move packages out of token that are not related to docker jwt token

pkg/appview/middleware/registry.go

@@ -339,7 +339,7 @@ func (nr *NamespaceResolver) Repository(ctx context.Context, name reference.Name
 						"pullerDID", pullerDID,
 						"cacheKey", cacheKey)
 
-					token, err := token.GetOrFetchServiceTokenWithAppPassword(ctx, pullerDID, holdDID, pullerPDSEndpoint)
+					token, err := auth.GetOrFetchServiceTokenWithAppPassword(ctx, pullerDID, holdDID, pullerPDSEndpoint)
 					if err != nil {
 						slog.Error("Failed to get service token with app-password",
 							"component", "registry/middleware",
@@ -357,7 +357,7 @@ func (nr *NamespaceResolver) Repository(ctx context.Context, name reference.Name
 						"pullerDID", pullerDID,
 						"cacheKey", cacheKey)
 
-					token, err := token.GetOrFetchServiceToken(ctx, nr.refresher, pullerDID, holdDID, pullerPDSEndpoint)
+					token, err := auth.GetOrFetchServiceToken(ctx, nr.refresher, pullerDID, holdDID, pullerPDSEndpoint)
 					if err != nil {
 						slog.Error("Failed to get service token with OAuth",
 							"component", "registry/middleware",

pkg/appview/storage/crew.go

@@ -9,8 +9,8 @@ import (
 	"time"
 
 	"atcr.io/pkg/atproto"
+	"atcr.io/pkg/auth"
 	"atcr.io/pkg/auth/oauth"
-	"atcr.io/pkg/auth/token"
 )
 
 // EnsureCrewMembership attempts to register the user as a crew member on their default hold.
@@ -39,7 +39,7 @@ func EnsureCrewMembership(ctx context.Context, client *atproto.Client, refresher
 	}
 
 	// Wrap the refresher to match OAuthSessionRefresher interface
-	serviceToken, err := token.GetOrFetchServiceToken(ctx, refresher, client.DID(), holdDID, client.PDSEndpoint())
+	serviceToken, err := auth.GetOrFetchServiceToken(ctx, refresher, client.DID(), holdDID, client.PDSEndpoint())
 	if err != nil {
 		slog.Warn("failed to get service token", "holdDID", holdDID, "error", err)
 		return

pkg/appview/storage/proxy_blob_store_test.go

@@ -12,7 +12,7 @@ import (
 	"time"
 
 	"atcr.io/pkg/atproto"
-	"atcr.io/pkg/auth/token"
+	"atcr.io/pkg/auth"
 	"github.com/opencontainers/go-digest"
 )
 
@@ -22,8 +22,8 @@ func TestGetServiceToken_CachingLogic(t *testing.T) {
 	holdDID := "did:web:hold.example.com"
 
 	// Test 1: Empty cache - invalidate any existing token
-	token.InvalidateServiceToken(userDID, holdDID)
-	cachedToken, _ := token.GetServiceToken(userDID, holdDID)
+	auth.InvalidateServiceToken(userDID, holdDID)
+	cachedToken, _ := auth.GetServiceToken(userDID, holdDID)
 	if cachedToken != "" {
 		t.Error("Expected empty cache at start")
 	}
@@ -34,13 +34,13 @@ func TestGetServiceToken_CachingLogic(t *testing.T) {
 	testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
 	testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
 
-	err := token.SetServiceToken(userDID, holdDID, testToken)
+	err := auth.SetServiceToken(userDID, holdDID, testToken)
 	if err != nil {
 		t.Fatalf("Failed to set service token: %v", err)
 	}
 
 	// Test 3: Retrieve from cache
-	cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
+	cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
 	if cachedToken == "" {
 		t.Fatal("Expected token to be in cache")
 	}
@@ -56,10 +56,10 @@ func TestGetServiceToken_CachingLogic(t *testing.T) {
 	// Test 4: Expired token - GetServiceToken automatically removes it
 	expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
 	expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
-	token.SetServiceToken(userDID, holdDID, expiredToken)
+	auth.SetServiceToken(userDID, holdDID, expiredToken)
 
 	// GetServiceToken should return empty string for expired token
-	cachedToken, _ = token.GetServiceToken(userDID, holdDID)
+	cachedToken, _ = auth.GetServiceToken(userDID, holdDID)
 	if cachedToken != "" {
 		t.Error("Expected expired token to be removed from cache")
 	}
@@ -234,10 +234,10 @@ func TestServiceTokenCacheExpiry(t *testing.T) {
 	// Insert expired token
 	expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix())
 	expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature"
-	token.SetServiceToken(userDID, holdDID, expiredToken)
+	auth.SetServiceToken(userDID, holdDID, expiredToken)
 
 	// GetServiceToken should automatically remove expired tokens
-	cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
+	cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
 
 	// Should return empty string for expired token
 	if cachedToken != "" {
@@ -310,10 +310,10 @@ func BenchmarkServiceTokenCacheAccess(b *testing.B) {
 
 	testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix())
 	testTokenStr := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature"
-	token.SetServiceToken(userDID, holdDID, testTokenStr)
+	auth.SetServiceToken(userDID, holdDID, testTokenStr)
 
 	for b.Loop() {
-		cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID)
+		cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID)
 
 		if cachedToken == "" || time.Now().After(expiresAt) {
 			b.Error("Cache miss in benchmark")

pkg/auth/cache.go

@@ -2,7 +2,7 @@
 // Service tokens are JWTs issued by a user's PDS to authorize AppView to
 // act on their behalf when communicating with hold services. Tokens are
 // cached with automatic expiry parsing and 10-second safety margins.
-package token
+package auth
 
 import (
 	"encoding/base64"

pkg/auth/cache_test.go

@@ -1,4 +1,4 @@
-package token
+package auth
 
 import (
 	"testing"

pkg/auth/servicetoken.go

@@ -1,4 +1,4 @@
-package token
+package auth
 
 import (
 	"context"
@@ -12,7 +12,6 @@ import (
 	"time"
 
 	"atcr.io/pkg/atproto"
-	"atcr.io/pkg/auth"
 	"atcr.io/pkg/auth/oauth"
 	"github.com/bluesky-social/indigo/atproto/atclient"
 	indigo_oauth "github.com/bluesky-social/indigo/atproto/auth/oauth"
@@ -267,7 +266,7 @@ func GetOrFetchServiceTokenWithAppPassword(
 	}
 
 	// Get app-password access token from cache
-	accessToken, ok := auth.GetGlobalTokenCache().Get(did)
+	accessToken, ok := GetGlobalTokenCache().Get(did)
 	if !ok {
 		InvalidateServiceToken(did, holdDID)
 		slog.Error("No app-password access token found in cache",
@@ -314,7 +313,7 @@ func GetOrFetchServiceTokenWithAppPassword(
 
 	if resp.StatusCode == http.StatusUnauthorized {
 		// App-password token is invalid or expired - clear from cache
-		auth.GetGlobalTokenCache().Delete(did)
+		GetGlobalTokenCache().Delete(did)
 		InvalidateServiceToken(did, holdDID)
 		slog.Error("App-password token rejected by PDS",
 			"component", "token/servicetoken",

pkg/auth/servicetoken_test.go

@@ -1,4 +1,4 @@
-package token
+package auth
 
 import (
 	"context"