(did, repository);
42
35
CREATE INDEX IF NOT EXISTS idx_manifests_created_at ON manifests(created_at DESC);
43
36
CREATE INDEX IF NOT EXISTS idx_manifests_digest ON manifests(digest);
37
+
38
+
CREATE TABLE IF NOT EXISTS repository_annotations (
39
+
did TEXT NOT NULL,
40
+
repository TEXT NOT NULL,
41
+
key TEXT NOT NULL,
42
+
value TEXT NOT NULL,
43
+
updated_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
44
+
PRIMARY KEY(did, repository, key),
45
+
FOREIGN KEY(did) REFERENCES users(did) ON DELETE CASCADE
46
+
);
47
+
CREATE INDEX IF NOT EXISTS idx_repository_annotations_did_repo ON repository_annotations(did, repository);
48
+
CREATE INDEX IF NOT EXISTS idx_repository_annotations_key ON repository_annotations(key);
44
49
45
50
CREATE TABLE IF NOT EXISTS layers (
46
51
manifest_id INTEGER NOT NULL,
+10
-9
pkg/appview/handlers/repository.go
+10
-9
pkg/appview/handlers/repository.go
···
136
136
ManifestCount: len(manifests),
137
137
}
138
138
139
-
// Fetch repository metadata from most recent manifest
140
-
title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL, err := db.GetRepositoryMetadata(h.DB, owner.DID, repository)
139
+
// Fetch repository metadata from annotations table
140
+
metadata, err := db.GetRepositoryMetadata(h.DB, owner.DID, repository)
141
141
if err != nil {
142
142
log.Printf("Failed to fetch repository metadata: %v", err)
143
143
// Continue without metadata on error
144
144
} else {
145
-
repo.Title = title
146
-
repo.Description = description
147
-
repo.SourceURL = sourceURL
148
-
repo.DocumentationURL = documentationURL
149
-
repo.Licenses = licenses
150
-
repo.IconURL = iconURL
151
-
repo.ReadmeURL = readmeURL
145
+
repo.Title = metadata["org.opencontainers.image.title"]
146
+
repo.Description = metadata["org.opencontainers.image.description"]
147
+
repo.SourceURL = metadata["org.opencontainers.image.source"]
148
+
repo.DocumentationURL = metadata["org.opencontainers.image.documentation"]
149
+
repo.Licenses = metadata["org.opencontainers.image.licenses"]
150
+
repo.IconURL = metadata["io.atcr.icon"]
151
+
repo.ReadmeURL = metadata["io.atcr.readme"]
152
+
repo.Version = metadata["org.opencontainers.image.version"]
152
153
}
153
154
154
155
// Fetch star count
+28
-27
pkg/appview/jetstream/processor.go
+28
-27
pkg/appview/jetstream/processor.go
···
143
143
if err := json.Unmarshal(recordData, &manifestRecord); err != nil {
144
144
return 0, fmt.Errorf("failed to unmarshal manifest: %w", err)
145
145
}
146
-
// Extract OCI annotations from manifest
147
-
var title, description, sourceURL, documentationURL, licenses, iconURL, readmeURL string
148
-
if manifestRecord.Annotations != nil {
149
-
title = manifestRecord.Annotations["org.opencontainers.image.title"]
150
-
description = manifestRecord.Annotations["org.opencontainers.image.description"]
151
-
sourceURL = manifestRecord.Annotations["org.opencontainers.image.source"]
152
-
documentationURL = manifestRecord.Annotations["org.opencontainers.image.documentation"]
153
-
licenses = manifestRecord.Annotations["org.opencontainers.image.licenses"]
154
-
iconURL = manifestRecord.Annotations["io.atcr.icon"]
155
-
readmeURL = manifestRecord.Annotations["io.atcr.readme"]
156
-
}
157
-
158
146
// Detect manifest type
159
147
isManifestList := len(manifestRecord.Manifests) > 0
160
148
161
-
// Prepare manifest for insertion
149
+
// Prepare manifest for insertion (WITHOUT annotation fields)
162
150
manifest := &db.Manifest{
163
-
DID: did,
164
-
Repository: manifestRecord.Repository,
165
-
Digest: manifestRecord.Digest,
166
-
MediaType: manifestRecord.MediaType,
167
-
SchemaVersion: manifestRecord.SchemaVersion,
168
-
HoldEndpoint: manifestRecord.HoldEndpoint,
169
-
CreatedAt: manifestRecord.CreatedAt,
170
-
Title: title,
171
-
Description: description,
172
-
SourceURL: sourceURL,
173
-
DocumentationURL: documentationURL,
174
-
Licenses: licenses,
175
-
IconURL: iconURL,
176
-
ReadmeURL: readmeURL,
151
+
DID: did,
152
+
Repository: manifestRecord.Repository,
153
+
Digest: manifestRecord.Digest,
154
+
MediaType: manifestRecord.MediaType,
155
+
SchemaVersion: manifestRecord.SchemaVersion,
156
+
HoldEndpoint: manifestRecord.HoldEndpoint,
157
+
CreatedAt: manifestRecord.CreatedAt,
158
+
// Annotations removed - stored separately in repository_annotations table
177
159
}
178
160
179
161
// Set config fields only for image manifests (not manifest lists)
···
199
181
manifestID = existingID
200
182
} else {
201
183
return 0, fmt.Errorf("failed to insert manifest: %w", err)
184
+
}
185
+
}
186
+
187
+
// Update repository annotations ONLY if manifest has at least one non-empty annotation
188
+
