+11 -11

appview/issues/issues.go

reviewed

··· 12 12 "time" 13 13 14 14 comatproto "github.com/bluesky-social/indigo/api/atproto" 15 15 + atpclient "github.com/bluesky-social/indigo/atproto/client" 15 16 "github.com/bluesky-social/indigo/atproto/syntax" 16 17 lexutil "github.com/bluesky-social/indigo/lex/util" 17 18 "github.com/go-chi/chi/v5" ··· 27 26 "tangled.org/core/appview/pagination" 28 27 "tangled.org/core/appview/reporesolver" 29 28 "tangled.org/core/appview/validator" 30 30 - "tangled.org/core/appview/xrpcclient" 31 29 "tangled.org/core/idresolver" 32 30 tlog "tangled.org/core/log" 33 31 "tangled.org/core/tid" ··· 166 166 return 167 167 } 168 168 169 169 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoIssueNSID, user.Did, newIssue.Rkey) 169 169 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoIssueNSID, user.Did, newIssue.Rkey) 170 170 if err != nil { 171 171 l.Error("failed to get record", "err", err) 172 172 rp.pages.Notice(w, noticeId, "Failed to edit issue, no record found on PDS.") 173 173 return 174 174 } 175 175 176 176 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 176 176 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 177 177 Collection: tangled.RepoIssueNSID, 178 178 Repo: user.Did, 179 179 Rkey: newIssue.Rkey, ··· 241 241 rp.pages.Notice(w, "issue-comment", "Failed to delete comment.") 242 242 return 243 243 } 244 244 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 244 244 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 245 245 Collection: tangled.RepoIssueNSID, 246 246 Repo: issue.Did, 247 247 Rkey: issue.Rkey, ··· 408 408 } 409 409 410 410 // create a record first 411 411 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 411 411 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 412 412 Collection: tangled.RepoIssueCommentNSID, 413 413 Repo: comment.Did, 414 414 Rkey: comment.Rkey, ··· 559 559 // rkey is optional, it was introduced later 560 560 if newComment.Rkey != "" { 561 561 // update the record on pds 562 562 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoIssueCommentNSID, user.Did, comment.Rkey) 562 562 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoIssueCommentNSID, user.Did, comment.Rkey) 563 563 if err != nil { 564 564 log.Println("failed to get record", "err", err, "did", newComment.Did, "rkey", newComment.Rkey) 565 565 rp.pages.Notice(w, fmt.Sprintf("comment-%s-status", commentId), "Failed to update description, no record found on PDS.") 566 566 return 567 567 } 568 568 569 569 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 569 569 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 570 570 Collection: tangled.RepoIssueCommentNSID, 571 571 Repo: user.Did, 572 572 Rkey: newComment.Rkey, ··· 733 733 rp.pages.Notice(w, "issue-comment", "Failed to delete comment.") 734 734 return 735 735 } 736 736 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 736 736 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 737 737 Collection: tangled.RepoIssueCommentNSID, 738 738 Repo: user.Did, 739 739 Rkey: comment.Rkey, ··· 865 865 rp.pages.Notice(w, "issues", "Failed to create issue.") 866 866 return 867 867 } 868 868 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 868 868 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 869 869 Collection: tangled.RepoIssueNSID, 870 870 Repo: user.Did, 871 871 Rkey: issue.Rkey, ··· 923 923 // this is used to rollback changes made to the PDS 924 924 // 925 925 // it is a no-op if the provided ATURI is empty 926 926 - func rollbackRecord(ctx context.Context, aturi string, xrpcc *xrpcclient.Client) error { 926 926 + func rollbackRecord(ctx context.Context, aturi string, client *atpclient.APIClient) error { 927 927 if aturi == "" { 928 928 return nil 929 929 } ··· 934 934 repo := parsed.Authority().String() 935 935 rkey := parsed.RecordKey().String() 936 936 937 937 - _, err := xrpcc.RepoDeleteRecord(ctx, &comatproto.RepoDeleteRecord_Input{ 937 937 + _, err := comatproto.RepoDeleteRecord(ctx, client, &comatproto.RepoDeleteRecord_Input{ 938 938 Collection: collection, 939 939 Repo: repo, 940 940 Rkey: rkey,

+6 -6

appview/knots/knots.go

reviewed

··· 185 185 return 186 186 } 187 187 188 188 - ex, _ := client.RepoGetRecord(r.Context(), "", tangled.KnotNSID, user.Did, domain) 188 188 + ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.KnotNSID, user.Did, domain) 189 189 var exCid *string 190 190 if ex != nil { 191 191 exCid = ex.Cid 192 192 } 193 193 194 194 // re-announce by registering under same rkey 195 195 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 195 195 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 196 196 Collection: tangled.KnotNSID, 197 197 Repo: user.Did, 198 198 Rkey: domain, ··· 323 323 return 324 324 } 325 325 326 326 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 326 326 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 327 327 Collection: tangled.KnotNSID, 328 328 Repo: user.Did, 329 329 Rkey: domain, ··· 431 431 return 432 432 } 433 433 434 434 - ex, _ := client.RepoGetRecord(r.Context(), "", tangled.KnotNSID, user.Did, domain) 434 434 + ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.KnotNSID, user.Did, domain) 435 435 var exCid *string 436 436 if ex != nil { 437 437 exCid = ex.Cid 438 438 } 439 439 440 440 // ignore the error here 441 441 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 441 441 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 442 442 Collection: tangled.KnotNSID, 443 443 Repo: user.Did, 444 444 Rkey: domain, ··· 555 555 556 556 rkey := tid.TID() 557 557 558 558 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 558 558 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 559 559 Collection: tangled.KnotMemberNSID, 560 560 Repo: user.Did, 561 561 Rkey: rkey,

+9 -9

appview/labels/labels.go

reviewed

··· 9 9 "net/http" 10 10 "time" 11 11 12 12 - comatproto "github.com/bluesky-social/indigo/api/atproto" 13 13 - "github.com/bluesky-social/indigo/atproto/syntax" 14 14 - lexutil "github.com/bluesky-social/indigo/lex/util" 15 15 - "github.com/go-chi/chi/v5" 16 16 - 17 12 "tangled.org/core/api/tangled" 18 13 "tangled.org/core/appview/db" 19 14 "tangled.org/core/appview/middleware" ··· 16 21 "tangled.org/core/appview/oauth" 17 22 "tangled.org/core/appview/pages" 18 23 "tangled.org/core/appview/validator" 19 19 - "tangled.org/core/appview/xrpcclient" 20 24 "tangled.org/core/log" 21 25 "tangled.org/core/rbac" 22 26 "tangled.org/core/tid" 27 27 + 28 28 + comatproto "github.com/bluesky-social/indigo/api/atproto" 29 29 + atpclient "github.com/bluesky-social/indigo/atproto/client" 30 30 + "github.com/bluesky-social/indigo/atproto/syntax" 31 31 + lexutil "github.com/bluesky-social/indigo/lex/util" 32 32 + "github.com/go-chi/chi/v5" 23 33 ) 24 34 25 35 type Labels struct { ··· 196 196 return 197 197 } 198 198 199 199 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 199 199 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 200 200 Collection: tangled.LabelOpNSID, 201 201 Repo: did, 202 202 Rkey: rkey, ··· 252 252 // this is used to rollback changes made to the PDS 253 253 // 254 254 // it is a no-op if the provided ATURI is empty 255 255 - func rollbackRecord(ctx context.Context, aturi string, xrpcc *xrpcclient.Client) error { 255 255 + func rollbackRecord(ctx context.Context, aturi string, client *atpclient.APIClient) error { 256 256 if aturi == "" { 257 257 return nil 258 258 } ··· 263 263 repo := parsed.Authority().String() 264 264 rkey := parsed.RecordKey().String() 265 265 266 266 - _, err := xrpcc.RepoDeleteRecord(ctx, &comatproto.RepoDeleteRecord_Input{ 266 266 + _, err := comatproto.RepoDeleteRecord(ctx, client, &comatproto.RepoDeleteRecord_Input{ 267 267 Collection: collection, 268 268 Repo: repo, 269 269 Rkey: rkey,

+5 -14

appview/middleware/middleware.go

reviewed

··· 43 43 44 44 type middlewareFunc func(http.Handler) http.Handler 45 45 46 46 - func (mw *Middleware) TryRefreshSession() middlewareFunc { 47 47 - return func(next http.Handler) http.Handler { 48 48 - return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 49 49 - _, _, _ = mw.oauth.GetSession(r) 50 50 - next.ServeHTTP(w, r) 51 51 - }) 52 52 - } 53 53 - } 54 54 - 55 55 - func AuthMiddleware(a *oauth.OAuth) middlewareFunc { 46 46 + func AuthMiddleware(o *oauth.OAuth) middlewareFunc { 56 47 return func(next http.Handler) http.Handler { 57 48 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 58 49 returnURL := "/" ··· 63 72 } 64 73 } 65 74 66 66 - _, auth, err := a.GetSession(r) 75 75 + sess, err := o.ResumeSession(r) 67 76 if err != nil { 68 68 - log.Println("not logged in, redirecting", "err", err) 77 77 + log.Println("failed to resume session, redirecting...", "err", err, "url", r.URL.String()) 69 78 redirectFunc(w, r) 70 79 return 71 80 } 72 81 73 73 - if !auth { 74 74 - log.Printf("not logged in, redirecting") 82 82 + if sess == nil { 83 83 + log.Printf("session is nil, redirecting...") 75 84 redirectFunc(w, r) 76 85 return 77 86 }

+18 -20

appview/notifications/notifications.go

reviewed

··· 1 1 package notifications 2 2 3 3 import ( 4 4 - "fmt" 5 4 "log" 6 5 "net/http" 7 6 "strconv" ··· 30 31 func (n *Notifications) Router(mw *middleware.Middleware) http.Handler { 31 32 r := chi.NewRouter() 32 33 33 33 - r.Use(middleware.AuthMiddleware(n.oauth)) 34 34 - 35 35 - r.With(middleware.Paginate).Get("/", n.notificationsPage) 36 36 - 37 34 r.Get("/count", n.getUnreadCount) 38 38 - r.Post("/{id}/read", n.markRead) 39 39 - r.Post("/read-all", n.markAllRead) 40 40 - r.Delete("/{id}", n.deleteNotification) 35 35 + 36 36 + r.Group(func(r chi.Router) { 37 37 + r.Use(middleware.AuthMiddleware(n.oauth)) 38 38 + r.With(middleware.Paginate).Get("/", n.notificationsPage) 39 39 + r.Post("/{id}/read", n.markRead) 40 40 + r.Post("/read-all", n.markAllRead) 41 41 + r.Delete("/{id}", n.deleteNotification) 42 42 + }) 41 43 42 44 return r 43 45 } 44 46 45 47 func (n *Notifications) notificationsPage(w http.ResponseWriter, r *http.Request) { 46 46 - userDid := n.oauth.GetDid(r) 48 48 + user := n.oauth.GetUser(r) 47 49 48 50 page, ok := r.Context().Value("page").(pagination.Page) 49 51 if !ok { ··· 54 54 55 55 total, err := db.CountNotifications( 56 56 n.db, 57 57 - db.FilterEq("recipient_did", userDid), 57 57 + db.FilterEq("recipient_did", user.Did), 58 58 ) 59 59 if err != nil { 60 60 log.Println("failed to get total notifications:", err) ··· 65 65 notifications, err := db.GetNotificationsWithEntities( 66 66 n.db, 67 67 page, 68 68 - db.FilterEq("recipient_did", userDid), 68 68 + db.FilterEq("recipient_did", user.Did), 69 69 ) 70 70 if err != nil { 71 71 log.Println("failed to get notifications:", err) ··· 73 73 return 74 74 } 75 75 76 76 - err = n.db.MarkAllNotificationsRead(r.Context(), userDid) 76 76 + err = n.db.MarkAllNotificationsRead(r.Context(), user.Did) 77 77 if err != nil { 78 78 log.Println("failed to mark notifications as read:", err) 79 79 } 80 80 81 81 unreadCount := 0 82 82 83 83 - user := n.oauth.GetUser(r) 84 84 - if user == nil { 85 85 - http.Error(w, "Failed to get user", http.StatusInternalServerError) 86 86 - return 87 87 - } 88 88 - 89 89 - fmt.Println(n.pages.Notifications(w, pages.NotificationsParams{ 83 83 + n.pages.Notifications(w, pages.NotificationsParams{ 90 84 LoggedInUser: user, 91 85 Notifications: notifications, 92 86 UnreadCount: unreadCount, 93 87 Page: page, 94 88 Total: total, 95 95 - })) 89 89 + }) 96 90 } 97 91 98 92 func (n *Notifications) getUnreadCount(w http.ResponseWriter, r *http.Request) { 99 93 user := n.oauth.GetUser(r) 94 94 + if user == nil { 95 95 + return 96 96 + } 97 97 + 100 98 count, err := db.CountNotifications( 101 99 n.db, 102 100 db.FilterEq("recipient_did", user.Did),

-24

appview/oauth/client/oauth_client.go

reviewed

··· 1 1 - package client 2 2 - 3 3 - import ( 4 4 - oauth "tangled.org/anirudh.fi/atproto-oauth" 5 5 - "tangled.org/anirudh.fi/atproto-oauth/helpers" 6 6 - ) 7 7 - 8 8 - type OAuthClient struct { 9 9 - *oauth.Client 10 10 - } 11 11 - 12 12 - func NewClient(clientId, clientJwk, redirectUri string) (*OAuthClient, error) { 13 13 - k, err := helpers.ParseJWKFromBytes([]byte(clientJwk)) 14 14 - if err != nil { 15 15 - return nil, err 16 16 - } 17 17 - 18 18 - cli, err := oauth.NewClient(oauth.ClientArgs{ 19 19 - ClientId: clientId, 20 20 - ClientJwk: k, 21 21 - RedirectUri: redirectUri, 22 22 - }) 23 23 - return &OAuthClient{cli}, err 24 24 - }

