A container registry that uses the AT Protocol for manifest storage and S3 for blob storage.
atcr.io
docker
container
atproto
go
refactor oauth to use indigo
+446
-1549
+40
-33
cmd/hold/main.go
+40
-33
cmd/hold/main.go
···
18
18
19
19
"atcr.io/pkg/atproto"
20
20
"atcr.io/pkg/auth/oauth"
21
+
indigooauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
21
22
22
23
// Import storage drivers
23
24
_ "github.com/distribution/distribution/v3/registry/storage/driver/filesystem"
···
610
611
mux.HandleFunc("/move", service.HandleMove)
611
612
612
613
// OAuth client metadata endpoint for ATProto OAuth
613
-
clientID := cfg.Server.PublicURL + "/client-metadata.json"
614
-
clientMetadata := oauth.NewClientMetadata(clientID, []string{cfg.Server.PublicURL + "/oauth/callback"})
615
-
clientMetadata.ClientName = "ATCR Hold Service"
616
-
clientMetadata.ApplicationType = "web" // Changed from "native" since this is a web service
617
-
mux.HandleFunc("/client-metadata.json", oauth.ServeMetadata(clientMetadata))
614
+
// The hold service serves its metadata at /client-metadata.json
615
+
// This is referenced by its client ID URL
616
+
mux.HandleFunc("/client-metadata.json", func(w http.ResponseWriter, r *http.Request) {
617
+
// Create a temporary config to generate metadata (indigo provides this)
618
+
redirectURI := cfg.Server.PublicURL + "/oauth/callback"
619
+
clientID := cfg.Server.PublicURL + "/client-metadata.json"
620
+
scopes := []string{"atproto"} // Hold service uses default scopes
621
+
622
+
config := indigooauth.NewPublicConfig(clientID, redirectURI, scopes)
623
+
metadata := config.ClientMetadata()
624
+
625
+
// Serve as JSON
626
+
w.Header().Set("Content-Type", "application/json")
627
+
w.Header().Set("Access-Control-Allow-Origin", "*")
628
+
json.NewEncoder(w).Encode(metadata)
629
+
})
618
630
mux.HandleFunc("/blobs/", func(w http.ResponseWriter, r *http.Request) {
619
631
switch r.Method {
620
632
case http.MethodGet, http.MethodHead:
···
884
896
885
897
// Run interactive OAuth flow with persistent server
886
898
ctx := context.Background()
887
-
result, err := oauth.RunInteractiveFlow(
899
+
900
+
// Note: holdScopes are ignored for now as indigo uses default scopes
901
+
// TODO: Enhance indigo App to support custom scopes if needed
902
+
_ = holdScopes
903
+
904
+
result, err := oauth.InteractiveFlowWithCallback(
888
905
ctx,
889
-
oauth.InteractiveFlowConfig{
890
-
BaseURL: baseURL,
891
-
Handle: handle,
892
-
Scopes: holdScopes,
906
+
baseURL,
907
+
handle,
908
+
nil, // scopes (not used - indigo uses defaults)
909
+
func(handler http.HandlerFunc) error {
910
+
// Register callback on existing server (persistent server pattern)
911
+
http.HandleFunc("/auth/oauth/callback", handler)
912
+
return nil
893
913
},
894
-
func(authURL string, handler *oauth.CallbackHandler, metadata *oauth.ClientMetadata) error {
895
-
// First call (authURL empty): register callback handler
896
-
if authURL == "" {
897
-
// Register callback on existing server (persistent server pattern)
898
-
// Note: metadata is not used here since hold service serves it separately on main server
899
-
http.HandleFunc("/auth/oauth/callback", handler.ServeHTTP)
900
-
return nil
901
-
}
902
-
903
-
// Second call (authURL populated): display URL
904
-
// Print the OAuth URL for user to visit (hold-specific formatting)
914
+
func(authURL string) error {
915
+
// Display OAuth URL for user to visit
905
916
log.Print("\n" + strings.Repeat("=", 80))
906
917
log.Printf("OAUTH AUTHORIZATION REQUIRED")
907
918
log.Print(strings.Repeat("=", 80))
···
909
920
log.Printf(" %s\n", authURL)
910
921
log.Printf("Waiting for authorization...")
911
922
log.Print(strings.Repeat("=", 80) + "\n")
912
-
913
923
return nil
914
924
},
915
925
)
···
917
927
return err
918
928
}
919
929
920
-
log.Printf("Authorization received, exchanging code for token...")
921
-
token := result.Token
922
-
923
-
log.Printf("OAuth token obtained successfully")
930
+
log.Printf("Authorization received!")
931
+
log.Printf("OAuth session obtained successfully")
924
932
log.Printf("DID: %s", did)
925
933
log.Printf("PDS: %s", pdsEndpoint)
926
934
927
-
// Now register with the token using DPoP
928
-
// Create ATProto client with DPoP transport from OAuth client
929
-
dpopKey := result.Client.DPoPKey()
930
-
dpopTransport := oauth.NewDPoPTransport(http.DefaultTransport, dpopKey)
931
-
// Set the access token in the transport for "ath" claim computation
932
-
dpopTransport.SetAccessToken(token.AccessToken)
933
-
client := atproto.NewClientWithDPoP(pdsEndpoint, did, token.AccessToken, dpopKey, dpopTransport)
935
+
// Extract access token and HTTP client from session
936
+
accessToken, _ := result.Session.GetHostAccessData()
937
+
httpClient := result.Session.APIClient().Client
938
+
939
+
// Create ATProto client with indigo's DPoP-configured HTTP client
940
+
client := atproto.NewClientWithHTTPClient(pdsEndpoint, did, accessToken, httpClient)
934
941
935
942
return s.registerWithClient(publicURL, did, client)
936
943
}
+18
-21
cmd/registry/serve.go
+18
-21
cmd/registry/serve.go
···
69
69
// Initialize OAuth components
70
70
fmt.Println("Initializing OAuth components...")
71
71
72
-
// 1. Create refresh token storage
72
+
// 1. Create OAuth session storage
73
73
// Allow override via environment variable for Docker deployments
74
74
storagePath := os.Getenv("ATCR_TOKEN_STORAGE_PATH")
75
75
if storagePath == "" {
76
76
var err error
77
-
storagePath, err = oauth.GetDefaultPath()
77
+
storagePath, err = oauth.GetDefaultStorePath()
78
78
if err != nil {
79
79
return fmt.Errorf("failed to get storage path: %w", err)
80
80
}
···
86
86
return fmt.Errorf("failed to create storage directory: %w", err)
87
87
}
88
88
89
-
fmt.Printf("Using token storage path: %s\n", storagePath)
89
+
fmt.Printf("Using OAuth session storage path: %s\n", storagePath)
90
90
91
-
refreshStorage, err := oauth.NewRefreshTokenStorage(storagePath)
91
+
oauthStore, err := oauth.NewFileStore(storagePath)
92
92
if err != nil {
93
-
return fmt.Errorf("failed to create refresh token storage: %w", err)
93
+
return fmt.Errorf("failed to create OAuth store: %w", err)
94
94
}
95
95
96
96
// 2. Create session manager with 30-day TTL
···
119
119
120
120
fmt.Printf("DEBUG: Base URL for OAuth: %s\n", baseURL)
121
121
122
-
// 4. Create refresher
123
-
refresher := oauth.NewRefresher(refreshStorage, baseURL)
124
-
// Start cleanup routine (runs every hour)
125
-
refresher.StartCleanupRoutine(1 * time.Hour)
122
+
// 4. Create OAuth app (indigo client)
123
+
oauthApp, err := oauth.NewApp(baseURL, oauthStore)
124
+
if err != nil {
125
+
return fmt.Errorf("failed to create OAuth app: %w", err)
126
+
}
127
+
128
+
// 5. Create refresher
129
+
refresher := oauth.NewRefresher(oauthApp)
126
130
127
-
// 5. Set global refresher for middleware
131
+
// 6. Set global refresher for middleware
128
132
middleware.SetGlobalRefresher(refresher)
129
133
130
-
// 6. Initialize UI components (get session store for OAuth integration)
134
+
// 7. Initialize UI components (get session store for OAuth integration)
131
135
uiDatabase, uiSessionStore, uiTemplates, uiRouter := initializeUI(config, refresher, baseURL)
132
136
133
-
// 7. Create OAuth server
134
-
oauthServer := oauth.NewServer(refreshStorage, sessionManager, baseURL)
137
+
// 8. Create OAuth server
138
+
oauthServer := oauth.NewServer(oauthApp, sessionManager)
135
139
// Connect server to refresher for cache invalidation
136
140
oauthServer.SetRefresher(refresher)
137
141
// Connect UI session store for web login
···
181
185
mux.HandleFunc("/auth/oauth/authorize", oauthServer.ServeAuthorize)
182
186
mux.HandleFunc("/auth/oauth/callback", oauthServer.ServeCallback)
183
187
184
-
// Start OAuth server cleanup routine
185
-
go func() {
186
-
ticker := time.NewTicker(10 * time.Minute)
187
-
defer ticker.Stop()
188
-
for range ticker.C {
189
-
oauthServer.CleanupExpiredStates()
190
-
}
191
-
}()
188
+
// Note: Indigo handles OAuth state cleanup internally via its store
192
189
193
190
// Mount auth endpoints if enabled
194
191
if issuer != nil {
+9
-3
go.mod
+9
-3
go.mod
···
3
3
go 1.24.7
4
4
5
5
require (
6
-
authelia.com/client/oauth2 v0.0.0-20250405043315-6378a9b2a190
7
-
github.com/AxisCommunications/go-dpop v1.1.2
6
+
github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e
8
7
github.com/distribution/distribution/v3 v3.0.0
9
8
github.com/distribution/reference v0.6.0
10
9
github.com/golang-jwt/jwt/v5 v5.2.2
11
-
github.com/google/uuid v1.6.0
12
10
github.com/gorilla/mux v1.8.1
13
11
github.com/gorilla/websocket v1.5.3
14
12
github.com/klauspost/compress v1.18.0
···
21
19
github.com/aws/aws-sdk-go v1.55.5 // indirect
22
20
github.com/beorn7/perks v1.0.1 // indirect
23
21
github.com/bshuster-repo/logrus-logstash-hook v1.0.0 // indirect
22
+
github.com/carlmjohnson/versioninfo v0.22.5 // indirect
24
23
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
25
24
github.com/cespare/xxhash/v2 v2.3.0 // indirect
26
25
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
···
32
31
github.com/go-jose/go-jose/v4 v4.1.2 // indirect
33
32
github.com/go-logr/logr v1.4.2 // indirect
34
33
github.com/go-logr/stdr v1.2.2 // indirect
34
+
github.com/google/go-cmp v0.7.0 // indirect
35
+
github.com/google/go-querystring v1.1.0 // indirect
36
+
github.com/google/uuid v1.6.0 // indirect
35
37
github.com/gorilla/handlers v1.5.2 // indirect
36
38
github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0 // indirect
37
39
github.com/hashicorp/golang-lru/arc/v2 v2.0.6 // indirect
38
40
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
39
41
github.com/inconshreveable/mousetrap v1.1.0 // indirect
40
42
github.com/jmespath/go-jmespath v0.4.0 // indirect
43
+
github.com/mr-tron/base58 v1.2.0 // indirect
41
44
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
42
45
github.com/opencontainers/image-spec v1.1.0 // indirect
43
46
github.com/prometheus/client_golang v1.20.5 // indirect
···
49
52
github.com/redis/go-redis/v9 v9.7.3 // indirect
50
53
github.com/sirupsen/logrus v1.9.3 // indirect
51
54
github.com/spf13/pflag v1.0.5 // indirect
55
+
gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect
56
+
gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 // indirect
52
57
go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 // indirect
53
58
go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 // indirect
54
59
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.57.0 // indirect
···
76
81
golang.org/x/sync v0.15.0 // indirect
77
82
golang.org/x/sys v0.33.0 // indirect
78
83
golang.org/x/text v0.26.0 // indirect
84
+
golang.org/x/time v0.6.0 // indirect
79
85
google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 // indirect
80
86
google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 // indirect
81
87
google.golang.org/grpc v1.68.0 // indirect
+84
-4
go.sum
+84
-4
go.sum
···
1
-
authelia.com/client/oauth2 v0.0.0-20250405043315-6378a9b2a190 h1:5YfShMnyeIOFX5C1I7i6YrEpIfQCeeDBFTjau/iLfVU=
2
-
authelia.com/client/oauth2 v0.0.0-20250405043315-6378a9b2a190/go.mod h1:f0e/AQgp3qHJ2gSVnCheQZ4gTCm7BHasGpWrce36n9Q=
3
1
github.com/AdaLogics/go-fuzz-headers v0.0.0-20221103172237-443f56ff4ba8 h1:d+pBUmsteW5tM87xmVXHZ4+LibHRFn40SPAoZJOg2ak=
4
2
github.com/AdaLogics/go-fuzz-headers v0.0.0-20221103172237-443f56ff4ba8/go.mod h1:i9fr2JpcEcY/IHEvzCM3qXUZYOQHgR89dt4es1CgMhc=
5
-
github.com/AxisCommunications/go-dpop v1.1.2 h1:ICgk/8crE7pmWo5MML1kzyHF9wVJg6a78fW7rKxFavg=
6
-
github.com/AxisCommunications/go-dpop v1.1.2/go.mod h1:bGUXY9Wd4mnd+XUrOYZr358J2f6z9QO/dLhL1SsiD+0=
7
3
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
8
4
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
9
5
github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
···
12
8
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
13
9
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
14
10
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
11
+
github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e h1:IutKPwmbU0LrYqw03EuwJtMdAe67rDTrL1U8S8dicRU=
12
+
github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e/go.mod h1:n6QE1NDPFoi7PRbMUZmc2y7FibCqiVU4ePpsvhHUBR8=
15
13
github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
16
14
github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
17
15
