+217

src/api/auth.rs

··· 1 1 + use crate::resolver::HickoryDnsTxtResolver; 2 2 + use crate::{ 3 3 + config, 4 4 + storage::{SqliteSessionStore, SqliteStateStore}, 5 5 + templates::{ErrorTemplate, LoginTemplate}, 6 6 + }; 7 7 + use actix_session::Session; 8 8 + use actix_web::{ 9 9 + HttpRequest, HttpResponse, Responder, Result, get, post, 10 10 + web::{self, Redirect}, 11 11 + }; 12 12 + use askama::Template; 13 13 + use atrium_api::agent::Agent; 14 14 + use atrium_identity::{did::CommonDidResolver, handle::AtprotoHandleResolver}; 15 15 + use atrium_oauth::{ 16 16 + AuthorizeOptions, CallbackParams, DefaultHttpClient, KnownScope, OAuthClient, Scope, 17 17 + }; 18 18 + use serde::{Deserialize, Serialize}; 19 19 + use std::sync::Arc; 20 20 + 21 21 + #[derive(Deserialize)] 22 22 + pub struct OAuthCallbackParams { 23 23 + pub state: Option<String>, 24 24 + pub iss: Option<String>, 25 25 + pub code: Option<String>, 26 26 + pub error: Option<String>, 27 27 + pub error_description: Option<String>, 28 28 + } 29 29 + 30 30 + pub type OAuthClientType = Arc< 31 31 + OAuthClient< 32 32 + SqliteStateStore, 33 33 + SqliteSessionStore, 34 34 + CommonDidResolver<DefaultHttpClient>, 35 35 + AtprotoHandleResolver<HickoryDnsTxtResolver, DefaultHttpClient>, 36 36 + >, 37 37 + >; 38 38 + 39 39 + /// OAuth client metadata endpoint for production 40 40 + #[get("/oauth-client-metadata.json")] 41 41 + pub async fn client_metadata(config: web::Data<config::Config>) -> Result<HttpResponse> { 42 42 + let public_url = config.oauth_redirect_base.clone(); 43 43 + 44 44 + let metadata = serde_json::json!({ 45 45 + "client_id": format!("{}/oauth-client-metadata.json", public_url), 46 46 + "client_name": "Status Sphere", 47 47 + "client_uri": public_url.clone(), 48 48 + "redirect_uris": [format!("{}/oauth/callback", public_url)], 49 49 + "scope": "atproto repo:io.zzstoatzz.status.record rpc:app.bsky.actor.getProfile?aud=did:web:api.bsky.app#bsky_appview rpc:app.bsky.graph.getFollows?aud=did:web:api.bsky.app", 50 50 + "grant_types": ["authorization_code", "refresh_token"], 51 51 + "response_types": ["code"], 52 52 + "token_endpoint_auth_method": "none", 53 53 + "dpop_bound_access_tokens": true 54 54 + }); 55 55 + 56 56 + Ok(HttpResponse::Ok() 57 57 + .content_type("application/json") 58 58 + .body(metadata.to_string())) 59 59 + } 60 60 + 61 61 + /// OAuth callback endpoint to complete session creation 62 62 + #[get("/oauth/callback")] 63 63 + pub async fn oauth_callback( 64 64 + request: HttpRequest, 65 65 + params: web::Query<OAuthCallbackParams>, 66 66 + oauth_client: web::Data<OAuthClientType>, 67 67 + session: Session, 68 68 + ) -> HttpResponse { 69 69 + // Check if there's an OAuth error from BlueSky 70 70 + if let Some(error) = &params.error { 71 71 + let error_msg = params 72 72 + .error_description 73 73 + .as_deref() 74 74 + .unwrap_or("An error occurred during authentication"); 75 75 + log::error!("OAuth error from BlueSky: {} - {}", error, error_msg); 76 76 + 77 77 + let html = ErrorTemplate { 78 78 + title: "Authentication Error", 79 79 + error: error_msg, 80 80 + }; 81 81 + return HttpResponse::BadRequest().body(html.render().expect("template should be valid")); 82 82 + } 83 83 + 84 84 + // Check if we have the required code field for a successful callback 85 85 + let code = match &params.code { 86 86 + Some(code) => code.clone(), 87 87 + None => { 88 88 + log::error!("OAuth callback missing required code parameter"); 89 89 + let html = ErrorTemplate { 90 90 + title: "Error", 91 91 + error: "Missing required OAuth code. Please try logging in again.", 92 92 + }; 93 93 + return HttpResponse::BadRequest() 94 94 + .body(html.render().expect("template should be valid")); 95 95 + } 96 96 + }; 97 97 + 98 98 + // Create CallbackParams for the OAuth client 99 99 + let callback_params = CallbackParams { 100 100 + code, 101 101 + state: params.state.clone(), 102 102 + iss: params.iss.clone(), 103 103 + }; 104 104 + 105 105 + //Processes the call back and parses out a session if found and valid 106 106 + match oauth_client.callback(callback_params).await { 107 107 + Ok((bsky_session, _)) => { 108 108 + let agent = Agent::new(bsky_session); 109 109 + match agent.did().await { 110 110 + Some(did) => { 111 111 + session.insert("did", did).unwrap(); 112 112 + Redirect::to("/") 113 113 + .see_other() 114 114 + .respond_to(&request) 115 115 + .map_into_boxed_body() 116 116 + } 117 117 + None => { 118 118 + let html = ErrorTemplate { 119 119 + title: "Error", 120 120 + error: "The OAuth agent did not return a DID. May try re-logging in.", 121 121 + }; 122 122 + HttpResponse::Ok().body(html.render().expect("template should be valid")) 123 123 + } 124 124 + } 125 125 + } 126 126 + Err(err) => { 127 127 + log::error!("Error: {err}"); 128 128 + let html = ErrorTemplate { 129 129 + title: "Error", 130 130 + error: "OAuth error, check the logs", 131 131 + }; 132 132 + HttpResponse::Ok().body(html.render().expect("template should be valid")) 133 133 + } 134 134 + } 135 135 + } 136 136 + 137 137 + /// Takes you to the login page 138 138 + #[get("/login")] 139 139 + pub async fn login() -> Result<impl Responder> { 140 140 + let html = LoginTemplate { 141 141 + title: "Log in", 142 142 + error: None, 143 143 + }; 144 144 + Ok(web::Html::new( 145 145 + html.render().expect("template should be valid"), 146 146 + )) 147 147 + } 148 148 + 149 149 + /// Logs you out by destroying your cookie on the server and web browser 150 150 + #[get("/logout")] 151 151 + pub async fn logout(request: HttpRequest, session: Session) -> HttpResponse { 152 152 + session.purge(); 153 153 + Redirect::to("/") 154 154 + .see_other() 155 155 + .respond_to(&request) 156 156 + .map_into_boxed_body() 157 157 + } 158 158 + 159 159 + /// The post body for logging in 160 160 + #[derive(Serialize, Deserialize, Clone)] 161 161 + pub struct LoginForm { 162 162 + pub handle: String, 163 163 + } 164 164 + 165 165 + /// Login endpoint 166 166 + #[post("/login")] 167 167 + pub async fn login_post( 168 168 + request: HttpRequest, 169 169 + params: web::Form<LoginForm>, 170 170 + oauth_client: web::Data<OAuthClientType>, 171 171 + ) -> HttpResponse { 172 172 + // This will act the same as the js method isValidHandle to make