+2 -1

appview/oauth/consts.go

reviewed

··· 1 1 package oauth 2 2 3 3 const ( 4 4 - SessionName = "appview-session" 4 4 + SessionName = "appview-session-v2" 5 5 SessionHandle = "handle" 6 6 SessionDid = "did" 7 7 + SessionId = "id" 7 8 SessionPds = "pds" 8 9 SessionAccessJwt = "accessJwt" 9 10 SessionRefreshJwt = "refreshJwt"

+65

appview/oauth/handler.go

reviewed

··· 1 1 + package oauth 2 2 + 3 3 + import ( 4 4 + "encoding/json" 5 5 + "log" 6 6 + "net/http" 7 7 + 8 8 + "github.com/go-chi/chi/v5" 9 9 + "github.com/lestrrat-go/jwx/v2/jwk" 10 10 + ) 11 11 + 12 12 + func (o *OAuth) Router() http.Handler { 13 13 + r := chi.NewRouter() 14 14 + 15 15 + r.Get("/oauth/client-metadata.json", o.clientMetadata) 16 16 + r.Get("/oauth/jwks.json", o.jwks) 17 17 + r.Get("/oauth/callback", o.callback) 18 18 + return r 19 19 + } 20 20 + 21 21 + func (o *OAuth) clientMetadata(w http.ResponseWriter, r *http.Request) { 22 22 + doc := o.ClientApp.Config.ClientMetadata() 23 23 + doc.JWKSURI = &o.JwksUri 24 24 + 25 25 + w.Header().Set("Content-Type", "application/json") 26 26 + if err := json.NewEncoder(w).Encode(doc); err != nil { 27 27 + http.Error(w, err.Error(), http.StatusInternalServerError) 28 28 + return 29 29 + } 30 30 + } 31 31 + 32 32 + func (o *OAuth) jwks(w http.ResponseWriter, r *http.Request) { 33 33 + jwks := o.Config.OAuth.Jwks 34 34 + pubKey, err := pubKeyFromJwk(jwks) 35 35 + if err != nil { 36 36 + log.Printf("error parsing public key: %v", err) 37 37 + http.Error(w, err.Error(), http.StatusInternalServerError) 38 38 + return 39 39 + } 40 40 + 41 41 + response := map[string]any{ 42 42 + "keys": []jwk.Key{pubKey}, 43 43 + } 44 44 + 45 45 + w.Header().Set("Content-Type", "application/json") 46 46 + w.WriteHeader(http.StatusOK) 47 47 + json.NewEncoder(w).Encode(response) 48 48 + } 49 49 + 50 50 + func (o *OAuth) callback(w http.ResponseWriter, r *http.Request) { 51 51 + ctx := r.Context() 52 52 + 53 53 + sessData, err := o.ClientApp.ProcessCallback(ctx, r.URL.Query()) 54 54 + if err != nil { 55 55 + http.Error(w, err.Error(), http.StatusInternalServerError) 56 56 + return 57 57 + } 58 58 + 59 59 + if err := o.SaveSession(w, r, sessData); err != nil { 60 60 + http.Error(w, err.Error(), http.StatusInternalServerError) 61 61 + return 62 62 + } 63 63 + 64 64 + http.Redirect(w, r, "/", http.StatusFound) 65 65 + }