if manifestRecord.Annotations != nil {
189
+
hasData := false
190
+
for _, value := range manifestRecord.Annotations {
191
+
if value != "" {
192
+
hasData = true
193
+
break
194
+
}
195
+
}
196
+
197
+
if hasData {
198
+
// Replace all annotations for this repository
199
+
err = db.UpsertRepositoryAnnotations(p.db, did, manifestRecord.Repository, manifestRecord.Annotations)
200
+
if err != nil {
201
+
return 0, fmt.Errorf("failed to upsert annotations: %w", err)
202
+
}
202
203
}
203
204
}
204
205
+6
pkg/appview/static/css/style.css
+6
pkg/appview/static/css/style.css
+6
-1
pkg/appview/templates/pages/repository.html
+6
-1
pkg/appview/templates/pages/repository.html
···
43
43
</div>
44
44
45
45
<!-- Metadata Section -->
46
-
{{ if or .Repository.Licenses .Repository.SourceURL .Repository.DocumentationURL }}
46
+
{{ if or .Repository.Licenses .Repository.SourceURL .Repository.DocumentationURL .Repository.Version }}
47
47
<div class="repo-metadata">
48
+
{{ if .Repository.Version }}
49
+
<span class="metadata-badge version-badge" title="Version">
50
+
{{ .Repository.Version }}
51
+
</span>
52
+
{{ end }}
48
53
{{ if .Repository.Licenses }}
49
54
{{ range parseLicenses .Repository.Licenses }}
50
55
{{ if .IsValid }}
+5
pkg/hold/config.go
+5
pkg/hold/config.go
···
28
28
// If true, creates/maintains a crew record with memberPattern: "*" (allows all authenticated users)
29
29
// If false, deletes the wildcard crew record if it exists
30
30
AllowAllCrew bool `yaml:"allow_all_crew"`
31
+
32
+
// ProfileAvatarURL is the URL to download the avatar image from (from env: HOLD_PROFILE_AVATAR)
33
+
// If set, the avatar will be downloaded and uploaded as a blob during bootstrap
34
+
ProfileAvatarURL string `yaml:"profile_avatar_url"`
31
35
}
32
36
33
37
// StorageConfig wraps distribution's storage configuration
···
91
95
// Registration configuration (optional)
92
96
cfg.Registration.OwnerDID = os.Getenv("HOLD_OWNER")
93
97
cfg.Registration.AllowAllCrew = os.Getenv("HOLD_ALLOW_ALL_CREW") == "true"
98
+
cfg.Registration.ProfileAvatarURL = getEnvOrDefault("HOLD_PROFILE_AVATAR", "https://imgs.blue/evan.jarrett.net/1TpTOdtS60GdJWBYEqtK22y688jajbQ9a5kbYRFtwuqrkBAE")
94
99
95
100
// Database configuration (optional - enables embedded PDS)
96
101
// Note: HOLD_DATABASE_DIR is a directory path, carstore creates db.sqlite3 inside it
+1
-1
pkg/hold/oci/xrpc_test.go
+1
-1
pkg/hold/oci/xrpc_test.go
+10
-10
pkg/hold/pds/auth_test.go
+10
-10
pkg/hold/pds/auth_test.go
···
512
512
holdDID := "did:web:hold01.atcr.io"
513
513
514
514
// Bootstrap with owner
515
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
515
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
516
516
if err != nil {
517
517
t.Fatalf("Failed to bootstrap PDS: %v", err)
518
518
}
···
546
546
holdDID := "did:web:hold01.atcr.io"
547
547
548
548
// Bootstrap
549
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
549
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
550
550
if err != nil {
551
551
t.Fatalf("Failed to bootstrap PDS: %v", err)
552
552
}
···
605
605
holdDID := "did:web:hold01.atcr.io"
606
606
607
607
// Bootstrap
608
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
608
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
609
609
if err != nil {
610
610
t.Fatalf("Failed to bootstrap PDS: %v", err)
611
611
}
···
650
650
ownerDID := "did:plc:owner123"
651
651
652
652
// Bootstrap with owner
653
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
653
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
654
654
if err != nil {
655
655
t.Fatalf("Failed to bootstrap PDS: %v", err)
656
656
}
···
696
696
ownerDID := "did:plc:owner123"
697
697
698
698
// Bootstrap
699
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
699
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
700
700
if err != nil {
701
701
t.Fatalf("Failed to bootstrap PDS: %v", err)
702
702
}
···
769
769
ownerDID := "did:plc:owner123"
770
770
771
771
// Bootstrap with public=true
772
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
772
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
773
773
if err != nil {
774
774
t.Fatalf("Failed to bootstrap PDS: %v", err)
775
775
}
···
806
806
ownerDID := "did:plc:owner123"
807
807
808
808
// Bootstrap with public=false
809
-
err := pds.Bootstrap(ctx, ownerDID, false, false)
809
+
err := pds.Bootstrap(ctx, nil, ownerDID, false, false, "")
810
810
if err != nil {
811
811
t.Fatalf("Failed to bootstrap PDS: %v", err)
812
812
}
···
848
848
ownerDID := "did:plc:owner123"
849
849
850
850
// Bootstrap
851
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
851
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
