mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-23 18:54:16 +00:00
Evan JarrettandClaude Fable 5.1
a01b08b924
indigo's identity directory refuses HTTP and IP-hosted did:web, and its OAuth client is growing an SSRF-guarded transport that refuses loopback and private addresses. Local development and the test suites need both, and the workarounds were scattered: two did:web fallbacks in the resolver, a hand-rolled appview key fetch on the hold, and the OAuth client left on indigo's defaults so any test driving it against an httptest server depended on the transport staying permissive. Move every departure from indigo's defaults into one file pair in pkg/atproto: indigo_prod.go (!testmode) returns indigo's directory and OAuth client unchanged; indigo_local.go (testmode) wraps the directory so a did:web naming an IP, localhost, or a host with a port resolves over plain HTTP, and gives the OAuth client plain HTTP clients. All six identity and OAuth constructor call sites go through NewDirectory and NewOAuthClientApp. The resolver fallbacks, DIDWebToURL, and the hold's scheme-guessing key fetch are gone; the hold resolves the appview key through the directory, preferring #appview, and purges and retries once on a signature failure so a re-keyed appview is not masked by the 24-hour cache. There is no runtime switch for this: a production binary cannot be configured to resolve local DIDs. The runtime test_mode flag still gates the remaining behavioral branches only. Tests, the harness, make dev, Air, Dockerfile.dev, and docker-compose build with the tag; fixtures that need loopback did:web fail fast naming it. Test hold servers now serve a did.json via pkg/testpds so they resolve as real holds under the tag. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UwYzaG3Yy7uA8FbZ5qk3tQ
34 lines
1.2 KiB
Go
34 lines
1.2 KiB
Go
package testpds
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
)
|
|
|
|
// DIDWebForURL returns the did:web identifier for a local http://host:port
|
|
// URL, percent-encoding the port colon as did:web requires. It is the DID a
|
|
// `-tags testmode` build resolves back to that URL by fetching
|
|
// http://host:port/.well-known/did.json.
|
|
func DIDWebForURL(rawURL string) string {
|
|
return "did:web:" + didWebForHost(rawURL)
|
|
}
|
|
|
|
// HoldDIDDocumentHandler serves a minimal did:web document for a test server
|
|
// standing in for a hold: both the #atproto_pds and #atcr_hold services point
|
|
// at baseURL, and no keys are declared. Mount it at /.well-known/did.json so
|
|
// the test-mode identity directory can resolve the server's DID.
|
|
func HoldDIDDocumentHandler(did, baseURL string) http.HandlerFunc {
|
|
doc := map[string]any{
|
|
"@context": []string{"https://www.w3.org/ns/did/v1"},
|
|
"id": did,
|
|
"service": []map[string]string{
|
|
{"id": "#atproto_pds", "type": "AtprotoPersonalDataServer", "serviceEndpoint": baseURL},
|
|
{"id": "#atcr_hold", "type": "AtcrHoldService", "serviceEndpoint": baseURL},
|
|
},
|
|
}
|
|
return func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/did+ld+json")
|
|
_ = json.NewEncoder(w).Encode(doc)
|
|
}
|
|
}
|