remove auth middleware

pkg/appview/db/stats_migration.go

@@ -143,8 +143,16 @@ func MigrateStatsToHolds(ctx context.Context, db *sql.DB) error {
 	slog.Info("Stats migration completed", "component", "migration",
 		"success", successCount, "skipped", skipCount, "errors", errorCount, "total", len(stats))
 
-	// Mark migration complete (even if some failed - they'll get updates via Jetstream)
-	return markMigrationComplete(db)
+	// Only mark complete if there were no errors
+	// Skipped repos (no hold DID) will never migrate - that's fine
+	// Errors are transient failures that should be retried
+	if errorCount == 0 {
+		return markMigrationComplete(db)
+	}
+
+	slog.Warn("Stats migration had errors, will retry on next startup", "component", "migration",
+		"errors", errorCount)
+	return nil
 }
 
 // markMigrationComplete records that the stats migration has been done

pkg/hold/oci/xrpc.go

@@ -40,6 +40,10 @@ func NewXRPCHandler(holdPDS *pds.HoldPDS, s3Service s3.S3Service, driver storage
 
 // RegisterHandlers registers all OCI XRPC endpoints with the chi router
 func (h *XRPCHandler) RegisterHandlers(r chi.Router) {
+	// Temporary migration endpoint - no auth required
+	// TODO: Remove after stats migration is complete
+	r.Post(atproto.HoldSetStats, h.HandleSetStats)
+
 	// All multipart upload endpoints require blob:write permission
 	r.Group(func(r chi.Router) {
 		r.Use(h.requireBlobWriteAccess)
@@ -50,7 +54,6 @@ func (h *XRPCHandler) RegisterHandlers(r chi.Router) {
 		r.Post(atproto.HoldCompleteUpload, h.HandleCompleteUpload)
 		r.Post(atproto.HoldAbortUpload, h.HandleAbortUpload)
 		r.Post(atproto.HoldNotifyManifest, h.HandleNotifyManifest)
-		r.Post(atproto.HoldSetStats, h.HandleSetStats)
 	})
 }