852
852
if err != nil {
853
853
t.Fatalf("Failed to bootstrap PDS: %v", err)
854
854
}
···
916
916
ownerDID := "did:plc:owner123"
917
917
918
918
// Bootstrap
919
-
err := pds.Bootstrap(ctx, ownerDID, true, false)
919
+
err := pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
920
920
if err != nil {
921
921
t.Fatalf("Failed to bootstrap PDS: %v", err)
922
922
}
···
1040
1040
ownerDID := "did:plc:owner123"
1041
1041
1042
1042
// Bootstrap with specified settings
1043
-
err := pds.Bootstrap(ctx, ownerDID, tt.public, tt.allowAllCrew)
1043
+
err := pds.Bootstrap(ctx, nil, ownerDID, tt.public, tt.allowAllCrew, "")
1044
1044
if err != nil {
1045
1045
t.Fatalf("Failed to bootstrap PDS: %v", err)
1046
1046
}
+174
pkg/hold/pds/profile.go
+174
pkg/hold/pds/profile.go
···
1
+
package pds
2
+
3
+
import (
4
+
"bytes"
5
+
"context"
6
+
"crypto/sha256"
7
+
"fmt"
8
+
"io"
9
+
"net/http"
10
+
"time"
11
+
12
+
bsky "github.com/bluesky-social/indigo/api/bsky"
13
+
lexutil "github.com/bluesky-social/indigo/lex/util"
14
+
"github.com/distribution/distribution/v3/registry/storage/driver"
15
+
"github.com/ipfs/go-cid"
16
+
"github.com/multiformats/go-multihash"
17
+
)
18
+
19
+
const (
20
+
// ProfileRkey is the fixed rkey for the profile record (singleton)
21
+
ProfileRkey = "self"
22
+
23
+
// ProfileCollection is the collection name for Bluesky actor profiles
24
+
ProfileCollection = "app.bsky.actor.profile"
25
+
)
26
+
27
+
// downloadImage downloads an image from a URL and returns the data and content type
28
+
func downloadImage(ctx context.Context, url string) ([]byte, string, error) {
29
+
req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
30
+
if err != nil {
31
+
return nil, "", fmt.Errorf("failed to create request: %w", err)
32
+
}
33
+
34
+
client := &http.Client{
35
+
Timeout: 30 * time.Second,
36
+
}
37
+
38
+
resp, err := client.Do(req)
39
+
if err != nil {
40
+
return nil, "", fmt.Errorf("failed to download image: %w", err)
41
+
}
42
+
defer resp.Body.Close()
43
+
44
+
if resp.StatusCode != http.StatusOK {
45
+
return nil, "", fmt.Errorf("download failed with status %d", resp.StatusCode)
46
+
}
47
+
48
+
// Read image data
49
+
data, err := io.ReadAll(resp.Body)
50
+
if err != nil {
51
+
return nil, "", fmt.Errorf("failed to read image data: %w", err)
52
+
}
53
+
54
+
// Get content type from response header
55
+
contentType := resp.Header.Get("Content-Type")
56
+
if contentType == "" {
57
+
contentType = "application/octet-stream"
58
+
}
59
+
60
+
return data, contentType, nil
61
+
}
62
+
63
+
// uploadBlobToStorage uploads a blob to the hold's storage and returns a blob reference
64
+
// This stores the blob at the ATProto path for the hold's DID
65
+
func uploadBlobToStorage(ctx context.Context, storageDriver driver.StorageDriver, did string, data []byte, mimeType string) (*lexutil.LexBlob, error) {
66
+
if len(data) == 0 {
67
+
return nil, fmt.Errorf("empty blob data")
68
+
}
69
+
70
+
size := int64(len(data))
71
+
72
+
// Compute SHA-256 hash
73
+
hash := sha256.Sum256(data)
74
+
75
+
// Create CIDv1 with SHA-256 multihash
76
+
mh, err := multihash.EncodeName(hash[:], "sha2-256")
77
+
if err != nil {
78
+
return nil, fmt.Errorf("failed to encode multihash: %w", err)
79
+
}
80
+
81
+
// Create CIDv1 with raw codec (0x55)
82
+
// ATProto uses CIDv1 with raw codec for blobs
83
+
blobCID := cid.NewCidV1(0x55, mh)
84
+
85
+
// Store blob via distribution driver at ATProto path
86
+
path := atprotoBlobPath(did, blobCID.String())
87
+
88
+
// Write blob to storage using distribution driver
89
+
writer, err := storageDriver.Writer(ctx, path, false)
90
+
if err != nil {
91
+
return nil, fmt.Errorf("failed to create writer: %w", err)
92
+
}
93
+
94
+
// Write data
95
+
n, err := io.Copy(writer, bytes.NewReader(data))
96
+
if err != nil {
97
+
writer.Cancel(ctx)
98
+
return nil, fmt.Errorf("failed to write blob: %w", err)
99
+
}
100
+
101
+
// Commit the write
102
+
if err := writer.Commit(ctx); err != nil {
103
+
return nil, fmt.Errorf("failed to commit blob: %w", err)
104
+
}
105
+
106
+
if n != size {
107
+
return nil, fmt.Errorf("size mismatch: wrote %d bytes, expected %d", n, size)
108
+
}
109
+
110
+
// Create blob reference in the format expected by bsky.ActorProfile
111
+
// LexLink is a type alias for cid.Cid
112
+
lexLink := lexutil.LexLink(blobCID)
113
+
blob := &lexutil.LexBlob{
114
+
Ref: lexLink,
115
+
MimeType: mimeType,
116
+
Size: size,
117
+
}
118
+
119
+
return blob, nil
120
+
}
121
+
122
+
// CreateProfileRecord creates the app.bsky.actor.profile record for the hold
123
+
// This will FAIL if the profile record already exists.