-538

appview/oauth/handler/handler.go

reviewed

··· 1 1 - package oauth 2 2 - 3 3 - import ( 4 4 - "bytes" 5 5 - "context" 6 6 - "encoding/json" 7 7 - "fmt" 8 8 - "log" 9 9 - "net/http" 10 10 - "net/url" 11 11 - "slices" 12 12 - "strings" 13 13 - "time" 14 14 - 15 15 - "github.com/go-chi/chi/v5" 16 16 - "github.com/gorilla/sessions" 17 17 - "github.com/lestrrat-go/jwx/v2/jwk" 18 18 - "github.com/posthog/posthog-go" 19 19 - "tangled.org/anirudh.fi/atproto-oauth/helpers" 20 20 - tangled "tangled.org/core/api/tangled" 21 21 - sessioncache "tangled.org/core/appview/cache/session" 22 22 - "tangled.org/core/appview/config" 23 23 - "tangled.org/core/appview/db" 24 24 - "tangled.org/core/appview/middleware" 25 25 - "tangled.org/core/appview/oauth" 26 26 - "tangled.org/core/appview/oauth/client" 27 27 - "tangled.org/core/appview/pages" 28 28 - "tangled.org/core/consts" 29 29 - "tangled.org/core/idresolver" 30 30 - "tangled.org/core/rbac" 31 31 - "tangled.org/core/tid" 32 32 - ) 33 33 - 34 34 - const ( 35 35 - oauthScope = "atproto transition:generic" 36 36 - ) 37 37 - 38 38 - type OAuthHandler struct { 39 39 - config *config.Config 40 40 - pages *pages.Pages 41 41 - idResolver *idresolver.Resolver 42 42 - sess *sessioncache.SessionStore 43 43 - db *db.DB 44 44 - store *sessions.CookieStore 45 45 - oauth *oauth.OAuth 46 46 - enforcer *rbac.Enforcer 47 47 - posthog posthog.Client 48 48 - } 49 49 - 50 50 - func New( 51 51 - config *config.Config, 52 52 - pages *pages.Pages, 53 53 - idResolver *idresolver.Resolver, 54 54 - db *db.DB, 55 55 - sess *sessioncache.SessionStore, 56 56 - store *sessions.CookieStore, 57 57 - oauth *oauth.OAuth, 58 58 - enforcer *rbac.Enforcer, 59 59 - posthog posthog.Client, 60 60 - ) *OAuthHandler { 61 61 - return &OAuthHandler{ 62 62 - config: config, 63 63 - pages: pages, 64 64 - idResolver: idResolver, 65 65 - db: db, 66 66 - sess: sess, 67 67 - store: store, 68 68 - oauth: oauth, 69 69 - enforcer: enforcer, 70 70 - posthog: posthog, 71 71 - } 72 72 - } 73 73 - 74 74 - func (o *OAuthHandler) Router() http.Handler { 75 75 - r := chi.NewRouter() 76 76 - 77 77 - r.Get("/login", o.login) 78 78 - r.Post("/login", o.login) 79 79 - 80 80 - r.With(middleware.AuthMiddleware(o.oauth)).Post("/logout", o.logout) 81 81 - 82 82 - r.Get("/oauth/client-metadata.json", o.clientMetadata) 83 83 - r.Get("/oauth/jwks.json", o.jwks) 84 84 - r.Get("/oauth/callback", o.callback) 85 85 - return r 86 86 - } 87 87 - 88 88 - func (o *OAuthHandler) clientMetadata(w http.ResponseWriter, r *http.Request) { 89 89 - w.Header().Set("Content-Type", "application/json") 90 90 - w.WriteHeader(http.StatusOK) 91 91 - json.NewEncoder(w).Encode(o.oauth.ClientMetadata()) 92 92 - } 93 93 - 94 94 - func (o *OAuthHandler) jwks(w http.ResponseWriter, r *http.Request) { 95 95 - jwks := o.config.OAuth.Jwks 96 96 - pubKey, err := pubKeyFromJwk(jwks) 97 97 - if err != nil { 98 98 - log.Printf("error parsing public key: %v", err) 99 99 - http.Error(w, err.Error(), http.StatusInternalServerError) 100 100 - return 101 101 - } 102 102 - 103 103 - response := helpers.CreateJwksResponseObject(pubKey) 104 104 - 105 105 - w.Header().Set("Content-Type", "application/json") 106 106 - w.WriteHeader(http.StatusOK) 107 107 - json.NewEncoder(w).Encode(response) 108 108 - } 109 109 - 110 110 - func (o *OAuthHandler) login(w http.ResponseWriter, r *http.Request) { 111 111 - switch r.Method { 112 112 - case http.MethodGet: 113 113 - returnURL := r.URL.Query().Get("return_url") 114 114 - o.pages.Login(w, pages.LoginParams{ 115 115 - ReturnUrl: returnURL, 116 116 - }) 117 117 - case http.MethodPost: 118 118 - handle := r.FormValue("handle") 119 119 - 120 120 - // when users copy their handle from bsky.app, it tends to have these characters around it: 121 121 - // 122 122 - // @nelind.dk: 123 123 - // \u202a ensures that the handle is always rendered left to right and 124 124 - // \u202c reverts that so the rest of the page renders however it should 125 125 - handle = strings.TrimPrefix(handle, "\u202a") 126 126 - handle = strings.TrimSuffix(handle, "\u202c") 127 127 - 128 128 - // `@` is harmless 129 129 - handle = strings.TrimPrefix(handle, "@") 130 130 - 131 131 - // basic handle validation 132 132 - if !strings.Contains(handle, ".") { 133 133 - log.Println("invalid handle format", "raw", handle) 134 134 - o.pages.Notice(w, "login-msg", fmt.Sprintf("\"%s\" is an invalid handle. Did you mean %s.bsky.social?", handle, handle)) 135 135 - return 136 136 - } 137 137 - 138 138 - resolved, err := o.idResolver.ResolveIdent(r.Context(), handle) 139 139 - if err != nil { 140 140 - log.Println("failed to resolve handle:", err) 141 141 - o.pages.Notice(w, "login-msg", fmt.Sprintf("\"%s\" is an invalid handle.", handle)) 142 142 - return 143 143 - } 144 144 - self := o.oauth.ClientMetadata() 145 145 - oauthClient, err := client.NewClient( 146 146 - self.ClientID, 147 147 - o.config.OAuth.Jwks, 148 148 - self.RedirectURIs[0], 149 149 - ) 150 150 - 151 151 - if err != nil { 152 152 - log.Println("failed to create oauth client:", err) 153 153 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 154 154 - return 155 155 - } 156 156 - 157 157 - authServer, err := oauthClient.ResolvePdsAuthServer(r.Context(), resolved.PDSEndpoint()) 158 158 - if err != nil { 159 159 - log.Println("failed to resolve auth server:", err) 160 160 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 161 161 - return 162 162 - } 163 163 - 164 164 - authMeta, err := oauthClient.FetchAuthServerMetadata(r.Context(), authServer) 165 165 - if err != nil { 166 166 - log.Println("failed to fetch auth server metadata:", err) 167 167 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 168 168 - return 169 169 - } 170 170 - 171 171 - dpopKey, err := helpers.GenerateKey(nil) 172 172 - if err != nil { 173 173 - log.Println("failed to generate dpop key:", err) 174 174 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 175 175 - return 176 176 - } 177 177 - 178 178 - dpopKeyJson, err := json.Marshal(dpopKey) 179 179 - if err != nil { 180 180 - log.Println("failed to marshal dpop key:", err) 181 181 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 182 182 - return 183 183 - } 184 184 - 185 185 - parResp, err := oauthClient.SendParAuthRequest(r.Context(), authServer, authMeta, handle, oauthScope, dpopKey) 186 186 - if err != nil { 187 187 - log.Println("failed to send par auth request:", err) 188 188 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 189 189 - return 190 190 - } 191 191 - 192 192 - err = o.sess.SaveRequest(r.Context(), sessioncache.OAuthRequest{ 193 193 - Did: resolved.DID.String(), 194 194 - PdsUrl: resolved.PDSEndpoint(), 195 195 - Handle: handle, 196 196 - AuthserverIss: authMeta.Issuer, 197 197 - PkceVerifier: parResp.PkceVerifier, 198 198 - DpopAuthserverNonce: parResp.DpopAuthserverNonce, 199 199 - DpopPrivateJwk: string(dpopKeyJson), 200 200 - State: parResp.State, 201 201 - ReturnUrl: r.FormValue("return_url"), 202 202 - }) 203 203 - if err != nil { 204 204 - log.Println("failed to save oauth request:", err) 205 205 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 206 206 - return 207 207 - } 208 208 - 209 209 - u, _ := url.Parse(authMeta.AuthorizationEndpoint) 210 210 - query := url.Values{} 211 211 - query.Add("client_id", self.ClientID) 212 212 - query.Add("request_uri", parResp.RequestUri) 213 213 - u.RawQuery = query.Encode() 214 214 - o.pages.HxRedirect(w, u.String()) 215 215 - } 216 216 - } 217 217 - 218 218 - func (o *OAuthHandler) callback(w http.ResponseWriter, r *http.Request) { 219 219 - state := r.FormValue("state") 220 220 - 221 221 - oauthRequest, err := o.sess.GetRequestByState(r.Context(), state) 222 222 - if err != nil { 223 223 - log.Println("failed to get oauth request:", err) 224 224 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 225 225 - return 226 226 - } 227 227 - 228 228 - defer func() { 229 229 - err := o.sess.DeleteRequestByState(r.Context(), state) 230 230 - if err != nil { 231 231 - log.Println("failed to delete oauth request for state:", state, err) 232 232 - } 233 233 - }() 234 234 - 235 235 - error := r.FormValue("error") 236 236 - errorDescription := r.FormValue("error_description") 237 237 - if error != "" || errorDescription != "" { 238 238 - log.Printf("error: %s, %s", error, errorDescription) 239 239 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 240 240 - return 241 241 - } 242 242 - 243 243 - code := r.FormValue("code") 244 244 - if code == "" { 245 245 - log.Println("missing code for state: ", state) 246 246 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 247 247 - return 248 248 - } 249 249 - 250 250 - iss := r.FormValue("iss") 251 251 - if iss == "" { 252 252 - log.Println("missing iss for state: ", state) 253 253 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 254 254 - return 255 255 - } 256 256 - 257 257 - if iss != oauthRequest.AuthserverIss { 258 258 - log.Println("mismatched iss:", iss, "!=", oauthRequest.AuthserverIss, "for state:", state) 259 259 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 260 260 - return 261 261 - } 262 262 - 263 263 - self := o.oauth.ClientMetadata() 264 264 - 265 265 - oauthClient, err := client.NewClient( 266 266 - self.ClientID, 267 267 - o.config.OAuth.Jwks, 268 268 - self.RedirectURIs[0], 269 269 - ) 270 270 - 271 271 - if err != nil { 272 272 - log.Println("failed to create oauth client:", err) 273 273 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 274 274 - return 275 275 - } 276 276 - 277 277 - jwk, err := helpers.ParseJWKFromBytes([]byte(oauthRequest.DpopPrivateJwk)) 278 278 - if err != nil { 279 279 - log.Println("failed to parse jwk:", err) 280 280 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 281 281 - return 282 282 - } 283 283 - 284 284 - tokenResp, err := oauthClient.InitialTokenRequest( 285 285 - r.Context(), 286 286 - code, 287 287 - oauthRequest.AuthserverIss, 288 288 - oauthRequest.PkceVerifier, 289 289 - oauthRequest.DpopAuthserverNonce, 290 290 - jwk, 291 291 - ) 292 292 - if err != nil { 293 293 - log.Println("failed to get token:", err) 294 294 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 295 295 - return 296 296 - } 297 297 - 298 298 - if tokenResp.Scope != oauthScope { 299 299 - log.Println("scope doesn't match:", tokenResp.Scope) 300 300 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 301 301 - return 302 302 - } 303 303 - 304 304 - err = o.oauth.SaveSession(w, r, *oauthRequest, tokenResp) 305 305 - if err != nil { 306 306 - log.Println("failed to save session:", err) 307 307 - o.pages.Notice(w, "login-msg", "Failed to authenticate. Try again later.") 308 308 - return 309 309 - } 310 310 - 311 311 - log.Println("session saved successfully") 312 312 - go o.addToDefaultKnot(oauthRequest.Did) 313 313 - go o.addToDefaultSpindle(oauthRequest.Did) 314 314 - 315 315 - if !o.config.Core.Dev { 316 316 - err = o.posthog.Enqueue(posthog.Capture{ 317 317 - DistinctId: oauthRequest.Did, 318 318 - Event: "signin", 319 319 - }) 320 320 - if err != nil { 321 321 - log.Println("failed to enqueue posthog event:", err) 322 322 - } 323 323 - } 324 324 - 325 325 - returnUrl := oauthRequest.ReturnUrl 326 326 - if returnUrl == "" { 327 327 - returnUrl = "/" 328 328 - } 329 329 - 330 330 - http.Redirect(w, r, returnUrl, http.StatusFound) 331 331 - } 332 332 - 333 333 - func (o *OAuthHandler) logout(w http.ResponseWriter, r *http.Request) { 334 334 - err := o.oauth.ClearSession(r, w) 335 335 - if err != nil { 336 336 - log.Println("failed to clear session:", err) 337 337 - http.Redirect(w, r, "/", http.StatusFound) 338 338 - return 339 339 - } 340 340 - 341 341 - log.Println("session cleared successfully") 342 342 - o.pages.HxRedirect(w, "/login") 343 343 - } 344 344 - 345 345 - func pubKeyFromJwk(jwks string) (jwk.Key, error) { 346 346 - k, err := helpers.ParseJWKFromBytes([]byte(jwks)) 347 347 - if err != nil { 348 348 - return nil, err 349 349 - } 350 350 - pubKey, err := k.PublicKey() 351 351 - if err != nil { 352 352 - return nil, err 353 353 - } 354 354 - return pubKey, nil 355 355 - } 356 356 - 357 357 - func (o *OAuthHandler) addToDefaultSpindle(did string) { 358 358 - // use the tangled.sh app password to get an accessJwt 359 359 - // and create an sh.tangled.spindle.member record with that 360 360 - spindleMembers, err := db.GetSpindleMembers( 361 361 - o.db, 362 362 - db.FilterEq("instance", "spindle.tangled.sh"), 363 363 - db.FilterEq("subject", did), 364 364 - ) 365 365 - if err != nil { 366 366 - log.Printf("failed to get spindle members for did %s: %v", did, err) 367 367 - return 368 368 - } 369 369 - 370 370 - if len(spindleMembers) != 0 { 371 371 - log.Printf("did %s is already a member of the default spindle", did) 372 372 - return 373 373 - } 374 374 - 375 375 - log.Printf("adding %s to default spindle", did) 376 376 - session, err := o.createAppPasswordSession(o.config.Core.AppPassword, consts.TangledDid) 377 377 - if err != nil { 378 378 - log.Printf("failed to create session: %s", err) 379 379 - return 380 380 - } 381 381 - 382 382 - record := tangled.SpindleMember{ 383 383 - LexiconTypeID: "sh.tangled.spindle.member", 384 384 - Subject: did, 385 385 - Instance: consts.DefaultSpindle, 386 386 - CreatedAt: time.Now().Format(time.RFC3339), 387 387 - } 388 388 - 389 389 - if err := session.putRecord(record, tangled.SpindleMemberNSID); err != nil { 390 390 - log.Printf("failed to add member to default spindle: %s", err) 391 391 - return 392 392 - } 393 393 - 394 394 - log.Printf("successfully added %s to default spindle", did) 395 395 - } 396 396 - 397 397 - func (o *OAuthHandler) addToDefaultKnot(did string) { 398 398 - // use the tangled.sh app password to get an accessJwt 399 399 - // and create an sh.tangled.spindle.member record with that 400 400 - 401 401 - allKnots, err := o.enforcer.GetKnotsForUser(did) 402 402 - if err != nil { 403 403 - log.Printf("failed to get knot members for did %s: %v", did, err) 404 404 - return 405 405 - } 406 406 - 407 407 - if slices.Contains(allKnots, consts.DefaultKnot) { 408 408 - log.Printf("did %s is already a member of the default knot", did) 409 409 - return 410 410 - } 411 411 - 412 412 - log.Printf("adding %s to default knot", did) 413 413 - session, err := o.createAppPasswordSession(o.config.Core.TmpAltAppPassword, consts.IcyDid) 414 414 - if err != nil { 415 415 - log.Printf("failed to create session: %s", err) 416 416 - return 417 417 - } 418 418 - 419 419 - record := tangled.KnotMember{ 420 420 - LexiconTypeID: "sh.tangled.knot.member", 421 421 - Subject: did, 422 422 - Domain: consts.DefaultKnot, 423 423 - CreatedAt: time.Now().Format(time.RFC3339), 424 424 - } 425 425 - 426 426 - if err := session.putRecord(record, tangled.KnotMemberNSID); err != nil { 427 427 - log.Printf("failed to add member to default knot: %s", err) 428 428 - return 429 429 - } 430 430 - 431 431 - if err := o.enforcer.AddKnotMember(consts.DefaultKnot, did); err != nil { 432 432 - log.Printf("failed to set up enforcer rules: %s", err) 433 433 - return 434 434 - } 435 435 - 436 436 - log.Printf("successfully added %s to default Knot", did) 437 437 - } 438 438 - 439 439 - // create a session using apppasswords 440 440 - type session struct { 441 441 - AccessJwt string `json:"accessJwt"` 442 442 - PdsEndpoint string 443 443 - Did string 444 444 - } 445 445 - 446 446 - func (o *OAuthHandler) createAppPasswordSession(appPassword, did string) (*session, error) { 447 447 - if appPassword == "" { 448 448 - return nil, fmt.Errorf("no app password configured, skipping member addition") 449 449 - } 450 450 - 451 451 - resolved, err := o.idResolver.ResolveIdent(context.Background(), did) 452 452 - if err != nil { 453 453 - return nil, fmt.Errorf("failed to resolve tangled.sh DID %s: %v", did, err) 454 454 - } 455 455 - 456 456 - pdsEndpoint := resolved.PDSEndpoint() 457 457 - if pdsEndpoint == "" { 458 458 - return nil, fmt.Errorf("no PDS endpoint found for tangled.sh DID %s", did) 459 459 - } 460 460 - 461 461 - sessionPayload := map[string]string{ 462 462 - "identifier": did, 463 463 - "password": appPassword, 464 464 - } 465 465 - sessionBytes, err := json.Marshal(sessionPayload) 466 466 - if err != nil { 467 467 - return nil, fmt.Errorf("failed to marshal session payload: %v", err) 468 468 - } 469 469 - 470 470 - sessionURL := pdsEndpoint + "/xrpc/com.atproto.server.createSession" 471 471 - sessionReq, err := http.NewRequestWithContext(context.Background(), "POST", sessionURL, bytes.NewBuffer(sessionBytes)) 472 472 - if err != nil { 473 473 - return nil, fmt.Errorf("failed to create session request: %v", err) 474 474 - } 475 475 - sessionReq.Header.Set("Content-Type", "application/json") 476 476 - 477 477 - client := &http.Client{Timeout: 30 * time.Second} 478 478 - sessionResp, err := client.Do(sessionReq) 479 479 - if err != nil { 480 480 - return nil, fmt.Errorf("failed to create session: %v", err) 481 481 - } 482 482 - defer sessionResp.Body.Close() 483 483 - 484 484 - if sessionResp.StatusCode != http.StatusOK { 485 485 - return nil, fmt.Errorf("failed to create session: HTTP %d", sessionResp.StatusCode) 486 486 - } 487 487 - 488 488 - var session session 489 489 - if err := json.NewDecoder(sessionResp.Body).Decode(&session); err != nil { 490 490 - return nil, fmt.Errorf("failed to decode session response: %v", err) 491 491 - } 492 492 - 493 493 - session.PdsEndpoint = pdsEndpoint 494 494 - session.Did = did 495 495 - 496 496 - return &session, nil 497 497 - } 498 498 - 499 499 - func (s *session) putRecord(record any, collection string) error { 500 500 - recordBytes, err := json.Marshal(record) 501 501 - if err != nil { 502 502 - return fmt.Errorf("failed to marshal knot member record: %w", err) 503 503 - } 504 504 - 505 505 - payload := map[string]any{ 506 506 - "repo": s.Did, 507 507 - "collection": collection, 508 508 - "rkey": tid.TID(), 509 509 - "record": json.RawMessage(recordBytes), 510 510 - } 511 511 - 512 512 - payloadBytes, err := json.Marshal(payload) 513 513 - if err != nil { 514 514 - return fmt.Errorf("failed to marshal request payload: %w", err) 515 515 - } 516 516 - 517 517 - url := s.PdsEndpoint + "/xrpc/com.atproto.repo.putRecord" 518 518 - req, err := http.NewRequestWithContext(context.Background(), "POST", url, bytes.NewBuffer(payloadBytes)) 519 519 - if err != nil { 520 520 - return fmt.Errorf("failed to create HTTP request: %w", err) 521 521 - } 522 522 - 523 523 - req.Header.Set("Content-Type", "application/json") 524 524 - req.Header.Set("Authorization", "Bearer "+s.AccessJwt) 525 525 - 526 526 - client := &http.Client{Timeout: 30 * time.Second} 527 527 - resp, err := client.Do(req) 528 528 - if err != nil { 529 529 - return fmt.Errorf("failed to add user to default service: %w", err) 530 530 - } 531 531 - defer resp.Body.Close() 532 532 - 533 533 - if resp.StatusCode != http.StatusOK { 534 534 - return fmt.Errorf("failed to add user to default service: HTTP %d", resp.StatusCode) 535 535 - } 536 536 - 537 537 - return nil 538 538 - }

