+1

apps/identity-wallet/src-tauri/Cargo.toml

reviewed

··· 35 35 rand_core = { workspace = true } 36 36 uuid = { workspace = true } 37 37 tokio = { workspace = true } 38 38 + hickory-resolver = { workspace = true } 38 39 zeroize = { workspace = true } 39 40 40 41 [dev-dependencies]

+1

apps/identity-wallet/src-tauri/src/lib.rs

reviewed

··· 5 5 pub mod keychain; 6 6 pub mod oauth; 7 7 pub mod oauth_client; 8 8 + pub mod pds_client; 8 9 9 10 use crypto::{build_did_plc_genesis_op_with_external_signer, CryptoError, DidKeyUri}; 10 11 use serde::{Deserialize, Serialize};

+205

apps/identity-wallet/src-tauri/src/pds_client.rs

reviewed

··· 1 1 + // pattern: Imperative Shell 2 2 + // 3 3 + // Gathers: PDS discovery parameters (handle, DID, OAuth metadata) 4 4 + // Processes: DNS TXT resolution, HTTP well-known fetches, PDS OAuth metadata discovery 5 5 + // Returns: PDS endpoints, authorization server metadata, or error codes 6 6 + 7 7 + use std::collections::HashMap; 8 8 + 9 9 + use reqwest::Client; 10 10 + use serde::{Deserialize, Serialize}; 11 11 + 12 12 + /// Error type for PDS client operations. 13 13 + /// 14 14 + /// Serializes to frontend with `#[serde(tag = "code", rename_all = "SCREAMING_SNAKE_CASE")]`, 15 15 + /// matching the `OAuthError` / `IdentityStoreError` pattern. 16 16 + #[derive(Debug, Serialize)] 17 17 + #[serde(tag = "code", rename_all = "SCREAMING_SNAKE_CASE")] 18 18 + pub enum PdsClientError { 19 19 + /// Neither DNS nor HTTP resolution succeeded for the handle. 20 20 + HandleNotFound, 21 21 + 22 22 + /// plc.directory returned 404 for the DID. 23 23 + DidNotFound, 24 24 + 25 25 + /// PDS endpoint is down or unreachable. 26 26 + PdsUnreachable { 27 27 + /// Reason for unreachability (transport error, connection refused, etc.). 28 28 + /// Not serialized to frontend (serde skip). 29 29 + #[serde(skip)] 30 30 + source: String, 31 31 + }, 32 32 + 33 33 + /// Transport-level failure (DNS timeout, connection refused, etc.). 34 34 + NetworkError { message: String }, 35 35 + 36 36 + /// Response body couldn't be parsed or was missing expected fields. 37 37 + InvalidResponse { message: String }, 38 38 + 39 39 + /// PAR or token exchange failed. 40 40 + OAuthFailed { message: String }, 41 41 + } 42 42 + 43 43 + impl std::fmt::Display for PdsClientError { 44 44 + fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { 45 45 + match self { 46 46 + Self::HandleNotFound => write!(f, "handle not found"), 47 47 + Self::DidNotFound => write!(f, "did not found"), 48 48 + Self::PdsUnreachable { source } => write!(f, "pds unreachable: {}", source), 49 49 + Self::NetworkError { message } => write!(f, "network error: {}", message), 50 50 + Self::InvalidResponse { message } => write!(f, "invalid response: {}", message), 51 51 + Self::OAuthFailed { message } => write!(f, "oauth failed: {}", message), 52 52 + } 53 53 + } 54 54 + } 55 55 + 56 56 + impl std::error::Error for PdsClientError {} 57 57 + 58 58 + /// PLC directory DID document response. 59 59 + /// 60 60 + /// Returned from `GET {plc_directory_url}/{did}`. 61 61 + /// Field names use camelCase per the API. 62 62 + #[derive(Debug, Deserialize)] 63 63 + #[serde(rename_all = "camelCase")] 64 64 + pub struct PlcDidDocument { 65 65 + pub did: String, 66 66 + pub also_known_as: Vec<String>, 67 67 + pub rotation_keys: Vec<String>, 68 68 + pub verification_methods: serde_json::Value, 69 69 + pub services: HashMap<String, PlcService>, 70 70 + } 71 71 + 72 72 + /// PLC service entry (one service in `PlcDidDocument.services`). 73 73 + #[derive(Debug, Deserialize)] 74 74 + pub struct PlcService { 75 75 + #[serde(rename = "type")] 76 76 + pub service_type: String, 77 77 + pub endpoint: String, 78 78 + } 79 79 + 80 80 + /// OAuth authorization server metadata. 81 81 + /// 82 82 + /// Returned from `GET {pds_url}/.well-known/oauth-authorization-server`. 83 83 + #[derive(Debug, Deserialize)] 84 84 + pub struct AuthServerMetadata { 85 85 + pub issuer: String, 86 86 + pub authorization_endpoint: String, 87 87 + pub token_endpoint: String, 88 88 + pub pushed_authorization_request_endpoint: Option<String>, 89 89 + pub response_types_supported: Vec<String>, 90 90 + pub grant_types_supported: Vec<String>, 91 91 + pub code_challenge_methods_supported: Vec<String>, 92 92 + pub dpop_signing_alg_values_supported: Option<Vec<String>>, 93 93 + pub scopes_supported: Option<Vec<String>>, 94 94 + } 95 95 + 96 96 + /// Response from PAR (Pushed Authorization Request). 