A container registry that uses the AT Protocol for manifest storage and S3 for blob storage.
atcr.io
docker
container
atproto
go
try and provide more helpful reponses when oauth expires and when pushing manifest lists
+434
-42
+6
-32
.tangled/workflows/release.yml
+6
-32
.tangled/workflows/release.yml
···
2
2
# Triggers on version tags and builds cross-platform binaries using buildah
3
3
4
4
when:
5
-
- event: ["manual"]
5
+
- event: ["push"]
6
6
tag: ["v*"]
7
7
8
-
engine: "nixery"
9
-
10
-
dependencies:
11
-
nixpkgs:
12
-
- buildah
13
-
- gnugrep # Required for tag detection
8
+
engine: "kubernetes"
14
9
15
10
environment:
16
11
IMAGE_REGISTRY: atcr.io
17
12
IMAGE_USER: evan.jarrett.net
18
13
19
14
steps:
20
-
- name: Get tag for current commit
21
-
command: |
22
-
# Fetch tags (shallow clone doesn't include them by default)
23
-
git fetch --tags
24
-
25
-
# Find the tag that points to the current commit
26
-
TAG=$(git tag --points-at HEAD | grep -E '^v[0-9]' | head -n1)
27
-
28
-
if [ -z "$TAG" ]; then
29
-
echo "Error: No version tag found for current commit"
30
-
echo "Available tags:"
31
-
git tag
32
-
echo "Current commit:"
33
-
git rev-parse HEAD
34
-
exit 1
35
-
fi
36
-
37
-
echo "Building version: $TAG"
38
-
echo "$TAG" > .version
39
15
40
16
- name: Setup build environment
41
17
command: |
···
53
29
54
30
- name: Build and push AppView image
55
31
command: |
56
-
TAG=$(cat .version)
57
-
32
+
echo ${TANGLED_REF_NAME}
58
33
buildah bud \
59
34
--storage-driver vfs \
60
-
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:${TAG} \
35
+
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:${TANGLED_REF_NAME} \
61
36
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:latest \
62
37
--file ./Dockerfile.appview \
63
38
.
···
68
43
69
44
- name: Build and push Hold image
70
45
command: |
71
-
TAG=$(cat .version)
72
-
46
+
echo ${TANGLED_REF_NAME}
73
47
buildah bud \
74
48
--storage-driver vfs \
75
-
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:${TAG} \
49
+
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:${TANGLED_REF_NAME} \
76
50
--tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:latest \
77
51
--file ./Dockerfile.hold \
78
52
.
+4
cmd/appview/serve.go
+4
cmd/appview/serve.go
···
409
409
// Basic Auth token endpoint (supports device secrets and app passwords)
410
410
tokenHandler := token.NewHandler(issuer, deviceStore)
411
411
412
+
// Register OAuth session checker for device auth validation
413
+
// This ensures device secrets only work when the linked OAuth session exists
414
+
tokenHandler.SetOAuthSessionChecker(oauthStore)
415
+
412
416
// Register token post-auth callback for profile management
413
417
// This decouples the token package from AppView-specific dependencies
414
418
tokenHandler.SetPostAuthCallback(func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error {
+79
-6
cmd/credential-helper/main.go
+79
-6
cmd/credential-helper/main.go
···
67
67
Error string `json:"error,omitempty"`
68
68
}
69
69
70
+
// AuthErrorResponse is the JSON error response from /auth/token
71
+
type AuthErrorResponse struct {
72
+
Error string `json:"error"`
73
+
Message string `json:"message"`
74
+
LoginURL string `json:"login_url,omitempty"`
75
+
}
76
+
77
+
// ValidationResult represents the result of credential validation
78
+
type ValidationResult struct {
79
+
Valid bool
80
+
OAuthSessionExpired bool