+121 -216

appview/oauth/oauth.go

reviewed

··· 1 1 package oauth 2 2 3 3 import ( 4 4 + "errors" 4 5 "fmt" 5 5 - "log" 6 6 "net/http" 7 7 - "net/url" 8 7 "time" 9 8 10 10 - indigo_xrpc "github.com/bluesky-social/indigo/xrpc" 9 9 + comatproto "github.com/bluesky-social/indigo/api/atproto" 10 10 + "github.com/bluesky-social/indigo/atproto/auth/oauth" 11 11 + atpclient "github.com/bluesky-social/indigo/atproto/client" 12 12 + "github.com/bluesky-social/indigo/atproto/syntax" 13 13 + xrpc "github.com/bluesky-social/indigo/xrpc" 11 14 "github.com/gorilla/sessions" 12 12 - oauth "tangled.org/anirudh.fi/atproto-oauth" 13 13 - "tangled.org/anirudh.fi/atproto-oauth/helpers" 14 14 - sessioncache "tangled.org/core/appview/cache/session" 15 15 + "github.com/lestrrat-go/jwx/v2/jwk" 15 16 "tangled.org/core/appview/config" 16 16 - "tangled.org/core/appview/oauth/client" 17 17 - xrpc "tangled.org/core/appview/xrpcclient" 18 17 ) 19 18 20 20 - type OAuth struct { 21 21 - store *sessions.CookieStore 22 22 - config *config.Config 23 23 - sess *sessioncache.SessionStore 24 24 - } 19 19 + func New(config *config.Config) (*OAuth, error) { 25 20 26 26 - func NewOAuth(config *config.Config, sess *sessioncache.SessionStore) *OAuth { 27 27 - return &OAuth{ 28 28 - store: sessions.NewCookieStore([]byte(config.Core.CookieSecret)), 29 29 - config: config, 30 30 - sess: sess, 21 21 + var oauthConfig oauth.ClientConfig 22 22 + var clientUri string 23 23 + 24 24 + if config.Core.Dev { 25 25 + clientUri = "http://127.0.0.1:3000" 26 26 + callbackUri := clientUri + "/oauth/callback" 27 27 + oauthConfig = oauth.NewLocalhostConfig(callbackUri, []string{"atproto", "transition:generic"}) 28 28 + } else { 29 29 + clientUri = config.Core.AppviewHost 30 30 + clientId := fmt.Sprintf("%s/oauth/client-metadata.json", clientUri) 31 31 + callbackUri := clientUri + "/oauth/callback" 32 32 + oauthConfig = oauth.NewPublicConfig(clientId, callbackUri, []string{"atproto", "transition:generic"}) 31 33 } 34 34 + 35 35 + jwksUri := clientUri + "/oauth/jwks.json" 36 36 + 37 37 + authStore, err := NewRedisStore(config.Redis.ToURL()) 38 38 + if err != nil { 39 39 + return nil, err 40 40 + } 41 41 + 42 42 + sessStore := sessions.NewCookieStore([]byte(config.Core.CookieSecret)) 43 43 + 44 44 + return &OAuth{ 45 45 + ClientApp: oauth.NewClientApp(&oauthConfig, authStore), 46 46 + Config: config, 47 47 + SessStore: sessStore, 48 48 + JwksUri: jwksUri, 49 49 + }, nil 32 50 } 33 51 34 34 - func (o *OAuth) Stores() *sessions.CookieStore { 35 35 - return o.store 52 52 + type OAuth struct { 53 53 + ClientApp *oauth.ClientApp 54 54 + SessStore *sessions.CookieStore 55 55 + Config *config.Config 56 56 + JwksUri string 36 57 } 37 58 38 38 - func (o *OAuth) SaveSession(w http.ResponseWriter, r *http.Request, oreq sessioncache.OAuthRequest, oresp *oauth.TokenResponse) error { 59 59 + func (o *OAuth) SaveSession(w http.ResponseWriter, r *http.Request, sessData *oauth.ClientSessionData) error { 39 60 // first we save the did in the user session 40 40 - userSession, err := o.store.Get(r, SessionName) 61 61 + userSession, err := o.SessStore.Get(r, SessionName) 41 62 if err != nil { 42 63 return err 43 64 } 44 65 45 45 - userSession.Values[SessionDid] = oreq.Did 46 46 - userSession.Values[SessionHandle] = oreq.Handle 47 47 - userSession.Values[SessionPds] = oreq.PdsUrl 66 66 + userSession.Values[SessionDid] = sessData.AccountDID.String() 67 67 + userSession.Values[SessionPds] = sessData.HostURL 68 68 + userSession.Values[SessionId] = sessData.SessionID 48 69 userSession.Values[SessionAuthenticated] = true 49 49 - err = userSession.Save(r, w) 50 50 - if err != nil { 51 51 - return fmt.Errorf("error saving user session: %w", err) 52 52 - } 53 53 - 54 54 - // then save the whole thing in the db 55 55 - session := sessioncache.OAuthSession{ 56 56 - Did: oreq.Did, 57 57 - Handle: oreq.Handle, 58 58 - PdsUrl: oreq.PdsUrl, 59 59 - DpopAuthserverNonce: oreq.DpopAuthserverNonce, 60 60 - AuthServerIss: oreq.AuthserverIss, 61 61 - DpopPrivateJwk: oreq.DpopPrivateJwk, 62 62 - AccessJwt: oresp.AccessToken, 63 63 - RefreshJwt: oresp.RefreshToken, 64 64 - Expiry: time.Now().Add(time.Duration(oresp.ExpiresIn) * time.Second).Format(time.RFC3339), 65 65 - } 66 66 - 67 67 - return o.sess.SaveSession(r.Context(), session) 68 68 - } 69 69 - 70 70 - func (o *OAuth) ClearSession(r *http.Request, w http.ResponseWriter) error { 71 71 - userSession, err := o.store.Get(r, SessionName) 72 72 - if err != nil || userSession.IsNew { 73 73 - return fmt.Errorf("error getting user session (or new session?): %w", err) 74 74 - } 75 75 - 76 76 - did := userSession.Values[SessionDid].(string) 77 77 - 78 78 - err = o.sess.DeleteSession(r.Context(), did) 79 79 - if err != nil { 80 80 - return fmt.Errorf("error deleting oauth session: %w", err) 81 81 - } 82 82 - 83 83 - userSession.Options.MaxAge = -1 84 84 - 85 70 return userSession.Save(r, w) 86 71 } 87 72 88 88 - func (o *OAuth) GetSession(r *http.Request) (*sessioncache.OAuthSession, bool, error) { 89 89 - userSession, err := o.store.Get(r, SessionName) 90 90 - if err != nil || userSession.IsNew { 91 91 - return nil, false, fmt.Errorf("error getting user session (or new session?): %w", err) 92 92 - } 93 93 - 94 94 - did := userSession.Values[SessionDid].(string) 95 95 - auth := userSession.Values[SessionAuthenticated].(bool) 96 96 - 97 97 - session, err := o.sess.GetSession(r.Context(), did) 73 73 + func (o *OAuth) ResumeSession(r *http.Request) (*oauth.ClientSession, error) { 74 74 + userSession, err := o.SessStore.Get(r, SessionName) 98 75 if err != nil { 99 99 - return nil, false, fmt.Errorf("error getting oauth session: %w", err) 76 76 + return nil, fmt.Errorf("error getting user session: %w", err) 77 77 + } 78 78 + if userSession.IsNew { 79 79 + return nil, fmt.Errorf("no session available for user") 100 80 } 101 81 102 102 - expiry, err := time.Parse(time.RFC3339, session.Expiry) 82 82 + d := userSession.Values[SessionDid].(string) 83 83 + sessDid, err := syntax.ParseDID(d) 103 84 if err != nil { 104 104 - return nil, false, fmt.Errorf("error parsing expiry time: %w", err) 105 105 - } 106 106 - if time.Until(expiry) <= 5*time.Minute { 107 107 - privateJwk, err := helpers.ParseJWKFromBytes([]byte(session.DpopPrivateJwk)) 108 108 - if err != nil { 109 109 - return nil, false, err 110 110 - } 111 111 - 112 112 - self := o.ClientMetadata() 113 113 - 114 114 - oauthClient, err := client.NewClient( 115 115 - self.ClientID, 116 116 - o.config.OAuth.Jwks, 117 117 - self.RedirectURIs[0], 118 118 - ) 119 119 - 120 120 - if err != nil { 121 121 - return nil, false, err 122 122 - } 123 123 - 124 124 - resp, err := oauthClient.RefreshTokenRequest(r.Context(), session.RefreshJwt, session.AuthServerIss, session.DpopAuthserverNonce, privateJwk) 125 125 - if err != nil { 126 126 - return nil, false, err 127 127 - } 128 128 - 129 129 - newExpiry := time.Now().Add(time.Duration(resp.ExpiresIn) * time.Second).Format(time.RFC3339) 130 130 - err = o.sess.RefreshSession(r.Context(), did, resp.AccessToken, resp.RefreshToken, newExpiry) 131 131 - if err != nil { 132 132 - return nil, false, fmt.Errorf("error refreshing oauth session: %w", err) 133 133 - } 134 134 - 135 135 - // update the current session 136 136 - session.AccessJwt = resp.AccessToken 137 137 - session.RefreshJwt = resp.RefreshToken 138 138 - session.DpopAuthserverNonce = resp.DpopAuthserverNonce 139 139 - session.Expiry = newExpiry 85 85 + return nil, fmt.Errorf("malformed DID in session cookie '%s': %w", d, err) 140 86 } 141 87 142 142 - return session, auth, nil 88 88 + sessId := userSession.Values[SessionId].(string) 89 89 + 90 90 + clientSess, err := o.ClientApp.ResumeSession(r.Context(), sessDid, sessId) 91 91 + if err != nil { 92 92 + return nil, fmt.Errorf("failed to resume session: %w", err) 93 93 + } 94 94 + 95 95 + return clientSess, nil 96 96 + } 97 97 + 98 98 + func (o *OAuth) DeleteSession(w http.ResponseWriter, r *http.Request) error { 99 99 + userSession, err := o.SessStore.Get(r, SessionName) 100 100 + if err != nil { 101 101 + return fmt.Errorf("error getting user session: %w", err) 102 102 + } 103 103 + if userSession.IsNew { 104 104 + return fmt.Errorf("no session available for user") 105 105 + } 106 106 + 107 107 + d := userSession.Values[SessionDid].(string) 108 108 + sessDid, err := syntax.ParseDID(d) 109 109 + if err != nil { 110 110 + return fmt.Errorf("malformed DID in session cookie '%s': %w", d, err) 111 111 + } 112 112 + 113 113 + sessId := userSession.Values[SessionId].(string) 114 114 + 115 115 + // delete the session 116 116 + err1 := o.ClientApp.Logout(r.Context(), sessDid, sessId) 117 117 + 118 118 + // remove the cookie 119 119 + userSession.Options.MaxAge = -1 120 120 + err2 := o.SessStore.Save(r, w, userSession) 121 121 + 122 122 + return errors.Join(err1, err2) 123 123 + } 124 124 + 125 125 + func pubKeyFromJwk(jwks string) (jwk.Key, error) { 126 126 + k, err := jwk.ParseKey([]byte(jwks)) 127 127 + if err != nil { 128 128 + return nil, err 129 129 + } 130 130 + pubKey, err := k.PublicKey() 131 131 + if err != nil { 132 132 + return nil, err 133 133 + } 134 134 + return pubKey, nil 143 135 } 144 136 145 137 type User struct { 146 146 - Handle string 147 147 - Did string 148 148 - Pds string 138 138 + Did string 139 139 + Pds string 149 140 } 150 141 151 151 - func (a *OAuth) GetUser(r *http.Request) *User { 152 152 - clientSession, err := a.store.Get(r, SessionName) 142 142 + func (o *OAuth) GetUser(r *http.Request) *User { 143 143 + sess, err := o.SessStore.Get(r, SessionName) 153 144 154 154 - if err != nil || clientSession.IsNew { 145 145 + if err != nil || sess.IsNew { 155 146 return nil 156 147 } 157 148 158 149 return &User{ 159 159 - Handle: clientSession.Values[SessionHandle].(string), 160 160 - Did: clientSession.Values[SessionDid].(string), 161 161 - Pds: clientSession.Values[SessionPds].(string), 150 150 + Did: sess.Values[SessionDid].(string), 151 151 + Pds: sess.Values[SessionPds].(string), 162 152 } 163 153 } 164 154 165 165 - func (a *OAuth) GetDid(r *http.Request) string { 166 166 - clientSession, err := a.store.Get(r, SessionName) 167 167 - 168 168 - if err != nil || clientSession.IsNew { 169 169 - return "" 155 155 + func (o *OAuth) GetDid(r *http.Request) string { 156 156 + if u := o.GetUser(r); u != nil { 157 157 + return u.Did 170 158 } 171 159 172 172 - return clientSession.Values[SessionDid].(string) 160 160 + return "" 173 161 } 174 162 175 175 - func (o *OAuth) AuthorizedClient(r *http.Request) (*xrpc.Client, error) { 176 176 - session, auth, err := o.GetSession(r) 163 163 + func (o *OAuth) AuthorizedClient(r *http.Request) (*atpclient.APIClient, error) { 164 164 + session, err := o.ResumeSession(r) 177 165 if err != nil { 178 166 return nil, fmt.Errorf("error getting session: %w", err) 179 167 } 180 180 - if !auth { 181 181 - return nil, fmt.Errorf("not authorized") 182 182 - } 183 183 - 184 184 - client := &oauth.XrpcClient{ 185 185 - OnDpopPdsNonceChanged: func(did, newNonce string) { 186 186 - err := o.sess.UpdateNonce(r.Context(), did, newNonce) 187 187 - if err != nil { 188 188 - log.Printf("error updating dpop pds nonce: %v", err) 189 189 - } 190 190 - }, 191 191 - } 192 192 - 193 193 - privateJwk, err := helpers.ParseJWKFromBytes([]byte(session.DpopPrivateJwk)) 194 194 - if err != nil { 195 195 - return nil, fmt.Errorf("error parsing private jwk: %w", err) 196 196 - } 197 197 - 198 198 - xrpcClient := xrpc.NewClient(client, &oauth.XrpcAuthedRequestArgs{ 199 199 - Did: session.Did, 200 200 - PdsUrl: session.PdsUrl, 201 201 - DpopPdsNonce: session.PdsUrl, 202 202 - AccessToken: session.AccessJwt, 203 203 - Issuer: session.AuthServerIss, 204 204 - DpopPrivateJwk: privateJwk, 205 205 - }) 206 206 - 207 207 - return xrpcClient, nil 168 168 + return session.APIClient(), nil 208 169 } 209 170 210 210 - // use this to create a client to communicate with knots or spindles 211 211 - // 212 171 // this is a higher level abstraction on ServerGetServiceAuth 213 172 type ServiceClientOpts struct { 214 173 service string ··· 218 259 return scheme + s.service 219 260 } 220 261 221 221 - func (o *OAuth) ServiceClient(r *http.Request, os ...ServiceClientOpt) (*indigo_xrpc.Client, error) { 262 262 + func (o *OAuth) ServiceClient(r *http.Request, os ...ServiceClientOpt) (*xrpc.Client, error) { 222 263 opts := ServiceClientOpts{} 223 264 for _, o := range os { 224 265 o(&opts) 225 266 } 226 267 227 227 - authorizedClient, err := o.AuthorizedClient(r) 268 268 + client, err := o.AuthorizedClient(r) 228 269 if err != nil { 229 270 return nil, err 230 271 } ··· 235 276 opts.exp = sixty 236 277 } 237 278 238 238 - resp, err := authorizedClient.ServerGetServiceAuth(r.Context(), opts.Audience(), opts.exp, opts.lxm) 279 279 + resp, err := comatproto.ServerGetServiceAuth(r.Context(), client, opts.Audience(), opts.exp, opts.lxm) 239 280 if err != nil { 240 281 return nil, err 241 282 } 242 283 243 243 - return &indigo_xrpc.Client{ 244 244 - Auth: &indigo_xrpc.AuthInfo{ 284 284 + return &xrpc.Client{ 285 285 + Auth: &xrpc.AuthInfo{ 245 286 AccessJwt: resp.Token, 246 287 }, 247 288 Host: opts.Host(), ··· 249 290 Timeout: time.Second * 5, 250 291 }, 251 292 }, nil 252 252 - } 253 253 - 254 254 - type ClientMetadata struct { 255 255 - ClientID string `json:"client_id"` 256 256 - ClientName string `json:"client_name"` 257 257 - SubjectType string `json:"subject_type"` 258 258 - ClientURI string `json:"client_uri"` 259 259 - RedirectURIs []string `json:"redirect_uris"` 260 260 - GrantTypes []string `json:"grant_types"` 261 261 - ResponseTypes []string `json:"response_types"` 262 262 - ApplicationType string `json:"application_type"` 263 263 - DpopBoundAccessTokens bool `json:"dpop_bound_access_tokens"` 264 264 - JwksURI string `json:"jwks_uri"` 265 265 - Scope string `json:"scope"` 266 266 - TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"` 267 267 - TokenEndpointAuthSigningAlg string `json:"token_endpoint_auth_signing_alg"` 268 268 - } 269 269 - 270 270 - func (o *OAuth) ClientMetadata() ClientMetadata { 271 271 - makeRedirectURIs := func(c string) []string { 272 272 - return []string{fmt.Sprintf("%s/oauth/callback", c)} 273 273 - } 274 274 - 275 275 - clientURI := o.config.Core.AppviewHost 276 276 - clientID := fmt.Sprintf("%s/oauth/client-metadata.json", clientURI) 277 277 - redirectURIs := makeRedirectURIs(clientURI) 278 278 - 279 279 - if o.config.Core.Dev { 280 280 - clientURI = "http://127.0.0.1:3000" 281 281 - redirectURIs = makeRedirectURIs(clientURI) 282 282 - 283 283 - query := url.Values{} 284 284 - query.Add("redirect_uri", redirectURIs[0]) 285 285 - query.Add("scope", "atproto transition:generic") 286 286 - clientID = fmt.Sprintf("http://localhost?%s", query.Encode()) 287 287 - } 288 288 - 289 289 - jwksURI := fmt.Sprintf("%s/oauth/jwks.json", clientURI) 290 290 - 291 291 - return ClientMetadata{ 292 292 - ClientID: clientID, 293 293 - ClientName: "Tangled", 294 294 - SubjectType: "public", 295 295 - ClientURI: clientURI, 296 296 - RedirectURIs: redirectURIs, 297 297 - GrantTypes: []string{"authorization_code", "refresh_token"}, 298 298 - ResponseTypes: []string{"code"}, 299 299 - ApplicationType: "web", 300 300 - DpopBoundAccessTokens: true, 301 301 - JwksURI: jwksURI, 302 302 - Scope: "atproto transition:generic", 303 303 - TokenEndpointAuthMethod: "private_key_jwt", 304 304 - TokenEndpointAuthSigningAlg: "ES256", 305 305 - } 306 293 }

