at-container-registry/pkg/appview/holdclient/tier_update.go

// Package holdclient provides client functions for the appview to call hold XRPC endpoints.
package holdclient

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"log/slog"
	"net/http"
	"strings"
	"sync"
	"time"

	"atcr.io/pkg/atproto"
	"atcr.io/pkg/auth"
	"github.com/bluesky-social/indigo/atproto/atcrypto"
)

// tierUpdateMaxAttempts bounds per-hold retries when pushing a tier update.
const tierUpdateMaxAttempts = 3

// tierUpdateHTTPClient bounds each hold request so a hung hold can't block the
// Stripe webhook indefinitely (http.DefaultClient has no timeout). The caller
// also imposes an overall context deadline across all holds and retries.
var tierUpdateHTTPClient = &http.Client{Timeout: 5 * time.Second}

// UpdateCrewTierOnHold calls io.atcr.hold.updateCrewTier on a specific hold.
// It signs a short-lived JWT with the appview's P-256 key and sends the tier update request.
func UpdateCrewTierOnHold(ctx context.Context, holdDID, holdURL, userDID string, tierRank int, privateKey *atcrypto.PrivateKeyP256, appviewDID string) error {
	// Sign appview service token
	token, err := auth.CreateAppviewServiceToken(privateKey, appviewDID, holdDID, userDID)
	if err != nil {
		return fmt.Errorf("failed to create appview token: %w", err)
	}

	// Build request body
	body, err := json.Marshal(map[string]any{
		"userDid":  userDID,
		"tierRank": tierRank,
	})
	if err != nil {
		return fmt.Errorf("failed to marshal request: %w", err)
	}

	// Build URL
	url := strings.TrimSuffix(holdURL, "/") + atproto.HoldUpdateCrewTier

	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(body))
	if err != nil {
		return fmt.Errorf("failed to create request: %w", err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+token)

	resp, err := tierUpdateHTTPClient.Do(req)
	if err != nil {
		return fmt.Errorf("failed to call updateCrewTier on %s: %w", holdDID, err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		respBody, _ := io.ReadAll(resp.Body)
		return fmt.Errorf("updateCrewTier on %s returned %d: %s", holdDID, resp.StatusCode, string(respBody))
	}

	return nil
}

// UpdateCrewTierOnAllHolds pushes a tier update to all managed holds, retrying
// each hold a bounded number of times. It returns a joined error covering every
// hold that could not be updated (after retries), so callers — notably the
// Stripe webhook — can fail the request and let Stripe redeliver. Returns nil
// only when every managed hold was updated successfully.
// Holds are contacted concurrently. Serially, one unreachable hold burns the
// caller's whole deadline on its own retries (3 attempts x 5s plus backoff) and
// the holds after it are never contacted at all — and since the caller retries
// in the same order, a persistently-down first hold means later holds are never
// updated. Fanning out gives every hold the same shot at the budget.
func UpdateCrewTierOnAllHolds(ctx context.Context, managedHolds []string, userDID string, tierRank int, privateKey *atcrypto.PrivateKeyP256, appviewDID string) error {
	errs := make([]error, len(managedHolds))

	var wg sync.WaitGroup
	for i, holdDID := range managedHolds {
		wg.Go(func() {
			holdURL, err := atproto.ResolveHoldDIDToURL(ctx, holdDID)
			if err != nil {
				slog.Warn("Could not resolve hold DID to URL",
					"holdDID", holdDID,
					"error", err,
				)
				errs[i] = fmt.Errorf("resolve hold %s: %w", holdDID, err)
				return
			}

			if err := updateCrewTierWithRetry(ctx, holdDID, holdURL, userDID, tierRank, privateKey, appviewDID); err != nil {
				slog.Error("Failed to update crew tier on hold",
					"holdDID", holdDID,
					"userDID", userDID,
					"tierRank", tierRank,
					"error", err,
				)
				errs[i] = err
				return
			}

			slog.Info("Updated crew tier on hold",
				"holdDID", holdDID,
				"userDID", userDID,
				"tierRank", tierRank,
			)
		})
	}
	wg.Wait()

	return errors.Join(errs...)
}

// updateCrewTierWithRetry calls UpdateCrewTierOnHold with bounded retries and a
// small linear backoff, aborting early if the context is cancelled.
func updateCrewTierWithRetry(ctx context.Context, holdDID, holdURL, userDID string, tierRank int, privateKey *atcrypto.PrivateKeyP256, appviewDID string) error {
	var lastErr error
	for attempt := 1; attempt <= tierUpdateMaxAttempts; attempt++ {
		lastErr = UpdateCrewTierOnHold(ctx, holdDID, holdURL, userDID, tierRank, privateKey, appviewDID)
		if lastErr == nil {
			return nil
		}
		if attempt < tierUpdateMaxAttempts {
			select {
			case <-ctx.Done():
				return ctx.Err()
			case <-time.After(time.Duration(attempt) * 200 * time.Millisecond):
			}
		}
	}
	return fmt.Errorf("update crew tier on %s after %d attempts: %w", holdDID, tierUpdateMaxAttempts, lastErr)
}