81
+
LoginURL string
82
+
}
83
+
70
84
var (
71
85
version = "dev"
72
86
commit = "none"
···
123
137
124
138
// If credentials exist, validate them
125
139
if found && deviceConfig.DeviceSecret != "" {
126
-
if !validateCredentials(appViewURL, deviceConfig.Handle, deviceConfig.DeviceSecret) {
140
+
result := validateCredentials(appViewURL, deviceConfig.Handle, deviceConfig.DeviceSecret)
141
+
if !result.Valid {
142
+
if result.OAuthSessionExpired {
143
+
// OAuth session expired - need to re-authenticate via browser
144
+
// Device secret is still valid, just need to restore OAuth session
145
+
fmt.Fprintf(os.Stderr, "OAuth session expired. Opening browser to re-authenticate...\n")
146
+
147
+
loginURL := result.LoginURL
148
+
if loginURL == "" {
149
+
loginURL = appViewURL + "/auth/oauth/login"
150
+
}
151
+
152
+
// Try to open browser
153
+
if err := openBrowser(loginURL); err != nil {
154
+
fmt.Fprintf(os.Stderr, "Could not open browser automatically.\n")
155
+
fmt.Fprintf(os.Stderr, "Please visit: %s\n", loginURL)
156
+
} else {
157
+
fmt.Fprintf(os.Stderr, "Please complete authentication in your browser.\n")
158
+
}
159
+
160
+
// Wait for user to complete OAuth flow, then retry
161
+
fmt.Fprintf(os.Stderr, "Waiting for authentication")
162
+
for i := 0; i < 60; i++ { // Wait up to 2 minutes
163
+
time.Sleep(2 * time.Second)
164
+
fmt.Fprintf(os.Stderr, ".")
165
+
166
+
// Retry validation
167
+
retryResult := validateCredentials(appViewURL, deviceConfig.Handle, deviceConfig.DeviceSecret)
168
+
if retryResult.Valid {
169
+
fmt.Fprintf(os.Stderr, "\n✓ Re-authenticated successfully!\n")
170
+
goto credentialsValid
171
+
}
172
+
}
173
+
fmt.Fprintf(os.Stderr, "\nAuthentication timed out. Please try again.\n")
174
+
os.Exit(1)
175
+
}
176
+
177
+
// Generic auth failure - delete credentials and re-authorize
127
178
fmt.Fprintf(os.Stderr, "Stored credentials for %s are invalid or expired\n", appViewURL)
128
179
// Delete the invalid credentials
129
180
delete(allCreds.Credentials, appViewURL)
···
134
185
found = false
135
186
}
136
187
}
188
+
credentialsValid:
137
189
138
190
if !found || deviceConfig.DeviceSecret == "" {
139
191
// No credentials for this AppView
···
550
602
}
551
603
552
604
// validateCredentials checks if the credentials are still valid by making a test request
553
-
func validateCredentials(appViewURL, handle, deviceSecret string) bool {
605
+
func validateCredentials(appViewURL, handle, deviceSecret string) ValidationResult {
554
606
// Call /auth/token to validate device secret and get JWT
555
607
// This is the proper way to validate credentials - /v2/ requires JWT, not Basic Auth
556
608
client := &http.Client{
···
562
614
563
615
req, err := http.NewRequest("GET", tokenURL, nil)
564
616
if err != nil {
565
-
return false
617
+
return ValidationResult{Valid: false}
566
618
}
567
619
568
620
// Set basic auth with device credentials
···
572
624
if err != nil {
573
625
// Network error - assume credentials are valid but server unreachable
574
626
// Don't trigger re-auth on network issues
575
-
return true
627
+
return ValidationResult{Valid: true}
576
628
}
577
629
defer resp.Body.Close()
578
630
579
631
// 200 = valid credentials
580
-
// 401 = invalid/expired credentials
632
+
if resp.StatusCode == http.StatusOK {
633
+
return ValidationResult{Valid: true}
634
+
}
635
+
636
+
