at-container-registry/pkg/credhelper/resolve.go

package credhelper

import (
	"context"
	"fmt"
	"io"
	"net"
	"strings"
	"time"
)

// dnsResolveTimeout bounds the _atproto TXT lookup. Handle resolution runs on
// Docker's synchronous credential path (every `store`, and every `get` for an
// account that has no DID yet), and the default resolver applies no deadline of
// its own. Without this, a blackholing DNS setup — captive portal, split-horizon
// VPN — stalls `docker login` and `docker pull` for the resolver's full retry
// budget on every invocation. Resolution is best-effort, so giving up early just
// leaves the account on its provisional handle key.
const dnsResolveTimeout = 2 * time.Second

// resolveHandleDID resolves an AT-proto handle to its DID using the two
// standard resolution methods, no server or auth required:
//
//  1. DNS: a TXT record at _atproto.<handle> whose value is "did=<did>".
//  2. HTTPS: GET https://<handle>/.well-known/atproto-did returning the bare DID.
//
// DNS is tried first (cheaper, no TLS), HTTPS second. If the input already
// looks like a DID it is returned as-is. Returns an error if neither method
// yields a DID — callers treat resolution as best-effort (a failure just means
// the account keeps its handle key until the next attempt).
func resolveHandleDID(handle string) (string, error) {
	h := normalizeHandle(handle)
	if h == "" {
		return "", fmt.Errorf("empty handle")
	}
	if looksLikeDID(h) {
		return h, nil
	}

	if did := resolveHandleDNS(h); did != "" {
		return did, nil
	}
	if did := resolveHandleHTTPS(h); did != "" {
		return did, nil
	}
	return "", fmt.Errorf("could not resolve handle %q to a DID", handle)
}

// normalizeHandle lowercases and strips an optional leading "@" and any scheme
// or trailing slash a caller may have passed through.
func normalizeHandle(handle string) string {
	h := strings.TrimSpace(handle)
	h = strings.TrimPrefix(h, "@")
	h = strings.TrimPrefix(h, "https://")
	h = strings.TrimPrefix(h, "http://")
	h = strings.TrimSuffix(h, "/")
	return strings.ToLower(h)
}

// looksLikeDID reports whether s is syntactically a DID (did:method:id).
func looksLikeDID(s string) bool {
	return strings.HasPrefix(s, "did:") && strings.Count(s, ":") >= 2
}

// resolveHandleDNS looks up the _atproto.<handle> TXT record and extracts the
// DID. Returns "" on any failure.
func resolveHandleDNS(handle string) string {
	ctx, cancel := context.WithTimeout(context.Background(), dnsResolveTimeout)
	defer cancel()

	records, err := net.DefaultResolver.LookupTXT(ctx, "_atproto."+handle)
	if err != nil {
		return ""
	}
	return parseDIDFromTXT(records)
}

// parseDIDFromTXT returns the first "did=<did>" value found in a set of TXT
// records, or "" if none is a valid DID.
func parseDIDFromTXT(records []string) string {
	for _, rec := range records {
		val := strings.TrimSpace(strings.TrimPrefix(strings.TrimSpace(rec), "did="))
		if val != rec && looksLikeDID(val) {
			return val
		}
	}
	return ""
}

// resolveHandleHTTPS fetches https://<handle>/.well-known/atproto-did and
// returns the DID in the body. Returns "" on any failure.
func resolveHandleHTTPS(handle string) string {
	client := httpClientWithTimeout(5*time.Second, nil)
	resp, err := client.Get("https://" + handle + "/.well-known/atproto-did")
	if err != nil {
		return ""
	}
	defer resp.Body.Close()
	if resp.StatusCode != 200 {
		return ""
	}
	// The well-known document is a single line containing just the DID; cap the
	// read so a misbehaving host can't stream us an unbounded body.
	body, err := io.ReadAll(io.LimitReader(resp.Body, 2048))
	if err != nil {
		return ""
	}
	did := strings.TrimSpace(string(body))
	if !looksLikeDID(did) {
		return ""
	}
	return did
}