github.com/bsm/ginkgo/v2 v2.7.0/go.mod h1:AiKlXPm7ItEHNc/2+OkrNG4E0ITzojb9/xWzvQ9XZ9w=
···
20
18
github.com/bsm/gomega v1.26.0/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
21
19
github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
22
20
github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
21
+
github.com/carlmjohnson/versioninfo v0.22.5 h1:O00sjOLUAFxYQjlN/bzYTuZiS0y6fWDQjMRvwtKgwwc=
22
+
github.com/carlmjohnson/versioninfo v0.22.5/go.mod h1:QT9mph3wcVfISUKd0i9sZfVrPviHuSF+cUtLjm2WSf8=
23
23
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
24
24
github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
25
25
github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
···
60
60
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
61
61
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
62
62
github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
63
+
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
64
+
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
63
65
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
64
66
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
65
67
github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
···
68
70
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
69
71
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
70
72
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
73
+
github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
71
74
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
72
75
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
76
+
github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
77
+
github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
73
78
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
74
79
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
75
80
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
···
81
86
github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
82
87
github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0 h1:ad0vkEBuk23VJzZR9nkLVG0YAoN9coASF1GusYX6AlU=
83
88
github.com/grpc-ecosystem/grpc-gateway/v2 v2.23.0/go.mod h1:igFoXX2ELCW06bol23DWPB5BEWfZISOzSP5K2sbLea0=
89
+
github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
90
+
github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
91
+
github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M=
92
+
github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
93
+
github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c=
94
+
github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
84
95
github.com/hashicorp/golang-lru/arc/v2 v2.0.6 h1:4NU7uP5vSoK6TbaMj3NtY478TTAWLso/vL1gpNrInHg=
85
96
github.com/hashicorp/golang-lru/arc/v2 v2.0.6/go.mod h1:cfdDIX05DWvYV6/shsxDfa/OVcRieOt+q4FnM8x+Xno=
86
97
github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
87
98
github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
88
99
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
89
100
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
101
+
github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs=
102
+
github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0=
103
+
github.com/ipfs/go-block-format v0.2.0 h1:ZqrkxBA2ICbDRbK8KJs/u0O3dlp6gmAuuXUJNiW1Ycs=
104
+
github.com/ipfs/go-block-format v0.2.0/go.mod h1:+jpL11nFx5A/SPpsoBn6Bzkra/zaArfSmsknbPMYgzM=
105
+
github.com/ipfs/go-cid v0.4.1 h1:A/T3qGvxi4kpKWWcPC/PgbvDA2bjVLO7n4UeVwnbs/s=
106
+
github.com/ipfs/go-cid v0.4.1/go.mod h1:uQHwDeX4c6CtyrFwdqyhpNcxVewur1M7l7fNU7LKwZk=
107
+
github.com/ipfs/go-datastore v0.6.0 h1:JKyz+Gvz1QEZw0LsX1IBn+JFCJQH4SJVFtM4uWU0Myk=
108
+
github.com/ipfs/go-datastore v0.6.0/go.mod h1:rt5M3nNbSO/8q1t4LNkLyUwRs8HupMeN/8O4Vn9YAT8=
109
+
github.com/ipfs/go-ipfs-blockstore v1.3.1 h1:cEI9ci7V0sRNivqaOr0elDsamxXFxJMMMy7PTTDQNsQ=
110
+
github.com/ipfs/go-ipfs-blockstore v1.3.1/go.mod h1:KgtZyc9fq+P2xJUiCAzbRdhhqJHvsw8u2Dlqy2MyRTE=
111
+
github.com/ipfs/go-ipfs-ds-help v1.1.1 h1:B5UJOH52IbcfS56+Ul+sv8jnIV10lbjLF5eOO0C66Nw=
112
+
github.com/ipfs/go-ipfs-ds-help v1.1.1/go.mod h1:75vrVCkSdSFidJscs8n4W+77AtTpCIAdDGAwjitJMIo=
113
+
github.com/ipfs/go-ipfs-util v0.0.3 h1:2RFdGez6bu2ZlZdI+rWfIdbQb1KudQp3VGwPtdNCmE0=
114
+
github.com/ipfs/go-ipfs-util v0.0.3/go.mod h1:LHzG1a0Ig4G+iZ26UUOMjHd+lfM84LZCrn17xAKWBvs=
115
+
github.com/ipfs/go-ipld-cbor v0.1.0 h1:dx0nS0kILVivGhfWuB6dUpMa/LAwElHPw1yOGYopoYs=
116
+
github.com/ipfs/go-ipld-cbor v0.1.0/go.mod h1:U2aYlmVrJr2wsUBU67K4KgepApSZddGRDWBYR0H4sCk=
117
+
github.com/ipfs/go-ipld-format v0.6.0 h1:VEJlA2kQ3LqFSIm5Vu6eIlSxD/Ze90xtc4Meten1F5U=
118
+
github.com/ipfs/go-ipld-format v0.6.0/go.mod h1:g4QVMTn3marU3qXchwjpKPKgJv+zF+OlaKMyhJ4LHPg=
119
+
github.com/ipfs/go-log v1.0.5 h1:2dOuUCB1Z7uoczMWgAyDck5JLb72zHzrMnGnCNNbvY8=
120
+
github.com/ipfs/go-log v1.0.5/go.mod h1:j0b8ZoR+7+R99LD9jZ6+AJsrzkPbSXbZfGakb5JPtIo=
121
+
github.com/ipfs/go-log/v2 v2.5.1 h1:1XdUzF7048prq4aBjDQQ4SL5RxftpRGdXhNRwKSAlcY=
122
+
github.com/ipfs/go-log/v2 v2.5.1/go.mod h1:prSpmC1Gpllc9UYWxDiZDreBYw7zp4Iqp1kOLU9U5UI=
123
+
github.com/ipfs/go-metrics-interface v0.0.1 h1:j+cpbjYvu4R8zbleSs36gvB7jR+wsL2fGD6n0jO4kdg=
124
+
github.com/ipfs/go-metrics-interface v0.0.1/go.mod h1:6s6euYU4zowdslK0GKHmqaIZ3j/b/tL7HTWtJ4VPgWY=
125
+
github.com/jbenet/goprocess v0.1.4 h1:DRGOFReOMqqDNXwW70QkacFW0YN9QnwLV0Vqk+3oU0o=
126
+
github.com/jbenet/goprocess v0.1.4/go.mod h1:5yspPrukOVuOLORacaBi858NqyClJPQxYZlqdZVfqY4=
90
127
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
91
128
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
92
129
github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
···
96
133
github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
97
134
github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
98
135
github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
136
+
github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
137
+
github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
99
138
github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
100
139
github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
101
140
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
···
104
143
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
105
144
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
106
145
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
146
+
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
147
+
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
107
148
github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
108
149
github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
109
150
github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
151
+
github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
152
+
github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
110
153
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
111
154
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
112
155
github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
113
156
github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
157
+
github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
158
+
github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
159
+
github.com/multiformats/go-base32 v0.1.0 h1:pVx9xoSPqEIQG8o+UbAe7DNi51oej1NtK+aGkbLYxPE=
160
+
github.com/multiformats/go-base32 v0.1.0/go.mod h1:Kj3tFY6zNr+ABYMqeUNeGvkIC/UYgtWibDcT0rExnbI=
161
+
github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0=
162
+
github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a1UV0xHgWc0hkp4=
163
+
github.com/multiformats/go-multibase v0.2.0 h1:isdYCVLvksgWlMW9OZRYJEa9pZETFivncJHmHnnd87g=
164
+
github.com/multiformats/go-multibase v0.2.0/go.mod h1:bFBZX4lKCA/2lyOFSAoKH5SS6oPyjtnzK/XTFDPkNuk=
165
+
github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7BFvVU9RSh+U=
166
+
github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
167
+
github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
168
+
github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
114
169
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
115
170
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
116
171
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
···
118
173
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
119
174
github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
120
175
github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
176
+
github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
177
+
github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
121
178
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
122
179
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
123
180
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
181
+
github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f h1:VXTQfuJj9vKR4TCkEuWIckKvdHFeJH/huIFJ9/cXOB0=
182
+
github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f/go.mod h1:/zvteZs/GwLtCgZ4BL6CBsk9IKIlexP43ObX9AxTqTw=
124
183
github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
125
184
github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
126
185
github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
···
152
211
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
153
212
github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
154
213
github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
214
+
github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
215
+
github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
155
216
github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
156
217
github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
157
218
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
···
163
224
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
164
225
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
165
226
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
227
+
github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e h1:28X54ciEwwUxyHn9yrZfl5ojgF4CBNLWX7LR0rvBkf4=
228
+
github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e/go.mod h1:pM99HXyEbSQHcosHc0iW7YFmwnscr+t9Te4ibko05so=
229
+
gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b h1:CzigHMRySiX3drau9C6Q5CAbNIApmLdat5jPMqChvDA=
230
+
gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b/go.mod h1:/y/V339mxv2sZmYYR64O07VuCpdNZqCTwO8ZcouTMI8=
231
+
gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 h1:qwDnMxjkyLmAFgcfgTnfJrmYKWhHnci3GjDqcZp1M3Q=
232
+
gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02/go.mod h1:JTnUj0mpYiAsuZLmKjTx/ex3AtMowcCgnE7YNyCEP0I=
166
233
go.opentelemetry.io/contrib/bridges/prometheus v0.57.0 h1:UW0+QyeyBVhn+COBec3nGhfnFe5lwB0ic1JBVjzhk0w=
167
234
go.opentelemetry.io/contrib/bridges/prometheus v0.57.0/go.mod h1:ppciCHRLsyCio54qbzQv0E4Jyth/fLWDTJYfvWpcSVk=
168
235
go.opentelemetry.io/contrib/exporters/autoexport v0.57.0 h1:jmTVJ86dP60C01K3slFQa2NQ/Aoi7zA+wy7vMOKD9H4=
···
207
274
go.opentelemetry.io/otel/trace v1.32.0/go.mod h1:+i4rkvCraA+tG6AzwloGaCtkx53Fa+L+V8e9a7YvhT8=
208
275
go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
209
276
go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
277
+
go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
278
+
go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
210
279
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
211
280
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
281
+
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
282
+
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
283
+
go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
284
+
go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
212
285
golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
213
286
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
214
287
golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
···
231
304
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
232
305
golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
233
306
golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
307
+
golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
308
+
golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
309
+
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
310
+
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
311
+
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
234
312