// 401 = check if it's OAuth session expired
637
+
if resp.StatusCode == http.StatusUnauthorized {
638
+
// Try to parse JSON error response
639
+
body, err := io.ReadAll(resp.Body)
640
+
if err == nil {
641
+
var authErr AuthErrorResponse
642
+
if json.Unmarshal(body, &authErr) == nil && authErr.Error == "oauth_session_expired" {
643
+
return ValidationResult{
644
+
Valid: false,
645
+
OAuthSessionExpired: true,
646
+
LoginURL: authErr.LoginURL,
647
+
}
648
+
}
649
+
}
650
+
// Generic auth failure
651
+
return ValidationResult{Valid: false}
652
+
}
653
+
581
654
// Any other error = assume valid (don't re-auth on server issues)
582
-
return resp.StatusCode == http.StatusOK
655
+
return ValidationResult{Valid: true}
583
656
}
+14
pkg/appview/db/oauth_store.go
+14
pkg/appview/db/oauth_store.go
···
212
212
return &sessionData, sessionID, nil
213
213
}
214
214
215
+
// HasSessionForDID checks if an OAuth session exists for the given DID
216
+
// This is a lightweight check used by the token handler to verify device auth
217
+
func (s *OAuthStore) HasSessionForDID(ctx context.Context, did string) bool {
218
+
var count int
219
+
err := s.db.QueryRowContext(ctx, `
220
+
SELECT COUNT(*) FROM oauth_sessions WHERE account_did = ?
221
+
`, did).Scan(&count)
222
+
if err != nil {
223
+
slog.Debug("Failed to check session existence", "did", did, "error", err)
224
+
return false
225
+
}
226
+
return count > 0
227
+
}
228
+
215
229
// CleanupOldSessions removes sessions older than the specified duration
216
230
func (s *OAuthStore) CleanupOldSessions(ctx context.Context, olderThan time.Duration) error {
217
231
cutoff := time.Now().Add(-olderThan)
+31
pkg/appview/storage/manifest_store.go
+31
pkg/appview/storage/manifest_store.go
···
143
143
isManifestList := strings.Contains(manifestRecord.MediaType, "manifest.list") ||
144
144
strings.Contains(manifestRecord.MediaType, "image.index")
145
145
146
+
// Validate manifest list child references
147
+
// Reject manifest lists that reference non-existent child manifests
148
+
// This matches Docker Hub/ECR behavior and prevents users from accidentally pushing
149
+
// manifest lists where the underlying images don't exist
150
+
if isManifestList {
151
+
for _, ref := range manifestRecord.Manifests {
152
+
// Check if referenced manifest exists in user's PDS
153
+
refDigest, err := digest.Parse(ref.Digest)
154
+
if err != nil {
155
+
return "", fmt.Errorf("invalid digest in manifest list: %s", ref.Digest)
156
+
}
157
+
158
+
exists, err := s.Exists(ctx, refDigest)
159
+
if err != nil {
160
+
return "", fmt.Errorf("failed to check manifest reference: %w", err)
161
+
}
162
+
163
+
if !exists {
164
+
platform := "unknown"
165
+
if ref.Platform != nil {
166
+
platform = fmt.Sprintf("%s/%s", ref.Platform.OS, ref.Platform.Architecture)
167
+
}
168
+
slog.Warn("Manifest list references non-existent child manifest",
169
+
"repository", s.ctx.Repository,
170
+
"missingDigest", ref.Digest,
171
+
"platform", platform)
172
+
return "", distribution.ErrManifestBlobUnknown{Digest: refDigest}
173
+
}
174
+
}
175
+
}
176
+
146
177
if !isManifestList && s.blobStore != nil && manifestRecord.Config != nil && manifestRecord.Config.Digest != "" {
147
178
labels, err := s.extractConfigLabels(ctx, manifestRecord.Config.Digest)
148
179
if err != nil {
+247
pkg/appview/storage/manifest_store_test.go
+247
pkg/appview/storage/manifest_store_test.go