sure it is valid 173 173 + match atrium_api::types::string::Handle::new(params.handle.clone()) { 174 174 + Ok(handle) => { 175 175 + //Creates the oauth url to redirect to for the user to log in with their credentials 176 176 + let oauth_url = oauth_client 177 177 + .authorize( 178 178 + &handle, 179 179 + AuthorizeOptions { 180 180 + scopes: vec![ 181 181 + Scope::Known(KnownScope::Atproto), 182 182 + // Using granular scope for status records only 183 183 + // This replaces TransitionGeneric with specific permissions 184 184 + Scope::Unknown("repo:io.zzstoatzz.status.record".to_string()), 185 185 + // Need to read profiles for the feed page 186 186 + Scope::Unknown("rpc:app.bsky.actor.getProfile?aud=did:web:api.bsky.app#bsky_appview".to_string()), 187 187 + // Need to read following list for following feed 188 188 + Scope::Unknown("rpc:app.bsky.graph.getFollows?aud=did:web:api.bsky.app".to_string()), 189 189 + ], 190 190 + ..Default::default() 191 191 + }, 192 192 + ) 193 193 + .await; 194 194 + match oauth_url { 195 195 + Ok(url) => Redirect::to(url) 196 196 + .see_other() 197 197 + .respond_to(&request) 198 198 + .map_into_boxed_body(), 199 199 + Err(err) => { 200 200 + log::error!("Error: {err}"); 201 201 + let html = LoginTemplate { 202 202 + title: "Log in", 203 203 + error: Some("OAuth error"), 204 204 + }; 205 205 + HttpResponse::Ok().body(html.render().expect("template should be valid")) 206 206 + } 207 207 + } 208 208 + } 209 209 + Err(err) => { 210 210 + let html: LoginTemplate<'_> = LoginTemplate { 211 211 + title: "Log in", 212 212 + error: Some(err), 213 213 + }; 214 214 + HttpResponse::Ok().body(html.render().expect("template should be valid")) 215 215 + } 216 216 + } 217 217 + }

+40

src/api/mod.rs

··· 1 1 + pub mod auth; 2 2 + pub mod preferences; 3 3 + pub mod status; 4 4 + 5 5 + pub use auth::OAuthClientType; 6 6 + pub use status::HandleResolver; 7 7 + 8 8 + use actix_web::web; 9 9 + 10 10 + /// Configure all API routes 11 11 + pub fn configure_routes(cfg: &mut web::ServiceConfig) { 12 12 + cfg 13 13 + // Auth routes 14 14 + .service(auth::client_metadata) 15 15 + .service(auth::oauth_callback) 16 16 + .service(auth::login) 17 17 + .service(auth::logout) 18 18 + .service(auth::login_post) 19 19 + // Status page routes 20 20 + .service(status::home) 21 21 + .service(status::user_status_page) 22 22 + .service(status::feed) 23 23 + // Status JSON API routes 24 24 + .service(status::owner_status_json) 25 25 + .service(status::user_status_json) 26 26 + .service(status::status_json) 27 27 + .service(status::api_feed) 28 28 + // Emoji API routes 29 29 + .service(status::get_frequent_emojis) 30 30 + .service(status::get_custom_emojis) 31 31 + .service(status::get_following) 32 32 + // Status management routes 33 33 + .service(status::status) 34 34 + .service(status::clear_status) 35 35 + .service(status::delete_status) 36 36 + .service(status::hide_status) 37 37 + // Preferences routes 38 38 + .service(preferences::get_preferences) 39 39 + .service(preferences::save_preferences); 40 40 + }

+75

src/api/preferences.rs

··· 1 1 + use crate::{db, error_handler::AppError}; 2 2 + use actix_session::Session; 3 3 + use actix_web::{Responder, Result, get, post, web}; 4 4 + use async_sqlite::Pool; 5 5 + use atrium_api::types::string::Did; 6 6 + use serde::Deserialize; 7 7 + use std::sync::Arc; 8 8 + 9 9 + #[derive(Deserialize)] 10 10 + pub struct PreferencesUpdate { 11 11 + pub font_family: Option<String>, 12 12 + pub accent_color: Option<String>, 13 13 + } 14 14 + 15 15 + /// Get user preferences 16 16 + #[get("/api/preferences")] 17 17 + pub async fn get_preferences( 18 18 + session: Session, 19 19 + db_pool: web::Data<Arc<Pool>>, 20 20 + ) -> Result<impl Responder> { 21 21 + let did = session.get::<Did>("did")?; 22 22 + 23 23 + if let Some(did) = did { 24 24 + let prefs = db::get_user_preferences(&db_pool, did.as_str()) 25 25 + .await 26 26 + .map_err(|e| AppError::DatabaseError(e.to_string()))?; 27 27 + Ok(web::Json(serde_json::json!({ 28 28 + "font_family": prefs.font_family, 29 29 + "accent_color": prefs.accent_color 30 30 + }))) 31 31 + } else { 32 32 + Ok(web::Json(serde_json::json!({ 33 33 + "error": "Not authenticated" 34 34 + }))) 35 35 + } 36 36 + } 37 37 + 38 38 + /// Save user preferences 39 39 + #[post("/api/preferences")] 40 40 + pub async fn save_preferences( 41 41 + session: Session, 42 42 + db_pool: web::Data<Arc<Pool>>, 43 43 + payload: web::Json<PreferencesUpdate>, 44 44 + ) -> Result<impl Responder> { 45 45 + let did = session.get::<Did>("did")?; 46 46 + 47 47 + if let Some(did) = did { 48 48 + let mut prefs = db::get_user_preferences(&db_pool, did.as_str()) 49 49 + .await 50 50 + .map_err(|e| AppError::DatabaseError(e.to_string()))?; 51 51 + 52 52 + if let Some(font) = &payload.font_family { 53 53 + prefs.font_family = font.clone(); 54 54 + } 55 55 + if let Some(color) = &payload.accent_color { 56 56 + prefs.accent_color = color.clone(); 57 57 + } 58 58 + prefs.updated_at = std::time::SystemTime::now() 59 59 + .duration_since(std::time::UNIX_EPOCH) 60 60 + .unwrap() 61 61 + .as_secs() as i64; 62 62 + 63 63 + db::save_user_preferences(&db_pool, &prefs) 64 64 + .await 65 65 + .map_err(|e| AppError::DatabaseError(e.to_string()))?; 66 66 + 67 67 + Ok(web::Json(serde_json::json!({ 68 68 + "success": true 69 69 + }))) 70 70 + } else { 71 71 + Ok(web::Json(serde_json::json!({ 72 72 + "error": "Not authenticated" 73 73 + }))) 74 74 + } 75 75 + }

+1217

src/api/status.rs