google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28 h1:M0KvPgPmDZHPlbRbaNU1APr28TvwvvdUPlSv7PUvy8g=
235
313
google.golang.org/genproto/googleapis/api v0.0.0-20241104194629-dd2ea8efbc28/go.mod h1:dguCy7UOdZhTvLzDyt15+rOrawrpM4q7DD9dQ1P11P4=
236
314
google.golang.org/genproto/googleapis/rpc v0.0.0-20241104194629-dd2ea8efbc28 h1:XVhgTWWV3kGQlwJHR3upFWZeTsei6Oks1apkZSeonIE=
···
250
328
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
251
329
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
252
330
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
331
+
lukechampine.com/blake3 v1.2.1 h1:YuqqRuaqsGV71BV/nm9xlI0MKUv4QC54jQnBChWbGnI=
332
+
lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
+18
-10
pkg/appview/handlers/settings.go
+18
-10
pkg/appview/handlers/settings.go
···
25
25
return
26
26
}
27
27
28
-
// Get access token and DPoP transport for the user
29
-
accessToken, _, dpopTransport, err := h.Refresher.GetAccessToken(r.Context(), user.DID)
28
+
// Get OAuth session for the user
29
+
session, err := h.Refresher.GetSession(r.Context(), user.DID)
30
30
if err != nil {
31
-
http.Error(w, "Failed to get access token: "+err.Error(), http.StatusInternalServerError)
31
+
http.Error(w, "Failed to get session: "+err.Error(), http.StatusInternalServerError)
32
32
return
33
33
}
34
34
35
-
// Create ATProto client with DPoP transport
36
-
client := atproto.NewClientWithDPoP(user.PDSEndpoint, user.DID, accessToken, nil, dpopTransport)
35
+
// Extract access token and HTTP client from session
36
+
accessToken, _ := session.GetHostAccessData()
37
+
httpClient := session.APIClient().Client
38
+
39
+
// Create ATProto client with indigo's DPoP-configured HTTP client
40
+
client := atproto.NewClientWithHTTPClient(user.PDSEndpoint, user.DID, accessToken, httpClient)
37
41
38
42
// Fetch sailor profile
39
43
profile, err := atproto.GetProfile(r.Context(), client)
···
86
90
87
91
holdEndpoint := r.FormValue("hold_endpoint")
88
92
89
-
// Get access token and DPoP transport for the user
90
-
accessToken, _, dpopTransport, err := h.Refresher.GetAccessToken(r.Context(), user.DID)
93
+
// Get OAuth session for the user
94
+
session, err := h.Refresher.GetSession(r.Context(), user.DID)
91
95
if err != nil {
92
-
http.Error(w, "Failed to get access token: "+err.Error(), http.StatusInternalServerError)
96
+
http.Error(w, "Failed to get session: "+err.Error(), http.StatusInternalServerError)
93
97
return
94
98
}
95
99
96
-
// Create ATProto client with DPoP transport
97
-
client := atproto.NewClientWithDPoP(user.PDSEndpoint, user.DID, accessToken, nil, dpopTransport)
100
+
// Extract access token and HTTP client from session
101
+
accessToken, _ := session.GetHostAccessData()
102
+
httpClient := session.APIClient().Client
103
+
104
+
// Create ATProto client with indigo's DPoP-configured HTTP client
105
+
client := atproto.NewClientWithHTTPClient(user.PDSEndpoint, user.DID, accessToken, httpClient)
98
106
99
107
// Fetch existing profile or create new one
100
108
profile, err := atproto.GetProfile(r.Context(), client)
+14
pkg/atproto/client.go
+14
pkg/atproto/client.go
···
44
44
}
45
45
}
46
46
47
+
// NewClientWithHTTPClient creates a new ATProto client with a pre-configured HTTP client
48
+
// This is useful when using indigo's OAuth session which provides a DPoP-configured client
49
+
// The access token will be used for Authorization headers, while the HTTP client
50
+
// handles transport-level concerns (like DPoP proofs)
51
+
func NewClientWithHTTPClient(pdsEndpoint, did, accessToken string, httpClient *http.Client) *Client {
52
+
return &Client{
53
+
pdsEndpoint: pdsEndpoint,
54
+
did: did,
55
+
accessToken: accessToken,
56
+
httpClient: httpClient,
57
+
useDPoP: true, // Assume DPoP when using custom client
58
+
}
59
+
}
60
+
47
61
// authHeader returns the appropriate Authorization header value
48
62
func (c *Client) authHeader() string {
49
63
if c.useDPoP {
-269
pkg/auth/oauth/callback.go
-269
pkg/auth/oauth/callback.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"crypto/rand"
5
-
"encoding/base64"
6
-
"fmt"
7
-
"net"
8
-
"net/http"
9
-
"net/url"
10
-
"os/exec"
11
-
"runtime"
12
-
"strings"
13
-
"time"
14
-
)
15
-
16
-
// CallbackHandler manages OAuth callback handling
17
-
type CallbackHandler struct {
18
-
state string
19
-
codeChan chan string
20
-
errChan chan error
21
-
}
22
-
23
-
// NewCallbackHandler creates a new callback handler
24
-
func NewCallbackHandler(state string) *CallbackHandler {
25
-
return &CallbackHandler{
26
-
state: state,
27
-
codeChan: make(chan string, 1),
28
-
errChan: make(chan error, 1),
29
-
}
30
-
}
31
-
32
-
// ServeHTTP handles the OAuth callback request
33
-
func (h *CallbackHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
34
-
code := r.URL.Query().Get("code")
35
-
receivedState := r.URL.Query().Get("state")
36
-
errorParam := r.URL.Query().Get("error")
37
-
38
-
// Validate state parameter
39
-
if receivedState != h.state {
40
-
h.errChan <- fmt.Errorf("invalid state parameter")
41
-
http.Error(w, "Invalid state", http.StatusBadRequest)
42
-
return
43
-
}
44
-
45
-
// Check for OAuth error
46
-
if errorParam != "" {
47
-
h.errChan <- fmt.Errorf("OAuth error: %s (%s)",
48
-
errorParam,
49
-
r.URL.Query().Get("error_description"))
50
-
http.Error(w, "Authorization failed", http.StatusBadRequest)
51
-
return
52
-
}
53
-
54
-
// Validate code is present
55
-
if code == "" {
56
-
h.errChan <- fmt.Errorf("no authorization code received")
57
-
http.Error(w, "No code provided", http.StatusBadRequest)
58
-
return
59
-
}
60
-
61
-
// Send success response to browser
62
-
RenderSuccessHTML(w)
63
-
64
-
// Send code to waiting goroutine
65
-
select {
66
-
case h.codeChan <- code:
67
-
default:
68
-
// Channel already has a value or nobody is listening
69
-
}
70
-
}
71
-
72
-
// WaitForCode waits for the OAuth callback to complete
73
-
func (h *CallbackHandler) WaitForCode(timeout time.Duration) (string, error) {
74
-
select {
75
-
case code := <-h.codeChan:
76
-
return code, nil
77
-
case err := <-h.errChan:
78
-
return "", err
79
-
case <-time.After(timeout):
80
-
return "", fmt.Errorf("OAuth timeout after %v", timeout)
81
-
}
82
-
}
83
-
84
-
// GenerateState generates a random state parameter for OAuth
85
-
func GenerateState() (string, error) {
86
-
// Generate 32 random bytes
87
-
bytes := make([]byte, 32)
88
-
if _, err := rand.Read(bytes); err != nil {
89
-
return "", fmt.Errorf("failed to generate random state: %w", err)
90
-
}
91
-
return base64.RawURLEncoding.EncodeToString(bytes), nil
92
-
}
93
-
94
-
// OpenBrowser opens the default browser to the given URL
95
-
func OpenBrowser(url string) error {
96
-
var cmd *exec.Cmd
97
-
98
-
switch runtime.GOOS {
99
-
case "darwin":
100
-
cmd = exec.Command("open", url)
101
-
case "linux":
102
-
cmd = exec.Command("xdg-open", url)
103
-
case "windows":
104
-
cmd = exec.Command("rundll32", "url.dll,FileProtocolHandler", url)
105
-
default:
106
-
return fmt.Errorf("unsupported platform: %s", runtime.GOOS)
107
-
}
108
-
109
-
return cmd.Start()
110
-
}
111
-
112
-
// RenderSuccessHTML renders the OAuth success page
113
-
func RenderSuccessHTML(w http.ResponseWriter) {
114
-
w.Header().Set("Content-Type", "text/html; charset=utf-8")
115
-
fmt.Fprintf(w, `<!DOCTYPE html>
116
-
<html>
117
-
<head>
118
-
<meta charset="UTF-8">
119
-
<title>ATCR Authorization</title>
120
-
<style>
121
-
body {
122
-
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
123
-
display: flex;
124
-
justify-content: center;
125
-
align-items: center;
126
-
height: 100vh;
127
-
margin: 0;
128
-
background: linear-gradient(135deg, #667eea 0%%, #764ba2 100%%);
129
-
}
130
-
.container {
131
-
background: white;
132
-
padding: 3rem;
133
-
border-radius: 1rem;
134
-
box-shadow: 0 10px 40px rgba(0,0,0,0.2);
135
-
text-align: center;
136
-
max-width: 400px;
137
-
}
138
-
h1 {
139
-
color: #2d3748;
140
-
margin: 0 0 1rem 0;
141
-
font-size: 2rem;
142
-
}
143
-
p {
144
-
color: #718096;
145
-
margin: 0;
146
-
font-size: 1.1rem;
147
-
}
148
-
.checkmark {
149
-
font-size: 4rem;
150
-
color: #48bb78;
151
-
margin-bottom: 1rem;
152
-
}
153
-
</style>
154
-
</head>
155
-
<body>
156
-
<div class="container">
157
-
<div class="checkmark">✓</div>
158
-
<h1>Authorization Successful!</h1>
159
-
<p>You can close this window and return to the terminal.</p>
160
-
</div>
161
-
</body>
162
-
</html>`)
163
-
}
164
-
165
-
// StartCallbackServer creates an ephemeral HTTP server for OAuth callbacks
166
-
// This is useful for CLI tools that need a temporary OAuth endpoint
167
-
// Derives the listen address and paths from the metadata's ClientID and RedirectURIs
168
-
func StartCallbackServer(handler *CallbackHandler, metadata *ClientMetadata) (*http.Server, error) {
169
-
if len(metadata.RedirectURIs) == 0 {
170
-
return nil, fmt.Errorf("no redirect URIs in metadata")
171
-
}
172
-
173
-
// Parse redirect URI to extract listen address and callback path
174
-
redirectURI := metadata.RedirectURIs[0]
175
-
u, err := url.Parse(redirectURI)
176
-
if err != nil {
177
-
return nil, fmt.Errorf("failed to parse redirect URI: %w", err)
178
-
}
179
-
180
-
// Extract listen address (host:port)
181
-
addr := u.Host
182
-
callbackPath := u.Path
183
-
184
-
mux := http.NewServeMux()
185
-
186
-
// Check if this is a query-based client ID (localhost OAuth)
187
-
isQueryBased := strings.HasPrefix(metadata.ClientID, "http://localhost?")
188
-
189
-
var metadataPath string
190
-
if !isQueryBased {
191
-
// Metadata URL client ID - parse and serve metadata
192
-
clientIDURL := metadata.ClientID
193
-
if idx := strings.Index(clientIDURL, "?"); idx != -1 {
194
-
clientIDURL = clientIDURL[:idx]
195
-
}
196
-
197
-
clientURL, err := url.Parse(clientIDURL)
198
-
if err != nil {
199
-
return nil, fmt.Errorf("failed to parse client ID: %w", err)
200
-
}
201
-
metadataPath = clientURL.Path
202
-
203
-
// Serve client metadata at the path from ClientID
204
-
mux.Handle(metadataPath, ServeMetadata(metadata))
205
-
}
206
-
207
-
// Register OAuth callback handler at the path from RedirectURI
208
-
mux.Handle(callbackPath, handler)
209
-
210
-
server := &http.Server{
211
-
Addr: addr,
212
-
Handler: mux,
213
-
}
214
-
215
-
go func() {
216
-
if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
217
-
// Server error will be caught by WaitForCode timeout
218
-
}
219
-
}()
220
-
221
-
// Wait for server to be ready
222
-
if isQueryBased {
223
-
// For localhost/query-based, just check if port is listening
224
-
if !waitForPort(addr, 5*time.Second) {
225
-
return nil, fmt.Errorf("server failed to start within 5 seconds")
226
-
}
227
-
} else {
228
-
// For metadata URLs, check the metadata endpoint
229
-
checkURL := "http://" + addr + metadataPath
230
-
if !waitForServer(checkURL, 5*time.Second) {
231
-
return nil, fmt.Errorf("server failed to start within 5 seconds")
232
-
}
233
-
}
234
-
235
-
return server, nil
236
-
}
237
-
238
-
// waitForPort checks if a TCP port is listening
239
-
func waitForPort(addr string, timeout time.Duration) bool {
240
-
deadline := time.Now().Add(timeout)
241
-
242
-
for time.Now().Before(deadline) {
243
-
conn, err := net.DialTimeout("tcp", addr, 100*time.Millisecond)
244
-
if err == nil {
245
-
conn.Close()
246
-
return true
247
-
}
248
-
time.Sleep(10 * time.Millisecond)
249
-
}
250
-
return false
251
-
}
252
-
253
-
// waitForServer checks if the server is responding at the given URL
254
-
func waitForServer(url string, timeout time.Duration) bool {
255
-
deadline := time.Now().Add(timeout)
256
-
client := &http.Client{Timeout: 100 * time.Millisecond}
257
-
258
-
for time.Now().Before(deadline) {
259
-
resp, err := client.Get(url)
260
-
if err == nil {
261
-
resp.Body.Close()
262
-
if resp.StatusCode == http.StatusOK {
263
-
return true
264
-
}
265
-
}
266
-
time.Sleep(10 * time.Millisecond)
267
-
}
268
-
return false
269
-
}
+63
-208
pkg/auth/oauth/client.go
+63
-208
pkg/auth/oauth/client.go
···
2
2
3
3
import (
4
4
"context"
5
-
"crypto/ecdsa"
6
-
"crypto/elliptic"
7
-
"crypto/rand"
8
-
"crypto/sha256"
9
-
"encoding/base64"
10
5
"fmt"
11
-
"net/http"
12
-
13
6
"net/url"
14
7
"strings"
15
8
16
9
"atcr.io/pkg/atproto"
17
-
"authelia.com/client/oauth2"
10
+
"github.com/bluesky-social/indigo/atproto/auth/oauth"
11
+
"github.com/bluesky-social/indigo/atproto/syntax"
18
12