124
+
func (p *HoldPDS) CreateProfileRecord(ctx context.Context, storageDriver driver.StorageDriver, displayName, description, avatarURL string) (cid.Cid, error) {
125
+
// Create profile struct
126
+
profile := &bsky.ActorProfile{
127
+
DisplayName: &displayName,
128
+
Description: &description,
129
+
}
130
+
131
+
// Download and upload avatar if URL is provided
132
+
if avatarURL != "" {
133
+
fmt.Printf("Downloading avatar from %s\n", avatarURL)
134
+
imageData, mimeType, err := downloadImage(ctx, avatarURL)
135
+
if err != nil {
136
+
return cid.Undef, fmt.Errorf("failed to download avatar: %w", err)
137
+
}
138
+
139
+
fmt.Printf("Uploading avatar blob (%d bytes, %s)\n", len(imageData), mimeType)
140
+
avatarBlob, err := uploadBlobToStorage(ctx, storageDriver, p.did, imageData, mimeType)
141
+
if err != nil {
142
+
return cid.Undef, fmt.Errorf("failed to upload avatar blob: %w", err)
143
+
}
144
+
145
+
profile.Avatar = avatarBlob
146
+
fmt.Printf("Avatar uploaded successfully: %s\n", avatarBlob.Ref.String())
147
+
}
148
+
149
+
// Use repomgr.PutRecord - creates with explicit rkey, fails if already exists
150
+
recordPath, recordCID, err := p.repomgr.PutRecord(ctx, p.uid, ProfileCollection, ProfileRkey, profile)
151
+
if err != nil {
152
+
return cid.Undef, fmt.Errorf("failed to create profile record: %w", err)
153
+
}
154
+
155
+
fmt.Printf("Created profile record at %s, cid: %s\n", recordPath, recordCID)
156
+
return recordCID, nil
157
+
}
158
+
159
+
// GetProfileRecord retrieves the app.bsky.actor.profile record
160
+
func (p *HoldPDS) GetProfileRecord(ctx context.Context) (cid.Cid, *bsky.ActorProfile, error) {
161
+
// Use repomgr.GetRecord
162
+
recordCID, val, err := p.repomgr.GetRecord(ctx, p.uid, ProfileCollection, ProfileRkey, cid.Undef)
163
+
if err != nil {
164
+
return cid.Undef, nil, fmt.Errorf("failed to get profile record: %w", err)
165
+
}
166
+
167
+
// Type assert to bsky.ActorProfile
168
+
profileRecord, ok := val.(*bsky.ActorProfile)
169
+
if !ok {
170
+
return cid.Undef, nil, fmt.Errorf("unexpected type for profile record: %T", val)
171
+
}
172
+
173
+
return recordCID, profileRecord, nil
174
+
}
+34
-8
pkg/hold/pds/server.go
+34
-8
pkg/hold/pds/server.go
···
13
13
lexutil "github.com/bluesky-social/indigo/lex/util"
14
14
"github.com/bluesky-social/indigo/models"
15
15
"github.com/bluesky-social/indigo/repo"
16
+
"github.com/distribution/distribution/v3/registry/storage/driver"
16
17
"github.com/ipfs/go-cid"
17
18
)
18
19
···
107
108
return p.repomgr
108
109
}
109
110
110
-
// Bootstrap initializes the hold with the captain record and owner as first crew member
111
-
func (p *HoldPDS) Bootstrap(ctx context.Context, ownerDID string, public bool, allowAllCrew bool) error {
111
+
// Bootstrap initializes the hold with the captain record, owner as first crew member, and profile
112
+
func (p *HoldPDS) Bootstrap(ctx context.Context, storageDriver driver.StorageDriver, ownerDID string, public bool, allowAllCrew bool, avatarURL string) error {
112
113
if ownerDID == "" {
113
114
return nil
114
115
}
115
116
116
117
// Check if captain record already exists (idempotent bootstrap)
117
118
_, _, err := p.GetCaptainRecord(ctx)
118
-
if err == nil {
119
-
// Captain record exists, we're good
120
-
fmt.Printf("✅ Captain record exists, skipping bootstrap\n")
121
-
return nil
119
+
captainExists := (err == nil)
120
+
121
+
if captainExists {
122
+
// Captain record exists, skip captain/crew setup but still create profile if needed
123
+
fmt.Printf("✅ Captain record exists, skipping captain/crew setup\n")
124
+
} else {
125
+
fmt.Printf("🚀 Bootstrapping hold PDS with owner: %s\n", ownerDID)
122
126
}
123
127
124
-
fmt.Printf("🚀 Bootstrapping hold PDS with owner: %s\n", ownerDID)
128
+
if !captainExists {
125
129
126
130
// Initialize repo if it doesn't exist yet
127
131
// Check if repo exists by trying to get the head
···
150
154
return fmt.Errorf("failed to add owner as crew member: %w", err)
151
155
}
152
156
153
-
fmt.Printf("✅ Added %s as hold admin\n", ownerDID)
157
+
fmt.Printf("✅ Added %s as hold admin\n", ownerDID)
158
+
}
159
+
160
+
// Create profile record (idempotent - check if exists first)
161
+
// This runs even if captain exists (for existing holds being upgraded)
162
+
// Skip if no storage driver (e.g., in tests)
163
+
if storageDriver != nil {
164
+
_, _, err = p.GetProfileRecord(ctx)
165
+
if err != nil {
166
+
// Profile doesn't exist, create it
167
+
displayName := "Cargo Hold"
168
+
description := "ahoy from the cargo hold"
169
+
170
+
_, err = p.CreateProfileRecord(ctx, storageDriver, displayName, description, avatarURL)
171
+
if err != nil {
172
+
return fmt.Errorf("failed to create profile record: %w", err)
173
+
}
174
+
fmt.Printf("✅ Created profile record (displayName=%s)\n", displayName)
175
+
} else {
176
+
fmt.Printf("✅ Profile record already exists, skipping\n")
177
+
}
178
+
}
179
+
154
180
return nil
155
181
}
156
182
+10
-10
pkg/hold/pds/server_test.go
+10
-10
pkg/hold/pds/server_test.go
···
69
69
70
70
// Bootstrap with a captain record
71
71
