+6 -14

appview/oauth/accounts.go

··· 53 return &registry 54 } 55 56 - func (o *OAuth) SaveAccounts(w http.ResponseWriter, r *http.Request, registry *AccountRegistry) error { 57 session, err := o.SessStore.Get(r, AccountsName) 58 if err != nil { 59 o.Logger.Warn("failed to decode existing accounts cookie, will create new", "err", err) ··· 114 return nil 115 } 116 117 - func (r *AccountRegistry) OtherAccounts(activeDid string) []AccountInfo { 118 - result := make([]AccountInfo, 0, len(r.Accounts)) 119 - for _, acc := range r.Accounts { 120 - if acc.Did != activeDid { 121 - result = append(result, acc) 122 - } 123 - } 124 - return result 125 - } 126 - 127 func (o *OAuth) GetMultiAccountUser(r *http.Request) *MultiAccountUser { 128 - user := o.GetUser(r) 129 - if user == nil { 130 return nil 131 } 132 133 registry := o.GetAccounts(r) 134 return &MultiAccountUser{ 135 - Active: user, 0 0 136 Accounts: registry.Accounts, 137 } 138 }

··· 53 return &registry 54 } 55 56 + func (o *OAuth) saveAccounts(w http.ResponseWriter, r *http.Request, registry *AccountRegistry) error { 57 session, err := o.SessStore.Get(r, AccountsName) 58 if err != nil { 59 o.Logger.Warn("failed to decode existing accounts cookie, will create new", "err", err) ··· 114 return nil 115 } 116 0 0 0 0 0 0 0 0 0 0 117 func (o *OAuth) GetMultiAccountUser(r *http.Request) *MultiAccountUser { 118 + sess, err := o.ResumeSession(r) 119 + if err != nil { 120 return nil 121 } 122 123 registry := o.GetAccounts(r) 124 return &MultiAccountUser{ 125 + Active: &User{ 126 + Did: sess.Data.AccountDID.String(), 127 + }, 128 Accounts: registry.Accounts, 129 } 130 }

-35

appview/oauth/accounts_test.go

··· 211 }) 212 } 213 214 - func TestAccountRegistry_OtherAccounts(t *testing.T) { 215 - registry := &AccountRegistry{ 216 - Accounts: []AccountInfo{ 217 - {Did: "did:plc:active", Handle: "active", SessionId: "s1"}, 218 - {Did: "did:plc:other1", Handle: "other1", SessionId: "s2"}, 219 - {Did: "did:plc:other2", Handle: "other2", SessionId: "s3"}, 220 - }, 221 - } 222 - 223 - others := registry.OtherAccounts("did:plc:active") 224 - 225 - if len(others) != 2 { 226 - t.Errorf("OtherAccounts() len = %d, want 2", len(others)) 227 - } 228 - 229 - for _, acc := range others { 230 - if acc.Did == "did:plc:active" { 231 - t.Errorf("OtherAccounts() should not include active account") 232 - } 233 - } 234 - 235 - hasDid := func(did string) bool { 236 - for _, acc := range others { 237 - if acc.Did == did { 238 - return true 239 - } 240 - } 241 - return false 242 - } 243 - 244 - if !hasDid("did:plc:other1") || !hasDid("did:plc:other2") { 245 - t.Errorf("OtherAccounts() missing expected accounts") 246 - } 247 - } 248 - 249 func TestMultiAccountUser_Did(t *testing.T) { 250 t.Run("with active user", func(t *testing.T) { 251 user := &MultiAccountUser{

··· 211 }) 212 } 213 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 214 func TestMultiAccountUser_Did(t *testing.T) { 215 t.Run("with active user", func(t *testing.T) { 216 user := &MultiAccountUser{

-6

appview/oauth/consts.go

··· 10 SessionDid = "did" 11 SessionId = "id" 12 SessionPds = "pds" 13 - SessionAccessJwt = "accessJwt" 14 - SessionRefreshJwt = "refreshJwt" 15 - SessionExpiry = "expiry" 16 SessionAuthenticated = "authenticated" 17 - 18 - SessionDpopPrivateJwk = "dpopPrivateJwk" 19 - SessionDpopAuthServerNonce = "dpopAuthServerNonce" 20 )

··· 10 SessionDid = "did" 11 SessionId = "id" 12 SessionPds = "pds" 0 0 0 13 SessionAuthenticated = "authenticated" 0 0 0 14 )