)
19
13
20
-
// Client is an OAuth client for ATProto with DPoP support
21
-
type Client struct {
22
-
config *oauth2.Config
23
-
dpopKey *ecdsa.PrivateKey
24
-
dpopTransport *DPoPTransport
25
-
resolver *atproto.Resolver
26
-
baseUrl string
27
-
metadata *AuthServerMetadata
14
+
// App wraps indigo's ClientApp with ATCR-specific configuration
15
+
type App struct {
16
+
clientApp *oauth.ClientApp
17
+
baseURL string
18
+
resolver *atproto.Resolver
28
19
}
29
20
30
-
// NewClient creates a new OAuth client for ATProto from a base URL
31
-
func NewClient(baseURL string) (*Client, error) {
32
-
// Generate DPoP key
33
-
dpopKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
34
-
if err != nil {
35
-
return nil, fmt.Errorf("failed to generate DPoP key: %w", err)
36
-
}
21
+
// NewApp creates a new OAuth app for ATCR
22
+
func NewApp(baseURL string, store oauth.ClientAuthStore) (*App, error) {
23
+
config := NewClientConfig(baseURL)
24
+
clientApp := oauth.NewClientApp(&config, store)
37
25
38
-
return NewClientWithKey(baseURL, dpopKey), nil
26
+
return &App{
27
+
clientApp: clientApp,
28
+
baseURL: baseURL,
29
+
resolver: atproto.NewResolver(),
30
+
}, nil
39
31
}
40
32
41
-
// NewClientWithKey creates a new OAuth client with an existing DPoP key
42
-
// This is useful when working with stored credentials (e.g., in AppView token refresh)
43
-
func NewClientWithKey(baseURL string, dpopKey *ecdsa.PrivateKey) *Client {
44
-
return &Client{
45
-
dpopKey: dpopKey,
46
-
dpopTransport: NewDPoPTransport(http.DefaultTransport, dpopKey),
47
-
resolver: atproto.NewResolver(),
48
-
baseUrl: baseURL,
49
-
}
50
-
}
33
+
// NewClientConfig creates an OAuth client configuration for ATCR
34
+
func NewClientConfig(baseURL string) oauth.ClientConfig {
35
+
clientID := ClientID(baseURL)
36
+
redirectURI := RedirectURI(baseURL)
37
+
scopes := GetDefaultScopes()
51
38
52
-
// InitializeForHandle discovers the authorization server for a given handle/DID
53
-
func (c *Client) InitializeForHandle(ctx context.Context, handle string) error {
54
-
// Resolve handle to DID and PDS
55
-
_, pdsEndpoint, err := c.resolver.ResolveIdentity(ctx, handle)
56
-
if err != nil {
57
-
return fmt.Errorf("failed to resolve identity: %w", err)
39
+
// Check if this is localhost (public client) or production (confidential client)
40
+
if strings.Contains(baseURL, "127.0.0.1") || strings.Contains(baseURL, "localhost") {
41
+
return oauth.NewPublicConfig(clientID, redirectURI, scopes)
58
42
}
59
43
60
-
return c.InitializeForPDS(ctx, pdsEndpoint)
44
+
// Production: confidential client
45
+
// Note: Client secrets would be configured separately if needed
46
+
return oauth.NewPublicConfig(clientID, redirectURI, scopes)
61
47
}
62
48
63
-
// InitializeForPDS discovers the authorization server for a given PDS endpoint
64
-
// This is useful when you already know the PDS endpoint (e.g., from stored credentials)
65
-
func (c *Client) InitializeForPDS(ctx context.Context, pdsEndpoint string) error {
66
-
// Discover authorization server metadata
67
-
metadata, err := DiscoverAuthServer(ctx, pdsEndpoint)
49
+
// StartAuthFlow initiates an OAuth authorization flow for a given handle
50
+
// Returns the authorization URL (state is stored in the auth store)
51
+
func (a *App) StartAuthFlow(ctx context.Context, handle string) (authURL string, err error) {
52
+
// Start auth flow with handle as identifier
53
+
// Indigo will resolve the handle internally
54
+
authURL, err = a.clientApp.StartAuthFlow(ctx, handle)
68
55
if err != nil {
69
-
return fmt.Errorf("failed to discover authorization server: %w", err)
70
-
}
71
-
72
-
c.metadata = metadata
73
-
74
-
// Configure OAuth2 client
75
-
c.config = &oauth2.Config{
76
-
ClientID: c.ClientID(),
77
-
Endpoint: oauth2.Endpoint{
78
-
AuthURL: metadata.AuthorizationEndpoint,
79
-
TokenURL: metadata.TokenEndpoint,
80
-
PushedAuthURL: metadata.PushedAuthorizationRequestEndpoint,
81
-
},
82
-
RedirectURL: c.RedirectURI(),
83
-
Scopes: c.GetDefaultScopes(),
56
+
return "", fmt.Errorf("failed to start auth flow: %w", err)
84
57
}
85
58
86
-
return nil
87
-
}
88
-
89
-
// SetScopes sets custom OAuth scopes (must be called after InitializeForHandle)
90
-
func (c *Client) SetScopes(scopes []string) {
91
-
if c.config != nil {
92
-
c.config.Scopes = scopes
93
-
}
59
+
return authURL, nil
94
60
}
95
61
96
-
// AuthorizeURL generates the authorization URL with PKCE
97
-
func (c *Client) AuthorizeURL(state string) (authURL string, codeVerifier string, err error) {
98
-
if c.config == nil {
99
-
return "", "", fmt.Errorf("client not initialized - call InitializeForHandle first")
100
-
}
101
-
102
-
// Generate PKCE code verifier
103
-
codeVerifier, err = generateCodeVerifier()
62
+
// ProcessCallback processes an OAuth callback with authorization code and state
63
+
// Returns ClientSessionData which contains the session information
64
+
func (a *App) ProcessCallback(ctx context.Context, params url.Values) (*oauth.ClientSessionData, error) {
65
+
sessionData, err := a.clientApp.ProcessCallback(ctx, params)
104
66
if err != nil {
105
-
return "", "", fmt.Errorf("failed to generate code verifier: %w", err)
106
-
}
107
-
108
-
// Generate code challenge
109
-
codeChallenge := generateCodeChallenge(codeVerifier)
110
-
111
-
// Use PAR (Pushed Authorization Request) if supported
112
-
if c.metadata.PushedAuthorizationRequestEndpoint != "" {
113
-
authURL, err = c.authorizeURLWithPAR(state, codeChallenge)
114
-
if err != nil {
115
-
return "", "", fmt.Errorf("PAR failed: %w", err)
116
-
}
117
-
} else {
118
-
// Fallback to standard authorization
119
-
authURL = c.config.AuthCodeURL(state,
120
-
oauth2.SetAuthURLParam("code_challenge", codeChallenge),
121
-
oauth2.SetAuthURLParam("code_challenge_method", "S256"),
122
-
)
67
+
return nil, fmt.Errorf("failed to process OAuth callback: %w", err)
123
68
}
124
69
125
-
return authURL, codeVerifier, nil
70
+
return sessionData, nil
126
71
}
127
72
128
-
// authorizeURLWithPAR uses Pushed Authorization Request
129
-
func (c *Client) authorizeURLWithPAR(state, codeChallenge string) (string, error) {
130
-
fmt.Printf("DEBUG [oauth/client]: Starting PAR request\n")
131
-
fmt.Printf("DEBUG [oauth/client]: - client_id: %s\n", c.config.ClientID)
132
-
fmt.Printf("DEBUG [oauth/client]: - redirect_uri: %s\n", c.config.RedirectURL)
133
-
fmt.Printf("DEBUG [oauth/client]: - scope: %v\n", c.config.Scopes)
134
-
fmt.Printf("DEBUG [oauth/client]: - state: %s\n", state)
135
-
fmt.Printf("DEBUG [oauth/client]: - code_challenge_method: S256\n")
136
-
fmt.Printf("DEBUG [oauth/client]: - PAR endpoint: %s\n", c.config.Endpoint.PushedAuthURL)
137
-
138
-
// Create HTTP client with DPoP transport
139
-
ctx := context.WithValue(context.Background(), oauth2.HTTPClient, &http.Client{
140
-
Transport: c.dpopTransport,
141
-
})
142
-
143
-
// Use authelia's PushedAuth method
144
-
authURL, _, err := c.config.PushedAuth(ctx, state,
145
-
oauth2.SetAuthURLParam("code_challenge", codeChallenge),
146
-
oauth2.SetAuthURLParam("code_challenge_method", "S256"),
147
-
)
73
+
// ResumeSession resumes an existing OAuth session
74
+
// Returns a ClientSession that can be used to make authenticated requests
75
+
func (a *App) ResumeSession(ctx context.Context, did syntax.DID, sessionID string) (*oauth.ClientSession, error) {
76
+
session, err := a.clientApp.ResumeSession(ctx, did, sessionID)
148
77
if err != nil {
149
-
fmt.Printf("ERROR [oauth/client]: PAR request failed: %v\n", err)
150
-
return "", err
78
+
return nil, fmt.Errorf("failed to resume session: %w", err)
151
79
}
152
80
153
-
fmt.Printf("DEBUG [oauth/client]: PAR successful, authURL: %s\n", authURL.String())
154
-
return authURL.String(), nil
81
+
return session, nil
155
82
}
156
83
157
-
// Exchange exchanges an authorization code for an access token
158
-
func (c *Client) Exchange(ctx context.Context, code, codeVerifier string) (*oauth2.Token, error) {
159
-
if c.config == nil {
160
-
return nil, fmt.Errorf("client not initialized")
161
-
}
162
-
163
-
// Create HTTP client with DPoP transport
164
-
ctx = context.WithValue(ctx, oauth2.HTTPClient, &http.Client{
165
-
Transport: c.dpopTransport,
166
-
})
167
-
168
-
// Exchange the code for a token
169
-
token, err := c.config.Exchange(ctx, code,
170
-
oauth2.SetAuthURLParam("code_verifier", codeVerifier),
171
-
)
172
-
if err != nil {
173
-
return nil, fmt.Errorf("failed to exchange code: %w", err)
174
-
}
175
-
176
-
return token, nil
84
+
// GetClientApp returns the underlying indigo ClientApp
85
+
// This is useful for advanced use cases that need direct access
86
+
func (a *App) GetClientApp() *oauth.ClientApp {
87
+
return a.clientApp
177
88
}
178
89
179
-
// RefreshToken refreshes an access token using a refresh token
180
-
func (c *Client) RefreshToken(ctx context.Context, refreshToken string) (*oauth2.Token, error) {
181
-
if c.config == nil {
182
-
return nil, fmt.Errorf("client not initialized")
183
-
}
184
-
185
-
// Create HTTP client with DPoP transport
186
-
ctx = context.WithValue(ctx, oauth2.HTTPClient, &http.Client{
187
-
Transport: c.dpopTransport,
188
-
})
189
-
190
-
// Refresh the token
191
-
newToken, err := c.config.TokenSource(ctx, &oauth2.Token{
192
-
RefreshToken: refreshToken,
193
-
}).Token()
194
-
if err != nil {
195
-
return nil, fmt.Errorf("failed to refresh token: %w", err)
196
-
}
197
-
198
-
// Set access token on transport for "ath" claim in future DPoP proofs
199
-
c.dpopTransport.SetAccessToken(newToken.AccessToken)
200
-
201
-
return newToken, nil
202
-
}
203
-
204
-
func (c *Client) ClientID() string {
205
-
return c.ClientIDWithScopes(c.GetDefaultScopes())
90
+
// ClientID generates the OAuth client ID for ATCR
91
+
func ClientID(baseURL string) string {
92
+
return ClientIDWithScopes(baseURL, GetDefaultScopes())
206
93
}
207
94
208
-
func (c *Client) ClientIDWithScopes(scopes []string) string {
95
+
// ClientIDWithScopes generates a client ID with custom scopes
96
+
func ClientIDWithScopes(baseURL string, scopes []string) string {
209
97
scopeStr := strings.Join(scopes, " ")
210
-
if strings.Contains(c.baseUrl, "127.0.0.1") || strings.Contains(c.baseUrl, "localhost") {
98
+
if strings.Contains(baseURL, "127.0.0.1") || strings.Contains(baseURL, "localhost") {
211
99
// Localhost: use query-based client ID
212
100
return fmt.Sprintf("http://localhost?redirect_uri=%s&scope=%s",
213
-
url.QueryEscape(c.RedirectURI()),
101
+
url.QueryEscape(RedirectURI(baseURL)),
214
102
url.QueryEscape(scopeStr))
215
103
}
216
104
// Production: use metadata URL
217
-
return c.baseUrl + "/client-metadata.json"
105
+
return baseURL + "/client-metadata.json"
218
106
}
219
107
220
-
func (c *Client) RedirectURI() string {
221
-
return c.baseUrl + "/auth/oauth/callback"
222
-
}
223
-
224
-
// DPoPKey returns the DPoP private key
225
-
func (c *Client) DPoPKey() *ecdsa.PrivateKey {
226
-
return c.dpopKey
227
-
}
228
-
229
-
// DPoPTransport returns the DPoP transport
230
-
func (c *Client) DPoPTransport() *DPoPTransport {
231
-
return c.dpopTransport
232
-
}
233
-
234
-
// SetDPoPKey sets the DPoP private key (useful when loading from storage)
235
-
func (c *Client) SetDPoPKey(key *ecdsa.PrivateKey) {
236
-
c.dpopKey = key
237
-
c.dpopTransport = NewDPoPTransport(http.DefaultTransport, key)
108
+
// RedirectURI returns the OAuth redirect URI for ATCR
109
+
func RedirectURI(baseURL string) string {
110
+
return baseURL + "/auth/oauth/callback"
238
111
}
239
112
240
113
// GetDefaultScopes returns the default OAuth scopes for ATCR registry operations
241
-
func (c *Client) GetDefaultScopes() []string {
114
+
func GetDefaultScopes() []string {
242
115
return []string{
243
116
"atproto",
244
117
"transition:generic.full",
···
249
122
fmt.Sprintf("repo:%s?action=update", atproto.TagCollection),
250
123
}
251
124
}
252
-
253
-
// generateCodeVerifier generates a PKCE code verifier
254
-
func generateCodeVerifier() (string, error) {
255
-
// Generate 32 random bytes
256
-
bytes := make([]byte, 32)
257
-
if _, err := rand.Read(bytes); err != nil {
258
-
return "", err
259
-
}
260
-
261
-
// Base64 URL encode
262
-
return base64.RawURLEncoding.EncodeToString(bytes), nil
263
-
}
264
-
265
-
// generateCodeChallenge generates a PKCE code challenge from a verifier
266
-
func generateCodeChallenge(verifier string) string {
