From 7f2d780b0ad2aeff207d46dc7c847c17ef47ce12 Mon Sep 17 00:00:00 2001 From: Evan Jarrett Date: Mon, 29 Dec 2025 16:57:14 -0600 Subject: [PATCH] move packages out of token that are not related to docker jwt token --- pkg/appview/middleware/registry.go | 4 ++-- pkg/appview/storage/crew.go | 4 ++-- pkg/appview/storage/proxy_blob_store_test.go | 22 ++++++++++---------- pkg/auth/{token => }/cache.go | 2 +- pkg/auth/{token => }/cache_test.go | 2 +- pkg/auth/{token => }/servicetoken.go | 7 +++---- pkg/auth/{token => }/servicetoken_test.go | 2 +- 7 files changed, 21 insertions(+), 22 deletions(-) rename pkg/auth/{token => }/cache.go (99%) rename pkg/auth/{token => }/cache_test.go (99%) rename pkg/auth/{token => }/servicetoken.go (99%) rename pkg/auth/{token => }/servicetoken_test.go (98%) diff --git a/pkg/appview/middleware/registry.go b/pkg/appview/middleware/registry.go index 070edf1..96b3482 100644 --- a/pkg/appview/middleware/registry.go +++ b/pkg/appview/middleware/registry.go @@ -339,7 +339,7 @@ func (nr *NamespaceResolver) Repository(ctx context.Context, name reference.Name "pullerDID", pullerDID, "cacheKey", cacheKey) - token, err := token.GetOrFetchServiceTokenWithAppPassword(ctx, pullerDID, holdDID, pullerPDSEndpoint) + token, err := auth.GetOrFetchServiceTokenWithAppPassword(ctx, pullerDID, holdDID, pullerPDSEndpoint) if err != nil { slog.Error("Failed to get service token with app-password", "component", "registry/middleware", @@ -357,7 +357,7 @@ func (nr *NamespaceResolver) Repository(ctx context.Context, name reference.Name "pullerDID", pullerDID, "cacheKey", cacheKey) - token, err := token.GetOrFetchServiceToken(ctx, nr.refresher, pullerDID, holdDID, pullerPDSEndpoint) + token, err := auth.GetOrFetchServiceToken(ctx, nr.refresher, pullerDID, holdDID, pullerPDSEndpoint) if err != nil { slog.Error("Failed to get service token with OAuth", "component", "registry/middleware", diff --git a/pkg/appview/storage/crew.go b/pkg/appview/storage/crew.go index 25e6ec5..780f05a 100644 --- a/pkg/appview/storage/crew.go +++ b/pkg/appview/storage/crew.go @@ -9,8 +9,8 @@ import ( "time" "atcr.io/pkg/atproto" + "atcr.io/pkg/auth" "atcr.io/pkg/auth/oauth" - "atcr.io/pkg/auth/token" ) // EnsureCrewMembership attempts to register the user as a crew member on their default hold. @@ -39,7 +39,7 @@ func EnsureCrewMembership(ctx context.Context, client *atproto.Client, refresher } // Wrap the refresher to match OAuthSessionRefresher interface - serviceToken, err := token.GetOrFetchServiceToken(ctx, refresher, client.DID(), holdDID, client.PDSEndpoint()) + serviceToken, err := auth.GetOrFetchServiceToken(ctx, refresher, client.DID(), holdDID, client.PDSEndpoint()) if err != nil { slog.Warn("failed to get service token", "holdDID", holdDID, "error", err) return diff --git a/pkg/appview/storage/proxy_blob_store_test.go b/pkg/appview/storage/proxy_blob_store_test.go index 8a5cbc7..f162e9d 100644 --- a/pkg/appview/storage/proxy_blob_store_test.go +++ b/pkg/appview/storage/proxy_blob_store_test.go @@ -12,7 +12,7 @@ import ( "time" "atcr.io/pkg/atproto" - "atcr.io/pkg/auth/token" + "atcr.io/pkg/auth" "github.com/opencontainers/go-digest" ) @@ -22,8 +22,8 @@ func TestGetServiceToken_CachingLogic(t *testing.T) { holdDID := "did:web:hold.example.com" // Test 1: Empty cache - invalidate any existing token - token.InvalidateServiceToken(userDID, holdDID) - cachedToken, _ := token.GetServiceToken(userDID, holdDID) + auth.InvalidateServiceToken(userDID, holdDID) + cachedToken, _ := auth.GetServiceToken(userDID, holdDID) if cachedToken != "" { t.Error("Expected empty cache at start") } @@ -34,13 +34,13 @@ func TestGetServiceToken_CachingLogic(t *testing.T) { testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix()) testToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature" - err := token.SetServiceToken(userDID, holdDID, testToken) + err := auth.SetServiceToken(userDID, holdDID, testToken) if err != nil { t.Fatalf("Failed to set service token: %v", err) } // Test 3: Retrieve from cache - cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID) + cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID) if cachedToken == "" { t.Fatal("Expected token to be in cache") } @@ -56,10 +56,10 @@ func TestGetServiceToken_CachingLogic(t *testing.T) { // Test 4: Expired token - GetServiceToken automatically removes it expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix()) expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature" - token.SetServiceToken(userDID, holdDID, expiredToken) + auth.SetServiceToken(userDID, holdDID, expiredToken) // GetServiceToken should return empty string for expired token - cachedToken, _ = token.GetServiceToken(userDID, holdDID) + cachedToken, _ = auth.GetServiceToken(userDID, holdDID) if cachedToken != "" { t.Error("Expected expired token to be removed from cache") } @@ -234,10 +234,10 @@ func TestServiceTokenCacheExpiry(t *testing.T) { // Insert expired token expiredPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(-1*time.Hour).Unix()) expiredToken := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(expiredPayload) + ".signature" - token.SetServiceToken(userDID, holdDID, expiredToken) + auth.SetServiceToken(userDID, holdDID, expiredToken) // GetServiceToken should automatically remove expired tokens - cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID) + cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID) // Should return empty string for expired token if cachedToken != "" { @@ -310,10 +310,10 @@ func BenchmarkServiceTokenCacheAccess(b *testing.B) { testPayload := fmt.Sprintf(`{"exp":%d}`, time.Now().Add(50*time.Second).Unix()) testTokenStr := "eyJhbGciOiJIUzI1NiJ9." + base64URLEncode(testPayload) + ".signature" - token.SetServiceToken(userDID, holdDID, testTokenStr) + auth.SetServiceToken(userDID, holdDID, testTokenStr) for b.Loop() { - cachedToken, expiresAt := token.GetServiceToken(userDID, holdDID) + cachedToken, expiresAt := auth.GetServiceToken(userDID, holdDID) if cachedToken == "" || time.Now().After(expiresAt) { b.Error("Cache miss in benchmark") diff --git a/pkg/auth/token/cache.go b/pkg/auth/cache.go similarity index 99% rename from pkg/auth/token/cache.go rename to pkg/auth/cache.go index a08cff7..58c67f2 100644 --- a/pkg/auth/token/cache.go +++ b/pkg/auth/cache.go @@ -2,7 +2,7 @@ // Service tokens are JWTs issued by a user's PDS to authorize AppView to // act on their behalf when communicating with hold services. Tokens are // cached with automatic expiry parsing and 10-second safety margins. -package token +package auth import ( "encoding/base64" diff --git a/pkg/auth/token/cache_test.go b/pkg/auth/cache_test.go similarity index 99% rename from pkg/auth/token/cache_test.go rename to pkg/auth/cache_test.go index c718bfd..f0e0945 100644 --- a/pkg/auth/token/cache_test.go +++ b/pkg/auth/cache_test.go @@ -1,4 +1,4 @@ -package token +package auth import ( "testing" diff --git a/pkg/auth/token/servicetoken.go b/pkg/auth/servicetoken.go similarity index 99% rename from pkg/auth/token/servicetoken.go rename to pkg/auth/servicetoken.go index 378fbb3..a327269 100644 --- a/pkg/auth/token/servicetoken.go +++ b/pkg/auth/servicetoken.go @@ -1,4 +1,4 @@ -package token +package auth import ( "context" @@ -12,7 +12,6 @@ import ( "time" "atcr.io/pkg/atproto" - "atcr.io/pkg/auth" "atcr.io/pkg/auth/oauth" "github.com/bluesky-social/indigo/atproto/atclient" indigo_oauth "github.com/bluesky-social/indigo/atproto/auth/oauth" @@ -267,7 +266,7 @@ func GetOrFetchServiceTokenWithAppPassword( } // Get app-password access token from cache - accessToken, ok := auth.GetGlobalTokenCache().Get(did) + accessToken, ok := GetGlobalTokenCache().Get(did) if !ok { InvalidateServiceToken(did, holdDID) slog.Error("No app-password access token found in cache", @@ -314,7 +313,7 @@ func GetOrFetchServiceTokenWithAppPassword( if resp.StatusCode == http.StatusUnauthorized { // App-password token is invalid or expired - clear from cache - auth.GetGlobalTokenCache().Delete(did) + GetGlobalTokenCache().Delete(did) InvalidateServiceToken(did, holdDID) slog.Error("App-password token rejected by PDS", "component", "token/servicetoken", diff --git a/pkg/auth/token/servicetoken_test.go b/pkg/auth/servicetoken_test.go similarity index 98% rename from pkg/auth/token/servicetoken_test.go rename to pkg/auth/servicetoken_test.go index 9c5a720..126c49b 100644 --- a/pkg/auth/token/servicetoken_test.go +++ b/pkg/auth/servicetoken_test.go @@ -1,4 +1,4 @@ -package token +package auth import ( "context"