+3 -14

appview/oauth/oauth.go

··· 126 if err := registry.AddAccount(sessData.AccountDID.String(), handle, sessData.SessionID); err != nil { 127 return err 128 } 129 - return o.SaveAccounts(w, r, registry) 130 } 131 132 func (o *OAuth) ResumeSession(r *http.Request) (*oauth.ClientSession, error) { ··· 202 sess, err := o.ClientApp.ResumeSession(r.Context(), did, account.SessionId) 203 if err != nil { 204 registry.RemoveAccount(targetDid) 205 - _ = o.SaveAccounts(w, r, registry) 206 return fmt.Errorf("session expired for account: %w", err) 207 } 208 ··· 232 } 233 234 registry.RemoveAccount(targetDid) 235 - return o.SaveAccounts(w, r, registry) 236 } 237 238 type User struct { 239 Did string 240 - } 241 - 242 - func (o *OAuth) GetUser(r *http.Request) *User { 243 - sess, err := o.ResumeSession(r) 244 - if err != nil { 245 - return nil 246 - } 247 - 248 - return &User{ 249 - Did: sess.Data.AccountDID.String(), 250 - } 251 } 252 253 func (o *OAuth) GetDid(r *http.Request) string {

··· 126 if err := registry.AddAccount(sessData.AccountDID.String(), handle, sessData.SessionID); err != nil { 127 return err 128 } 129 + return o.saveAccounts(w, r, registry) 130 } 131 132 func (o *OAuth) ResumeSession(r *http.Request) (*oauth.ClientSession, error) { ··· 202 sess, err := o.ClientApp.ResumeSession(r.Context(), did, account.SessionId) 203 if err != nil { 204 registry.RemoveAccount(targetDid) 205 + _ = o.saveAccounts(w, r, registry) 206 return fmt.Errorf("session expired for account: %w", err) 207 } 208 ··· 232 } 233 234 registry.RemoveAccount(targetDid) 235 + return o.saveAccounts(w, r, registry) 236 } 237 238 type User struct { 239 Did string 0 0 0 0 0 0 0 0 0 0 0 240 } 241 242 func (o *OAuth) GetDid(r *http.Request) string {

-2

appview/pages/templates/user/login.html

··· 13 14 {{ if and .LoggedInUser .LoggedInUser.Accounts }} 15 {{ $accounts := .LoggedInUser.Accounts }} 16 - {{ if $accounts }} 17 <div class="my-4 border border-gray-200 dark:border-gray-700 rounded overflow-hidden"> 18 <div class="px-3 py-2 bg-gray-50 dark:bg-gray-800 border-b border-gray-200 dark:border-gray-700"> 19 <span class="text-xs text-gray-500 dark:text-gray-400 uppercase tracking-wide font-medium">Saved accounts</span> ··· 47 {{ end }} 48 </div> 49 </div> 50 - {{ end }} 51 {{ end }} 52 53 <form

··· 13 14 {{ if and .LoggedInUser .LoggedInUser.Accounts }} 15 {{ $accounts := .LoggedInUser.Accounts }} 0 16 <div class="my-4 border border-gray-200 dark:border-gray-700 rounded overflow-hidden"> 17 <div class="px-3 py-2 bg-gray-50 dark:bg-gray-800 border-b border-gray-200 dark:border-gray-700"> 18 <span class="text-xs text-gray-500 dark:text-gray-400 uppercase tracking-wide font-medium">Saved accounts</span> ··· 46 {{ end }} 47 </div> 48 </div> 0 49 {{ end }} 50 51 <form

+14 -14

appview/state/profile.go

··· 785 786 func (s *State) UploadProfileAvatar(w http.ResponseWriter, r *http.Request) { 787 l := s.logger.With("handler", "UploadProfileAvatar") 788 - user := s.oauth.GetUser(r) 789 - l = l.With("did", user.Did) 790 791 // Parse multipart form (10MB max) 792 if err := r.ParseMultipartForm(10 << 20); err != nil { ··· 833 l.Info("uploaded avatar blob", "cid", uploadBlobResp.Blob.Ref.String()) 834 835 // get current profile record from PDS to get its CID for swap 836 - getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Did, "self") 837 if err != nil { 838 l.Error("failed to get current profile record", "err", err) 839 s.pages.Notice(w, "avatar-error", "Failed to get current profile from your PDS") ··· 857 858 _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 859 Collection: tangled.ActorProfileNSID, 860 - Repo: user.Did, 861 Rkey: "self", 862 Record: &lexutil.LexiconTypeDecoder{Val: profileRecord}, 863 SwapRecord: getRecordResp.Cid, ··· 871 872 l.Info("successfully updated profile with avatar") 873 874 - profile, err := db.GetProfile(s.db, user.Did) 875 if err != nil { 876 l.Warn("getting profile data from DB", "err", err) 877 } 878 if profile == nil { 879 - profile = &models.Profile{Did: user.Did} 880 } 881 profile.Avatar = uploadBlobResp.Blob.Ref.String() 882 ··· 901 902 func (s *State) RemoveProfileAvatar(w http.ResponseWriter, r *http.Request) { 903 l := s.logger.With("handler", "RemoveProfileAvatar") 904 - user := s.oauth.GetUser(r) 905 - l = l.With("did", user.Did) 906 907 client, err := s.oauth.AuthorizedClient(r) 908 if err != nil { ··· 911 return 912 } 913 914 - getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Did, "self") 915 if err != nil { 916 l.Error("failed to get current profile record", "err", err) 917 s.pages.Notice(w, "avatar-error", "Failed to get current profile from your PDS") ··· 935 936 _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 937 Collection: tangled.ActorProfileNSID, 938 - Repo: user.Did, 939 Rkey: "self", 940 Record: &lexutil.LexiconTypeDecoder{Val: profileRecord}, 941 SwapRecord: getRecordResp.Cid, ··· 949 950 l.Info("successfully removed avatar from PDS") 951 952 - profile, err := db.GetProfile(s.db, user.Did) 953 if err != nil { 954 l.Warn("getting profile data from DB", "err", err) 955 } 956 if profile == nil { 957 - profile = &models.Profile{Did: user.Did} 958 } 959 profile.Avatar = "" 960 ··· 983 log.Println("invalid profile update form", err) 984 return 985 } 986 - user := s.oauth.GetUser(r) 987 988 hideOthers := false 989 hideMine := false ··· 995 hideOthers = true 996 } 997 998 - err = db.UpsertPunchcardPreference(s.db, user.Did, hideMine, hideOthers) 999 if err != nil { 1000 log.Println("failed to update punchcard preferences", err) 1001 return