267
-
hash := sha256.Sum256([]byte(verifier))
268
-
return base64.RawURLEncoding.EncodeToString(hash[:])
269
-
}
-120
pkg/auth/oauth/discovery.go
-120
pkg/auth/oauth/discovery.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"context"
5
-
"encoding/json"
6
-
"fmt"
7
-
"net/http"
8
-
)
9
-
10
-
// ProtectedResourceMetadata represents the OAuth protected resource metadata
11
-
// as defined in ATProto OAuth spec
12
-
type ProtectedResourceMetadata struct {
13
-
Resource string `json:"resource"`
14
-
AuthorizationServers []string `json:"authorization_servers"`
15
-
}
16
-
17
-
// AuthServerMetadata represents the OAuth authorization server metadata
18
-
// as defined in RFC 8414
19
-
type AuthServerMetadata struct {
20
-
Issuer string `json:"issuer"`
21
-
AuthorizationEndpoint string `json:"authorization_endpoint"`
22
-
TokenEndpoint string `json:"token_endpoint"`
23
-
PushedAuthorizationRequestEndpoint string `json:"pushed_authorization_request_endpoint,omitempty"`
24
-
RegistrationEndpoint string `json:"registration_endpoint,omitempty"`
25
-
JWKsURI string `json:"jwks_uri,omitempty"`
26
-
ScopesSupported []string `json:"scopes_supported,omitempty"`
27
-
ResponseTypesSupported []string `json:"response_types_supported,omitempty"`
28
-
GrantTypesSupported []string `json:"grant_types_supported,omitempty"`
29
-
TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`
30
-
DPoPSigningAlgValuesSupported []string `json:"dpop_signing_alg_values_supported,omitempty"`
31
-
CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported,omitempty"`
32
-
AuthorizationResponseIssParameterSupported bool `json:"authorization_response_iss_parameter_supported,omitempty"`
33
-
}
34
-
35
-
// DiscoverProtectedResource discovers the protected resource metadata
36
-
// from the PDS endpoint to find the authorization servers
37
-
func DiscoverProtectedResource(ctx context.Context, pdsEndpoint string) (*ProtectedResourceMetadata, error) {
38
-
// Construct the well-known URL per ATProto OAuth spec
39
-
discoveryURL := fmt.Sprintf("%s/.well-known/oauth-protected-resource", pdsEndpoint)
40
-
41
-
req, err := http.NewRequestWithContext(ctx, "GET", discoveryURL, nil)
42
-
if err != nil {
43
-
return nil, fmt.Errorf("failed to create protected resource discovery request: %w", err)
44
-
}
45
-
46
-
client := &http.Client{}
47
-
resp, err := client.Do(req)
48
-
if err != nil {
49
-
return nil, fmt.Errorf("failed to fetch protected resource metadata: %w", err)
50
-
}
51
-
defer resp.Body.Close()
52
-
53
-
if resp.StatusCode != http.StatusOK {
54
-
return nil, fmt.Errorf("protected resource discovery failed with status %d", resp.StatusCode)
55
-
}
56
-
57
-
var metadata ProtectedResourceMetadata
58
-
if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil {
59
-
return nil, fmt.Errorf("failed to decode protected resource metadata: %w", err)
60
-
}
61
-
62
-
// Validate required fields
63
-
if len(metadata.AuthorizationServers) == 0 {
64
-
return nil, fmt.Errorf("protected resource metadata missing authorization_servers")
65
-
}
66
-
67
-
return &metadata, nil
68
-
}
69
-
70
-
// DiscoverAuthServer discovers the OAuth authorization server metadata
71
-
// using the ATProto two-step discovery process:
72
-
// 1. Fetch protected resource metadata from PDS to get authorization server URL
73
-
// 2. Fetch authorization server metadata from that URL
74
-
func DiscoverAuthServer(ctx context.Context, pdsEndpoint string) (*AuthServerMetadata, error) {
75
-
// Step 1: Discover the authorization server URL from the protected resource
76
-
protectedResource, err := DiscoverProtectedResource(ctx, pdsEndpoint)
77
-
if err != nil {
78
-
return nil, fmt.Errorf("step 1 failed - discover protected resource from PDS %s: %w", pdsEndpoint, err)
79
-
}
80
-
81
-
// Use the first authorization server (ATProto spec allows multiple, but typically one)
82
-
authServerURL := protectedResource.AuthorizationServers[0]
83
-
84
-
// Step 2: Fetch authorization server metadata
85
-
discoveryURL := fmt.Sprintf("%s/.well-known/oauth-authorization-server", authServerURL)
86
-
87
-
req, err := http.NewRequestWithContext(ctx, "GET", discoveryURL, nil)
88
-
if err != nil {
89
-
return nil, fmt.Errorf("step 2 failed - create request: %w", err)
90
-
}
91
-
92
-
client := &http.Client{}
93
-
resp, err := client.Do(req)
94
-
if err != nil {
95
-
return nil, fmt.Errorf("step 2 failed - fetch auth server metadata from %s: %w", discoveryURL, err)
96
-
}
97
-
defer resp.Body.Close()
98
-
99
-
if resp.StatusCode != http.StatusOK {
100
-
return nil, fmt.Errorf("step 2 failed - auth server discovery at %s returned status %d", discoveryURL, resp.StatusCode)
101
-
}
102
-
103
-
var metadata AuthServerMetadata
104
-
if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil {
105
-
return nil, fmt.Errorf("failed to decode authorization server metadata: %w", err)
106
-
}
107
-
108
-
// Validate required fields
109
-
if metadata.Issuer == "" {
110
-
return nil, fmt.Errorf("authorization server metadata missing issuer")
111
-
}
112
-
if metadata.AuthorizationEndpoint == "" {
113
-
return nil, fmt.Errorf("authorization server metadata missing authorization_endpoint")
114
-
}
115
-
if metadata.TokenEndpoint == "" {
116
-
return nil, fmt.Errorf("authorization server metadata missing token_endpoint")
117
-
}
118
-
119
-
return &metadata, nil
120
-
}
-97
pkg/auth/oauth/flow.go
-97
pkg/auth/oauth/flow.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"context"
5
-
"fmt"
6
-
"time"
7
-
8
-
"authelia.com/client/oauth2"
9
-
)
10
-
11
-
// InteractiveFlowConfig configures an interactive OAuth flow
12
-
type InteractiveFlowConfig struct {
13
-
BaseURL string // Base URL for OAuth callbacks (e.g., "http://127.0.0.1:8080")
14
-
Handle string // ATProto handle or DID
15
-
Scopes []string // Optional, defaults to GetDefaultScopes()
16
-
}
17
-
18
-
// FlowResult contains the result of a successful OAuth flow
19
-
type FlowResult struct {
20
-
Token *oauth2.Token
21
-
Client *Client // OAuth client with DPoP key set
22
-
}
23
-
24
-
// RunInteractiveFlow executes an interactive OAuth authorization code flow
25
-
// The setupCallback function is called TWICE:
26
-
// 1. First with authURL="" to start the server (before PAR)
27
-
// 2. Then with the actual authURL to display it to the user (after PAR)
28
-
//
29
-
// This two-phase approach ensures the server is running before PAR tries to fetch client metadata
30
-
func RunInteractiveFlow(ctx context.Context, cfg InteractiveFlowConfig,
31
-
setupCallback func(authURL string, handler *CallbackHandler, metadata *ClientMetadata) error) (*FlowResult, error) {
32
-
33
-
// Create OAuth client from base URL
34
-
client, err := NewClient(cfg.BaseURL)
35
-
if err != nil {
36
-
return nil, fmt.Errorf("failed to create OAuth client: %w", err)
37
-
}
38
-
39
-
// Initialize for the given handle
40
-
initCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
41
-
defer cancel()
42
-
43
-
if err := client.InitializeForHandle(initCtx, cfg.Handle); err != nil {
44
-
return nil, fmt.Errorf("failed to initialize client: %w", err)
45
-
}
46
-
47
-
// Set scopes if provided
48
-
if len(cfg.Scopes) > 0 {
49
-
client.SetScopes(cfg.Scopes)
50
-
}
51
-
52
-
// Generate state for OAuth flow
53
-
state, err := GenerateState()
54
-
if err != nil {
55
-
return nil, fmt.Errorf("failed to generate state: %w", err)
56
-
}
57
-
58
-
// Create callback handler and client metadata FIRST
59
-
callbackHandler := NewCallbackHandler(state)
60
-
metadata := NewClientMetadata(client.ClientID(), []string{client.RedirectURI()})
61
-
62
-
// Start server BEFORE generating auth URL (so PAR can fetch metadata)
63
-
if err := setupCallback("", callbackHandler, metadata); err != nil {
64
-
return nil, fmt.Errorf("callback setup failed: %w", err)
65
-
}
66
-
67
-
// NOW generate authorization URL with PKCE (PAR can succeed)
68
-
authURL, codeVerifier, err := client.AuthorizeURL(state)
69
-
if err != nil {
70
-
return nil, fmt.Errorf("failed to generate auth URL: %w", err)
71
-
}
72
-
73
-
// Display the auth URL (callback gets called again with URL)
74
-
if err := setupCallback(authURL, callbackHandler, metadata); err != nil {
75
-
return nil, fmt.Errorf("failed to display auth URL: %w", err)
76
-
}
77
-
78
-
// Wait for callback (5 minute timeout)
79
-
code, err := callbackHandler.WaitForCode(5 * time.Minute)
80
-
if err != nil {
81
-
return nil, err
82
-
}
83
-
84
-
// Exchange code for token
85
-
exchangeCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
86
-
defer cancel()
87
-
88
-
token, err := client.Exchange(exchangeCtx, code, codeVerifier)
89
-
if err != nil {
90
-
return nil, fmt.Errorf("failed to exchange code: %w", err)
91
-
}
92
-
93
-
return &FlowResult{
94
-
Token: token,
95
-
Client: client,
96
-
}, nil
97
-
}
-50
pkg/auth/oauth/metadata.go
-50
pkg/auth/oauth/metadata.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"encoding/json"
5
-
"net/http"
6
-
)
7
-
8
-
// ClientMetadata represents the OAuth client metadata document
9
-
// This follows the ATProto OAuth client metadata specification
10
-
type ClientMetadata struct {
11
-
ClientID string `json:"client_id"`
12
-
ClientName string `json:"client_name,omitempty"`
13
-
ClientURI string `json:"client_uri,omitempty"`
14
-
RedirectURIs []string `json:"redirect_uris"`
15
-
GrantTypes []string `json:"grant_types"`
16
-
ResponseTypes []string `json:"response_types"`
17
-
Scope string `json:"scope"`
18
-
TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"`
19
-
ApplicationType string `json:"application_type"`
20
-
DPoPBoundAccessTokens bool `json:"dpop_bound_access_tokens"`
21
-
}
22
-
23
-
// NewClientMetadata creates a client metadata document for ATProto OAuth
24
-
func NewClientMetadata(clientID string, redirectURIs []string) *ClientMetadata {
25
-
return &ClientMetadata{
26
-
ClientID: clientID,
27
-
ClientName: "ATCR Registry",
28
-
ClientURI: "https://github.com/yourusername/atcr.io",
29
-
RedirectURIs: redirectURIs,
30
-
GrantTypes: []string{"authorization_code", "refresh_token"},
31
-
ResponseTypes: []string{"code"},
32
-
Scope: "atproto",
33
-
TokenEndpointAuthMethod: "none", // Public client
34
-
ApplicationType: "native",
35
-
DPoPBoundAccessTokens: true,
36
-
}
37
-
}
38
-
39
-
// ServeMetadata returns an HTTP handler that serves the client metadata JSON
40
-
func ServeMetadata(metadata *ClientMetadata) http.HandlerFunc {
41
-
return func(w http.ResponseWriter, r *http.Request) {
42
-
w.Header().Set("Content-Type", "application/json")
43
-
w.Header().Set("Access-Control-Allow-Origin", "*")
44
-
45
-
if err := json.NewEncoder(w).Encode(metadata); err != nil {
46
-
http.Error(w, "failed to encode metadata", http.StatusInternalServerError)
47
-
return
48
-
}
49
-
}
50
-
}
+140
-106
pkg/auth/oauth/refresher.go
+140
-106
pkg/auth/oauth/refresher.go
···
2
2
3
3
import (
4
4
"context"
5
-
"crypto/ecdsa"
6
5
"fmt"
6
+
"net/http"
7
7
"sync"
8
-
"time"
8
+
9
+
"github.com/bluesky-social/indigo/atproto/auth/oauth"
10
+
"github.com/bluesky-social/indigo/atproto/syntax"
9
11
)
10
12
11
-
// AccessTokenEntry represents a cached access token
12
-
type AccessTokenEntry struct {
13
-
Token string
14
-
DPoPKey *ecdsa.PrivateKey
15
-
PDS string // Store PDS endpoint to create fresh transports
16
-
ExpiresAt time.Time
13
+
// SessionCache represents a cached OAuth session
14
+
type SessionCache struct {
15
+
Session *oauth.ClientSession
16
+
SessionID string
17
17
}
18
18
19
-
// Refresher manages OAuth token refresh for AppView
19
+
// Refresher manages OAuth sessions and token refresh for AppView
20
20
type Refresher struct {
21
-
storage *RefreshTokenStorage
22
-
accessTokens map[string]*AccessTokenEntry
21
+
app *App
22
+
sessions map[string]*SessionCache // Key: DID string
23
23
mu sync.RWMutex
24
24
refreshLocks map[string]*sync.Mutex // Per-DID locks for refresh operations
25
25
refreshLockMu sync.Mutex // Protects refreshLocks map
26
-
baseURL string
27
26
}
28
27
29
-
// NewRefresher creates a new token refresher
30
-
func NewRefresher(storage *RefreshTokenStorage, baseURL string) *Refresher {
28
+
// NewRefresher creates a new session refresher
29
+
func NewRefresher(app *App) *Refresher {
31
30
return &Refresher{
32
-
storage: storage,
33
-
accessTokens: make(map[string]*AccessTokenEntry),
31
+
app: app,
32
+