···
3
3
import (
4
4
"context"
5
5
"encoding/json"
6
+
"errors"
6
7
"io"
7
8
"net/http"
8
9
"net/http/httptest"
···
912
913
})
913
914
}
914
915
}
916
+
917
+
// TestManifestStore_Put_ManifestListValidation tests validation of manifest list child references
918
+
func TestManifestStore_Put_ManifestListValidation(t *testing.T) {
919
+
// Create a valid child manifest that exists
920
+
childManifest := []byte(`{
921
+
"schemaVersion":2,
922
+
"mediaType":"application/vnd.oci.image.manifest.v1+json",
923
+
"config":{"digest":"sha256:config123","size":100},
924
+
"layers":[{"digest":"sha256:layer1","size":200}]
925
+
}`)
926
+
childDigest := digest.FromBytes(childManifest)
927
+
928
+
tests := []struct {
929
+
name string
930
+
manifestList []byte
931
+
childExists bool // Whether the child manifest exists
932
+
wantErr bool
933
+
wantErrType string // "ErrManifestBlobUnknown" or empty
934
+
checkErrDigest string // Expected digest in error
935
+
}{
936
+
{
937
+
name: "valid manifest list - child exists",
938
+
manifestList: []byte(`{
939
+
"schemaVersion":2,
940
+
"mediaType":"application/vnd.oci.image.index.v1+json",
941
+
"manifests":[
942
+
{"digest":"` + childDigest.String() + `","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"amd64"}}
943
+
]
944
+
}`),
945
+
childExists: true,
946
+
wantErr: false,
947
+
},
948
+
{
949
+
name: "invalid manifest list - child does not exist",
950
+
manifestList: []byte(`{
951
+
"schemaVersion":2,
952
+
"mediaType":"application/vnd.oci.image.index.v1+json",
953
+
"manifests":[
954
+
{"digest":"sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"amd64"}}
955
+
]
956
+
}`),
957
+
childExists: false,
958
+
wantErr: true,
959
+
wantErrType: "ErrManifestBlobUnknown",
960
+
checkErrDigest: "sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
961
+
},
962
+
{
963
+
name: "attestation-only manifest list - attestation must also exist",
964
+
manifestList: []byte(`{
965
+
"schemaVersion":2,
966
+
"mediaType":"application/vnd.oci.image.index.v1+json",
967
+
"manifests":[
968
+
{"digest":"sha256:4444444444444444444444444444444444444444444444444444444444444444","size":100,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"unknown","architecture":"unknown"}}
969
+
]
970
+
}`),
971
+
childExists: false,
972
+
wantErr: true,
973
+
wantErrType: "ErrManifestBlobUnknown",
974
+
checkErrDigest: "sha256:4444444444444444444444444444444444444444444444444444444444444444",
975
+
},
976
+
{
977
+
name: "mixed manifest list - real platform missing, attestation present",
978
+
manifestList: []byte(`{
979
+
"schemaVersion":2,
980
+
"mediaType":"application/vnd.oci.image.index.v1+json",
981
+
"manifests":[
982
+
{"digest":"sha256:1111111111111111111111111111111111111111111111111111111111111111","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"arm64"}},
983
+
{"digest":"sha256:5555555555555555555555555555555555555555555555555555555555555555","size":100,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"unknown","architecture":"unknown"}}
984
+
]
985
+
}`),
986
+
childExists: false,
987
+
wantErr: true,
988
+
wantErrType: "ErrManifestBlobUnknown",
989
+
checkErrDigest: "sha256:1111111111111111111111111111111111111111111111111111111111111111",
990
+
},
991
+
{
992
+
name: "docker manifest list media type - child missing",
993
+
manifestList: []byte(`{
994
+
"schemaVersion":2,
995
+