··· 1 1 + use crate::resolver::HickoryDnsTxtResolver; 2 2 + use crate::{ 3 3 + api::auth::OAuthClientType, 4 4 + config, 5 5 + db::{self, StatusFromDb}, 6 6 + dev_utils, 7 7 + error_handler::AppError, 8 8 + lexicons::record::KnownRecord, 9 9 + rate_limiter::RateLimiter, 10 10 + templates::{ErrorTemplate, FeedTemplate, Profile, StatusTemplate}, 11 11 + }; 12 12 + use actix_session::Session; 13 13 + use actix_web::{ 14 14 + HttpRequest, HttpResponse, Responder, Result, get, post, 15 15 + web::{self, Redirect}, 16 16 + }; 17 17 + use askama::Template; 18 18 + use async_sqlite::{Pool, rusqlite}; 19 19 + use atrium_api::{ 20 20 + agent::Agent, 21 21 + types::string::{Datetime, Did}, 22 22 + }; 23 23 + use atrium_common::resolver::Resolver; 24 24 + use atrium_identity::{ 25 25 + did::CommonDidResolver, 26 26 + handle::{AtprotoHandleResolver, AtprotoHandleResolverConfig}, 27 27 + }; 28 28 + use atrium_oauth::DefaultHttpClient; 29 29 + use serde::{Deserialize, Serialize}; 30 30 + use std::{collections::HashMap, sync::Arc}; 31 31 + 32 32 + /// HandleResolver to make it easier to access the OAuthClient in web requests 33 33 + pub type HandleResolver = Arc<CommonDidResolver<DefaultHttpClient>>; 34 34 + 35 35 + /// Admin DID for moderation 36 36 + const ADMIN_DID: &str = "did:plc:xbtmt2zjwlrfegqvch7fboei"; // zzstoatzz.io 37 37 + 38 38 + /// Check if a DID is the admin 39 39 + fn is_admin(did: &str) -> bool { 40 40 + did == ADMIN_DID 41 41 + } 42 42 + 43 43 + /// The post body for changing your status 44 44 + #[derive(Serialize, Deserialize, Clone)] 45 45 + pub struct StatusForm { 46 46 + pub status: String, 47 47 + pub text: Option<String>, 48 48 + pub expires_in: Option<String>, // e.g., "1h", "30m", "1d", etc. 49 49 + } 50 50 + 51 51 + /// The post body for deleting a specific status 52 52 + #[derive(Serialize, Deserialize)] 53 53 + pub struct DeleteRequest { 54 54 + pub uri: String, 55 55 + } 56 56 + 57 57 + /// Hide/unhide a status (admin only) 58 58 + #[derive(Deserialize)] 59 59 + pub struct HideStatusRequest { 60 60 + pub uri: String, 61 61 + pub hidden: bool, 62 62 + } 63 63 + 64 64 + /// Parse duration string like "1h", "30m", "1d" into chrono::Duration 65 65 + fn parse_duration(duration_str: &str) -> Option<chrono::Duration> { 66 66 + if duration_str.is_empty() { 67 67 + return None; 68 68 + } 69 69 + 70 70 + let (num_str, unit) = duration_str.split_at(duration_str.len() - 1); 71 71 + let num: i64 = num_str.parse().ok()?; 72 72 + 73 73 + match unit { 74 74 + "m" => Some(chrono::Duration::minutes(num)), 75 75 + "h" => Some(chrono::Duration::hours(num)), 76 76 + "d" => Some(chrono::Duration::days(num)), 77 77 + "w" => Some(chrono::Duration::weeks(num)), 78 78 + _ => None, 79 79 + } 80 80 + } 81 81 + 82 82 + /// Homepage - shows logged-in user's status, or owner's status if not logged in 83 83 + #[get("/")] 84 84 + pub async fn home( 85 85 + session: Session, 86 86 + _oauth_client: web::Data<OAuthClientType>, 87 87 + db_pool: web::Data<Arc<Pool>>, 88 88 + handle_resolver: web::Data<HandleResolver>, 89 89 + ) -> Result<impl Responder> { 90 90 + // Default owner of the domain 91 91 + const OWNER_HANDLE: &str = "zzstoatzz.io"; 92 92 + 93 93 + // Check if user is logged in 94 94 + match session.get::<String>("did").unwrap_or(None) { 95 95 + Some(did_string) => { 96 96 + // User is logged in - show their status page 97 97 + log::debug!("Home: User is logged in with DID: {}", did_string); 98 98 + let did = Did::new(did_string.clone()).expect("failed to parse did"); 99 99 + 100 100 + // Get their handle 101 101 + let handle = match handle_resolver.resolve(&did).await { 102 102 + Ok(did_doc) => did_doc 103 103 + .also_known_as 104 104 + .and_then(|aka| aka.first().map(|h| h.replace("at://", ""))) 105 105 + .unwrap_or_else(|| did_string.clone()), 106 106 + Err(_) => did_string.clone(), 107 107 + }; 108 108 + 109 109 + // Get user's status 110 110 + let current_status = StatusFromDb::my_status(&db_pool, &did) 111 111 + .await 112 112 + .unwrap_or(None) 113 113 + .and_then(|s| { 114 114 + // Check if status is expired 115 115 + if let Some(expires_at) = s.expires_at { 116 116 + if chrono::Utc::now() > expires_at { 117 117 + return None; // Status expired 118 118 + } 119 119 + } 120 120 + Some(s) 121 121 + }); 122 122 + 123 123 + let history = StatusFromDb::load_user_statuses(&db_pool, &did, 10) 124 124 + .await 125 125 + .unwrap_or_else(|err| { 126 126 + log::error!("Error loading status history: {err}"); 127 127 + vec![] 128 128 + }); 129 129 + 130 130 + let html = StatusTemplate { 131 131 + title: "your status", 132 132 + handle, 133 133 + current_status, 134 134 + history, 135 135 + is_owner: true, // They're viewing their own status 136 136 + } 137 137 + .render() 138 138 + .expect("template should be valid"); 139 139 + 140 140 + Ok(web::Html::new(html)) 141 141 + } 142 142 + None => { 143 143 + // Not logged in - show owner's status 144 144 + // Resolve owner handle to DID 145 145 + let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 146 146 + dns_txt_resolver: HickoryDnsTxtResolver::default(), 147 147 + http_client: Arc::new(DefaultHttpClient::default()), 148 148 + }); 149 149 + 150 150 + let owner_handle = 151 151 + atrium_api::types::string::Handle::new(OWNER_HANDLE.to_string()).ok(); 152 152 + let owner_did = if let Some(handle) = owner_handle { 153 153 + atproto_handle_resolver.resolve(&handle).await.ok() 154 154 + } else { 155 155 + None 156 156 + }; 157 157 + 158 158 + let current_status = if let Some(ref did) = owner_did { 159 159 + StatusFromDb::my_status(&db_pool, did) 160 160 + .await 161 161 + .unwrap_or(None) 162 162 + .and_then(|s| { 163 163 + // Check if status is expired 164 164 + if let Some(expires_at) = s.expires_at { 165 165 + if chrono::Utc::now() > expires_at { 166 166 + return None; // Status expired 167 167 + } 168 168 + } 169 169 + Some(s) 170 170 + }) 171 171 + } else { 172 172 + None 173 173 + }; 174 174 + 175 175 + let history = if let Some(ref did) = owner_did { 176 176 + StatusFromDb::load_user_statuses(&db_pool, did, 10) 177 177 + .await 178 178 + .unwrap_or_else(|err| { 179 179 + log::error!("Error loading status history: {err}"); 180 180 + vec![] 181 181 + }) 182 182 + } else { 183 183 + vec![] 184 184 + }; 185 185 + 186 186 + let html = StatusTemplate { 187 187 + title: "nate's status", 188 188 + handle: OWNER_HANDLE.to_string(), 189 189 + current_status, 190 190 + history, 191 191 + is_owner: false, // Visitor viewing owner's status 192 192 + } 193 193 + .render() 194 194 + .expect("template should be valid"); 195 195 + 196 196 + Ok(web::Html::new(html)) 197 197 + } 198 198 + } 199 199 + } 200 200 + 201 201 + /// View a specific user's status page by handle 202 202 + #[get("/@{handle}")] 203 203 + pub async fn user_status_page( 204 204 + handle: web::Path<String>, 205 205 + session: Session, 206 206 + db_pool: web::Data<Arc<Pool>>, 207 207 + _handle_resolver: web::Data<HandleResolver>, 208 208 + ) -> Result<impl Responder> { 209 209 + let handle = handle.into_inner(); 210 210 + 211 211 + // Resolve handle to DID using ATProto handle resolution 212 212 + // First we need to create a handle resolver 213 213 + let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 214 214 + dns_txt_resolver: HickoryDnsTxtResolver::default(), 215 215 + http_client: Arc::new(DefaultHttpClient::default()), 216 216 + }); 217 217 + 218 218 + let handle_obj = atrium_api::types::string::Handle::new(handle.clone()).ok(); 219 219 + let did = match handle_obj { 220 220 + Some(h) => match atproto_handle_resolver.resolve(&h).await { 221 221 + Ok(did) => did, 222 222 + Err(_) => { 223 223 + // Could not resolve handle 224 224 + let html = ErrorTemplate { 225 225 + title: "User not found", 226 226 + error: &format!