97 97 + /// 98 98 + /// Returned from `POST {pushed_authorization_request_endpoint}`. 99 99 + #[derive(Debug, Deserialize)] 100 100 + pub struct PdsParResponse { 101 101 + pub request_uri: String, 102 102 + pub expires_in: u32, 103 103 + } 104 104 + 105 105 + /// Request body for `signPlcOperation`. 106 106 + /// 107 107 + /// Serializes to frontend with `#[serde(rename_all = "camelCase")]`. 108 108 + /// Optional fields are skipped if None. 109 109 + #[derive(Debug, Serialize)] 110 110 + #[serde(rename_all = "camelCase")] 111 111 + pub struct SignPlcOperationRequest { 112 112 + pub token: String, 113 113 + #[serde(skip_serializing_if = "Option::is_none")] 114 114 + pub rotation_keys: Option<Vec<String>>, 115 115 + #[serde(skip_serializing_if = "Option::is_none")] 116 116 + pub also_known_as: Option<Vec<String>>, 117 117 + #[serde(skip_serializing_if = "Option::is_none")] 118 118 + pub verification_methods: Option<serde_json::Value>, 119 119 + #[serde(skip_serializing_if = "Option::is_none")] 120 120 + pub services: Option<serde_json::Value>, 121 121 + } 122 122 + 123 123 + /// Response from `signPlcOperation`. 124 124 + /// 125 125 + /// Returned from `POST /xrpc/com.atproto.identity.signPlcOperation`. 126 126 + #[derive(Debug, Deserialize)] 127 127 + pub struct SignPlcOperationResponse { 128 128 + pub operation: serde_json::Value, 129 129 + } 130 130 + 131 131 + /// Recommended credentials for a DID. 132 132 + /// 133 133 + /// Returned from `GET /xrpc/com.atproto.identity.getRecommendedDidCredentials`. 134 134 + #[derive(Debug, Deserialize)] 135 135 + #[serde(rename_all = "camelCase")] 136 136 + pub struct RecommendedCredentials { 137 137 + pub rotation_keys: Option<Vec<String>>, 138 138 + pub also_known_as: Option<Vec<String>>, 139 139 + pub verification_methods: Option<serde_json::Value>, 140 140 + pub services: Option<serde_json::Value>, 141 141 + } 142 142 + 143 143 + /// PDS client for discovery and OAuth operations against arbitrary PDS endpoints. 144 144 + /// 145 145 + /// Stateless except for the HTTP client which pools connections. 146 146 + #[allow(dead_code)] 147 147 + pub struct PdsClient { 148 148 + client: Client, 149 149 + plc_directory_url: String, 150 150 + } 151 151 + 152 152 + impl PdsClient { 153 153 + /// Construct a new PdsClient with the default plc.directory URL. 154 154 + pub fn new() -> Self { 155 155 + Self { 156 156 + client: Client::new(), 157 157 + plc_directory_url: "https://plc.directory".to_string(), 158 158 + } 159 159 + } 160 160 + 161 161 + /// Test constructor: accepts a custom plc.directory URL (e.g., mock server). 162 162 + /// 163 163 + /// Follows the same pattern as `OAuthClient::new_for_test` in oauth_client.rs. 164 164 + #[cfg(test)] 165 165 + pub fn new_for_test(plc_directory_url: String) -> Self { 166 166 + Self { 167 167 + client: Client::new(), 168 168 + plc_directory_url, 169 169 + } 170 170 + } 171 171 + } 172 172 + 173 173 + impl Default for PdsClient { 174 174 + fn default() -> Self { 175 175 + Self::new() 176 176 + } 177 177 + } 178 178 + 179 179 + #[cfg(test)] 180 180 + mod tests { 181 181 + use super::*; 182 182 + 183 183 + #[test] 184 184 + fn test_pds_client_default() { 185 185 + let client = PdsClient::default(); 186 186 + assert_eq!(client.plc_directory_url, "https://plc.directory"); 187 187 + } 188 188 + 189 189 + #[test] 190 190 + fn test_sign_plc_operation_request_skip_none_fields() { 191 191 + let req = SignPlcOperationRequest { 192 192 + token: "test_token".to_string(), 193 193 + rotation_keys: None, 194 194 + also_known_as: None, 195 195 + verification_methods: None, 196 196 + services: None, 197 197 + }; 198 198 + 199 199 + let json = serde_json::to_string(&req).expect("serialization failed"); 200 200 + // Verify that None fields are skipped 201 201 + assert!(!json.contains("rotationKeys")); 202 202 + assert!(!json.contains("alsoKnownAs")); 203 203 + assert!(json.contains("token")); 204 204 + } 205 205 + }