"mediaType":"application/vnd.docker.distribution.manifest.list.v2+json",
996
+
"manifests":[
997
+
{"digest":"sha256:2222222222222222222222222222222222222222222222222222222222222222","size":300,"mediaType":"application/vnd.docker.distribution.manifest.v2+json","platform":{"os":"linux","architecture":"amd64"}}
998
+
]
999
+
}`),
1000
+
childExists: false,
1001
+
wantErr: true,
1002
+
wantErrType: "ErrManifestBlobUnknown",
1003
+
checkErrDigest: "sha256:2222222222222222222222222222222222222222222222222222222222222222",
1004
+
},
1005
+
{
1006
+
name: "manifest list with nil platform - should still validate",
1007
+
manifestList: []byte(`{
1008
+
"schemaVersion":2,
1009
+
"mediaType":"application/vnd.oci.image.index.v1+json",
1010
+
"manifests":[
1011
+
{"digest":"sha256:3333333333333333333333333333333333333333333333333333333333333333","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json"}
1012
+
]
1013
+
}`),
1014
+
childExists: false,
1015
+
wantErr: true,
1016
+
wantErrType: "ErrManifestBlobUnknown",
1017
+
checkErrDigest: "sha256:3333333333333333333333333333333333333333333333333333333333333333",
1018
+
},
1019
+
}
1020
+
1021
+
for _, tt := range tests {
1022
+
t.Run(tt.name, func(t *testing.T) {
1023
+
// Track GetRecord calls for manifest existence checks
1024
+
getRecordCalls := make(map[string]bool)
1025
+
1026
+
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1027
+
// Handle uploadBlob
1028
+
if r.URL.Path == atproto.RepoUploadBlob {
1029
+
w.WriteHeader(http.StatusOK)
1030
+
w.Write([]byte(`{"blob":{"$type":"blob","ref":{"$link":"bafytest"},"mimeType":"application/json","size":100}}`))
1031
+
return
1032
+
}
1033
+
1034
+
// Handle getRecord (for Exists check)
1035
+
if r.URL.Path == atproto.RepoGetRecord {
1036
+
rkey := r.URL.Query().Get("rkey")
1037
+
getRecordCalls[rkey] = true
1038
+
1039
+
// If child should exist, return it; otherwise return RecordNotFound
1040
+
if tt.childExists || rkey == childDigest.Encoded() {
1041
+
w.WriteHeader(http.StatusOK)
1042
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/` + rkey + `","cid":"bafytest","value":{}}`))
1043
+
} else {
1044
+
w.WriteHeader(http.StatusBadRequest)
1045
+
w.Write([]byte(`{"error":"RecordNotFound","message":"Record not found"}`))
1046
+
}
1047
+
return
1048
+
}
1049
+
1050
+
// Handle putRecord
1051
+
if r.URL.Path == atproto.RepoPutRecord {
1052
+
w.WriteHeader(http.StatusOK)
1053
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/test123","cid":"bafytest"}`))
1054
+
return
1055
+
}
1056
+
1057
+
w.WriteHeader(http.StatusOK)
1058
+
}))
1059
+
defer server.Close()
1060
+
1061
+
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
1062
+
db := &mockDatabaseMetrics{}
1063
+
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", db)
1064
+
store := NewManifestStore(ctx, nil)
1065
+
1066
+
manifest := &rawManifest{
1067
+
mediaType: "application/vnd.oci.image.index.v1+json",
1068
+
payload: tt.manifestList,
1069
+
}
1070
+
1071
+
_, err := store.Put(context.Background(), manifest)
1072
+
1073
+
if (err != nil) != tt.wantErr {
1074
+
t.Errorf("Put() error = %v, wantErr %v", err, tt.wantErr)
1075
+
return
1076
+
}
1077
+
1078
+
if tt.wantErr && tt.wantErrType == "ErrManifestBlobUnknown" {
1079
+
// Check that the error is of the correct type
1080
+
var blobErr distribution.ErrManifestBlobUnknown
1081
+
if !errors.As(err, &blobErr) {
1082
+
