diff --git a/pkg/appview/templates/pages/install.html b/pkg/appview/templates/pages/install.html
index 116d646..72a5c77 100644
--- a/pkg/appview/templates/pages/install.html
+++ b/pkg/appview/templates/pages/install.html
@@ -7,79 +7,6 @@
Install ATCR Credential Helper - ATCR
-
{{ template "nav" . }}
@@ -137,8 +64,7 @@ chmod +x install.sh
+
- Authentication
The credential helper will automatically prompt for authentication when you push or pull:
-export ATCR_AUTO_AUTH=1
-docker push {{ .RegistryURL }}/yourhandle/myapp:latestdocker push {{ .RegistryURL }}/yourhandle/myapp:latestThis will:
-
@@ -180,12 +106,8 @@ which docker-credential-atcr
# Add to PATH if needed
export PATH="/usr/local/bin:$PATH"
Authentication failed
-Make sure auto-auth is enabled:
-export ATCR_AUTO_AUTH=1Still having issues?
-Check the full documentation or open an issue.
+Check the full documentation or open an issue.
diff --git a/pkg/hold/authorization.go b/pkg/hold/authorization.go
index 2b07606..31dec64 100644
--- a/pkg/hold/authorization.go
+++ b/pkg/hold/authorization.go
@@ -106,6 +106,17 @@ func (s *HoldService) isCrewMember(did string) (bool, error) {
return false, fmt.Errorf("no PDS endpoint found for owner")
}
+ // Build this hold's URI for filtering
+ publicURL := s.config.Server.PublicURL
+ if publicURL == "" {
+ return false, fmt.Errorf("hold public URL not configured")
+ }
+ holdName, err := extractHostname(publicURL)
+ if err != nil {
+ return false, fmt.Errorf("failed to extract hold name: %w", err)
+ }
+ holdURI := fmt.Sprintf("at://%s/%s/%s", ownerDID, atproto.HoldCollection, holdName)
+
// Create unauthenticated client to read public records
client := atproto.NewClient(pdsEndpoint, ownerDID, "")
@@ -127,6 +138,11 @@ func (s *HoldService) isCrewMember(did string) (bool, error) {
continue
}
+ // Only check crew records for THIS hold (prevents cross-hold access)
+ if crewRecord.Hold != holdURI {
+ continue
+ }
+
// Check expiration (if set)
if crewRecord.ExpiresAt != nil && time.Now().After(*crewRecord.ExpiresAt) {
continue // Skip expired membership
diff --git a/pkg/hold/registration.go b/pkg/hold/registration.go
index 5206ba3..37d4968 100644
--- a/pkg/hold/registration.go
+++ b/pkg/hold/registration.go
@@ -256,12 +256,16 @@ func (s *HoldService) ReconcileAllowAllCrew(callbackHandler *http.HandlerFunc) e
return nil
}
-// hasAllowAllCrewRecord checks if the allow-all crew record exists in the PDS
+// hasAllowAllCrewRecord checks if the allow-all crew record exists in the PDS for THIS hold
func (s *HoldService) hasAllowAllCrewRecord() (bool, error) {
ownerDID := s.config.Registration.OwnerDID
+ publicURL := s.config.Server.PublicURL
if ownerDID == "" {
return false, fmt.Errorf("hold owner DID not configured")
}
+ if publicURL == "" {
+ return false, fmt.Errorf("hold public URL not configured")
+ }
ctx := context.Background()
@@ -282,11 +286,18 @@ func (s *HoldService) hasAllowAllCrewRecord() (bool, error) {
return false, fmt.Errorf("no PDS endpoint found for owner")
}
+ // Build hold-specific rkey
+ holdName, err := extractHostname(publicURL)
+ if err != nil {
+ return false, fmt.Errorf("failed to extract hostname: %w", err)
+ }
+ crewRKey := fmt.Sprintf("allow-all-%s", holdName)
+
// Create unauthenticated client to read public records
client := atproto.NewClient(pdsEndpoint, ownerDID, "")