+147

appview/oauth/store.go

reviewed

··· 1 1 + package oauth 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "encoding/json" 6 6 + "fmt" 7 7 + "time" 8 8 + 9 9 + "github.com/bluesky-social/indigo/atproto/auth/oauth" 10 10 + "github.com/bluesky-social/indigo/atproto/syntax" 11 11 + "github.com/redis/go-redis/v9" 12 12 + ) 13 13 + 14 14 + // redis-backed implementation of ClientAuthStore. 15 15 + type RedisStore struct { 16 16 + client *redis.Client 17 17 + SessionTTL time.Duration 18 18 + AuthRequestTTL time.Duration 19 19 + } 20 20 + 21 21 + var _ oauth.ClientAuthStore = &RedisStore{} 22 22 + 23 23 + func NewRedisStore(redisURL string) (*RedisStore, error) { 24 24 + opts, err := redis.ParseURL(redisURL) 25 25 + if err != nil { 26 26 + return nil, fmt.Errorf("failed to parse redis URL: %w", err) 27 27 + } 28 28 + 29 29 + client := redis.NewClient(opts) 30 30 + 31 31 + // test the connection 32 32 + ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) 33 33 + defer cancel() 34 34 + 35 35 + if err := client.Ping(ctx).Err(); err != nil { 36 36 + return nil, fmt.Errorf("failed to connect to redis: %w", err) 37 37 + } 38 38 + 39 39 + return &RedisStore{ 40 40 + client: client, 41 41 + SessionTTL: 30 * 24 * time.Hour, // 30 days 42 42 + AuthRequestTTL: 10 * time.Minute, // 10 minutes 43 43 + }, nil 44 44 + } 45 45 + 46 46 + func (r *RedisStore) Close() error { 47 47 + return r.client.Close() 48 48 + } 49 49 + 50 50 + func sessionKey(did syntax.DID, sessionID string) string { 51 51 + return fmt.Sprintf("oauth:session:%s:%s", did, sessionID) 52 52 + } 53 53 + 54 54 + func authRequestKey(state string) string { 55 55 + return fmt.Sprintf("oauth:auth_request:%s", state) 56 56 + } 57 57 + 58 58 + func (r *RedisStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauth.ClientSessionData, error) { 59 59 + key := sessionKey(did, sessionID) 60 60 + data, err := r.client.Get(ctx, key).Bytes() 61 61 + if err == redis.Nil { 62 62 + return nil, fmt.Errorf("session not found: %s", did) 63 63 + } 64 64 + if err != nil { 65 65 + return nil, fmt.Errorf("failed to get session: %w", err) 66 66 + } 67 67 + 68 68 + var sess oauth.ClientSessionData 69 69 + if err := json.Unmarshal(data, &sess); err != nil { 70 70 + return nil, fmt.Errorf("failed to unmarshal session: %w", err) 71 71 + } 72 72 + 73 73 + return &sess, nil 74 74 + } 75 75 + 76 76 + func (r *RedisStore) SaveSession(ctx context.Context, sess oauth.ClientSessionData) error { 77 77 + key := sessionKey(sess.AccountDID, sess.SessionID) 78 78 + 79 79 + data, err := json.Marshal(sess) 80 80 + if err != nil { 81 81 + return fmt.Errorf("failed to marshal session: %w", err) 82 82 + } 83 83 + 84 84 + if err := r.client.Set(ctx, key, data, r.SessionTTL).Err(); err != nil { 85 85 + return fmt.Errorf("failed to save session: %w", err) 86 86 + } 87 87 + 88 88 + return nil 89 89 + } 90 90 + 91 91 + func (r *RedisStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error { 92 92 + key := sessionKey(did, sessionID) 93 93 + if err := r.client.Del(ctx, key).Err(); err != nil { 94 94 + return fmt.Errorf("failed to delete session: %w", err) 95 95 + } 96 96 + return nil 97 97 + } 98 98 + 99 99 + func (r *RedisStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauth.AuthRequestData, error) { 100 100 + key := authRequestKey(state) 101 101 + data, err := r.client.Get(ctx, key).Bytes() 102 102 + if err == redis.Nil { 103 103 + return nil, fmt.Errorf("request info not found: %s", state) 104 104 + } 105 105 + if err != nil { 106 106 + return nil, fmt.Errorf("failed to get auth request: %w", err) 107 107 + } 108 108 + 109 109 + var req oauth.AuthRequestData 110 110 + if err := json.Unmarshal(data, &req); err != nil { 111 111 + return nil, fmt.Errorf("failed to unmarshal auth request: %w", err) 112 112 + } 113 113 + 114 114 + return &req, nil 115 115 + } 116 116 + 117 117 + func (r *RedisStore) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error { 118 118 + key := authRequestKey(info.State) 119 119 + 120 120 + // check if already exists (to match MemStore behavior) 121 121 + exists, err := r.client.Exists(ctx, key).Result() 122 122 + if err != nil { 123 123 + return fmt.Errorf("failed to check auth request existence: %w", err) 124 124 + } 125 125 + if exists > 0 { 126 126 + return fmt.Errorf("auth request already saved for state %s", info.State) 127 127 + } 128 128 + 129 129 + data, err := json.Marshal(info) 130 130 + if err != nil { 131 131 + return fmt.Errorf("failed to marshal auth request: %w", err) 132 132 + } 133 133 + 134 134 + if err := r.client.Set(ctx, key, data, r.AuthRequestTTL).Err(); err != nil { 135 135 + return fmt.Errorf("failed to save auth request: %w", err) 136 136 + } 137 137 + 138 138 + return nil 139 139 + } 140 140 + 141 141 + func (r *RedisStore) DeleteAuthRequestInfo(ctx context.Context, state string) error { 142 142 + key := authRequestKey(state) 143 143 + if err := r.client.Del(ctx, key).Err(); err != nil { 144 144 + return fmt.Errorf("failed to delete auth request: %w", err) 145 145 + } 146 146 + return nil 147 147 + }

+1 -1

appview/pages/templates/layouts/fragments/topbar.html

reviewed

··· 51 51 <summary 52 52 class="cursor-pointer list-none flex items-center gap-1" 53 53 > 54 54 - {{ $user := didOrHandle .Did .Handle }} 54 54 + {{ $user := .Did }} 55 55 <img 56 56 src="{{ tinyAvatar $user }}" 57 57 alt=""

+1 -1

appview/pages/templates/repo/pulls/fragments/pullNewComment.html

reviewed

··· 3 3 id="pull-comment-card-{{ .RoundNumber }}" 4 4 class="bg-white dark:bg-gray-800 rounded drop-shadow-sm p-4 relative w-full flex flex-col gap-2"> 5 5 <div class="text-sm text-gray-500 dark:text-gray-400"> 6 6 - {{ didOrHandle .LoggedInUser.Did .LoggedInUser.Handle }} 6 6 + {{ resolve .LoggedInUser.Did }} 7 7 </div> 8 8 <form 9 9 hx-post="/{{ .RepoInfo.FullName }}/pulls/{{ .Pull.PullId }}/round/{{ .RoundNumber }}/comment"

+1 -3

appview/pages/templates/user/settings/profile.html

reviewed

··· 33 33 <div class="flex flex-wrap text-sm items-center gap-1 text-gray-500 dark:text-gray-400"> 34 34 <span>Handle</span> 35 35 </div> 36 36 - {{ if .LoggedInUser.Handle }} 37 36 <span class="font-bold"> 38 38 - @{{ .LoggedInUser.Handle }} 37 37 + {{ resolve .LoggedInUser.Did }} 39 38 </span> 40 40 - {{ end }} 41 39 </div> 42 40 </div> 43 41 <div class="flex items-center justify-between p-4">

+2 -1

appview/pipelines/pipelines.go

reviewed

··· 48 48 ) *Pipelines { 49 49 logger := log.New("pipelines") 50 50 51 51 - return &Pipelines{oauth: oauth, 51 51 + return &Pipelines{ 52 52 + oauth: oauth, 52 53 repoResolver: repoResolver, 53 54 pages: pages, 54 55 idResolver: idResolver,

+6 -6

appview/pulls/pulls.go

reviewed

··· 665 665 s.pages.Notice(w, "pull-comment", "Failed to create comment.") 666 666 return 667 667 } 668 668 - atResp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 668 668 + atResp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 669 669 Collection: tangled.RepoPullCommentNSID, 670 670 Repo: user.Did, 671 671 Rkey: tid.TID(), ··· 1142 1142 return 1143 1143 } 1144 1144 1145 1145 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1145 1145 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1146 1146 Collection: tangled.RepoPullNSID, 1147 1147 Repo: user.Did, 1148 1148 Rkey: rkey, ··· 1239 1239 } 1240 1240 writes = append(writes, &write) 1241 1241 } 1242 1242 - _, err = client.RepoApplyWrites(r.Context(), &comatproto.RepoApplyWrites_Input{ 1242 1242 + _, err = comatproto.RepoApplyWrites(r.Context(), client, &comatproto.RepoApplyWrites_Input{ 1243 1243 Repo: user.Did, 1244 1244 Writes: writes, 1245 1245 }) ··· 1770 1770 return 1771 1771 } 1772 1772 1773 1773 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoPullNSID, user.Did, pull.Rkey) 1773 1773 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoPullNSID, user.Did, pull.Rkey) 1774 1774 if err != nil { 1775 1775 // failed to get record 1776 1776 s.pages.Notice(w, "resubmit-error", "Failed to update pull, no record found on PDS.") ··· 1793 1793 } 1794 1794 } 1795 1795 1796 1796 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1796 1796 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1797 1797 Collection: tangled.RepoPullNSID, 1798 1798 Repo: user.Did, 1799 1799 Rkey: pull.Rkey, ··· 2065 2065 return 2066 2066 } 2067 2067 2068 2068 - _, err = client.RepoApplyWrites(r.Context(), &comatproto.RepoApplyWrites_Input{ 2068 2068 + _, err = comatproto.RepoApplyWrites(r.Context(), client, &comatproto.RepoApplyWrites_Input{ 2069 2069 Repo: user.Did, 2070 2070 Writes: writes, 2071 2071 })