("Could not find user @{}. This handle may not exist or may not be using the ATProto network.", handle), 227 227 + } 228 228 + .render() 229 229 + .expect("template should be valid"); 230 230 + return Ok(web::Html::new(html)); 231 231 + } 232 232 + }, 233 233 + None => { 234 234 + // Invalid handle format 235 235 + let html = ErrorTemplate { 236 236 + title: "Invalid handle", 237 237 + error: &format!( 238 238 + "'{}' is not a valid handle format. Handles should be like 'alice.bsky.social'", 239 239 + handle 240 240 + ), 241 241 + } 242 242 + .render() 243 243 + .expect("template should be valid"); 244 244 + return Ok(web::Html::new(html)); 245 245 + } 246 246 + }; 247 247 + 248 248 + // Check if logged in user is viewing their own page 249 249 + let is_owner = match session.get::<String>("did").unwrap_or(None) { 250 250 + Some(session_did) => session_did == did.to_string(), 251 251 + None => false, 252 252 + }; 253 253 + 254 254 + // Get user's status 255 255 + let current_status = StatusFromDb::my_status(&db_pool, &did) 256 256 + .await 257 257 + .unwrap_or(None) 258 258 + .and_then(|s| { 259 259 + // Check if status is expired 260 260 + if let Some(expires_at) = s.expires_at { 261 261 + if chrono::Utc::now() > expires_at { 262 262 + return None; // Status expired 263 263 + } 264 264 + } 265 265 + Some(s) 266 266 + }); 267 267 + 268 268 + let history = StatusFromDb::load_user_statuses(&db_pool, &did, 10) 269 269 + .await 270 270 + .unwrap_or_else(|err| { 271 271 + log::error!("Error loading status history: {err}"); 272 272 + vec![] 273 273 + }); 274 274 + 275 275 + let html = StatusTemplate { 276 276 + title: &format!("@{} status", handle), 277 277 + handle: handle.clone(), 278 278 + current_status, 279 279 + history, 280 280 + is_owner, 281 281 + } 282 282 + .render() 283 283 + .expect("template should be valid"); 284 284 + 285 285 + Ok(web::Html::new(html)) 286 286 + } 287 287 + 288 288 + /// JSON API for the owner's status (top-level endpoint) 289 289 + #[get("/json")] 290 290 + pub async fn owner_status_json( 291 291 + db_pool: web::Data<Arc<Pool>>, 292 292 + _handle_resolver: web::Data<HandleResolver>, 293 293 + ) -> Result<impl Responder> { 294 294 + // Default owner of the domain 295 295 + const OWNER_HANDLE: &str = "zzstoatzz.io"; 296 296 + 297 297 + // Resolve handle to DID using ATProto handle resolution 298 298 + let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 299 299 + dns_txt_resolver: HickoryDnsTxtResolver::default(), 300 300 + http_client: Arc::new(DefaultHttpClient::default()), 301 301 + }); 302 302 + 303 303 + let did = match atproto_handle_resolver 304 304 + .resolve(&OWNER_HANDLE.parse().expect("failed to parse handle")) 305 305 + .await 306 306 + { 307 307 + Ok(d) => Some(d.to_string()), 308 308 + Err(e) => { 309 309 + log::error!("Failed to resolve handle {}: {}", OWNER_HANDLE, e); 310 310 + None 311 311 + } 312 312 + }; 313 313 + 314 314 + let current_status = if let Some(did) = did { 315 315 + let did = Did::new(did).expect("failed to parse did"); 316 316 + StatusFromDb::my_status(&db_pool, &did) 317 317 + .await 318 318 + .unwrap_or(None) 319 319 + .and_then(|s| { 320 320 + // Check if status is expired 321 321 + if let Some(expires_at) = s.expires_at { 322 322 + if chrono::Utc::now() > expires_at { 323 323 + return None; // Status expired 324 324 + } 325 325 + } 326 326 + Some(s) 327 327 + }) 328 328 + } else { 329 329 + None 330 330 + }; 331 331 + 332 332 + let response = if let Some(status_data) = current_status { 333 333 + serde_json::json!({ 334 334 + "handle": OWNER_HANDLE, 335 335 + "status": "known", 336 336 + "emoji": status_data.status, 337 337 + "text": status_data.text, 338 338 + "since": status_data.started_at.to_rfc3339(), 339 339 + "expires": status_data.expires_at.map(|e| e.to_rfc3339()), 340 340 + }) 341 341 + } else { 342 342 + serde_json::json!({ 343 343 + "handle": OWNER_HANDLE, 344 344 + "status": "unknown", 345 345 + "message": "No current status is known" 346 346 + }) 347 347 + }; 348 348 + 349 349 + Ok(web::Json(response)) 350 350 + } 351 351 + 352 352 + /// JSON API for a specific user's status 353 353 + #[get("/@{handle}/json")] 354 354 + pub async fn user_status_json( 355 355 + handle: web::Path<String>, 356 356 + db_pool: web::Data<Arc<Pool>>, 357 357 + _handle_resolver: web::Data<HandleResolver>, 358 358 + ) -> Result<impl Responder> { 359 359 + let handle = handle.into_inner(); 360 360 + 361 361 + // Resolve handle to DID using ATProto handle resolution 362 362 + // First we need to create a handle resolver 363 363 + let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 364 364 + dns_txt_resolver: HickoryDnsTxtResolver::default(), 365 365 + http_client: Arc::new(DefaultHttpClient::default()), 366 366 + }); 367 367 + 368 368 + let handle_obj = atrium_api::types::string::Handle::new(handle.clone()).ok(); 369 369 + let did = match handle_obj { 370 370 + Some(h) => match atproto_handle_resolver.resolve(&h).await { 371 371 + Ok(did) => did, 372 372 + Err(_) => { 373 373 + return Ok(web::Json(serde_json::json!({ 374 374 + "status": "unknown", 375 375 + "message": format!("Could not resolve handle @{}", handle) 376 376 + }))); 377 377 + } 378 378 + }, 379 379 + None => { 380 380 + return Ok(web::Json(serde_json::json!({ 381 381 + "status": "unknown", 382 382 + "message": format!