ownerDID := "did:plc:owner123"
72
-
if err := pds1.Bootstrap(ctx, ownerDID, true, false); err != nil {
72
+
if err := pds1.Bootstrap(ctx, nil, ownerDID, true, false, ""); err != nil {
73
73
t.Fatalf("Bootstrap failed: %v", err)
74
74
}
75
75
···
129
129
publicAccess := true
130
130
allowAllCrew := false
131
131
132
-
err = pds.Bootstrap(ctx, ownerDID, publicAccess, allowAllCrew)
132
+
err = pds.Bootstrap(ctx, nil, ownerDID, publicAccess, allowAllCrew, "")
133
133
if err != nil {
134
134
t.Fatalf("Bootstrap failed: %v", err)
135
135
}
···
204
204
ownerDID := "did:plc:alice123"
205
205
206
206
// First bootstrap
207
-
err = pds.Bootstrap(ctx, ownerDID, true, false)
207
+
err = pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
208
208
if err != nil {
209
209
t.Fatalf("First bootstrap failed: %v", err)
210
210
}
···
223
223
crewCount1 := len(crew1)
224
224
225
225
// Second bootstrap (should be idempotent - skip creation)
226
-
err = pds.Bootstrap(ctx, ownerDID, true, false)
226
+
err = pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
227
227
if err != nil {
228
228
t.Fatalf("Second bootstrap failed: %v", err)
229
229
}
···
268
268
defer pds.Close()
269
269
270
270
// Bootstrap with empty owner DID (should be no-op)
271
-
err = pds.Bootstrap(ctx, "", true, false)
271
+
err = pds.Bootstrap(ctx, nil, "", true, false, "")
272
272
if err != nil {
273
273
t.Fatalf("Bootstrap with empty owner should not error: %v", err)
274
274
}
···
302
302
303
303
// Bootstrap to create captain record
304
304
ownerDID := "did:plc:alice123"
305
-
if err := pds.Bootstrap(ctx, ownerDID, true, false); err != nil {
305
+
if err := pds.Bootstrap(ctx, nil, ownerDID, true, false, ""); err != nil {
306
306
t.Fatalf("Bootstrap failed: %v", err)
307
307
}
308
308
···
355
355
publicAccess := true
356
356
allowAllCrew := false
357
357
358
-
err = pds.Bootstrap(ctx, ownerDID, publicAccess, allowAllCrew)
358
+
err = pds.Bootstrap(ctx, nil, ownerDID, publicAccess, allowAllCrew, "")
359
359
if err != nil {
360
360
t.Fatalf("Bootstrap failed with did:web owner: %v", err)
361
361
}
···
414
414
415
415
// Bootstrap with did:plc owner
416
416
plcOwner := "did:plc:alice123"
417
-
err = pds.Bootstrap(ctx, plcOwner, true, false)
417
+
err = pds.Bootstrap(ctx, nil, plcOwner, true, false, "")
418
418
if err != nil {
419
419
t.Fatalf("Bootstrap failed: %v", err)
420
420
}
···
509
509
}
510
510
511
511
// Bootstrap should create captain record
512
-
err = pds.Bootstrap(ctx, ownerDID, true, false)
512
+
err = pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
513
513
if err != nil {
514
514
t.Fatalf("Bootstrap failed: %v", err)
515
515
}
···
585
585
586
586
// Bootstrap should be idempotent but notice missing crew
587
587
// Currently Bootstrap skips if captain exists, so crew won't be added
588
-
err = pds.Bootstrap(ctx, ownerDID, true, false)
588
+
err = pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
589
589
if err != nil {
590
590
t.Fatalf("Bootstrap failed: %v", err)
591
591
}
+60
-41
pkg/hold/pds/xrpc.go
+60
-41
pkg/hold/pds/xrpc.go
···
795
795
json.NewEncoder(w).Encode(response)
796
796
}
797
797
798
-
// HandleGetBlob wraps existing presigned download URL logic
799
-
// Supports both ATProto CIDs and OCI sha256 digests
800
-
// Authorization: If captain.public = true, open to all. If false, requires crew with blob:read permission.
798
+
// HandleGetBlob routes blob requests to appropriate handlers based on blob type
799
+
// Routes to:
800
+
// - handleGetOCIBlob for OCI image blobs (sha256:...)
801
+
// - handleGetATProtoBlob for ATProto blobs (CID format)
801
802
func (h *XRPCHandler) HandleGetBlob(w http.ResponseWriter, r *http.Request) {
802
-
log.Printf("[HandleGetBlob] %s request received", r.Method)
803
-
804
803
did := r.URL.Query().Get("did")
805
804
cidOrDigest := r.URL.Query().Get("cid")
806
805
807
-
log.Printf("[HandleGetBlob] did=%s, cid=%s", did, cidOrDigest)
806
+
log.Printf("[HandleGetBlob] %s request - did=%s, cid=%s", r.Method, did, cidOrDigest)
808
807
809
808
if did == "" || cidOrDigest == "" {
810
809
http.Error(w, "missing required parameters", http.StatusBadRequest)
811
810
return
812
811
}
813
812
814
-
// For OCI blobs (sha256:...), skip DID validation since they're content-addressed and globally deduplicated
815
-
// For ATProto blobs (CID format), validate DID since they're stored per-DID
816
-
if !strings.HasPrefix(cidOrDigest, "sha256:") {
817
-
// ATProto blob - validate DID
818
-
if did != h.pds.DID() {
819
-
log.Printf("[HandleGetBlob] DID mismatch for ATProto blob: got %s, expected %s", did, h.pds.DID())
820
-
http.Error(w, "invalid did", http.StatusBadRequest)
821
-
return
822
-
}
823
-
} else {
824
-
// OCI blob - DID doesn't matter, use empty string for content-addressed storage
825
-
did = ""
813
+
// Route based on blob type
814
+
if strings.HasPrefix(cidOrDigest, "sha256:") {
815
+
// OCI blob (container image layers)
816
+
h.handleGetOCIBlob(w, r, did, cidOrDigest)
817
+
return
826
818
}
827
819
828
-
// Validate blob read access
820
+
// ATProto blob (profile avatars, etc.)