+11 -10

appview/repo/artifact.go

reviewed

··· 10 10 "net/url" 11 11 "time" 12 12 13 13 - comatproto "github.com/bluesky-social/indigo/api/atproto" 14 14 - lexutil "github.com/bluesky-social/indigo/lex/util" 15 15 - indigoxrpc "github.com/bluesky-social/indigo/xrpc" 16 16 - "github.com/dustin/go-humanize" 17 17 - "github.com/go-chi/chi/v5" 18 18 - "github.com/go-git/go-git/v5/plumbing" 19 19 - "github.com/ipfs/go-cid" 20 13 "tangled.org/core/api/tangled" 21 14 "tangled.org/core/appview/db" 22 15 "tangled.org/core/appview/models" ··· 18 25 "tangled.org/core/appview/xrpcclient" 19 26 "tangled.org/core/tid" 20 27 "tangled.org/core/types" 28 28 + 29 29 + comatproto "github.com/bluesky-social/indigo/api/atproto" 30 30 + lexutil "github.com/bluesky-social/indigo/lex/util" 31 31 + indigoxrpc "github.com/bluesky-social/indigo/xrpc" 32 32 + "github.com/dustin/go-humanize" 33 33 + "github.com/go-chi/chi/v5" 34 34 + "github.com/go-git/go-git/v5/plumbing" 35 35 + "github.com/ipfs/go-cid" 21 36 ) 22 37 23 38 // TODO: proper statuses here on early exit ··· 61 60 return 62 61 } 63 62 64 64 - uploadBlobResp, err := client.RepoUploadBlob(r.Context(), file) 63 63 + uploadBlobResp, err := comatproto.RepoUploadBlob(r.Context(), client, file) 65 64 if err != nil { 66 65 log.Println("failed to upload blob", err) 67 66 rp.pages.Notice(w, "upload", "Failed to upload blob to your PDS. Try again later.") ··· 73 72 rkey := tid.TID() 74 73 createdAt := time.Now() 75 74 76 76 - putRecordResp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 75 75 + putRecordResp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 77 76 Collection: tangled.RepoArtifactNSID, 78 77 Repo: user.Did, 79 78 Rkey: rkey, ··· 250 249 return 251 250 } 252 251 253 253 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 252 252 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 254 253 Collection: tangled.RepoArtifactNSID, 255 254 Repo: user.Did, 256 255 Rkey: artifact.Rkey,

+28 -35

appview/repo/repo.go

reviewed

··· 17 17 "strings" 18 18 "time" 19 19 20 20 - comatproto "github.com/bluesky-social/indigo/api/atproto" 21 21 - lexutil "github.com/bluesky-social/indigo/lex/util" 22 22 - indigoxrpc "github.com/bluesky-social/indigo/xrpc" 23 20 "tangled.org/core/api/tangled" 24 21 "tangled.org/core/appview/commitverify" 25 22 "tangled.org/core/appview/config" ··· 37 40 "tangled.org/core/types" 38 41 "tangled.org/core/xrpc/serviceauth" 39 42 43 43 + comatproto "github.com/bluesky-social/indigo/api/atproto" 44 44 + atpclient "github.com/bluesky-social/indigo/atproto/client" 45 45 + "github.com/bluesky-social/indigo/atproto/syntax" 46 46 + lexutil "github.com/bluesky-social/indigo/lex/util" 47 47 + indigoxrpc "github.com/bluesky-social/indigo/xrpc" 40 48 securejoin "github.com/cyphar/filepath-securejoin" 41 49 "github.com/go-chi/chi/v5" 42 50 "github.com/go-git/go-git/v5/plumbing" 43 43 - 44 44 - "github.com/bluesky-social/indigo/atproto/syntax" 45 51 ) 46 52 47 53 type Repo struct { ··· 307 307 // this is a bit of a pain because the golang atproto impl does not allow nil SwapRecord field 308 308 // 309 309 // SwapRecord is optional and should happen automagically, but given that it does not, we have to perform two requests 310 310 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 310 310 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 311 311 if err != nil { 312 312 // failed to get record 313 313 rp.pages.Notice(w, "repo-notice", "Failed to update description, no record found on PDS.") 314 314 return 315 315 } 316 316 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 316 316 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 317 317 Collection: tangled.RepoNSID, 318 318 Repo: newRepo.Did, 319 319 Rkey: newRepo.Rkey, ··· 863 863 user := rp.oauth.GetUser(r) 864 864 l := rp.logger.With("handler", "EditSpindle") 865 865 l = l.With("did", user.Did) 866 866 - l = l.With("handle", user.Handle) 867 866 868 867 errorId := "operation-error" 869 868 fail := func(msg string, err error) { ··· 915 916 return 916 917 } 917 918 918 918 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 919 919 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 919 920 if err != nil { 920 921 fail("Failed to update spindle, no record found on PDS.", err) 921 922 return 922 923 } 923 923 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 924 924 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 924 925 Collection: tangled.RepoNSID, 925 926 Repo: newRepo.Did, 926 927 Rkey: newRepo.Rkey, ··· 950 951 user := rp.oauth.GetUser(r) 951 952 l := rp.logger.With("handler", "AddLabel") 952 953 l = l.With("did", user.Did) 953 953 - l = l.With("handle", user.Handle) 954 954 955 955 f, err := rp.repoResolver.Resolve(r) 956 956 if err != nil { ··· 1018 1020 1019 1021 // emit a labelRecord 1020 1022 labelRecord := label.AsRecord() 1021 1021 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1023 1023 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1022 1024 Collection: tangled.LabelDefinitionNSID, 1023 1025 Repo: label.Did, 1024 1026 Rkey: label.Rkey, ··· 1041 1043 newRepo.Labels = append(newRepo.Labels, aturi) 1042 1044 repoRecord := newRepo.AsRecord() 1043 1045 1044 1044 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 1046 1046 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 1045 1047 if err != nil { 1046 1048 fail("Failed to update labels, no record found on PDS.", err) 1047 1049 return 1048 1050 } 1049 1049 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1051 1051 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1050 1052 Collection: tangled.RepoNSID, 1051 1053 Repo: newRepo.Did, 1052 1054 Rkey: newRepo.Rkey, ··· 1109 1111 user := rp.oauth.GetUser(r) 1110 1112 l := rp.logger.With("handler", "DeleteLabel") 1111 1113 l = l.With("did", user.Did) 1112 1112 - l = l.With("handle", user.Handle) 1113 1114 1114 1115 f, err := rp.repoResolver.Resolve(r) 1115 1116 if err != nil { ··· 1138 1141 } 1139 1142 1140 1143 // delete label record from PDS 1141 1141 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 1144 1144 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 1142 1145 Collection: tangled.LabelDefinitionNSID, 1143 1146 Repo: label.Did, 1144 1147 Rkey: label.Rkey, ··· 1160 1163 newRepo.Labels = updated 1161 1164 repoRecord := newRepo.AsRecord() 1162 1165 1163 1163 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 1166 1166 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoNSID, newRepo.Did, newRepo.Rkey) 1164 1167 if err != nil { 1165 1168 fail("Failed to update labels, no record found on PDS.", err) 1166 1169 return 1167 1170 } 1168 1168 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1171 1171 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1169 1172 Collection: tangled.RepoNSID, 1170 1173 Repo: newRepo.Did, 1171 1174 Rkey: newRepo.Rkey, ··· 1217 1220 user := rp.oauth.GetUser(r) 1218 1221 l := rp.logger.With("handler", "SubscribeLabel") 1219 1222 l = l.With("did", user.Did) 1220 1220 - l = l.With("handle", user.Handle) 1221 1223 1222 1224 f, err := rp.repoResolver.Resolve(r) 1223 1225 if err != nil { ··· 1257 1261 return 1258 1262 } 1259 1263 1260 1260 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoNSID, f.Repo.Did, f.Repo.Rkey) 1264 1264 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoNSID, f.Repo.Did, f.Repo.Rkey) 1261 1265 if err != nil { 1262 1266 fail("Failed to update labels, no record found on PDS.", err) 1263 1267 return 1264 1268 } 1265 1265 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1269 1269 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1266 1270 Collection: tangled.RepoNSID, 1267 1271 Repo: newRepo.Did, 1268 1272 Rkey: newRepo.Rkey, ··· 1303 1307 user := rp.oauth.GetUser(r) 1304 1308 l := rp.logger.With("handler", "UnsubscribeLabel") 1305 1309 l = l.With("did", user.Did) 1306 1306 - l = l.With("handle", user.Handle) 1307 1310 1308 1311 f, err := rp.repoResolver.Resolve(r) 1309 1312 if err != nil { ··· 1345 1350 return 1346 1351 } 1347 1352 1348 1348 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoNSID, f.Repo.Did, f.Repo.Rkey) 1353 1353 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.RepoNSID, f.Repo.Did, f.Repo.Rkey) 1349 1354 if err != nil { 1350 1355 fail("Failed to update labels, no record found on PDS.", err) 1351 1356 return 1352 1357 } 1353 1353 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1358 1358 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1354 1359 Collection: tangled.RepoNSID, 1355 1360 Repo: newRepo.Did, 1356 1361 Rkey: newRepo.Rkey, ··· 1474 1479 user := rp.oauth.GetUser(r) 1475 1480 l := rp.logger.With("handler", "AddCollaborator") 1476 1481 l = l.With("did", user.Did) 1477 1477 - l = l.With("handle", user.Handle) 1478 1482 1479 1483 f, err := rp.repoResolver.Resolve(r) 1480 1484 if err != nil { ··· 1520 1526 currentUser := rp.oauth.GetUser(r) 1521 1527 rkey := tid.TID() 1522 1528 createdAt := time.Now() 1523 1523 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 1529 1529 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 1524 1530 Collection: tangled.RepoCollaboratorNSID, 1525 1531 Repo: currentUser.Did, 1526 1532 Rkey: rkey, ··· 1611 1617 } 1612 1618 1613 1619 // remove record from pds 1614 1614 - xrpcClient, err := rp.oauth.AuthorizedClient(r) 1620 1620 + atpClient, err := rp.oauth.AuthorizedClient(r) 1615 1621 if err != nil { 1616 1622 log.Println("failed to get authorized client", err) 1617 1623 return 1618 1624 } 1619 1619 - _, err = xrpcClient.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 1625 1625 + _, err = comatproto.RepoDeleteRecord(r.Context(), atpClient, &comatproto.RepoDeleteRecord_Input{ 1620 1626 Collection: tangled.RepoNSID, 1621 1627 Repo: user.Did, 1622 1628 Rkey: f.Rkey, ··· 1758 1764 func (rp *Repo) Secrets(w http.ResponseWriter, r *http.Request) { 1759 1765 user := rp.oauth.GetUser(r) 1760 1766 l := rp.logger.With("handler", "Secrets") 1761 1761 - l = l.With("handle", user.Handle) 1762 1767 l = l.With("did", user.Did) 1763 1768 1764 1769 f, err := rp.repoResolver.Resolve(r) ··· 2172 2179 } 2173 2180 record := repo.AsRecord() 2174 2181 2175 2175 - xrpcClient, err := rp.oauth.AuthorizedClient(r) 2182 2182 + atpClient, err := rp.oauth.AuthorizedClient(r) 2176 2183 if err != nil { 2177 2184 l.Error("failed to create xrpcclient", "err", err) 2178 2185 rp.pages.Notice(w, "repo", "Failed to fork repository.") 2179 2186 return 2180 2187 } 2181 2188 2182 2182 - atresp, err := xrpcClient.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 2189 2189 + atresp, err := comatproto.RepoPutRecord(r.Context(), atpClient, &comatproto.RepoPutRecord_Input{ 2183 2190 Collection: tangled.RepoNSID, 2184 2191 Repo: user.Did, 2185 2192 Rkey: rkey, ··· 2211 2218 rollback := func() { 2212 2219 err1 := tx.Rollback() 2213 2220 err2 := rp.enforcer.E.LoadPolicy() 2214 2214 - err3 := rollbackRecord(context.Background(), aturi, xrpcClient) 2221 2221 + err3 := rollbackRecord(context.Background(), aturi, atpClient) 2215 2222 2216 2223 // ignore txn complete errors, this is okay 2217 2224 if errors.Is(err1, sql.ErrTxDone) { ··· 2284 2291 aturi = "" 2285 2292 2286 2293 rp.notifier.NewRepo(r.Context(), repo) 2287 2287 - rp.pages.HxLocation(w, fmt.Sprintf("/@%s/%s", user.Handle, forkName)) 2294 2294 + rp.pages.HxLocation(w, fmt.Sprintf("/@%s/%s", user.Did, forkName)) 2288 2295 } 2289 2296 } 2290 2297 2291 2298 // this is used to rollback changes made to the PDS 2292 2299 // 2293 2300 // it is a no-op if the provided ATURI is empty 2294 2294 - func rollbackRecord(ctx context.Context, aturi string, xrpcc *xrpcclient.Client) error { 2301 2301 + func rollbackRecord(ctx context.Context, aturi string, client *atpclient.APIClient) error { 2295 2302 if aturi == "" { 2296 2303 return nil 2297 2304 } ··· 2302 2309 repo := parsed.Authority().String() 2303 2310 rkey := parsed.RecordKey().String() 2304 2311 2305 2305 - _, err := xrpcc.RepoDeleteRecord(ctx, &comatproto.RepoDeleteRecord_Input{ 2312 2312 + _, err := comatproto.RepoDeleteRecord(ctx, client, &comatproto.RepoDeleteRecord_Input{ 2306 2313 Collection: collection, 2307 2314 Repo: repo, 2308 2315 Rkey: rkey,