t.Errorf("Put() error type = %T, want distribution.ErrManifestBlobUnknown", err)
1083
+
return
1084
+
}
1085
+
1086
+
// Check that the error contains the expected digest
1087
+
if tt.checkErrDigest != "" {
1088
+
expectedDigest, _ := digest.Parse(tt.checkErrDigest)
1089
+
if blobErr.Digest != expectedDigest {
1090
+
t.Errorf("ErrManifestBlobUnknown.Digest = %v, want %v", blobErr.Digest, expectedDigest)
1091
+
}
1092
+
}
1093
+
}
1094
+
})
1095
+
}
1096
+
}
1097
+
1098
+
// TestManifestStore_Put_ManifestListValidation_MultipleChildren tests validation with multiple child manifests
1099
+
func TestManifestStore_Put_ManifestListValidation_MultipleChildren(t *testing.T) {
1100
+
// Create two valid child manifests
1101
+
childManifest1 := []byte(`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"digest":"sha256:config1","size":100},"layers":[]}`)
1102
+
childManifest2 := []byte(`{"schemaVersion":2,"mediaType":"application/vnd.oci.image.manifest.v1+json","config":{"digest":"sha256:config2","size":100},"layers":[]}`)
1103
+
childDigest1 := digest.FromBytes(childManifest1)
1104
+
childDigest2 := digest.FromBytes(childManifest2)
1105
+
1106
+
// Track which manifests exist
1107
+
existingManifests := map[string]bool{
1108
+
childDigest1.Encoded(): true,
1109
+
childDigest2.Encoded(): true,
1110
+
}
1111
+
1112
+
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
1113
+
if r.URL.Path == atproto.RepoUploadBlob {
1114
+
w.Write([]byte(`{"blob":{"$type":"blob","ref":{"$link":"bafytest"},"size":100}}`))
1115
+
return
1116
+
}
1117
+
1118
+
if r.URL.Path == atproto.RepoGetRecord {
1119
+
rkey := r.URL.Query().Get("rkey")
1120
+
if existingManifests[rkey] {
1121
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/` + rkey + `","cid":"bafytest","value":{}}`))
1122
+
} else {
1123
+
w.WriteHeader(http.StatusBadRequest)
1124
+
w.Write([]byte(`{"error":"RecordNotFound"}`))
1125
+
}
1126
+
return
1127
+
}
1128
+
1129
+
if r.URL.Path == atproto.RepoPutRecord {
1130
+
w.Write([]byte(`{"uri":"at://did:plc:test123/io.atcr.manifest/test123","cid":"bafytest"}`))
1131
+
return
1132
+
}
1133
+
1134
+
w.WriteHeader(http.StatusOK)
1135
+
}))
1136
+
defer server.Close()
1137
+
1138
+
client := atproto.NewClient(server.URL, "did:plc:test123", "token")
1139
+
ctx := mockRegistryContext(client, "myapp", "did:web:hold.example.com", "did:plc:test123", "test.handle", nil)
1140
+
store := NewManifestStore(ctx, nil)
1141
+
1142
+
// Create manifest list with both children
1143
+
manifestList := []byte(`{
1144
+
"schemaVersion":2,
1145
+
"mediaType":"application/vnd.oci.image.index.v1+json",
1146
+
"manifests":[
1147
+
{"digest":"` + childDigest1.String() + `","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"amd64"}},
1148
+
{"digest":"` + childDigest2.String() + `","size":300,"mediaType":"application/vnd.oci.image.manifest.v1+json","platform":{"os":"linux","architecture":"arm64"}}
1149
+
]
1150
+
}`)
1151
+
1152
+
manifest := &rawManifest{
1153
+
mediaType: "application/vnd.oci.image.index.v1+json",
1154
+
payload: manifestList,
1155
+
}
1156
+
1157
+
_, err := store.Put(context.Background(), manifest)
1158
+
if err != nil {
1159
+
t.Errorf("Put() should succeed when all child manifests exist, got error: %v", err)
1160
+
}
1161
+
}
+53
-4
pkg/auth/token/handler.go
+53
-4
pkg/auth/token/handler.go
···
20
20
// without coupling the token package to AppView-specific dependencies.