("Invalid handle format: @{}", handle) 383 383 + }))); 384 384 + } 385 385 + }; 386 386 + 387 387 + let current_status = StatusFromDb::my_status(&db_pool, &did) 388 388 + .await 389 389 + .unwrap_or(None) 390 390 + .and_then(|s| { 391 391 + // Check if status is expired 392 392 + if let Some(expires_at) = s.expires_at { 393 393 + if chrono::Utc::now() > expires_at { 394 394 + return None; // Status expired 395 395 + } 396 396 + } 397 397 + Some(s) 398 398 + }); 399 399 + 400 400 + let response = if let Some(status_data) = current_status { 401 401 + serde_json::json!({ 402 402 + "status": "known", 403 403 + "emoji": status_data.status, 404 404 + "text": status_data.text, 405 405 + "since": status_data.started_at.to_rfc3339(), 406 406 + "expires": status_data.expires_at.map(|e| e.to_rfc3339()), 407 407 + }) 408 408 + } else { 409 409 + serde_json::json!({ 410 410 + "status": "unknown", 411 411 + "message": format!("No current status is known for @{}", handle) 412 412 + }) 413 413 + }; 414 414 + 415 415 + Ok(web::Json(response)) 416 416 + } 417 417 + 418 418 + /// JSON API endpoint for status - returns current status or "unknown" 419 419 + #[get("/api/status")] 420 420 + pub async fn status_json(db_pool: web::Data<Arc<Pool>>) -> Result<impl Responder> { 421 421 + const OWNER_DID: &str = "did:plc:xbtmt2zjwlrfegqvch7fboei"; // zzstoatzz.io 422 422 + 423 423 + let owner_did = Did::new(OWNER_DID.to_string()).ok(); 424 424 + let current_status = if let Some(ref did) = owner_did { 425 425 + StatusFromDb::my_status(&db_pool, did) 426 426 + .await 427 427 + .unwrap_or(None) 428 428 + .and_then(|s| { 429 429 + // Check if status is expired 430 430 + if let Some(expires_at) = s.expires_at { 431 431 + if chrono::Utc::now() > expires_at { 432 432 + return None; // Status expired 433 433 + } 434 434 + } 435 435 + Some(s) 436 436 + }) 437 437 + } else { 438 438 + None 439 439 + }; 440 440 + 441 441 + let response = if let Some(status_data) = current_status { 442 442 + serde_json::json!({ 443 443 + "status": "known", 444 444 + "emoji": status_data.status, 445 445 + "text": status_data.text, 446 446 + "since": status_data.started_at.to_rfc3339(), 447 447 + "expires": status_data.expires_at.map(|e| e.to_rfc3339()), 448 448 + }) 449 449 + } else { 450 450 + serde_json::json!({ 451 451 + "status": "unknown", 452 452 + "message": "No current status is known" 453 453 + }) 454 454 + }; 455 455 + 456 456 + Ok(web::Json(response)) 457 457 + } 458 458 + 459 459 + /// Feed page - shows all users' statuses 460 460 + #[get("/feed")] 461 461 + pub async fn feed( 462 462 + request: HttpRequest, 463 463 + session: Session, 464 464 + oauth_client: web::Data<OAuthClientType>, 465 465 + db_pool: web::Data<Arc<Pool>>, 466 466 + handle_resolver: web::Data<HandleResolver>, 467 467 + config: web::Data<config::Config>, 468 468 + ) -> Result<impl Responder> { 469 469 + // This is essentially the old home function 470 470 + const TITLE: &str = "status feed"; 471 471 + 472 472 + // Check if dev mode is active 473 473 + let query = request.query_string(); 474 474 + let use_dev_mode = config.dev_mode && dev_utils::is_dev_mode_requested(query); 475 475 + 476 476 + let mut statuses = if use_dev_mode { 477 477 + // Mix dummy data with real data for testing 478 478 + let mut real_statuses = StatusFromDb::load_latest_statuses(&db_pool) 479 479 + .await 480 480 + .unwrap_or_else(|err| { 481 481 + log::error!("Error loading statuses: {err}"); 482 482 + vec![] 483 483 + }); 484 484 + let dummy_statuses = dev_utils::generate_dummy_statuses(15); 485 485 + real_statuses.extend(dummy_statuses); 486 486 + // Resort by started_at 487 487 + real_statuses.sort_by(|a, b| b.started_at.cmp(&a.started_at)); 488 488 + real_statuses 489 489 + } else { 490 490 + StatusFromDb::load_latest_statuses(&db_pool) 491 491 + .await 492 492 + .unwrap_or_else(|err| { 493 493 + log::error!("Error loading statuses: {err}"); 494 494 + vec![] 495 495 + }) 496 496 + }; 497 497 + 498 498 + let mut quick_resolve_map: HashMap<Did, String> = HashMap::new(); 499 499 + for db_status in &mut statuses { 500 500 + let authors_did = Did::new(db_status.author_did.clone()).expect("failed to parse did"); 501 501 + match quick_resolve_map.get(&authors_did) { 502 502 + None => {} 503 503 + Some(found_handle) => { 504 504 + db_status.handle = Some(found_handle.clone()); 505 505 + continue; 506 506 + } 507 507 + } 508 508 + db_status.handle = match handle_resolver.resolve(&authors_did).await { 509 509 + Ok(did_doc) => match did_doc.also_known_as { 510 510 + None => None, 511 511 + Some(also_known_as) => match also_known_as.is_empty() { 512 512 + true => None, 513 513 + false => { 514 514 + let full_handle = also_known_as.first().unwrap(); 515 515 + let handle = full_handle.replace("at://", ""); 516 516 + quick_resolve_map.insert(authors_did, handle.clone()); 517 517 + Some(handle) 518 518 + } 519 519 + }, 520 520 + }, 521 521 + Err(err) => { 522 522 + log::error!("Error resolving did: {err}"); 523 523 + None 524 524 + } 525 525 + }; 526 526 + } 527 527 + 528 528 + match session.get::<String>("did").unwrap_or(None) { 529 529 + Some(did_string) => { 530 530 + log::debug!("Feed: User has session with DID: {}", did_string); 531 531 + let did = Did::new(did_string.clone()).expect("failed to parse did"); 532 532 + let _my_status = StatusFromDb::my_status(&db_pool, &did) 533 533 + .await 534 534 + .unwrap_or_else(|err| { 535 535 + log::error!("Error loading my status: {err}"); 536 536 + None 537 537 + }); 538 538 + 539 539 + log::debug!( 540 540 + "Feed: Attempting to restore OAuth session for DID: {}", 541 541 + did_string 542 542 + ); 543 543 + match oauth_client.restore(&did).await { 544 544 + Ok(session) => { 545 545 + log::debug!("Feed: Successfully restored OAuth session"); 546 546 + let agent = Agent::new(session); 547 547 + let profile = agent 548 548 + .api 549 549 + .app 550 550 + .bsky 551 551 + .actor 552 552 + .get_profile( 553 553 + atrium_api::app::bsky::actor::get_profile::ParametersData { 554 554 + actor: atrium_api::types::string::AtIdentifier::Did(did.clone()), 555 555 + } 556 556 + .into(), 557 557 + ) 558 558 + .await; 559 559 + 560 560 + let is_admin = is_admin(did.as_str()); 561 561 + let html = FeedTemplate { 562 562 + title: TITLE, 563 563 + profile: match profile { 564 564 + Ok(profile) => { 565 565 + let profile_data = Profile { 566 566 + did: profile.did.to_string(), 567 567 + display_name: profile.display_name.clone(), 568 568 + }; 569 569 + Some(profile_data) 570 570 + } 571 571 + Err(err) => { 572 572 + log::error!