sessions: make(map[string]*SessionCache),
34
33
refreshLocks: make(map[string]*sync.Mutex),
35
-
baseURL: baseURL,
36
34
}
37
35
}
38
36
39
-
// GetAccessToken gets a fresh access token for a DID
40
-
// Returns cached token if still valid, otherwise refreshes
41
-
// Returns: accessToken, dpopKey, dpopTransport, error
42
-
func (r *Refresher) GetAccessToken(ctx context.Context, did string) (string, *ecdsa.PrivateKey, *DPoPTransport, error) {
37
+
// GetSession gets a fresh OAuth session for a DID
38
+
// Returns cached session if still valid, otherwise resumes from store
39
+
func (r *Refresher) GetSession(ctx context.Context, did string) (*oauth.ClientSession, error) {
43
40
// Check cache first (fast path)
44
41
r.mu.RLock()
45
-
entry, ok := r.accessTokens[did]
42
+
cached, ok := r.sessions[did]
46
43
r.mu.RUnlock()
47
44
48
-
if ok && time.Now().Before(entry.ExpiresAt) {
49
-
// Token still valid - create fresh transport to avoid nonce reuse
50
-
transport := NewDPoPTransport(nil, entry.DPoPKey)
51
-
transport.SetAccessToken(entry.Token)
52
-
return entry.Token, entry.DPoPKey, transport, nil
45
+
if ok && cached.Session != nil {
46
+
// Session cached, tokens will auto-refresh if needed
47
+
return cached.Session, nil
53
48
}
54
49
55
-
// Token expired or not cached, need to refresh
56
-
// Get or create per-DID lock to prevent concurrent refreshes
50
+
// Session not cached, need to resume from store
51
+
// Get or create per-DID lock to prevent concurrent resume operations
57
52
r.refreshLockMu.Lock()
58
53
didLock, ok := r.refreshLocks[did]
59
54
if !ok {
···
66
61
didLock.Lock()
67
62
defer didLock.Unlock()
68
63
69
-
// Double-check cache after acquiring lock (another goroutine might have refreshed)
64
+
// Double-check cache after acquiring lock (another goroutine might have loaded it)
70
65
r.mu.RLock()
71
-
entry, ok = r.accessTokens[did]
66
+
cached, ok = r.sessions[did]
72
67
r.mu.RUnlock()
73
68
74
-
if ok && time.Now().Before(entry.ExpiresAt) {
75
-
// Token was refreshed while we waited for the lock - create fresh transport
76
-
transport := NewDPoPTransport(nil, entry.DPoPKey)
77
-
transport.SetAccessToken(entry.Token)
78
-
return entry.Token, entry.DPoPKey, transport, nil
69
+
if ok && cached.Session != nil {
70
+
return cached.Session, nil
79
71
}
80
72
81
-
// Actually refresh the token
82
-
return r.RefreshToken(ctx, did)
73
+
// Actually resume the session
74
+
return r.resumeSession(ctx, did)
83
75
}
84
76
85
-
// RefreshToken forces a token refresh for a DID
86
-
// Returns: accessToken, dpopKey, dpopTransport, error
87
-
func (r *Refresher) RefreshToken(ctx context.Context, did string) (string, *ecdsa.PrivateKey, *DPoPTransport, error) {
88
-
// Get stored refresh token
89
-
entry, err := r.storage.Get(did)
77
+
// GetAccessToken gets a fresh access token for a DID
78
+
// This is a convenience method that extracts the access token from the session
79
+
func (r *Refresher) GetAccessToken(ctx context.Context, did string) (string, error) {
80
+
session, err := r.GetSession(ctx, did)
90
81
if err != nil {
91
-
return "", nil, nil, fmt.Errorf("failed to get stored refresh token: %w", err)
82
+
return "", err
92
83
}
93
84
94
-
// Parse DPoP key
95
-
dpopKey, err := r.storage.GetDPoPKey(did)
85
+
// Get access token and DPoP nonce from session
86
+
accessToken, _ := session.GetHostAccessData()
87
+
return accessToken, nil
88
+
}
89
+
90
+
// GetHTTPClient returns an HTTP client with DPoP authentication for a DID
91
+
// The client automatically adds DPoP headers and refreshes tokens as needed
92
+
func (r *Refresher) GetHTTPClient(ctx context.Context, did string) (*http.Client, error) {
93
+
session, err := r.GetSession(ctx, did)
96
94
if err != nil {
97
-
return "", nil, nil, fmt.Errorf("failed to get DPoP key: %w", err)
95
+
return nil, err
98
96
}
99
97
100
-
// Create OAuth client with stored DPoP key
101
-
client := NewClientWithKey(r.baseURL, dpopKey)
98
+
// Get API client from session
99
+
// This client automatically handles DPoP and token refresh
100
+
apiClient := session.APIClient()
101
+
return apiClient.Client, nil
102
+
}
102
103
103
-
// Initialize for PDS endpoint
104
-
if err := client.InitializeForPDS(ctx, entry.PDS); err != nil {
105
-
return "", nil, nil, fmt.Errorf("failed to initialize OAuth client: %w", err)
106
-
}
107
-
108
-
// Refresh the token
109
-
token, err := client.RefreshToken(ctx, entry.RefreshToken)
104
+
// resumeSession loads a session from storage and caches it
105
+
func (r *Refresher) resumeSession(ctx context.Context, did string) (*oauth.ClientSession, error) {
106
+
// Parse DID
107
+
accountDID, err := syntax.ParseDID(did)
110
108
if err != nil {
111
-
return "", nil, nil, fmt.Errorf("failed to refresh token: %w", err)
109
+
return nil, fmt.Errorf("failed to parse DID: %w", err)
112
110
}
113
111
114
-
// Update last refresh timestamp
115
-
if err := r.storage.UpdateLastRefresh(did); err != nil {
116
-
// Log but don't fail - this is not critical
117
-
fmt.Printf("WARNING: failed to update last refresh timestamp for %s: %v\n", did, err)
112
+
// Get all sessions for this DID from store
113
+
fileStore, ok := r.app.clientApp.Store.(*FileStore)
114
+
if !ok {
115
+
return nil, fmt.Errorf("store is not a FileStore")
118
116
}
119
117
120
-
// If a new refresh token was issued, update storage
121
-
if token.RefreshToken != "" && token.RefreshToken != entry.RefreshToken {
122
-
entry.RefreshToken = token.RefreshToken
123
-
if err := r.storage.Store(did, entry); err != nil {
124
-
// Log but don't fail - we have the access token
125
-
fmt.Printf("WARNING: failed to update refresh token for %s: %v\n", did, err)
118
+
// Find a session for this DID
119
+
sessions := fileStore.ListSessions()
120
+
var sessionID string
121
+
for _, sessionData := range sessions {
122
+
if sessionData.AccountDID.String() == did {
123
+
sessionID = sessionData.SessionID
124
+
break
126
125
}
127
126
}
128
127
129
-
// Cache the access token (but not transport - create fresh each time)
130
-
// Expire 1 minute early to avoid edge cases
131
-
expiresAt := token.Expiry.Add(-1 * time.Minute)
128
+
if sessionID == "" {
129
+
return nil, fmt.Errorf("no session found for DID: %s", did)
130
+
}
131
+
132
+
// Resume session
133
+
session, err := r.app.ResumeSession(ctx, accountDID, sessionID)
134
+
if err != nil {
135
+
return nil, fmt.Errorf("failed to resume session: %w", err)
136
+
}
132
137
138
+
// Cache the session
133
139
r.mu.Lock()
134
-
r.accessTokens[did] = &AccessTokenEntry{
135
-
Token: token.AccessToken,
136
-
DPoPKey: dpopKey,
137
-
PDS: entry.PDS,
138
-
ExpiresAt: expiresAt,
140
+
r.sessions[did] = &SessionCache{
141
+
Session: session,
142
+
SessionID: sessionID,
139
143
}
140
144
r.mu.Unlock()
141
145
142
-
// Create fresh transport for this request
143
-
dpopTransport := NewDPoPTransport(nil, dpopKey)
144
-
dpopTransport.SetAccessToken(token.AccessToken)
145
-
146
-
return token.AccessToken, dpopKey, dpopTransport, nil
146
+
return session, nil
147
147
}
148
148
149
-
// InvalidateAccessToken removes a cached access token for a DID
150
-
// This is useful when a new refresh token is obtained (e.g., after re-authorization)
151
-
func (r *Refresher) InvalidateAccessToken(did string) {
149
+
// InvalidateSession removes a cached session for a DID
150
+
// This is useful when a new OAuth flow creates a fresh session
151
+
func (r *Refresher) InvalidateSession(did string) {
152
152
r.mu.Lock()
153
-
delete(r.accessTokens, did)
153
+
delete(r.sessions, did)
154
154
r.mu.Unlock()
155
155
}
156
156
157
-
// RevokeToken removes stored refresh token and cached access token
158
-
func (r *Refresher) RevokeToken(did string) error {
157
+
// RevokeSession removes a session from both cache and storage
158
+
func (r *Refresher) RevokeSession(ctx context.Context, did string) error {
159
+
// Remove from cache
159
160
r.mu.Lock()
160
-
delete(r.accessTokens, did)
161
+
cached, ok := r.sessions[did]
162
+
delete(r.sessions, did)
161
163
r.mu.Unlock()
162
164
163
-
return r.storage.Delete(did)
165
+
if !ok {
166
+
// Not cached, still try to delete from storage
167
+
accountDID, err := syntax.ParseDID(did)
168
+
if err != nil {
169
+
return fmt.Errorf("failed to parse DID: %w", err)
170
+
}
171
+
172
+
// Find session ID from store
173
+
fileStore, ok := r.app.clientApp.Store.(*FileStore)
174
+
if !ok {
175
+
return fmt.Errorf("store is not a FileStore")
176
+
}
177
+
178
+
sessions := fileStore.ListSessions()
179
+
for _, sessionData := range sessions {
180
+
if sessionData.AccountDID.String() == did {
181
+
return r.app.clientApp.Store.DeleteSession(ctx, accountDID, sessionData.SessionID)
182
+
}
183
+
}
184
+
185
+
return fmt.Errorf("no session found for DID: %s", did)
186
+
}
187
+
188
+
// Revoke the session via OAuth
189
+
if err := cached.Session.RevokeSession(ctx); err != nil {
190
+
fmt.Printf("WARNING: failed to revoke session for %s: %v\n", did, err)
191
+
// Continue anyway to delete from storage
192
+
}
193
+
194
+
// Delete from storage
195
+
accountDID, err := syntax.ParseDID(did)
196
+
if err != nil {
197
+
return fmt.Errorf("failed to parse DID: %w", err)
198
+
}
199
+
200
+
return r.app.clientApp.Store.DeleteSession(ctx, accountDID, cached.SessionID)
164
201
}
165
202
166
-
// CleanupExpiredTokens removes expired access tokens from cache
167
-
// Should be called periodically (e.g., every hour)
168
-
func (r *Refresher) CleanupExpiredTokens() {
203
+
// CleanupExpiredSessions removes expired sessions from cache
204
+
// Note: indigo handles token expiry automatically, but we clean up orphaned cache entries
205
+
func (r *Refresher) CleanupExpiredSessions(ctx context.Context) {
169
206
r.mu.Lock()
170
207
defer r.mu.Unlock()
171
208
172
-
now := time.Now()
173
-
for did, entry := range r.accessTokens {
174
-
if now.After(entry.ExpiresAt) {
175
-
delete(r.accessTokens, did)
209
+
// For each cached session, verify it still exists in storage
210
+
for did, cached := range r.sessions {
211
+
accountDID, err := syntax.ParseDID(did)
212
+
if err != nil {
213
+
delete(r.sessions, did)
214
+
continue
176
215
}
177
-
}
178
-
}
179
216
180
-
// StartCleanupRoutine starts a background goroutine to cleanup expired tokens
181
-
func (r *Refresher) StartCleanupRoutine(interval time.Duration) {
182
-
go func() {
183
-
ticker := time.NewTicker(interval)
184
-
defer ticker.Stop()
185
-
186
-
for range ticker.C {
187
-
r.CleanupExpiredTokens()
217
+
// Try to get session from store
218
+
_, err = r.app.clientApp.Store.GetSession(ctx, accountDID, cached.SessionID)
219
+
if err != nil {
220
+
// Session no longer exists, remove from cache
221
+
delete(r.sessions, did)
188
222
}
189
-
}()
223
+
}
190
224
}
+55
-159
pkg/auth/oauth/server.go
+55
-159
pkg/auth/oauth/server.go
···
2
2
3
3
import (
4
4
"context"
5
-
"crypto/ecdsa"
6
-
"crypto/rand"
7
5
"fmt"
8
6
"html/template"
9
7
"net/http"
10
-
"sync"
11
8
"time"
12
9
13
-
"atcr.io/pkg/atproto"
14
10
"atcr.io/pkg/auth/session"
15
11
)
16
12
···
21
17
22
18
// Server handles OAuth authorization for the AppView
23
19
type Server struct {
24
-
storage *RefreshTokenStorage
20
+
app *App
25
21
sessionManager *session.Manager
26
-
resolver *atproto.Resolver
27
22
refresher *Refresher
28
23
uiSessionStore UISessionStore
29
-
baseURL string
30
-
states map[string]*OAuthState
31
-
statesMu sync.RWMutex
32
-
}
33
-
34
-
// OAuthState tracks an in-progress OAuth flow
35
-
type OAuthState struct {
36
-
State string
37
-
Handle string
38
-
DID string
39
-
PDSEndpoint string
40
-
CodeVerifier string
41
-
DPoPKey *ecdsa.PrivateKey
42
-
CreatedAt time.Time
43
24
}
44
25
45
26
// NewServer creates a new OAuth server
46
-
func NewServer(storage *RefreshTokenStorage, sessionManager *session.Manager, baseURL string) *Server {
27
+
func NewServer(app *App, sessionManager *session.Manager) *Server {
47
28
return &Server{
48
-
storage: storage,
29
+
app: app,
49
30
sessionManager: sessionManager,
50
-
resolver: atproto.NewResolver(),
51
-
refresher: nil, // Will be set via SetRefresher()
52
-
baseURL: baseURL,
53
-
states: make(map[string]*OAuthState),
54
31
}
55
32
}
56
33
57
-
// SetRefresher sets the refresher for invalidating access token cache
34
+
// SetRefresher sets the refresher for invalidating session cache
58
35
func (s *Server) SetRefresher(refresher *Refresher) {