- // Query for specific rkey "allow-all"
- record, err := client.GetRecord(ctx, atproto.HoldCrewCollection, "allow-all")
+ // Query for hold-specific allow-all record
+ record, err := client.GetRecord(ctx, atproto.HoldCrewCollection, crewRKey)
if err != nil {
// Record doesn't exist
if errors.Is(err, atproto.ErrRecordNotFound) {
@@ -302,7 +313,13 @@ func (s *HoldService) hasAllowAllCrewRecord() (bool, error) {
}
// Check if it's the exact wildcard pattern
- return crewRecord.MemberPattern != nil && *crewRecord.MemberPattern == "*", nil
+ if crewRecord.MemberPattern == nil || *crewRecord.MemberPattern != "*" {
+ return false, nil
+ }
+
+ // Verify it's for this hold (defensive check)
+ expectedHoldURI := fmt.Sprintf("at://%s/%s/%s", ownerDID, atproto.HoldCollection, holdName)
+ return crewRecord.Hold == expectedHoldURI, nil
}
// createAllowAllCrewRecord creates a wildcard crew record allowing all authenticated users
@@ -329,7 +346,9 @@ func (s *HoldService) createAllowAllCrewRecord(callbackHandler *http.HandlerFunc
// Create wildcard crew record
crewRecord := atproto.NewHoldCrewRecordWithPattern(holdURI, "*", "write")
- _, err = client.PutRecord(ctx, atproto.HoldCrewCollection, "allow-all", crewRecord)
+ // Use hold-specific rkey to support multiple holds with different allow-all settings
+ crewRKey := fmt.Sprintf("allow-all-%s", holdName)
+ _, err = client.PutRecord(ctx, atproto.HoldCrewCollection, crewRKey, crewRecord)
if err != nil {
return fmt.Errorf("failed to create allow-all crew record: %w", err)
}
@@ -338,19 +357,26 @@ func (s *HoldService) createAllowAllCrewRecord(callbackHandler *http.HandlerFunc
return nil
}
-// deleteAllowAllCrewRecord deletes the wildcard crew record
+// deleteAllowAllCrewRecord deletes the wildcard crew record for this hold
func (s *HoldService) deleteAllowAllCrewRecord(callbackHandler *http.HandlerFunc) error {
- // Safety check: only delete if it's the exact wildcard pattern
+ // Safety check: only delete if it's the exact wildcard pattern for THIS hold
isWildcard, err := s.hasAllowAllCrewRecord()
if err != nil {
return fmt.Errorf("failed to check allow-all crew record: %w", err)
}
if !isWildcard {
- log.Printf("Warning: 'allow-all' crew record exists but is not wildcard - skipping deletion")
+ log.Printf("Note: 'allow-all' crew record not found for this hold (may exist for other holds)")
return nil
}
+ // Get hold name for rkey
+ holdName, err := extractHostname(s.config.Server.PublicURL)
+ if err != nil {
+ return fmt.Errorf("failed to extract hostname: %w", err)
+ }
+ crewRKey := fmt.Sprintf("allow-all-%s", holdName)
+
// Run OAuth flow to get authenticated client
client, err := s.runOAuthFlow(callbackHandler, "Deleting allow-all crew record")
if err != nil {
@@ -359,13 +385,13 @@ func (s *HoldService) deleteAllowAllCrewRecord(callbackHandler *http.HandlerFunc
ctx := context.Background()
- // Delete the record
- err = client.DeleteRecord(ctx, atproto.HoldCrewCollection, "allow-all")
+ // Delete the hold-specific allow-all record
+ err = client.DeleteRecord(ctx, atproto.HoldCrewCollection, crewRKey)
if err != nil {
return fmt.Errorf("failed to delete allow-all crew record: %w", err)
}
- log.Printf("✓ Deleted allow-all crew record")
+ log.Printf("✓ Deleted allow-all crew record for this hold")
return nil
}