("Error accessing profile: {err}"); 573 573 + None 574 574 + } 575 575 + }, 576 576 + statuses, 577 577 + is_admin, 578 578 + dev_mode: use_dev_mode, 579 579 + } 580 580 + .render() 581 581 + .expect("template should be valid"); 582 582 + 583 583 + Ok(web::Html::new(html)) 584 584 + } 585 585 + Err(err) => { 586 586 + // Don't purge the session - OAuth tokens might be expired but user is still logged in 587 587 + log::warn!("Could not restore OAuth session for feed: {:?}", err); 588 588 + 589 589 + // Show feed without profile info instead of error page 590 590 + let html = FeedTemplate { 591 591 + title: TITLE, 592 592 + profile: None, 593 593 + statuses, 594 594 + is_admin: is_admin(did.as_str()), 595 595 + dev_mode: use_dev_mode, 596 596 + } 597 597 + .render() 598 598 + .expect("template should be valid"); 599 599 + 600 600 + Ok(web::Html::new(html)) 601 601 + } 602 602 + } 603 603 + } 604 604 + None => { 605 605 + let html = FeedTemplate { 606 606 + title: TITLE, 607 607 + profile: None, 608 608 + statuses, 609 609 + is_admin: false, 610 610 + dev_mode: use_dev_mode, 611 611 + } 612 612 + .render() 613 613 + .expect("template should be valid"); 614 614 + 615 615 + Ok(web::Html::new(html)) 616 616 + } 617 617 + } 618 618 + } 619 619 + 620 620 + /// Get paginated statuses for infinite scrolling 621 621 + #[get("/api/feed")] 622 622 + pub async fn api_feed( 623 623 + query: web::Query<HashMap<String, String>>, 624 624 + db_pool: web::Data<Arc<Pool>>, 625 625 + handle_resolver: web::Data<HandleResolver>, 626 626 + config: web::Data<config::Config>, 627 627 + ) -> Result<impl Responder> { 628 628 + let offset = query 629 629 + .get("offset") 630 630 + .and_then(|s| s.parse::<i32>().ok()) 631 631 + .unwrap_or(0); 632 632 + let limit = query 633 633 + .get("limit") 634 634 + .and_then(|s| s.parse::<i32>().ok()) 635 635 + .unwrap_or(20) 636 636 + .min(50); // Cap at 50 items per request 637 637 + 638 638 + // Check if dev mode is requested 639 639 + let use_dev_mode = config.dev_mode && query.get("dev").is_some_and(|v| v == "true" || v == "1"); 640 640 + 641 641 + let mut statuses = if use_dev_mode && offset == 0 { 642 642 + // For first page in dev mode, mix dummy data with real data 643 643 + let mut real_statuses = StatusFromDb::load_statuses_paginated(&db_pool, 0, limit / 2) 644 644 + .await 645 645 + .unwrap_or_else(|err| { 646 646 + log::error!("Error loading paginated statuses: {err}"); 647 647 + vec![] 648 648 + }); 649 649 + let dummy_statuses = dev_utils::generate_dummy_statuses((limit / 2) as usize); 650 650 + real_statuses.extend(dummy_statuses); 651 651 + real_statuses.sort_by(|a, b| b.started_at.cmp(&a.started_at)); 652 652 + real_statuses 653 653 + } else { 654 654 + StatusFromDb::load_statuses_paginated(&db_pool, offset, limit) 655 655 + .await 656 656 + .unwrap_or_else(|err| { 657 657 + log::error!("Error loading statuses: {err}"); 658 658 + vec![] 659 659 + }) 660 660 + }; 661 661 + 662 662 + // Resolve handles for each status 663 663 + let mut quick_resolve_map: HashMap<Did, String> = HashMap::new(); 664 664 + for db_status in &mut statuses { 665 665 + let authors_did = Did::new(db_status.author_did.clone()).expect("failed to parse did"); 666 666 + match quick_resolve_map.get(&authors_did) { 667 667 + None => {} 668 668 + Some(found_handle) => { 669 669 + db_status.handle = Some(found_handle.clone()); 670 670 + continue; 671 671 + } 672 672 + } 673 673 + db_status.handle = match handle_resolver.resolve(&authors_did).await { 674 674 + Ok(did_doc) => match did_doc.also_known_as { 675 675 + None => None, 676 676 + Some(also_known_as) => match also_known_as.is_empty() { 677 677 + true => None, 678 678 + false => { 679 679 + let full_handle = also_known_as.first().unwrap(); 680 680 + let handle = full_handle.replace("at://", ""); 681 681 + quick_resolve_map.insert(authors_did, handle.clone()); 682 682 + Some(handle) 683 683 + } 684 684 + }, 685 685 + }, 686 686 + Err(_) => None, 687 687 + }; 688 688 + } 689 689 + 690 690 + Ok(HttpResponse::Ok().json(statuses)) 691 691 + } 692 692 + 693 693 + /// Get the most frequently used emojis from all statuses 694 694 + #[get("/api/frequent-emojis")] 695 695 + pub async fn get_frequent_emojis(db_pool: web::Data<Arc<Pool>>) -> Result<impl Responder> { 696 696 + // Get top 20 most frequently used emojis 697 697 + let emojis = db::get_frequent_emojis(&db_pool, 20) 698 698 + .await 699 699 + .unwrap_or_else(|err| { 700 700 + log::error!("Failed to get frequent emojis: {}", err); 701 701 + Vec::new() 702 702 + }); 703 703 + 704 704 + // If we have less than 12 emojis, add some defaults to fill it out 705 705 + let mut result = emojis; 706 706 + if result.is_empty() { 707 707 + log::info!("No emoji usage data found, using defaults"); 708 708 + let defaults = vec![ 709 709 + "😊", "👍", "❤️", "😂", "🎉", "🔥", "✨", "💯", "🚀", "💪", "🙏", "👏", 710 710 + ]; 711 711 + result = defaults.into_iter().map(String::from).collect(); 712 712 + } else if result.len() < 12 { 713 713 + log::info!("Found {} emojis, padding with defaults", result.len()); 714 714 + let defaults = vec![ 715 715 + "😊", "👍", "❤️", "😂", "🎉", "🔥", "✨", "💯", "🚀", "💪", "🙏", "👏", 716 716 + ]; 717 717 + for emoji in defaults { 718 718 + if !result.contains(&emoji.to_string()) && result.len() < 20 { 719 719 + result.push(emoji.to_string()); 720 720 + } 721 721 + } 722 722 + } else { 723 723 + log::info!("Found {} frequently used emojis", result.len()); 724 724 + } 725 725 + 726 726 + Ok(web::Json(result)) 727 727 + } 728 728 + 729 729 + /// Get all custom emojis available on the site 730 730 + #[get("/api/custom-emojis")] 731 731 + pub async fn get_custom_emojis() -> Result<impl Responder> { 732 732 + use std::fs; 733 733 + 734 734 + #[derive(Serialize)] 735 735 + struct SimpleEmoji { 736 736 + name: String, 737 737 + filename: String, 738 738 + } 739 739 + 740 740 + let emojis_dir = "static/emojis"; 741 741 + let mut emojis = Vec::new(); 742 742 + 743 743 + if let Ok(entries) = fs::read_dir(emojis_dir) { 744 744 + for entry in entries.flatten() { 745 745 + if let Some(filename) = entry.file_name().to_str() { 746 746 + // Only include image files 747 747 + if filename.ends_with(".png") 748 748 + || filename.ends_with(".gif") 749 749 + || filename.ends_with(".jpg") 750 750 + || filename.ends_with(".webp") 751 751 + { 752 752 + // Remove file extension to get name 753 753 + let name = filename 754 754 + .rsplit_once('.') 