821
+
h.handleGetATProtoBlob(w, r, did, cidOrDigest)
822
+
}
823
+
824
+
// handleGetOCIBlob handles OCI container image blob requests
825
+
// Returns JSON with presigned URL for AppView integration
826
+
// Authorization: Protected by hold access control (captain.public or crew with blob:read)
827
+
func (h *XRPCHandler) handleGetOCIBlob(w http.ResponseWriter, r *http.Request, did, digest string) {
828
+
log.Printf("[handleGetOCIBlob] Processing OCI blob: %s", digest)
829
+
830
+
// Validate blob read access (hold access control)
829
831
// If captain.public = true, returns nil (public access allowed)
830
832
// If captain.public = false, validates auth and checks for blob:read permission
831
833
_, err := ValidateBlobReadAccess(r, h.pds, h.httpClient)
832
834
if err != nil {
833
-
log.Printf("[HandleGetBlob] Authorization failed: %v", err)
835
+
log.Printf("[handleGetOCIBlob] Authorization failed: %v", err)
834
836
http.Error(w, fmt.Sprintf("authorization failed: %v", err), http.StatusForbidden)
835
837
return
836
838
}
837
839
838
-
// Flexible digest parsing: accept both CID and sha256 digest formats
839
-
var digest string
840
-
if strings.HasPrefix(cidOrDigest, "sha256:") {
841
-
// OCI digest format - use directly
842
-
digest = cidOrDigest
843
-
} else {
844
-
// Standard ATProto CID - for ATCR OCI use case, we expect sha256 digests
845
-
// If a real CID is provided, we could convert it here, but for now
846
-
// we'll just pass it through and let the blob store handle it
847
-
digest = cidOrDigest
848
-
}
849
-
850
-
// Determine presigned URL operation
851
-
// Check for ?method=HEAD query parameter first (from AppView), then fall back to request method
852
-
// HEAD and GET need different presigned URL signatures
840
+
// Determine presigned URL operation (GET or HEAD)
841
+
// Check for ?method=HEAD query parameter first (from AppView)
853
842
operation := r.URL.Query().Get("method")
854
843
if operation == "" {
855
844
operation = "GET"
856
845
}
857
846
858
-
// Generate presigned URL for the operation
859
-
presignedURL, err := h.GetPresignedURL(r.Context(), operation, digest, did)
847
+
// Generate presigned URL (use empty DID for content-addressed storage)
848
+
presignedURL, err := h.GetPresignedURL(r.Context(), operation, digest, "")
860
849
if err != nil {
861
-
log.Printf("[HandleGetBlob] Failed to get presigned %s URL: digest=%s, did=%s, err=%v", operation, digest, did, err)
850
+
log.Printf("[handleGetOCIBlob] Failed to get presigned %s URL: %v", operation, err)
862
851
http.Error(w, "failed to get presigned URL", http.StatusInternalServerError)
863
852
return
864
853
}
865
854
866
-
log.Printf("[HandleGetBlob] Returning presigned %s URL: %s", operation, presignedURL)
855
+
log.Printf("[handleGetOCIBlob] Returning presigned %s URL: %s", operation, presignedURL)
867
856
868
-
// Return JSON response with the presigned URL
869
-
// AppView will either redirect (GET) or proxy (HEAD) using this URL
857
+
// Return JSON response with presigned URL (AppView expects this format)
870
858
response := map[string]string{
871
859
"url": presignedURL,
872
860
}
873
861
w.Header().Set("Content-Type", "application/json")
874
862
json.NewEncoder(w).Encode(response)
863
+
}
864
+
865
+
// handleGetATProtoBlob handles standard ATProto blob requests
866
+
// Returns 307 redirect to presigned URL (standard ATProto behavior)
867
+
// Authorization: Public per ATProto spec (no auth required)
868
+
func (h *XRPCHandler) handleGetATProtoBlob(w http.ResponseWriter, r *http.Request, did, cid string) {
869
+
log.Printf("[handleGetATProtoBlob] Processing ATProto blob: %s", cid)
870
+
871
+
// Validate DID (ATProto blobs are stored per-DID for data sovereignty)
872
+
if did != h.pds.DID() {
873
+
log.Printf("[handleGetATProtoBlob] DID mismatch: got %s, expected %s", did, h.pds.DID())
874
+
http.Error(w, "invalid did", http.StatusBadRequest)
875
+
return
876
+
}
877
+
878
+
// Determine presigned URL operation (GET or HEAD)
879
+
operation := r.URL.Query().Get("method")
880
+
if operation == "" {
881
+
operation = "GET"
882
+
}
883
+
884
+
// Generate presigned URL (use DID for per-DID storage path)
885
+
presignedURL, err := h.GetPresignedURL(r.Context(), operation, cid, did)
886
+
if err != nil {
887
+
log.Printf("[handleGetATProtoBlob] Failed to get presigned %s URL: %v", operation, err)
888
+
http.Error(w, "failed to get presigned URL", http.StatusInternalServerError)
889
+
return
890
+
}
891
+
892
+
// Return 307 redirect (standard ATProto behavior - client fetches blob directly)
893
+
http.Redirect(w, r, presignedURL, http.StatusTemporaryRedirect)
875
894
}
876
895
877
896
// HandleListRepos lists all repositories in this PDS
+25
-36
pkg/hold/pds/xrpc_test.go
+25
-36
pkg/hold/pds/xrpc_test.go
···
46
46
r, w, _ := os.Pipe()
47
47
os.Stdout = w
48
48
49
-
err = pds.Bootstrap(ctx, ownerDID, true, false)
49
+
err = pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
50
50
51
51
// Restore stdout
52
52
w.Close()
···
1347
1347
r, w, _ := os.Pipe()
1348
1348
os.Stdout = w
1349
1349
1350
-
err = pds.Bootstrap(ctx, ownerDID, true, false)
1350
+
err = pds.Bootstrap(ctx, nil, ownerDID, true, false, "")
1351
1351
1352
1352
// Restore stdout
1353
1353
w.Close()
···
1501
1501
1502
1502
// Tests for HandleGetBlob
1503
1503
1504
-
// TestHandleGetBlob tests com.atproto.sync.getBlob