+2 -2

appview/settings/settings.go

reviewed

··· 470 470 } 471 471 472 472 // store in pds too 473 473 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 473 473 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 474 474 Collection: tangled.PublicKeyNSID, 475 475 Repo: did, 476 476 Rkey: rkey, ··· 527 527 528 528 if rkey != "" { 529 529 // remove from pds too 530 530 - _, err := client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 530 530 + _, err := comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 531 531 Collection: tangled.PublicKeyNSID, 532 532 Repo: did, 533 533 Rkey: rkey,

-2

appview/signup/signup.go

reviewed

··· 20 20 "tangled.org/core/appview/models" 21 21 "tangled.org/core/appview/pages" 22 22 "tangled.org/core/appview/state/userutil" 23 23 - "tangled.org/core/appview/xrpcclient" 24 23 "tangled.org/core/idresolver" 25 24 ) 26 25 ··· 28 29 db *db.DB 29 30 cf *dns.Cloudflare 30 31 posthog posthog.Client 31 31 - xrpc *xrpcclient.Client 32 32 idResolver *idresolver.Resolver 33 33 pages *pages.Pages 34 34 l *slog.Logger

+5 -5

appview/spindles/spindles.go

reviewed

··· 189 189 return 190 190 } 191 191 192 192 - ex, _ := client.RepoGetRecord(r.Context(), "", tangled.SpindleNSID, user.Did, instance) 192 192 + ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.SpindleNSID, user.Did, instance) 193 193 var exCid *string 194 194 if ex != nil { 195 195 exCid = ex.Cid 196 196 } 197 197 198 198 // re-announce by registering under same rkey 199 199 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 199 199 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 200 200 Collection: tangled.SpindleNSID, 201 201 Repo: user.Did, 202 202 Rkey: instance, ··· 332 332 return 333 333 } 334 334 335 335 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 335 335 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 336 336 Collection: tangled.SpindleNSID, 337 337 Repo: user.Did, 338 338 Rkey: instance, ··· 542 542 return 543 543 } 544 544 545 545 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 545 545 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 546 546 Collection: tangled.SpindleMemberNSID, 547 547 Repo: user.Did, 548 548 Rkey: rkey, ··· 683 683 } 684 684 685 685 // remove from pds 686 686 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 686 686 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 687 687 Collection: tangled.SpindleMemberNSID, 688 688 Repo: user.Did, 689 689 Rkey: members[0].Rkey,

+2 -2

appview/state/follow.go

reviewed

··· 43 43 case http.MethodPost: 44 44 createdAt := time.Now().Format(time.RFC3339) 45 45 rkey := tid.TID() 46 46 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 46 46 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 47 47 Collection: tangled.GraphFollowNSID, 48 48 Repo: currentUser.Did, 49 49 Rkey: rkey, ··· 88 88 return 89 89 } 90 90 91 91 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 91 91 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 92 92 Collection: tangled.GraphFollowNSID, 93 93 Repo: currentUser.Did, 94 94 Rkey: follow.Rkey,

+63

appview/state/login.go

reviewed

··· 1 1 + package state 2 2 + 3 3 + import ( 4 4 + "fmt" 5 5 + "log" 6 6 + "net/http" 7 7 + "strings" 8 8 + 9 9 + "tangled.org/core/appview/pages" 10 10 + ) 11 11 + 12 12 + func (s *State) Login(w http.ResponseWriter, r *http.Request) { 13 13 + switch r.Method { 14 14 + case http.MethodGet: 15 15 + returnURL := r.URL.Query().Get("return_url") 16 16 + s.pages.Login(w, pages.LoginParams{ 17 17 + ReturnUrl: returnURL, 18 18 + }) 19 19 + case http.MethodPost: 20 20 + handle := r.FormValue("handle") 21 21 + 22 22 + // when users copy their handle from bsky.app, it tends to have these characters around it: 23 23 + // 24 24 + // @nelind.dk: 25 25 + // \u202a ensures that the handle is always rendered left to right and 26 26 + // \u202c reverts that so the rest of the page renders however it should 27 27 + handle = strings.TrimPrefix(handle, "\u202a") 28 28 + handle = strings.TrimSuffix(handle, "\u202c") 29 29 + 30 30 + // `@` is harmless 31 31 + handle = strings.TrimPrefix(handle, "@") 32 32 + 33 33 + // basic handle validation 34 34 + if !strings.Contains(handle, ".") { 35 35 + log.Println("invalid handle format", "raw", handle) 36 36 + s.pages.Notice( 37 37 + w, 38 38 + "login-msg", 39 39 + fmt.Sprintf("\"%s\" is an invalid handle. Did you mean %s.bsky.social or %s.tngl.sh?", handle, handle, handle), 40 40 + ) 41 41 + return 42 42 + } 43 43 + 44 44 + redirectURL, err := s.oauth.ClientApp.StartAuthFlow(r.Context(), handle) 45 45 + if err != nil { 46 46 + http.Error(w, err.Error(), http.StatusInternalServerError) 47 47 + return 48 48 + } 49 49 + 50 50 + s.pages.HxRedirect(w, redirectURL) 51 51 + } 52 52 + } 53 53 + 54 54 + func (s *State) Logout(w http.ResponseWriter, r *http.Request) { 55 55 + err := s.oauth.DeleteSession(w, r) 56 56 + if err != nil { 57 57 + log.Println("failed to logout", "err", err) 58 58 + } else { 59 59 + log.Println("logged out successfully") 60 60 + } 61 61 + 62 62 + s.pages.HxRedirect(w, "/login") 63 63 + }

+2 -2

appview/state/profile.go

reviewed

··· 634 634 vanityStats = append(vanityStats, string(v.Kind)) 635 635 } 636 636 637 637 - ex, _ := client.RepoGetRecord(r.Context(), "", tangled.ActorProfileNSID, user.Did, "self") 637 637 + ex, _ := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Did, "self") 638 638 var cid *string 639 639 if ex != nil { 640 640 cid = ex.Cid 641 641 } 642 642 643 643 - _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 643 643 + _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 644 644 Collection: tangled.ActorProfileNSID, 645 645 Repo: user.Did, 646 646 Rkey: "self",

+3 -3

appview/state/reaction.go

reviewed

··· 7 7 8 8 comatproto "github.com/bluesky-social/indigo/api/atproto" 9 9 "github.com/bluesky-social/indigo/atproto/syntax" 10 10 - 11 10 lexutil "github.com/bluesky-social/indigo/lex/util" 11 11 + 12 12 "tangled.org/core/api/tangled" 13 13 "tangled.org/core/appview/db" 14 14 "tangled.org/core/appview/models" ··· 47 47 case http.MethodPost: 48 48 createdAt := time.Now().Format(time.RFC3339) 49 49 rkey := tid.TID() 50 50 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 50 50 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 51 51 Collection: tangled.FeedReactionNSID, 52 52 Repo: currentUser.Did, 53 53 Rkey: rkey, ··· 92 92 return 93 93 } 94 94 95 95 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 95 95 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 96 96 Collection: tangled.FeedReactionNSID, 97 97 Repo: currentUser.Did, 98 98 Rkey: reaction.Rkey,

+5 -10

appview/state/router.go

reviewed

··· 5 5 "strings" 6 6 7 7 "github.com/go-chi/chi/v5" 8 8 - "github.com/gorilla/sessions" 9 8 "tangled.org/core/appview/issues" 10 9 "tangled.org/core/appview/knots" 11 10 "tangled.org/core/appview/labels" 12 11 "tangled.org/core/appview/middleware" 13 12 "tangled.org/core/appview/notifications" 14 14 - oauthhandler "tangled.org/core/appview/oauth/handler" 15 13 "tangled.org/core/appview/pipelines" 16 14 "tangled.org/core/appview/pulls" 17 15 "tangled.org/core/appview/repo" ··· 32 34 s.pages, 33 35 ) 34 36 35 35 - router.Use(middleware.TryRefreshSession()) 36 37 router.Get("/favicon.svg", s.Favicon) 37 38 router.Get("/favicon.ico", s.Favicon) 38 39 router.Get("/pwa-manifest.json", s.PWAManifest) ··· 120 123 // special-case handler for serving tangled.org/core 121 124 r.Get("/core", s.Core()) 122 125 126 126 + r.Get("/login", s.Login) 127 127 + r.Post("/login", s.Login) 128 128 + r.Post("/logout", s.Logout) 129 129 + 123 130 r.Route("/repo", func(r chi.Router) { 124 131 r.Route("/new", func(r chi.Router) { 125 132 r.Use(middleware.AuthMiddleware(s.oauth)) ··· 165 164 r.Mount("/notifications", s.NotificationsRouter(mw)) 166 165 167 166 r.Mount("/signup", s.SignupRouter()) 168 168 - r.Mount("/", s.OAuthRouter()) 167 167 + r.Mount("/", s.oauth.Router()) 169 168 170 169 r.Get("/keys/{user}", s.Keys) 171 170 r.Get("/terms", s.TermsOfService) ··· 190 189 191 190 http.Redirect(w, r, "/@tangled.org/core", http.StatusFound) 192 191 } 193 193 - } 194 194 - 195 195 - func (s *State) OAuthRouter() http.Handler { 196 196 - store := sessions.NewCookieStore([]byte(s.config.Core.CookieSecret)) 197 197 - oauth := oauthhandler.New(s.config, s.pages, s.idResolver, s.db, s.sess, store, s.oauth, s.enforcer, s.posthog) 198 198 - return oauth.Router() 199 192 } 200 193 201 194 func (s *State) SettingsRouter() http.Handler {

+2 -2

appview/state/star.go

reviewed

··· 40 40 case http.MethodPost: 41 41 createdAt := time.Now().Format(time.RFC3339) 42 42 rkey := tid.TID() 43 43 - resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 43 43 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 44 44 Collection: tangled.FeedStarNSID, 45 45 Repo: currentUser.Did, 46 46 Rkey: rkey, ··· 92 92 return 93 93 } 94 94 95 95 - _, err = client.RepoDeleteRecord(r.Context(), &comatproto.RepoDeleteRecord_Input{ 95 95 + _, err = comatproto.RepoDeleteRecord(r.Context(), client, &comatproto.RepoDeleteRecord_Input{ 96 96 Collection: tangled.FeedStarNSID, 97 97 Repo: currentUser.Did, 98 98 Rkey: star.Rkey,

