primal
8192bce301
Add AT Protocol OAuth 2.0 authentication for dashboard
...
- Implement full OAuth 2.0 with PKCE using haileyok/atproto-oauth-golang
- Backend For Frontend (BFF) pattern: tokens stored server-side only
- AES-256-GCM encrypted session cookies
- Auto token refresh when near expiry
- Restrict access to allowed handles (1440.news, wehrv.bsky.social)
- Add genkey utility for generating OAuth configuration
- Generic error messages to prevent handle enumeration
- Server-side logging of failed login attempts for security monitoring
New files:
- oauth.go: OAuth client wrapper and DID/handle resolution
- oauth_session.go: Session management with encrypted cookies
- oauth_middleware.go: RequireAuth middleware for route protection
- oauth_handlers.go: Login, callback, logout, metadata endpoints
- cmd/genkey/main.go: Generate OAuth secrets and JWK keypair
- oauth.env.example: Configuration template
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-30 15:16:51 -05:00
primal
516848e529
Revise domain status flow: skip uses takedown, add drop for permanent deletion
...
- Import default changed from 'hold' to 'pass' (auto-crawl)
- Skip now uses PDS takedown (hides posts but preserves data)
- Added 'drop' status for permanent deletion (requires skip first)
- Added TakedownAccount/RestoreAccount PDS functions
- Un-skip restores PDS accounts and reactivates feeds
- Dashboard shows 'drop' button only for skipped domains
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-29 23:18:17 -05:00
primal
43916c8042
Exclude skip status domains from default API listing
...
When no status filter is provided, the domains API now excludes
domains with 'skip' status (including bare TLDs) by default.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-29 22:34:24 -05:00
primal
1066f42189
Refactor large Go files into focused modules
...
Split dashboard.go (3,528 lines) into:
- routes.go: HTTP route registration
- api_domains.go: Domain API handlers
- api_feeds.go: Feed API handlers
- api_publish.go: Publishing API handlers
- api_search.go: Search API handlers
- templates.go: HTML templates
- dashboard.go: Stats functions only (235 lines)
Split publisher.go (1,502 lines) into:
- pds_auth.go: Authentication and account management
- pds_records.go: Record operations (upload, update, delete)
- handle.go: Handle derivation from feed URLs
- image.go: Image processing and favicon fetching
- publisher.go: Core types and PublishItem (439 lines)
Split feed.go (1,137 lines) into:
- item.go: Item struct and DB operations
- feed_check.go: Feed checking and processing
- feed.go: Feed struct and DB operations (565 lines)
Also includes domain import batch size increase (1k -> 100k).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com >
2026-01-29 22:25:02 -05:00