1504
+
// TestHandleGetBlob tests com.atproto.sync.getBlob with ATProto CID
1505
+
// ATProto blobs should return 307 redirect to presigned URL
1505
1506
// Spec: https://docs.bsky.app/docs/api/com-atproto-sync-get-blob
1506
1507
func TestHandleGetBlob(t *testing.T) {
1507
1508
handler, _, _ := setupTestXRPCHandlerWithBlobs(t)
···
1517
1518
1518
1519
handler.HandleGetBlob(w, req)
1519
1520
1520
-
// Should return 200 OK with JSON response containing presigned URL
1521
-
if w.Code != http.StatusOK {
1522
-
t.Errorf("Expected status 200 OK, got %d", w.Code)
1521
+
// ATProto blob should return 307 Temporary Redirect
1522
+
if w.Code != http.StatusTemporaryRedirect {
1523
+
t.Errorf("Expected status 307 Temporary Redirect, got %d", w.Code)
1523
1524
}
1524
1525
1525
-
// Verify Content-Type is JSON
1526
-
contentType := w.Header().Get("Content-Type")
1527
-
if contentType != "application/json" {
1528
-
t.Errorf("Expected Content-Type application/json, got %s", contentType)
1526
+
// Verify Location header exists with presigned URL
1527
+
location := w.Header().Get("Location")
1528
+
if location == "" {
1529
+
t.Error("Expected Location header in 307 redirect")
1529
1530
}
1530
1531
1531
-
// Parse JSON response
1532
-
var response map[string]string
1533
-
if err := json.Unmarshal(w.Body.Bytes(), &response); err != nil {
1534
-
t.Fatalf("Failed to parse JSON response: %v", err)
1535
-
}
1536
-
1537
-
// Verify URL field exists (will be XRPC proxy URL since we don't have S3 client)
1538
-
if response["url"] == "" {
1539
-
t.Error("Expected url field in response")
1532
+
// Should be XRPC proxy URL since we don't have S3 client
1533
+
if !strings.Contains(location, "/xrpc/com.atproto.sync.getBlob") {
1534
+
t.Errorf("Expected XRPC proxy URL, got: %s", location)
1540
1535
}
1541
1536
}
1542
1537
···
1589
1584
1590
1585
handler.HandleGetBlob(w, req)
1591
1586
1592
-
// Should return 200 OK with JSON response containing presigned HEAD URL
1593
-
if w.Code != http.StatusOK {
1594
-
t.Errorf("Expected status 200 OK, got %d", w.Code)
1587
+
// ATProto blob should return 307 Temporary Redirect (even for HEAD)
1588
+
if w.Code != http.StatusTemporaryRedirect {
1589
+
t.Errorf("Expected status 307 Temporary Redirect, got %d", w.Code)
1595
1590
}
1596
1591
1597
-
// Verify Content-Type is JSON
1598
-
contentType := w.Header().Get("Content-Type")
1599
-
if contentType != "application/json" {
1600
-
t.Errorf("Expected Content-Type application/json, got %s", contentType)
1601
-
}
1602
-
1603
-
// Parse JSON response
1604
-
var response map[string]string
1605
-
if err := json.Unmarshal(w.Body.Bytes(), &response); err != nil {
1606
-
t.Fatalf("Failed to parse JSON response: %v", err)
1592
+
// Verify Location header exists with presigned URL
1593
+
location := w.Header().Get("Location")
1594
+
if location == "" {
1595
+
t.Error("Expected Location header in 307 redirect")
1607
1596
}
1608
1597
1609
-
// Verify URL field exists (will be XRPC proxy URL since we don't have S3 client)
1610
-
if response["url"] == "" {
1611
-
t.Error("Expected url field in response")
1598
+
// Should be XRPC proxy URL since we don't have S3 client
1599
+
if !strings.Contains(location, "/xrpc/com.atproto.sync.getBlob") {
1600
+
t.Errorf("Expected XRPC proxy URL, got: %s", location)
1612
1601
}
1613
1602
}
1614
1603
···
1800
1789
1801
1790
// Clean up - recreate captain record if it was deleted
1802
1791
if w.Code == http.StatusOK {
1803
-
handler.pds.Bootstrap(ctx, "did:plc:testowner123", true, false)
1792
+
handler.pds.Bootstrap(ctx, nil, "did:plc:testowner123", true, false, "")
1804
1793
}
1805
1794
}
1806
1795
+112
scripts/test-hold-endpoints.sh
+112
scripts/test-hold-endpoints.sh
···
1
+
#!/bin/bash
2
+
3
+
# Test script for ATProto sync endpoints on hold service
4
+
# Usage: ./test-hold-endpoints.sh [HOLD_URL] [DID]
5
+
6
+
HOLD_URL="${1:-http://172.28.0.3:8080}"
7
+
# You'll need to replace this with your hold's actual DID
8
+
DID="${2:-did:web:172.28.0.3%3A8080}"
9
+
10
+
echo "Testing ATProto sync endpoints on: $HOLD_URL"
11
+
echo "Using DID: $DID"
12
+
echo "=========================================="
13
+
echo ""
14
+
15
+
# Test 1: List repositories
16
+
echo "1. Testing com.atproto.sync.listRepos"
17
+
echo " GET $HOLD_URL/xrpc/com.atproto.sync.listRepos"
18
+
echo " Response:"
19
+
curl -s -w "\n HTTP Status: %{http_code}\n" \
20
+
"$HOLD_URL/xrpc/com.atproto.sync.listRepos" | jq . 2>/dev/null || cat
21
+
echo ""
22
+
echo "=========================================="
23
+
echo ""
24
+
25
+
# Test 2: Describe repo
26
+
echo "2. Testing com.atproto.repo.describeRepo"
27
+
echo " GET $HOLD_URL/xrpc/com.atproto.repo.describeRepo?repo=$DID"
28
+
echo " Response:"
29
+
curl -s -w "\n HTTP Status: %{http_code}\n" \
30
+
"$HOLD_URL/xrpc/com.atproto.repo.describeRepo?repo=$DID" | jq . 2>/dev/null || cat
31
+
echo ""
32
+
echo "=========================================="
33
+
echo ""
34
+
35
+
# Test 3: Get repository (CAR file)
36
+
echo "3. Testing com.atproto.sync.getRepo"
37
+
echo " GET $HOLD_URL/xrpc/com.atproto.sync.getRepo?did=$DID"
38
+
echo " Response (showing first 200 bytes of CAR file):"
39
+
curl -s -w "\n HTTP Status: %{http_code}\n Content-Type: %{content_type}\n" \
40
+
"$HOLD_URL/xrpc/com.atproto.sync.getRepo?did=$DID" | head -c 200
41
+
echo ""
42
+
echo " [truncated...]"