755 755 + .map(|(name, _)| name) 756 756 + .unwrap_or(filename) 757 757 + .to_string(); 758 758 + emojis.push(SimpleEmoji { 759 759 + name: name.clone(), 760 760 + filename: filename.to_string(), 761 761 + }); 762 762 + } 763 763 + } 764 764 + } 765 765 + } 766 766 + 767 767 + // Sort by name 768 768 + emojis.sort_by(|a, b| a.name.cmp(&b.name)); 769 769 + 770 770 + Ok(HttpResponse::Ok().json(emojis)) 771 771 + } 772 772 + 773 773 + /// Get the DIDs of accounts the logged-in user follows 774 774 + #[get("/api/following")] 775 775 + pub async fn get_following( 776 776 + session: Session, 777 777 + _oauth_client: web::Data<OAuthClientType>, 778 778 + ) -> Result<impl Responder> { 779 779 + // Check if user is logged in 780 780 + let did = match session.get::<Did>("did").ok().flatten() { 781 781 + Some(did) => did, 782 782 + None => { 783 783 + return Ok(HttpResponse::Unauthorized().json(serde_json::json!({ 784 784 + "error": "Not logged in" 785 785 + }))); 786 786 + } 787 787 + }; 788 788 + 789 789 + // WORKAROUND: Call public API directly for getFollows since OAuth scope isn't working 790 790 + // Both getProfile and getFollows are public endpoints that don't require auth 791 791 + // but when called through OAuth, getFollows requires a scope that doesn't exist yet 792 792 + 793 793 + let mut all_follows = Vec::new(); 794 794 + let mut cursor: Option<String> = None; 795 795 + 796 796 + // Use reqwest to call the public API directly 797 797 + let client = reqwest::Client::new(); 798 798 + 799 799 + loop { 800 800 + let mut url = format!( 801 801 + "https://public.api.bsky.app/xrpc/app.bsky.graph.getFollows?actor={}", 802 802 + did.as_str() 803 803 + ); 804 804 + 805 805 + if let Some(c) = &cursor { 806 806 + url.push_str(&format!("&cursor={}", c)); 807 807 + } 808 808 + 809 809 + match client.get(&url).send().await { 810 810 + Ok(response) => { 811 811 + match response.json::<serde_json::Value>().await { 812 812 + Ok(json) => { 813 813 + // Extract follows 814 814 + if let Some(follows) = json["follows"].as_array() { 815 815 + for follow in follows { 816 816 + if let Some(did_str) = follow["did"].as_str() { 817 817 + all_follows.push(did_str.to_string()); 818 818 + } 819 819 + } 820 820 + } 821 821 + 822 822 + // Check for cursor 823 823 + cursor = json["cursor"].as_str().map(|s| s.to_string()); 824 824 + if cursor.is_none() { 825 825 + break; 826 826 + } 827 827 + } 828 828 + Err(err) => { 829 829 + log::error!("Failed to parse follows response: {}", err); 830 830 + return Ok(HttpResponse::InternalServerError().json(serde_json::json!({ 831 831 + "error": "Failed to parse follows" 832 832 + }))); 833 833 + } 834 834 + } 835 835 + } 836 836 + Err(err) => { 837 837 + log::error!("Failed to fetch follows from public API: {}", err); 838 838 + return Ok(HttpResponse::InternalServerError().json(serde_json::json!({ 839 839 + "error": "Failed to fetch follows" 840 840 + }))); 841 841 + } 842 842 + } 843 843 + } 844 844 + 845 845 + Ok(HttpResponse::Ok().json(serde_json::json!({ 846 846 + "follows": all_follows 847 847 + }))) 848 848 + } 849 849 + 850 850 + /// Clear the user's status by deleting the ATProto record 851 851 + #[post("/status/clear")] 852 852 + pub async fn clear_status( 853 853 + request: HttpRequest, 854 854 + session: Session, 855 855 + oauth_client: web::Data<OAuthClientType>, 856 856 + db_pool: web::Data<Arc<Pool>>, 857 857 + ) -> HttpResponse { 858 858 + // Check if the user is logged in 859 859 + match session.get::<String>("did").unwrap_or(None) { 860 860 + Some(did_string) => { 861 861 + let did = Did::new(did_string.clone()).expect("failed to parse did"); 862 862 + 863 863 + // Get the user's current status to find the record key 864 864 + match StatusFromDb::my_status(&db_pool, &did).await { 865 865 + Ok(Some(current_status)) => { 866 866 + // Extract the record key from the URI 867 867 + // URI format: at://did:plc:xxx/io.zzstoatzz.status.record/rkey 868 868 + let parts: Vec<&str> = current_status.uri.split('/').collect(); 869 869 + if let Some(rkey) = parts.last() { 870 870 + // Get OAuth session 871 871 + match oauth_client.restore(&did).await { 872 872 + Ok(session) => { 873 873 + let agent = Agent::new(session); 874 874 + 875 875 + // Delete the record from ATProto using com.atproto.repo.deleteRecord 876 876 + let delete_request = 877 877 + atrium_api::com::atproto::repo::delete_record::InputData { 878 878 + collection: atrium_api::types::string::Nsid::new( 879 879 + "io.zzstoatzz.status.record".to_string(), 880 880 + ) 881 881 + .expect("valid nsid"), 882 882 + repo: did.clone().into(), 883 883 + rkey: atrium_api::types::string::RecordKey::new( 884 884 + rkey.to_string(), 885 885 + ) 886 886 + .expect("valid rkey"), 887 887 + swap_commit: None, 888 888 + swap_record: None, 889 889 + }; 890 890 + match agent 891 891 + .api 892 892 + .com 893 893 + .atproto 894 894 + .repo 895 895 + .delete_record(delete_request.into()) 896 896 + .await 897 897 + { 898 898 + Ok(_) => { 899 899 + // Also remove from local database 900 900 + let _ = StatusFromDb::delete_by_uri( 901 901 + &db_pool, 902 902 + current_status.uri, 903 903 + ) 904 904 + .await; 905 905 + 906 906 + Redirect::to("/") 907 907 + .see_other() 908 908 + .respond_to(&request) 909 909 + .map_into_boxed_body() 910 910 + } 911 911 + Err(e) => { 912 912 + log::error!("Failed to delete status from ATProto: {e}"); 913 913 + HttpResponse::InternalServerError() 914 914 + .body("Failed to clear status") 915 915 + } 916 916 + } 917 917 + } 918 918 + Err(e) => { 919 919 + log::error!("Failed to restore OAuth session: {e}"); 920 920 + HttpResponse::InternalServerError().body("Session error") 921 921 + } 922 922 + } 923 923 + } else { 924 924 + HttpResponse::BadRequest().body("Invalid status URI") 925 925 + } 926 926 + } 927 927 + Ok(None) => { 928 928 + // No status to clear 929 929 + Redirect::to("/") 930 930 + .see_other() 931 931 + .respond_to(&request) 932 932 + .map_into_boxed_body() 933 933 + } 934 934 + Err(e) => { 935 935 + log::error!