59
36
s.refresher = refresher
60
37
}
···
80
57
81
58
fmt.Printf("DEBUG [oauth/server]: Starting OAuth flow for handle=%s\n", handle)
82
59
83
-
// Resolve handle to DID and PDS
84
-
did, pdsEndpoint, err := s.resolver.ResolveIdentity(r.Context(), handle)
60
+
// Start auth flow via indigo
61
+
authURL, err := s.app.StartAuthFlow(r.Context(), handle)
85
62
if err != nil {
86
-
fmt.Printf("ERROR [oauth/server]: Failed to resolve handle: %v\n", err)
87
-
http.Error(w, fmt.Sprintf("failed to resolve handle: %v", err), http.StatusBadRequest)
88
-
return
89
-
}
90
-
91
-
fmt.Printf("DEBUG [oauth/server]: Resolved handle=%s -> did=%s, pds=%s\n", handle, did, pdsEndpoint)
92
-
93
-
// Create OAuth client from base URL
94
-
fmt.Printf("DEBUG [oauth/server]: Creating OAuth client for baseURL=%s\n", s.baseURL)
95
-
client, err := NewClient(s.baseURL)
96
-
if err != nil {
97
-
fmt.Printf("ERROR [oauth/server]: Failed to create OAuth client: %v\n", err)
98
-
http.Error(w, fmt.Sprintf("failed to create OAuth client: %v", err), http.StatusInternalServerError)
99
-
return
100
-
}
101
-
102
-
// Initialize for the handle's PDS
103
-
fmt.Printf("DEBUG [oauth/server]: Initializing OAuth client for handle=%s\n", handle)
104
-
if err := client.InitializeForHandle(r.Context(), handle); err != nil {
105
-
fmt.Printf("ERROR [oauth/server]: Failed to initialize OAuth: %v\n", err)
106
-
http.Error(w, fmt.Sprintf("failed to initialize OAuth: %v", err), http.StatusInternalServerError)
107
-
return
108
-
}
109
-
110
-
// Generate authorization URL
111
-
state := generateState()
112
-
fmt.Printf("DEBUG [oauth/server]: Generating authorization URL with state=%s\n", state)
113
-
authURL, codeVerifier, err := client.AuthorizeURL(state)
114
-
if err != nil {
115
-
fmt.Printf("ERROR [oauth/server]: Failed to generate auth URL: %v\n", err)
116
-
http.Error(w, fmt.Sprintf("failed to generate auth URL: %v", err), http.StatusInternalServerError)
63
+
fmt.Printf("ERROR [oauth/server]: Failed to start auth flow: %v\n", err)
64
+
http.Error(w, fmt.Sprintf("failed to start auth flow: %v", err), http.StatusInternalServerError)
117
65
return
118
66
}
119
67
120
68
fmt.Printf("DEBUG [oauth/server]: Generated authURL=%s\n", authURL)
121
-
122
-
// Store state for callback
123
-
s.statesMu.Lock()
124
-
s.states[state] = &OAuthState{
125
-
State: state,
126
-
Handle: handle,
127
-
DID: did,
128
-
PDSEndpoint: pdsEndpoint,
129
-
CodeVerifier: codeVerifier,
130
-
DPoPKey: client.dpopKey,
131
-
CreatedAt: time.Now(),
132
-
}
133
-
s.statesMu.Unlock()
134
69
135
70
// Redirect to PDS authorization page
71
+
// Note: indigo handles state internally via the auth store
136
72
http.Redirect(w, r, authURL, http.StatusFound)
137
73
}
138
74
···
143
79
return
144
80
}
145
81
146
-
// Get code and state from query parameters
147
-
code := r.URL.Query().Get("code")
148
-
state := r.URL.Query().Get("state")
82
+
// Check for OAuth error
83
+
if errorParam := r.URL.Query().Get("error"); errorParam != "" {
84
+
errorDesc := r.URL.Query().Get("error_description")
85
+
s.renderError(w, fmt.Sprintf("OAuth error: %s - %s", errorParam, errorDesc))
86
+
return
87
+
}
149
88
150
-
if code == "" || state == "" {
151
-
s.renderError(w, "Missing code or state parameter")
89
+
// Process OAuth callback via indigo (handles state validation internally)
90
+
sessionData, err := s.app.ProcessCallback(r.Context(), r.URL.Query())
91
+
if err != nil {
92
+
s.renderError(w, fmt.Sprintf("Failed to process OAuth callback: %v", err))
152
93
return
153
94
}
154
95
155
-
// Retrieve OAuth state
156
-
s.statesMu.Lock()
157
-
oauthState, ok := s.states[state]
158
-
delete(s.states, state) // Consume state
159
-
s.statesMu.Unlock()
96
+
did := sessionData.AccountDID.String()
97
+
sessionID := sessionData.SessionID
160
98
161
-
if !ok {
162
-
s.renderError(w, "Invalid or expired state")
163
-
return
99
+
fmt.Printf("DEBUG [oauth/server]: OAuth callback successful for DID=%s, sessionID=%s\n", did, sessionID)
100
+
101
+
// Invalidate cached session (if any) since we have a new session with new tokens
102
+
if s.refresher != nil {
103
+
s.refresher.InvalidateSession(did)
104
+
fmt.Printf("DEBUG [oauth/server]: Invalidated cached session for DID=%s after creating new session\n", did)
105
+
}
106
+
107
+
// We need to get the handle for the session token
108
+
// Resolve DID to handle using our resolver
109
+
handle, err := s.resolveHandle(r.Context(), did)
110
+
if err != nil {
111
+
fmt.Printf("WARNING [oauth/server]: Failed to resolve DID to handle: %v, using DID as handle\n", err)
112
+
handle = did // Fallback to DID if resolution fails
164
113
}
165
114
166
-
// Exchange code for tokens
167
-
sessionToken, err := s.exchangeCodeForSession(r.Context(), code, oauthState)
115
+
// Create session token for credential helper
116
+
sessionToken, err := s.sessionManager.Create(did, handle)
168
117
if err != nil {
169
-
s.renderError(w, fmt.Sprintf("Failed to exchange code: %v", err))
118
+
s.renderError(w, fmt.Sprintf("Failed to create session token: %v", err))
170
119
return
171
120
}
172
121
173
122
// Check if this is a UI login (has oauth_return_to cookie)
174
123
if cookie, err := r.Cookie("oauth_return_to"); err == nil && s.uiSessionStore != nil {
175
-
// Create UI session with PDS endpoint
176
-
sessionID, err := s.uiSessionStore.Create(oauthState.DID, oauthState.Handle, oauthState.PDSEndpoint, 24*time.Hour)
124
+
// Create UI session
125
+
uiSessionID, err := s.uiSessionStore.Create(did, handle, sessionData.HostURL, 24*time.Hour)
177
126
if err != nil {
178
127
s.renderError(w, fmt.Sprintf("Failed to create UI session: %v", err))
179
128
return
···
182
131
// Set UI session cookie
183
132
http.SetCookie(w, &http.Cookie{
184
133
Name: "atcr_session",
185
-
Value: sessionID,
134
+
Value: uiSessionID,
186
135
Path: "/",
187
136
MaxAge: 86400, // 24 hours
188
137
HttpOnly: true,
···
209
158
}
210
159
211
160
// Render success page with session token (for credential helper)
212
-
s.renderSuccess(w, sessionToken, oauthState.Handle)
161
+
s.renderSuccess(w, sessionToken, handle)
213
162
}
214
163
215
-
// exchangeCodeForSession exchanges authorization code for tokens and creates session
216
-
func (s *Server) exchangeCodeForSession(ctx context.Context, code string, state *OAuthState) (string, error) {
217
-
// Create OAuth client with stored DPoP key
218
-
client := NewClientWithKey(s.baseURL, state.DPoPKey)
219
-
220
-
// Initialize for PDS endpoint
221
-
if err := client.InitializeForPDS(ctx, state.PDSEndpoint); err != nil {
222
-
return "", fmt.Errorf("failed to initialize OAuth client: %w", err)
223
-
}
224
-
225
-
// Exchange code for token
226
-
token, err := client.Exchange(ctx, code, state.CodeVerifier)
164
+
// resolveHandle attempts to resolve a DID to a handle
165
+
// This is a best-effort helper - we use the resolver to look up the handle
166
+
func (s *Server) resolveHandle(ctx context.Context, did string) (string, error) {
167
+
// Parse the DID document to get the handle
168
+
// Note: This is a simple implementation - in production we might want to cache this
169
+
doc, err := s.app.resolver.ResolveDIDDocument(ctx, did)
227
170
if err != nil {
228
-
return "", fmt.Errorf("failed to exchange code: %w", err)
171
+
return "", fmt.Errorf("failed to resolve DID document: %w", err)
229
172
}
230
173
231
-
// Encode DPoP key to PEM
232
-
dpopKeyPEM, err := EncodeDPoPKey(state.DPoPKey)
233
-
if err != nil {
234
-
return "", fmt.Errorf("failed to encode DPoP key: %w", err)
174
+
// Try to find a handle in the alsoKnownAs field
175
+
for _, aka := range doc.AlsoKnownAs {
176
+
if len(aka) > 5 && aka[:5] == "at://" {
177
+
return aka[5:], nil
178
+
}
235
179
}
236
180
237
-
// Store refresh token
238
-
refreshEntry := &RefreshTokenEntry{
239
-
RefreshToken: token.RefreshToken,
240
-
DPoPKeyPEM: dpopKeyPEM,
241
-
PDS: state.PDSEndpoint,
242
-
Handle: state.Handle,
243
-
CreatedAt: time.Now(),
244
-
LastRefresh: time.Now(),
245
-
}
246
-
247
-
if err := s.storage.Store(state.DID, refreshEntry); err != nil {
248
-
return "", fmt.Errorf("failed to store refresh token: %w", err)
249
-
}
250
-
251
-
// Invalidate cached access token (if any) since we have a new refresh token with new scopes
252
-
if s.refresher != nil {
253
-
s.refresher.InvalidateAccessToken(state.DID)
254
-
fmt.Printf("DEBUG [oauth/server]: Invalidated cached access token for DID=%s after storing new refresh token\n", state.DID)
255
-
}
256
-
257
-
// Create session token for credential helper
258
-
sessionToken, err := s.sessionManager.Create(state.DID, state.Handle)
259
-
if err != nil {
260
-
return "", fmt.Errorf("failed to create session token: %w", err)
261
-
}
262
-
263
-
return sessionToken, nil
181
+
return "", fmt.Errorf("no handle found in DID document")
264
182
}
265
183
266
184
// renderSuccess renders the success page
···
294
212
if err := tmpl.Execute(w, data); err != nil {
295
213
http.Error(w, "failed to render template", http.StatusInternalServerError)
296
214
}
297
-
}
298
-
299
-
// CleanupExpiredStates removes expired OAuth states
300
-
// Should be called periodically
301
-
func (s *Server) CleanupExpiredStates() {
302
-
s.statesMu.Lock()
303
-
defer s.statesMu.Unlock()
304
-
305
-
now := time.Now()
306
-
for state, oauthState := range s.states {
307
-
// States expire after 10 minutes
308
-
if now.Sub(oauthState.CreatedAt) > 10*time.Minute {
309
-
delete(s.states, state)
310
-
}
311
-
}
312
-
}
313
-
314
-
// generateState generates a random state parameter
315
-
func generateState() string {
316
-
b := make([]byte, 32)
317
-
rand.Read(b)
318
-
return fmt.Sprintf("%x", b)
319
215
}
320
216
321
217
// HTML templates
-112
pkg/auth/oauth/storage.go
-112
pkg/auth/oauth/storage.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"crypto/ecdsa"
5
-
"crypto/x509"
6
-
"encoding/json"
7
-
"encoding/pem"
8
-
"fmt"
9
-
"os"
10
-
"path/filepath"
11
-
"time"
12
-
)
13
-
14
-
// TokenStore represents persisted OAuth tokens and DPoP key
15
-
type TokenStore struct {
16
-
AccessToken string `json:"access_token"`
17
-
RefreshToken string `json:"refresh_token,omitempty"`
18
-
TokenType string `json:"token_type"`
19
-
ExpiresAt time.Time `json:"expires_at"`
20
-
DPoPKeyPEM string `json:"dpop_key_pem"` // ECDSA private key in PEM format
21
-
DID string `json:"did,omitempty"`
22
-
Handle string `json:"handle,omitempty"`
23
-
}
24
-
25
-
// Save persists the token store to a file
26
-
func (s *TokenStore) Save(path string) error {
27
-
// Ensure directory exists
28
-
dir := filepath.Dir(path)
29
-
if err := os.MkdirAll(dir, 0700); err != nil {
30
-
return fmt.Errorf("failed to create token directory: %w", err)
31
-
}
32
-
33
-
// Marshal to JSON
34
-
data, err := json.MarshalIndent(s, "", " ")
35
-
if err != nil {
36
-
return fmt.Errorf("failed to marshal token store: %w", err)
37
-
}
38
-
39
-
// Write to file with secure permissions
40
-
if err := os.WriteFile(path, data, 0600); err != nil {
41
-
return fmt.Errorf("failed to write token store: %w", err)
42
-
}
43
-
44
-
return nil
45
-
}
46
-
47
-
// LoadTokenStore loads a token store from a file
48
-
func LoadTokenStore(path string) (*TokenStore, error) {
49
-
data, err := os.ReadFile(path)
50
-
if err != nil {
51
-
return nil, fmt.Errorf("failed to read token store: %w", err)
52
-
}
53
-
54
-
var store TokenStore
55
-
if err := json.Unmarshal(data, &store); err != nil {
56
-
return nil, fmt.Errorf("failed to unmarshal token store: %w", err)
57
-
}
58
-
59
-
return &store, nil
60
-
}
61
-
62
-
// GetDPoPKey decodes the PEM-encoded DPoP private key
63
-
func (s *TokenStore) GetDPoPKey() (*ecdsa.PrivateKey, error) {
64
-
block, _ := pem.Decode([]byte(s.DPoPKeyPEM))
65
-
if block == nil {
66
-
return nil, fmt.Errorf("failed to decode PEM block")
67
-
}
68
-
69
-
key, err := x509.ParseECPrivateKey(block.Bytes)
70
-
if err != nil {
71
-
return nil, fmt.Errorf("failed to parse EC private key: %w", err)
72
-
}
73
-
74
-
return key, nil
75
-
}
76
-
77
-
// SetDPoPKey encodes the DPoP private key as PEM
78
-
func (s *TokenStore) SetDPoPKey(key *ecdsa.PrivateKey) error {
79
-
keyBytes, err := x509.MarshalECPrivateKey(key)
80
-
if err != nil {
81
-
return fmt.Errorf("failed to marshal EC private key: %w", err)
82
-
}
83
-
84
-
pemBlock := &pem.Block{
85
-
Type: "EC PRIVATE KEY",