··· 785 786 func (s *State) UploadProfileAvatar(w http.ResponseWriter, r *http.Request) { 787 l := s.logger.With("handler", "UploadProfileAvatar") 788 + user := s.oauth.GetMultiAccountUser(r) 789 + l = l.With("did", user.Active.Did) 790 791 // Parse multipart form (10MB max) 792 if err := r.ParseMultipartForm(10 << 20); err != nil { ··· 833 l.Info("uploaded avatar blob", "cid", uploadBlobResp.Blob.Ref.String()) 834 835 // get current profile record from PDS to get its CID for swap 836 + getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Active.Did, "self") 837 if err != nil { 838 l.Error("failed to get current profile record", "err", err) 839 s.pages.Notice(w, "avatar-error", "Failed to get current profile from your PDS") ··· 857 858 _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 859 Collection: tangled.ActorProfileNSID, 860 + Repo: user.Active.Did, 861 Rkey: "self", 862 Record: &lexutil.LexiconTypeDecoder{Val: profileRecord}, 863 SwapRecord: getRecordResp.Cid, ··· 871 872 l.Info("successfully updated profile with avatar") 873 874 + profile, err := db.GetProfile(s.db, user.Active.Did) 875 if err != nil { 876 l.Warn("getting profile data from DB", "err", err) 877 } 878 if profile == nil { 879 + profile = &models.Profile{Did: user.Active.Did} 880 } 881 profile.Avatar = uploadBlobResp.Blob.Ref.String() 882 ··· 901 902 func (s *State) RemoveProfileAvatar(w http.ResponseWriter, r *http.Request) { 903 l := s.logger.With("handler", "RemoveProfileAvatar") 904 + user := s.oauth.GetMultiAccountUser(r) 905 + l = l.With("did", user.Active.Did) 906 907 client, err := s.oauth.AuthorizedClient(r) 908 if err != nil { ··· 911 return 912 } 913 914 + getRecordResp, err := comatproto.RepoGetRecord(r.Context(), client, "", tangled.ActorProfileNSID, user.Active.Did, "self") 915 if err != nil { 916 l.Error("failed to get current profile record", "err", err) 917 s.pages.Notice(w, "avatar-error", "Failed to get current profile from your PDS") ··· 935 936 _, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{ 937 Collection: tangled.ActorProfileNSID, 938 + Repo: user.Active.Did, 939 Rkey: "self", 940 Record: &lexutil.LexiconTypeDecoder{Val: profileRecord}, 941 SwapRecord: getRecordResp.Cid, ··· 949 950 l.Info("successfully removed avatar from PDS") 951 952 + profile, err := db.GetProfile(s.db, user.Active.Did) 953 if err != nil { 954 l.Warn("getting profile data from DB", "err", err) 955 } 956 if profile == nil { 957 + profile = &models.Profile{Did: user.Active.Did} 958 } 959 profile.Avatar = "" 960 ··· 983 log.Println("invalid profile update form", err) 984 return 985 } 986 + user := s.oauth.GetMultiAccountUser(r) 987 988 hideOthers := false 989 hideMine := false ··· 995 hideOthers = true 996 } 997 998 + err = db.UpsertPunchcardPreference(s.db, user.Active.Did, hideMine, hideOthers) 999 if err != nil { 1000 log.Println("failed to update punchcard preferences", err) 1001 return