+23 -20

appview/state/state.go

reviewed

··· 11 11 "strings" 12 12 "time" 13 13 14 14 - comatproto "github.com/bluesky-social/indigo/api/atproto" 15 15 - "github.com/bluesky-social/indigo/atproto/syntax" 16 16 - lexutil "github.com/bluesky-social/indigo/lex/util" 17 17 - securejoin "github.com/cyphar/filepath-securejoin" 18 18 - "github.com/go-chi/chi/v5" 19 19 - "github.com/posthog/posthog-go" 20 14 "tangled.org/core/api/tangled" 21 15 "tangled.org/core/appview" 22 16 "tangled.org/core/appview/cache" ··· 32 38 tlog "tangled.org/core/log" 33 39 "tangled.org/core/rbac" 34 40 "tangled.org/core/tid" 41 41 + 42 42 + comatproto "github.com/bluesky-social/indigo/api/atproto" 43 43 + atpclient "github.com/bluesky-social/indigo/atproto/client" 44 44 + "github.com/bluesky-social/indigo/atproto/syntax" 45 45 + lexutil "github.com/bluesky-social/indigo/lex/util" 46 46 + securejoin "github.com/cyphar/filepath-securejoin" 47 47 + "github.com/go-chi/chi/v5" 48 48 + "github.com/posthog/posthog-go" 35 49 ) 36 50 37 51 type State struct { ··· 77 75 res = idresolver.DefaultResolver() 78 76 } 79 77 80 80 - pgs := pages.NewPages(config, res) 78 78 + pages := pages.NewPages(config, res) 81 79 cache := cache.New(config.Redis.Addr) 82 80 sess := session.New(cache) 83 83 - oauth := oauth.NewOAuth(config, sess) 81 81 + oauth2, err := oauth.New(config) 82 82 + if err != nil { 83 83 + return nil, fmt.Errorf("failed to start oauth handler: %w", err) 84 84 + } 84 85 validator := validator.New(d, res, enforcer) 85 86 86 87 posthog, err := posthog.NewWithConfig(config.Posthog.ApiKey, posthog.Config{Endpoint: config.Posthog.Endpoint}) ··· 167 162 state := &State{ 168 163 d, 169 164 notifier, 170 170 - oauth, 165 165 + oauth2, 171 166 enforcer, 172 172 - pgs, 167 167 + pages, 173 168 sess, 174 169 res, 175 170 posthog, ··· 280 275 // non-fatal 281 276 } 282 277 283 283 - fmt.Println(s.pages.Timeline(w, pages.TimelineParams{ 278 278 + s.pages.Timeline(w, pages.TimelineParams{ 284 279 LoggedInUser: user, 285 280 Timeline: timeline, 286 281 Repos: repos, 287 282 GfiLabel: gfiLabel, 288 288 - })) 283 283 + }) 289 284 } 290 285 291 286 func (s *State) UpgradeBanner(w http.ResponseWriter, r *http.Request) { ··· 296 291 297 292 l := s.logger.With("handler", "UpgradeBanner") 298 293 l = l.With("did", user.Did) 299 299 - l = l.With("handle", user.Handle) 300 294 301 295 regs, err := db.GetRegistrations( 302 296 s.db, ··· 435 431 436 432 user := s.oauth.GetUser(r) 437 433 l = l.With("did", user.Did) 438 438 - l = l.With("handle", user.Handle) 439 434 440 435 // form validation 441 436 domain := r.FormValue("domain") ··· 498 495 } 499 496 record := repo.AsRecord() 500 497 501 501 - xrpcClient, err := s.oauth.AuthorizedClient(r) 498 498 + atpClient, err := s.oauth.AuthorizedClient(r) 502 499 if err != nil { 503 500 l.Info("PDS write failed", "err", err) 504 501 s.pages.Notice(w, "repo", "Failed to write record to PDS.") 505 502 return 506 503 } 507 504 508 508 - atresp, err := xrpcClient.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 505 505 + atresp, err := comatproto.RepoPutRecord(r.Context(), atpClient, &comatproto.RepoPutRecord_Input{ 509 506 Collection: tangled.RepoNSID, 510 507 Repo: user.Did, 511 508 Rkey: rkey, ··· 537 534 rollback := func() { 538 535 err1 := tx.Rollback() 539 536 err2 := s.enforcer.E.LoadPolicy() 540 540 - err3 := rollbackRecord(context.Background(), aturi, xrpcClient) 537 537 + err3 := rollbackRecord(context.Background(), aturi, atpClient) 541 538 542 539 // ignore txn complete errors, this is okay 543 540 if errors.Is(err1, sql.ErrTxDone) { ··· 610 607 aturi = "" 611 608 612 609 s.notifier.NewRepo(r.Context(), repo) 613 613 - s.pages.HxLocation(w, fmt.Sprintf("/@%s/%s", user.Handle, repoName)) 610 610 + s.pages.HxLocation(w, fmt.Sprintf("/@%s/%s", user.Did, repoName)) 614 611 } 615 612 } 616 613 617 614 // this is used to rollback changes made to the PDS 618 615 // 619 616 // it is a no-op if the provided ATURI is empty 620 620 - func rollbackRecord(ctx context.Context, aturi string, xrpcc *xrpcclient.Client) error { 617 617 + func rollbackRecord(ctx context.Context, aturi string, client *atpclient.APIClient) error { 621 618 if aturi == "" { 622 619 return nil 623 620 } ··· 628 625 repo := parsed.Authority().String() 629 626 rkey := parsed.RecordKey().String() 630 627 631 631 - _, err := xrpcc.RepoDeleteRecord(ctx, &comatproto.RepoDeleteRecord_Input{ 628 628 + _, err := comatproto.RepoDeleteRecord(ctx, client, &comatproto.RepoDeleteRecord_Input{ 632 629 Collection: collection, 633 630 Repo: repo, 634 631 Rkey: rkey,

+9 -7

appview/strings/strings.go

reviewed

··· 22 22 "github.com/bluesky-social/indigo/api/atproto" 23 23 "github.com/bluesky-social/indigo/atproto/identity" 24 24 "github.com/bluesky-social/indigo/atproto/syntax" 25 25 - lexutil "github.com/bluesky-social/indigo/lex/util" 26 25 "github.com/go-chi/chi/v5" 26 26 + 27 27 + comatproto "github.com/bluesky-social/indigo/api/atproto" 28 28 + lexutil "github.com/bluesky-social/indigo/lex/util" 27 29 ) 28 30 29 31 type Strings struct { ··· 256 254 } 257 255 258 256 // first replace the existing record in the PDS 259 259 - ex, err := client.RepoGetRecord(r.Context(), "", tangled.StringNSID, entry.Did.String(), entry.Rkey) 257 257 + ex, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.StringNSID, entry.Did.String(), entry.Rkey) 260 258 if err != nil { 261 259 fail("Failed to updated existing record.", err) 262 260 return 263 261 } 264 264 - resp, err := client.RepoPutRecord(r.Context(), &atproto.RepoPutRecord_Input{ 262 262 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &atproto.RepoPutRecord_Input{ 265 263 Collection: tangled.StringNSID, 266 264 Repo: entry.Did.String(), 267 265 Rkey: entry.Rkey, ··· 286 284 s.Notifier.EditString(r.Context(), &entry) 287 285 288 286 // if that went okay, redir to the string 289 289 - s.Pages.HxRedirect(w, "/strings/"+user.Handle+"/"+entry.Rkey) 287 287 + s.Pages.HxRedirect(w, "/strings/"+user.Did+"/"+entry.Rkey) 290 288 } 291 289 292 290 } ··· 338 336 return 339 337 } 340 338 341 341 - resp, err := client.RepoPutRecord(r.Context(), &atproto.RepoPutRecord_Input{ 339 339 + resp, err := comatproto.RepoPutRecord(r.Context(), client, &atproto.RepoPutRecord_Input{ 342 340 Collection: tangled.StringNSID, 343 341 Repo: user.Did, 344 342 Rkey: string.Rkey, ··· 362 360 s.Notifier.NewString(r.Context(), &string) 363 361 364 362 // successful 365 365 - s.Pages.HxRedirect(w, "/strings/"+user.Handle+"/"+string.Rkey) 363 363 + s.Pages.HxRedirect(w, "/strings/"+user.Did+"/"+string.Rkey) 366 364 } 367 365 } 368 366 ··· 405 403 406 404 s.Notifier.DeleteString(r.Context(), user.Did, rkey) 407 405 408 408 - s.Pages.HxRedirect(w, "/strings/"+user.Handle) 406 406 + s.Pages.HxRedirect(w, "/strings/"+user.Did) 409 407 } 410 408 411 409 func (s *Strings) comment(w http.ResponseWriter, r *http.Request) {

-99

appview/xrpcclient/xrpc.go

reviewed

··· 1 1 package xrpcclient 2 2 3 3 import ( 4 4 - "bytes" 5 5 - "context" 6 4 "errors" 7 7 - "io" 8 5 "net/http" 9 6 10 10 - "github.com/bluesky-social/indigo/api/atproto" 11 11 - "github.com/bluesky-social/indigo/xrpc" 12 7 indigoxrpc "github.com/bluesky-social/indigo/xrpc" 13 13 - oauth "tangled.org/anirudh.fi/atproto-oauth" 14 8 ) 15 9 16 10 var ( ··· 13 19 ErrXrpcFailed = errors.New("xrpc request failed") 14 20 ErrXrpcInvalid = errors.New("invalid xrpc request") 15 21 ) 16 16 - 17 17 - type Client struct { 18 18 - *oauth.XrpcClient 19 19 - authArgs *oauth.XrpcAuthedRequestArgs 20 20 - } 21 21 - 22 22 - func NewClient(client *oauth.XrpcClient, authArgs *oauth.XrpcAuthedRequestArgs) *Client { 23 23 - return &Client{ 24 24 - XrpcClient: client, 25 25 - authArgs: authArgs, 26 26 - } 27 27 - } 28 28 - 29 29 - func (c *Client) RepoPutRecord(ctx context.Context, input *atproto.RepoPutRecord_Input) (*atproto.RepoPutRecord_Output, error) { 30 30 - var out atproto.RepoPutRecord_Output 31 31 - if err := c.Do(ctx, c.authArgs, xrpc.Procedure, "application/json", "com.atproto.repo.putRecord", nil, input, &out); err != nil { 32 32 - return nil, err 33 33 - } 34 34 - 35 35 - return &out, nil 36 36 - } 37 37 - 38 38 - func (c *Client) RepoApplyWrites(ctx context.Context, input *atproto.RepoApplyWrites_Input) (*atproto.RepoApplyWrites_Output, error) { 39 39 - var out atproto.RepoApplyWrites_Output 40 40 - if err := c.Do(ctx, c.authArgs, xrpc.Procedure, "application/json", "com.atproto.repo.applyWrites", nil, input, &out); err != nil { 41 41 - return nil, err 42 42 - } 43 43 - 44 44 - return &out, nil 45 45 - } 46 46 - 47 47 - func (c *Client) RepoGetRecord(ctx context.Context, cid string, collection string, repo string, rkey string) (*atproto.RepoGetRecord_Output, error) { 48 48 - var out atproto.RepoGetRecord_Output 49 49 - 50 50 - params := map[string]interface{}{ 51 51 - "cid": cid, 52 52 - "collection": collection, 53 53 - "repo": repo, 54 54 - "rkey": rkey, 55 55 - } 56 56 - if err := c.Do(ctx, c.authArgs, xrpc.Query, "", "com.atproto.repo.getRecord", params, nil, &out); err != nil { 57 57 - return nil, err 58 58 - } 59 59 - 60 60 - return &out, nil 61 61 - } 62 62 - 63 63 - func (c *Client) RepoUploadBlob(ctx context.Context, input io.Reader) (*atproto.RepoUploadBlob_Output, error) { 64 64 - var out atproto.RepoUploadBlob_Output 65 65 - if err := c.Do(ctx, c.authArgs, xrpc.Procedure, "*/*", "com.atproto.repo.uploadBlob", nil, input, &out); err != nil { 66 66 - return nil, err 67 67 - } 68 68 - 69 69 - return &out, nil 70 70 - } 71 71 - 72 72 - func (c *Client) SyncGetBlob(ctx context.Context, cid string, did string) ([]byte, error) { 73 73 - buf := new(bytes.Buffer) 74 74 - 75 75 - params := map[string]interface{}{ 76 76 - "cid": cid, 77 77 - "did": did, 78 78 - } 79 79 - if err := c.Do(ctx, c.authArgs, xrpc.Query, "", "com.atproto.sync.getBlob", params, nil, buf); err != nil { 80 80 - return nil, err 81 81 - } 82 82 - 83 83 - return buf.Bytes(), nil 84 84 - } 85 85 - 86 86 - func (c *Client) RepoDeleteRecord(ctx context.Context, input *atproto.RepoDeleteRecord_Input) (*atproto.RepoDeleteRecord_Output, error) { 87 87 - var out atproto.RepoDeleteRecord_Output 88 88 - if err := c.Do(ctx, c.authArgs, xrpc.Procedure, "application/json", "com.atproto.repo.deleteRecord", nil, input, &out); err != nil { 89 89 - return nil, err 90 90 - } 91 91 - 92 92 - return &out, nil 93 93 - } 94 94 - 95 95 - func (c *Client) ServerGetServiceAuth(ctx context.Context, aud string, exp int64, lxm string) (*atproto.ServerGetServiceAuth_Output, error) { 96 96 - var out atproto.ServerGetServiceAuth_Output 97 97 - 98 98 - params := map[string]interface{}{ 99 99 - "aud": aud, 100 100 - "exp": exp, 101 101 - "lxm": lxm, 102 102 - } 103 103 - if err := c.Do(ctx, c.authArgs, xrpc.Query, "", "com.atproto.server.getServiceAuth", params, nil, &out); err != nil { 104 104 - return nil, err 105 105 - } 106 106 - 107 107 - return &out, nil 108 108 - } 109 22 110 23 // produces a more manageable error 111 24 func HandleXrpcErr(err error) error {

+1 -1

go.mod

reviewed

··· 8 8 github.com/alecthomas/chroma/v2 v2.15.0 9 9 github.com/avast/retry-go/v4 v4.6.1 10 10 github.com/bluekeyes/go-gitdiff v0.8.1 11 11 - github.com/bluesky-social/indigo v0.0.0-20250724221105-5827c8fb61bb 11 11 + github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e 12 12 github.com/bluesky-social/jetstream v0.0.0-20241210005130-ea96859b93d1 13 13 github.com/carlmjohnson/versioninfo v0.22.5 14 14 github.com/casbin/casbin/v2 v2.103.0

+2

go.sum

reviewed

··· 25 25 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= 26 26 github.com/bluesky-social/indigo v0.0.0-20250724221105-5827c8fb61bb h1:BqMNDZMfXwiRTJ6NvQotJ0qInn37JH5U8E+TF01CFHQ= 27 27 github.com/bluesky-social/indigo v0.0.0-20250724221105-5827c8fb61bb/go.mod h1:0XUyOCRtL4/OiyeqMTmr6RlVHQMDgw3LS7CfibuZR5Q= 28 28 + github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e h1:IutKPwmbU0LrYqw03EuwJtMdAe67rDTrL1U8S8dicRU= 29 29 + github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e/go.mod h1:n6QE1NDPFoi7PRbMUZmc2y7FibCqiVU4ePpsvhHUBR8= 28 30 github.com/bluesky-social/jetstream v0.0.0-20241210005130-ea96859b93d1 h1:CFvRtYNSnWRAi/98M3O466t9dYuwtesNbu6FVPymRrA= 29 31 github.com/bluesky-social/jetstream v0.0.0-20241210005130-ea96859b93d1/go.mod h1:WiYEeyJSdUwqoaZ71KJSpTblemUCpwJfh5oVXplK6T4= 30 32 github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=