21
21
type PostAuthCallback func(ctx context.Context, did, handle, pdsEndpoint, accessToken string) error
22
22
23
+
// OAuthSessionChecker checks if an OAuth session exists for a DID
24
+
// This interface allows the token handler to verify OAuth sessions without
25
+
// depending directly on the OAuth store implementation.
26
+
type OAuthSessionChecker interface {
27
+
HasSessionForDID(ctx context.Context, did string) bool
28
+
}
29
+
23
30
// Handler handles /auth/token requests
24
31
type Handler struct {
25
-
issuer *Issuer
26
-
validator *auth.SessionValidator
27
-
deviceStore *db.DeviceStore // For validating device secrets
28
-
postAuthCallback PostAuthCallback
32
+
issuer *Issuer
33
+
validator *auth.SessionValidator
34
+
deviceStore *db.DeviceStore // For validating device secrets
35
+
postAuthCallback PostAuthCallback
36
+
oauthSessionChecker OAuthSessionChecker
29
37
}
30
38
31
39
// NewHandler creates a new token handler
···
41
49
// This allows AppView to inject business logic without coupling the token package
42
50
func (h *Handler) SetPostAuthCallback(callback PostAuthCallback) {
43
51
h.postAuthCallback = callback
52
+
}
53
+
54
+
// SetOAuthSessionChecker sets the OAuth session checker for validating device auth
55
+
// When set, the handler will verify OAuth sessions exist before issuing tokens for device auth
56
+
func (h *Handler) SetOAuthSessionChecker(checker OAuthSessionChecker) {
57
+
h.oauthSessionChecker = checker
44
58
}
45
59
46
60
// TokenResponse represents the response from /auth/token
···
80
94
(use your ATProto handle + app-password)`, message, baseURL, r.Host), http.StatusUnauthorized)
81
95
}
82
96
97
+
// AuthErrorResponse is returned when authentication fails in a way the credential helper can handle
98
+
type AuthErrorResponse struct {
99
+
Error string `json:"error"`
100
+
Message string `json:"message"`
101
+
LoginURL string `json:"login_url,omitempty"`
102
+
}
103
+
104
+
// sendOAuthSessionExpiredError sends a JSON error response when OAuth session is missing
105
+
// This allows the credential helper to detect this specific error and open the browser
106
+
func sendOAuthSessionExpiredError(w http.ResponseWriter, r *http.Request) {
107
+
baseURL := getBaseURL(r)
108
+
loginURL := baseURL + "/auth/oauth/login"
109
+
110
+
w.Header().Set("WWW-Authenticate", `Basic realm="ATCR Registry"`)
111
+
w.Header().Set("Content-Type", "application/json")
112
+
w.WriteHeader(http.StatusUnauthorized)
113
+
114
+
resp := AuthErrorResponse{
115
+
Error: "oauth_session_expired",
116
+
Message: "OAuth session expired or invalidated. Please re-authenticate in your browser.",
117
+
LoginURL: loginURL,
118
+
}
119
+
json.NewEncoder(w).Encode(resp)
120
+
}
121
+
83
122
// ServeHTTP handles the token request
84
123
func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
85
124
slog.Debug("Received token request", "method", r.Method, "path", r.URL.Path)
···
128
167
slog.Debug("Device secret validation failed", "error", err)
129
168
sendAuthError(w, r, "authentication failed")
130
169
return
170
+
}
171
+
172
+
// Check if OAuth session exists for this device's DID
173
+
// Device secrets are permanent, but they require an active OAuth session to work
174
+
if h.oauthSessionChecker != nil {
175
+
if !h.oauthSessionChecker.HasSessionForDID(r.Context(), device.DID) {
176
+
slog.Debug("No OAuth session for device", "did", device.DID)
177
+
sendOAuthSessionExpiredError(w, r)
178
+
return
179
+
}
131
180
}
132
181
133
182
did = device.DID