From 02fabc4a4157bd8cb1d6e25667ec047aef1f579d Mon Sep 17 00:00:00 2001
From: Evan Jarrett <evan@evanjarrett.com>
Date: Tue, 9 Dec 2025 11:51:42 -0600
Subject: [PATCH] fix build pipeline. fix using wrong auth method when trying
 to push with app-password

---
 .tangled/workflows/release.yml     | 12 ++++++------
 pkg/appview/middleware/registry.go | 30 ++++++++++++++++++++----------
 2 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index fa4a444..731a2b0 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -24,21 +24,21 @@ steps:
   - name: Build and push AppView image
     command: |
       buildah bud \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:${TANGLED_REF_NAME} \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:latest \
+        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:${TANGLED_REF_NAME} \
+        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest \
         --file ./Dockerfile.appview \
         .
 
       buildah push \
-        ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-appview:latest
+        ${IMAGE_REGISTRY}/${IMAGE_USER}/appview:latest
 
   - name: Build and push Hold image
     command: |
       buildah bud \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:${TANGLED_REF_NAME} \
-        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:latest \
+        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:${TANGLED_REF_NAME} \
+        --tag ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest \
         --file ./Dockerfile.hold \
         .
 
       buildah push \
-        ${IMAGE_REGISTRY}/${IMAGE_USER}/atcr-hold:latest
+        ${IMAGE_REGISTRY}/${IMAGE_USER}/hold:latest
diff --git a/pkg/appview/middleware/registry.go b/pkg/appview/middleware/registry.go
index 6dd572f..1e90d22 100644
--- a/pkg/appview/middleware/registry.go
+++ b/pkg/appview/middleware/registry.go
@@ -404,24 +404,34 @@ func (nr *NamespaceResolver) Repository(ctx context.Context, name reference.Name
 	}
 
 	// Get access token for PDS operations
-	// Try OAuth refresher first (for users who authorized via AppView OAuth)
-	// Fall back to Basic Auth token cache (for users who used app passwords)
+	// Use auth method from JWT to determine client type:
+	// - OAuth users: use session provider (DPoP-enabled)
+	// - App-password users: use Basic Auth token cache
 	var atprotoClient *atproto.Client
 
-	if nr.refresher != nil {
-		// Use session provider for locked OAuth sessions
+	if authMethod == token.AuthMethodOAuth && nr.refresher != nil {
+		// OAuth flow: use session provider for locked OAuth sessions
 		// This prevents DPoP nonce race conditions during concurrent layer uploads
+		slog.Debug("Creating ATProto client with OAuth session provider",
+			"component", "registry/middleware",
+			"did", did,
+			"authMethod", authMethod)
 		atprotoClient = atproto.NewClientWithSessionProvider(pdsEndpoint, did, nr.refresher)
-	}
-
-	// Fall back to Basic Auth token cache if OAuth not available
-	if atprotoClient == nil {
+	} else {
+		// App-password flow (or fallback): use Basic Auth token cache
 		accessToken, ok := auth.GetGlobalTokenCache().Get(did)
 		if !ok {
-			slog.Debug("No cached access token found (neither OAuth nor Basic Auth)", "component", "registry/middleware", "did", did)
+			slog.Debug("No cached access token found for app-password auth",
+				"component", "registry/middleware",
+				"did", did,
+				"authMethod", authMethod)
 			accessToken = "" // Will fail on manifest push, but let it try
 		} else {
-			slog.Debug("Using Basic Auth access token", "component", "registry/middleware", "did", did, "token_length", len(accessToken))
+			slog.Debug("Creating ATProto client with app-password",
+				"component", "registry/middleware",
+				"did", did,
+				"authMethod", authMethod,
+				"token_length", len(accessToken))
 		}
 		atprotoClient = atproto.NewClient(pdsEndpoint, did, accessToken)
 	}