43
+
echo ""
44
+
echo "=========================================="
45
+
echo ""
46
+
47
+
# Test 4: List records (captain record)
48
+
echo "4. Testing com.atproto.repo.listRecords (captain)"
49
+
echo " GET $HOLD_URL/xrpc/com.atproto.repo.listRecords?repo=$DID&collection=io.atcr.hold.captain"
50
+
echo " Response:"
51
+
curl -s -w "\n HTTP Status: %{http_code}\n" \
52
+
"$HOLD_URL/xrpc/com.atproto.repo.listRecords?repo=$DID&collection=io.atcr.hold.captain" | jq . 2>/dev/null || cat
53
+
echo ""
54
+
echo "=========================================="
55
+
echo ""
56
+
57
+
# Test 5: List records (crew records)
58
+
echo "5. Testing com.atproto.repo.listRecords (crew)"
59
+
echo " GET $HOLD_URL/xrpc/com.atproto.repo.listRecords?repo=$DID&collection=io.atcr.hold.crew"
60
+
echo " Response:"
61
+
curl -s -w "\n HTTP Status: %{http_code}\n" \
62
+
"$HOLD_URL/xrpc/com.atproto.repo.listRecords?repo=$DID&collection=io.atcr.hold.crew" | jq . 2>/dev/null || cat
63
+
echo ""
64
+
echo "=========================================="
65
+
echo ""
66
+
67
+
# Test 6: Get blob (this will likely return an error without a valid CID)
68
+
echo "6. Testing com.atproto.sync.getBlob (requires valid CID)"
69
+
echo " Skipping - needs a real blob CID from your hold"
70
+
echo " Example command:"
71
+
echo " curl \"$HOLD_URL/xrpc/com.atproto.sync.getBlob?did=$DID&cid=bafyrei...\""
72
+
echo ""
73
+
echo "=========================================="
74
+
echo ""
75
+
76
+
# Test 7: WebSocket - subscribeRepos
77
+
echo "7. Testing com.atproto.sync.subscribeRepos (WebSocket)"
78
+
echo " This requires a WebSocket client like websocat or wscat"
79
+
echo ""
80
+
81
+
# Check if websocat is available
82
+
if command -v websocat &> /dev/null; then
83
+
echo " Found websocat! Connecting for 5 seconds..."
84
+
WS_URL="${HOLD_URL/http:/ws:}"
85
+
WS_URL="${WS_URL/https:/wss:}"
86
+
echo " WS URL: $WS_URL/xrpc/com.atproto.sync.subscribeRepos"
87
+
timeout 5 websocat "$WS_URL/xrpc/com.atproto.sync.subscribeRepos" 2>&1 || echo " Connection closed or timeout"
88
+
elif command -v wscat &> /dev/null; then
89
+
echo " Found wscat! Connecting for 5 seconds..."
90
+
WS_URL="${HOLD_URL/http:/ws:}"
91
+
WS_URL="${WS_URL/https:/wss:}"
92
+
echo " WS URL: $WS_URL/xrpc/com.atproto.sync.subscribeRepos"
93
+
timeout 5 wscat -c "$WS_URL/xrpc/com.atproto.sync.subscribeRepos" 2>&1 || echo " Connection closed or timeout"
94
+
else
95
+
echo " WebSocket client not found. Install websocat or wscat:"
96
+
echo " - websocat: cargo install websocat"
97
+
echo " - wscat: npm install -g wscat"
98
+
echo ""
99
+
echo " Manual test command:"
100
+
WS_URL="${HOLD_URL/http:/ws:}"
101
+
WS_URL="${WS_URL/https:/wss:}"
102
+
echo " websocat '$WS_URL/xrpc/com.atproto.sync.subscribeRepos'"
103
+
echo " OR"
104
+
echo " wscat -c '$WS_URL/xrpc/com.atproto.sync.subscribeRepos'"
105
+
fi
106
+
107
+
echo ""
108
+
echo "=========================================="
109
+
echo "Tests complete!"
110
+
echo ""
111
+
echo "Note: If you need to test with a specific blob, first push an image"
112
+
echo "to get real blob CIDs, then use them with getBlob endpoint."