at-container-registry/pkg/atproto/quota.go

package atproto

import (
	"context"
	"encoding/json"
	"fmt"
	"net/http"
	"net/url"
	"time"
)

// QuotaStats is the io.atcr.hold.getQuota response. Limit is nil for captains
// or unlimited tiers.
type QuotaStats struct {
	UserDID     string `json:"userDid"`
	UniqueBlobs int    `json:"uniqueBlobs,omitempty"`
	TotalSize   int64  `json:"totalSize"`
	Limit       *int64 `json:"limit,omitempty"`
	Tier        string `json:"tier,omitempty"`
}

// FetchQuotaStats calls the hold's public getQuota endpoint for userDID.
//
// userDID is query-escaped — did:web DIDs legitimately contain percent-encoded
// characters (e.g. "%3A" for port colons), and interpolating raw would let the
// server's query parser double-decode them and miss the keyed records.
//
// The 5s timeout is deliberately tight: every push runs through this on the
// way to issuing a registry JWT, and the gate falls open on errors so a slow
// hold doesn't lock users out of pushing.
func FetchQuotaStats(ctx context.Context, client *http.Client, holdDID, userDID string) (*QuotaStats, error) {
	if client == nil {
		client = http.DefaultClient
	}

	holdURL, err := ResolveHoldURL(ctx, holdDID)
	if err != nil {
		return nil, fmt.Errorf("resolve hold url: %w", err)
	}

	reqCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
	defer cancel()

	quotaURL := fmt.Sprintf("%s%s?userDid=%s", holdURL, HoldGetQuota, url.QueryEscape(userDID))
	req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, quotaURL, nil)
	if err != nil {
		return nil, fmt.Errorf("build request: %w", err)
	}

	resp, err := client.Do(req)
	if err != nil {
		return nil, fmt.Errorf("call hold: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("hold returned status %d", resp.StatusCode)
	}

	var stats QuotaStats
	if err := json.NewDecoder(resp.Body).Decode(&stats); err != nil {
		return nil, fmt.Errorf("decode response: %w", err)
	}
	return &stats, nil
}