86
-
Bytes: keyBytes,
87
-
}
88
-
89
-
s.DPoPKeyPEM = string(pem.EncodeToMemory(pemBlock))
90
-
return nil
91
-
}
92
-
93
-
// IsExpired checks if the access token is expired
94
-
func (s *TokenStore) IsExpired() bool {
95
-
// Add a 60 second buffer to refresh before actual expiry
96
-
return time.Now().After(s.ExpiresAt.Add(-60 * time.Second))
97
-
}
98
-
99
-
// ParseDPoPKey parses a PEM-encoded ECDSA private key
100
-
func ParseDPoPKey(pemData string) (*ecdsa.PrivateKey, error) {
101
-
block, _ := pem.Decode([]byte(pemData))
102
-
if block == nil {
103
-
return nil, fmt.Errorf("failed to decode PEM block")
104
-
}
105
-
106
-
key, err := x509.ParseECPrivateKey(block.Bytes)
107
-
if err != nil {
108
-
return nil, fmt.Errorf("failed to parse EC private key: %w", err)
109
-
}
110
-
111
-
return key, nil
112
-
}
-200
pkg/auth/oauth/tokenstorage.go
-200
pkg/auth/oauth/tokenstorage.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"crypto/ecdsa"
5
-
"crypto/x509"
6
-
"encoding/json"
7
-
"encoding/pem"
8
-
"fmt"
9
-
"os"
10
-
"path/filepath"
11
-
"sync"
12
-
"time"
13
-
)
14
-
15
-
// RefreshTokenEntry represents a stored refresh token for a user
16
-
type RefreshTokenEntry struct {
17
-
RefreshToken string `json:"refresh_token"`
18
-
DPoPKeyPEM string `json:"dpop_key_pem"`
19
-
PDS string `json:"pds_endpoint"`
20
-
Handle string `json:"handle"`
21
-
CreatedAt time.Time `json:"created_at"`
22
-
LastRefresh time.Time `json:"last_refreshed"`
23
-
}
24
-
25
-
// RefreshTokenStorage manages persistent storage of refresh tokens
26
-
type RefreshTokenStorage struct {
27
-
path string
28
-
tokens map[string]*RefreshTokenEntry
29
-
mu sync.RWMutex
30
-
}
31
-
32
-
// StorageData represents the JSON structure stored on disk
33
-
type StorageData struct {
34
-
RefreshTokens map[string]*RefreshTokenEntry `json:"refresh_tokens"`
35
-
}
36
-
37
-
// NewRefreshTokenStorage creates a new refresh token storage
38
-
func NewRefreshTokenStorage(path string) (*RefreshTokenStorage, error) {
39
-
storage := &RefreshTokenStorage{
40
-
path: path,
41
-
tokens: make(map[string]*RefreshTokenEntry),
42
-
}
43
-
44
-
// Load existing tokens if file exists
45
-
if err := storage.load(); err != nil {
46
-
if !os.IsNotExist(err) {
47
-
return nil, fmt.Errorf("failed to load tokens: %w", err)
48
-
}
49
-
// File doesn't exist yet, that's ok
50
-
}
51
-
52
-
return storage, nil
53
-
}
54
-
55
-
// GetDefaultPath returns the default storage path
56
-
func GetDefaultPath() (string, error) {
57
-
homeDir, err := os.UserHomeDir()
58
-
if err != nil {
59
-
return "", fmt.Errorf("failed to get home directory: %w", err)
60
-
}
61
-
62
-
atcrDir := filepath.Join(homeDir, ".atcr")
63
-
if err := os.MkdirAll(atcrDir, 0700); err != nil {
64
-
return "", fmt.Errorf("failed to create .atcr directory: %w", err)
65
-
}
66
-
67
-
return filepath.Join(atcrDir, "appview-tokens.json"), nil
68
-
}
69
-
70
-
// Store saves a refresh token for a DID
71
-
func (s *RefreshTokenStorage) Store(did string, entry *RefreshTokenEntry) error {
72
-
s.mu.Lock()
73
-
defer s.mu.Unlock()
74
-
75
-
s.tokens[did] = entry
76
-
return s.save()
77
-
}
78
-
79
-
// Get retrieves a refresh token for a DID
80
-
func (s *RefreshTokenStorage) Get(did string) (*RefreshTokenEntry, error) {
81
-
s.mu.RLock()
82
-
defer s.mu.RUnlock()
83
-
84
-
entry, ok := s.tokens[did]
85
-
if !ok {
86
-
return nil, fmt.Errorf("no refresh token found for DID: %s", did)
87
-
}
88
-
89
-
return entry, nil
90
-
}
91
-
92
-
// Delete removes a refresh token for a DID
93
-
func (s *RefreshTokenStorage) Delete(did string) error {
94
-
s.mu.Lock()
95
-
defer s.mu.Unlock()
96
-
97
-
delete(s.tokens, did)
98
-
return s.save()
99
-
}
100
-
101
-
// List returns all stored DIDs
102
-
func (s *RefreshTokenStorage) List() []string {
103
-
s.mu.RLock()
104
-
defer s.mu.RUnlock()
105
-
106
-
dids := make([]string, 0, len(s.tokens))
107
-
for did := range s.tokens {
108
-
dids = append(dids, did)
109
-
}
110
-
return dids
111
-
}
112
-
113
-
// GetDPoPKey retrieves and parses the DPoP private key for a DID
114
-
func (s *RefreshTokenStorage) GetDPoPKey(did string) (*ecdsa.PrivateKey, error) {
115
-
entry, err := s.Get(did)
116
-
if err != nil {
117
-
return nil, err
118
-
}
119
-
120
-
// Parse PEM encoded private key
121
-
block, _ := pem.Decode([]byte(entry.DPoPKeyPEM))
122
-
if block == nil {
123
-
return nil, fmt.Errorf("failed to parse PEM block")
124
-
}
125
-
126
-
// Parse EC private key
127
-
key, err := x509.ParseECPrivateKey(block.Bytes)
128
-
if err != nil {
129
-
return nil, fmt.Errorf("failed to parse EC private key: %w", err)
130
-
}
131
-
132
-
return key, nil
133
-
}
134
-
135
-
// UpdateLastRefresh updates the last refresh timestamp for a DID
136
-
func (s *RefreshTokenStorage) UpdateLastRefresh(did string) error {
137
-
s.mu.Lock()
138
-
defer s.mu.Unlock()
139
-
140
-
entry, ok := s.tokens[did]
141
-
if !ok {
142
-
return fmt.Errorf("no refresh token found for DID: %s", did)
143
-
}
144
-
145
-
entry.LastRefresh = time.Now()
146
-
return s.save()
147
-
}
148
-
149
-
// load reads tokens from disk
150
-
func (s *RefreshTokenStorage) load() error {
151
-
data, err := os.ReadFile(s.path)
152
-
if err != nil {
153
-
return err
154
-
}
155
-
156
-
var storageData StorageData
157
-
if err := json.Unmarshal(data, &storageData); err != nil {
158
-
return fmt.Errorf("failed to parse token storage: %w", err)
159
-
}
160
-
161
-
if storageData.RefreshTokens != nil {
162
-
s.tokens = storageData.RefreshTokens
163
-
}
164
-
165
-
return nil
166
-
}
167
-
168
-
// save writes tokens to disk
169
-
func (s *RefreshTokenStorage) save() error {
170
-
storageData := StorageData{
171
-
RefreshTokens: s.tokens,
172
-
}
173
-
174
-
data, err := json.MarshalIndent(storageData, "", " ")
175
-
if err != nil {
176
-
return fmt.Errorf("failed to marshal tokens: %w", err)
177
-
}
178
-
179
-
// Write with restrictive permissions
180
-
if err := os.WriteFile(s.path, data, 0600); err != nil {
181
-
return fmt.Errorf("failed to write tokens: %w", err)
182
-
}
183
-
184
-
return nil
185
-
}
186
-
187
-
// EncodeDPoPKey encodes an ECDSA private key to PEM format
188
-
func EncodeDPoPKey(key *ecdsa.PrivateKey) (string, error) {
189
-
keyBytes, err := x509.MarshalECPrivateKey(key)
190
-
if err != nil {
191
-
return "", fmt.Errorf("failed to marshal private key: %w", err)
192
-
}
193
-
194
-
block := &pem.Block{
195
-
Type: "EC PRIVATE KEY",
196
-
Bytes: keyBytes,
197
-
}
198
-
199
-
return string(pem.EncodeToMemory(block)), nil
200
-
}
-154
pkg/auth/oauth/transport.go
-154
pkg/auth/oauth/transport.go
···
1
-
package oauth
2
-
3
-
import (
4
-
"crypto/ecdsa"
5
-
"crypto/sha256"
6
-
"encoding/base64"
7
-
"fmt"
8
-
"net/http"
9
-
"sync"
10
-
"time"
11
-
12
-
"github.com/AxisCommunications/go-dpop"
13
-
"github.com/golang-jwt/jwt/v5"
14
-
"github.com/google/uuid"
15
-
)
16
-
17
-
// DPoPTransport is an HTTP RoundTripper that adds DPoP headers to requests
18
-
type DPoPTransport struct {
19
-
base http.RoundTripper
20
-
dpopKey *ecdsa.PrivateKey
21
-
accessToken string // For computing "ath" claim
22
-
nonce string
23
-
mu sync.RWMutex // Protects nonce
24
-
}
25
-
26
-
// NewDPoPTransport creates a new DPoP transport with the given private key
27
-
func NewDPoPTransport(base http.RoundTripper, dpopKey *ecdsa.PrivateKey) *DPoPTransport {
28
-
if base == nil {
29
-
base = http.DefaultTransport
30
-
}
31
-
return &DPoPTransport{
32
-
base: base,
33
-
dpopKey: dpopKey,
34
-
}
35
-
}
36
-
37
-
// RoundTrip implements http.RoundTripper
38
-
func (t *DPoPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
39
-
// Clone the request to avoid modifying the original
40
-
reqCopy := req.Clone(req.Context())
41
-
42
-
// Generate and add DPoP proof
43
-
if err := t.addDPoPHeader(reqCopy); err != nil {
44
-
return nil, fmt.Errorf("failed to add DPoP header: %w", err)
45
-
}
46
-
47
-
// Execute the request
48
-
resp, err := t.base.RoundTrip(reqCopy)
49
-
if err != nil {
50
-
return nil, err
51
-
}
52
-
53
-
// Check for DPoP nonce in response
54
-
if nonce := resp.Header.Get("DPoP-Nonce"); nonce != "" {
55
-
t.mu.Lock()
56
-
t.nonce = nonce
57
-
t.mu.Unlock()
58
-
}
59
-
60
-
// If we get 401 with use_dpop_nonce error, retry with nonce
61
-
if resp.StatusCode == http.StatusUnauthorized {
62
-
wwwAuth := resp.Header.Get("WWW-Authenticate")
63
-
if nonce := resp.Header.Get("DPoP-Nonce"); nonce != "" && wwwAuth != "" {
64
-
// Update nonce and retry
65
-
t.mu.Lock()
66
-
t.nonce = nonce
67
-
t.mu.Unlock()
68
-
69
-
// Close the first response
70
-
resp.Body.Close()
71
-
72
-
// Retry with new nonce
73
-
reqRetry := req.Clone(req.Context())
74
-
if err := t.addDPoPHeader(reqRetry); err != nil {
75
-
return nil, fmt.Errorf("failed to add DPoP header on retry: %w", err)
76
-
}
77
-
return t.base.RoundTrip(reqRetry)
78
-
}
79
-
}
80
-
81
-
return resp, nil
82
-
}
83
-
84
-
// addDPoPHeader generates and adds a DPoP proof header to the request
85
-
func (t *DPoPTransport) addDPoPHeader(req *http.Request) error {
86
-
// Read current nonce and access token
87
-
t.mu.RLock()
88
-
nonce := t.nonce
89
-
accessToken := t.accessToken
90
-
t.mu.RUnlock()
91
-
92
-
// Create DPoP proof claims
93
-
claims := &dpop.ProofTokenClaims{
94
-
RegisteredClaims: &jwt.RegisteredClaims{
95
-
ID: uuid.New().String(),
96
-
IssuedAt: jwt.NewNumericDate(time.Now()),
97
-
},
98
-
Method: dpop.HTTPVerb(req.Method),
99
-
URL: req.URL.Scheme + "://" + req.URL.Host + req.URL.Path,
100
-
}
101
-
102
-
// Add nonce if we have one
103
-
if nonce != "" {
104
-
claims.Nonce = nonce
105
-
}
106
-
107
-
// Add "ath" (access token hash) if we have an access token
108
-
// This is required when using DPoP with an access token
109
-
if accessToken != "" {
110
-
// Compute SHA-256 hash of the access token
111
-
hash := sha256.Sum256([]byte(accessToken))
112
-
// Base64url encode the hash (without padding)
113
-
ath := base64.RawURLEncoding.EncodeToString(hash[:])
114
-
claims.AccessTokenHash = ath
115
-
}
116
-
117
-
// Generate DPoP proof
118
-
// go-dpop automatically adds the JWK to the header
119
-
proofString, err := dpop.Create(jwt.SigningMethodES256, claims, t.dpopKey)
120
-
if err != nil {
121
-
return fmt.Errorf("failed to create DPoP proof: %w", err)
122
-
}
123
-
124
-
// Add DPoP header
125
-
req.Header.Set("DPoP", proofString)
126
-
proofPreview := proofString
127
-
if len(proofPreview) > 50 {
128
-
proofPreview = proofPreview[:50]
129
-
}
130
-
fmt.Printf("DEBUG [oauth/transport]: Added DPoP proof for %s %s (proof_length=%d, first_50=%q)\n", req.Method, req.URL.String(), len(proofString), proofPreview)
131
-
132
-
return nil
133
-
}
134
-
135
-
// SetNonce manually sets the DPoP nonce (useful for initial requests)
136
-
func (t *DPoPTransport) SetNonce(nonce string) {
137
-
t.mu.Lock()
138
-
defer t.mu.Unlock()
139
-
t.nonce = nonce
140
-
}
141
-
142
-
// GetNonce returns the current DPoP nonce
143
-
func (t *DPoPTransport) GetNonce() string {
144
-
t.mu.RLock()
145
-
defer t.mu.RUnlock()
146
-
return t.nonce
147
-
}
148
-
149
-
// SetAccessToken sets the access token for computing "ath" claim
150
-
func (t *DPoPTransport) SetAccessToken(token string) {
151
-
t.mu.Lock()
152
-
defer t.mu.Unlock()
153
-
t.accessToken = token
154
-
}
+5
-3
pkg/middleware/registry.go
+5
-3
pkg/middleware/registry.go
···
117
117
118
118
if globalRefresher != nil {
119
119
// Try OAuth flow first
120
-
accessToken, dpopKey, dpopTransport, err := globalRefresher.GetAccessToken(ctx, did)
120
+
session, err := globalRefresher.GetSession(ctx, did)
121
121
if err == nil {
122
-
// OAuth token available - use cached DPoP transport (preserves nonce)
122
+
// OAuth session available
123
+
accessToken, _ := session.GetHostAccessData()
124
+
httpClient := session.APIClient().Client
123
125
fmt.Printf("DEBUG [registry/middleware]: Using OAuth access token for DID=%s (length=%d, first_20=%q)\n", did, len(accessToken), accessToken[:min(20, len(accessToken))])
124
-
atprotoClient = atproto.NewClientWithDPoP(pdsEndpoint, did, accessToken, dpopKey, dpopTransport)
126
+
atprotoClient = atproto.NewClientWithHTTPClient(pdsEndpoint, did, accessToken, httpClient)
125
127
} else {
126
128
fmt.Printf("DEBUG [registry/middleware]: OAuth refresh failed for DID=%s: %v, falling back to Basic Auth\n", did, err)
127
129
}