("Database error: {e}"); 936 936 + HttpResponse::InternalServerError().body("Database error") 937 937 + } 938 938 + } 939 939 + } 940 940 + None => { 941 941 + // Not logged in 942 942 + Redirect::to("/login") 943 943 + .see_other() 944 944 + .respond_to(&request) 945 945 + .map_into_boxed_body() 946 946 + } 947 947 + } 948 948 + } 949 949 + 950 950 + /// Delete a specific status by URI (JSON endpoint) 951 951 + #[post("/status/delete")] 952 952 + pub async fn delete_status( 953 953 + session: Session, 954 954 + oauth_client: web::Data<OAuthClientType>, 955 955 + db_pool: web::Data<Arc<Pool>>, 956 956 + req: web::Json<DeleteRequest>, 957 957 + ) -> HttpResponse { 958 958 + // Check if the user is logged in 959 959 + match session.get::<String>("did").unwrap_or(None) { 960 960 + Some(did_string) => { 961 961 + let did = Did::new(did_string.clone()).expect("failed to parse did"); 962 962 + 963 963 + // Parse the URI to verify it belongs to this user 964 964 + // URI format: at://did:plc:xxx/io.zzstoatzz.status.record/rkey 965 965 + let uri_parts: Vec<&str> = req.uri.split('/').collect(); 966 966 + if uri_parts.len() < 5 { 967 967 + return HttpResponse::BadRequest().json(serde_json::json!({ 968 968 + "error": "Invalid status URI format" 969 969 + })); 970 970 + } 971 971 + 972 972 + // Extract DID from URI (at://did:plc:xxx/...) 973 973 + let uri_did_part = uri_parts[2]; 974 974 + if uri_did_part != did_string { 975 975 + return HttpResponse::Forbidden().json(serde_json::json!({ 976 976 + "error": "You can only delete your own statuses" 977 977 + })); 978 978 + } 979 979 + 980 980 + // Extract record key 981 981 + if let Some(rkey) = uri_parts.last() { 982 982 + // Get OAuth session 983 983 + match oauth_client.restore(&did).await { 984 984 + Ok(session) => { 985 985 + let agent = Agent::new(session); 986 986 + 987 987 + // Delete the record from ATProto 988 988 + let delete_request = 989 989 + atrium_api::com::atproto::repo::delete_record::InputData { 990 990 + collection: atrium_api::types::string::Nsid::new( 991 991 + "io.zzstoatzz.status.record".to_string(), 992 992 + ) 993 993 + .expect("valid nsid"), 994 994 + repo: did.clone().into(), 995 995 + rkey: atrium_api::types::string::RecordKey::new(rkey.to_string()) 996 996 + .expect("valid rkey"), 997 997 + swap_commit: None, 998 998 + swap_record: None, 999 999 + }; 1000 1000 + 1001 1001 + match agent 1002 1002 + .api 1003 1003 + .com 1004 1004 + .atproto 1005 1005 + .repo 1006 1006 + .delete_record(delete_request.into()) 1007 1007 + .await 1008 1008 + { 1009 1009 + Ok(_) => { 1010 1010 + // Also remove from local database 1011 1011 + let _ = 1012 1012 + StatusFromDb::delete_by_uri(&db_pool, req.uri.clone()).await; 1013 1013 + 1014 1014 + HttpResponse::Ok().json(serde_json::json!({ 1015 1015 + "success": true 1016 1016 + })) 1017 1017 + } 1018 1018 + Err(e) => { 1019 1019 + log::error!("Failed to delete status from ATProto: {e}"); 1020 1020 + HttpResponse::InternalServerError().json(serde_json::json!({ 1021 1021 + "error": "Failed to delete status" 1022 1022 + })) 1023 1023 + } 1024 1024 + } 1025 1025 + } 1026 1026 + Err(e) => { 1027 1027 + log::error!("Failed to restore OAuth session: {e}"); 1028 1028 + HttpResponse::InternalServerError().json(serde_json::json!({ 1029 1029 + "error": "Session error" 1030 1030 + })) 1031 1031 + } 1032 1032 + } 1033 1033 + } else { 1034 1034 + HttpResponse::BadRequest().json(serde_json::json!({ 1035 1035 + "error": "Invalid status URI" 1036 1036 + })) 1037 1037 + } 1038 1038 + } 1039 1039 + None => { 1040 1040 + // Not logged in 1041 1041 + HttpResponse::Unauthorized().json(serde_json::json!({ 1042 1042 + "error": "Not authenticated" 1043 1043 + })) 1044 1044 + } 1045 1045 + } 1046 1046 + } 1047 1047 + 1048 1048 + /// Hide/unhide a status (admin only) 1049 1049 + #[post("/admin/hide-status")] 1050 1050 + pub async fn hide_status( 1051 1051 + session: Session, 1052 1052 + db_pool: web::Data<Arc<Pool>>, 1053 1053 + req: web::Json<HideStatusRequest>, 1054 1054 + ) -> HttpResponse { 1055 1055 + // Check if the user is logged in and is admin 1056 1056 + match session.get::<String>("did").unwrap_or(None) { 1057 1057 + Some(did_string) => { 1058 1058 + if !is_admin(&did_string) { 1059 1059 + return HttpResponse::Forbidden().json(serde_json::json!({ 1060 1060 + "error": "Admin access required" 1061 1061 + })); 1062 1062 + } 1063 1063 + 1064 1064 + // Update the hidden status in the database 1065 1065 + let uri = req.uri.clone(); 1066 1066 + let hidden = req.hidden; 1067 1067 + 1068 1068 + let result = db_pool 1069 1069 + .conn(move |conn| { 1070 1070 + conn.execute( 1071 1071 + "UPDATE status SET hidden = ?1 WHERE uri = ?2", 1072 1072 + rusqlite::params![hidden, uri], 1073 1073 + ) 1074 1074 + }) 1075 1075 + .await; 1076 1076 + 1077 1077 + match result { 1078 1078 + Ok(rows_affected) if rows_affected > 0 => { 1079 1079 + HttpResponse::Ok().json(serde_json::json!({ 1080 1080 + "success": true, 1081 1081 + "message": if hidden { "Status hidden" } else { "Status unhidden" } 1082 1082 + })) 1083 1083 + } 1084 1084 + Ok(_) => HttpResponse::NotFound().json(serde_json::json!({ 1085 1085 + "error": "Status not found" 1086 1086 + })), 1087 1087 + Err(err) => { 1088 1088 + log::error!("Error updating hidden status: {}", err); 1089 1089 + HttpResponse::InternalServerError().json(serde_json::json!({ 1090 1090 + "error": "Database error" 1091 1091 + })) 1092 1092 + } 1093 1093 + } 1094 1094 + } 1095 1095 + None => HttpResponse::Unauthorized().json(serde_json::json!({ 1096 1096 + "error": "Not authenticated" 1097 1097 + })), 1098 1098 + } 1099 1099 + } 1100 1100 + 1101 1101 + /// Creates a new status 1102 1102 + #[post("/status")] 1103 1103 + pub async fn status( 1104 1104 + request: HttpRequest, 1105 1105 + session: Session, 1106 1106 + oauth_client: web::Data<OAuthClientType>, 1107 1107 + db_pool: web::Data<Arc<Pool>>, 1108 1108 + form: web::Form<StatusForm>, 1109 1109 + rate_limiter: web::Data<RateLimiter>, 1110 1110 + ) -> Result<HttpResponse, AppError> { 1111 1111 + // Apply rate limiting 1112 1112 + let client_key = RateLimiter::get_client_key(&request); 1113 1113 + if !rate_limiter.check_rate_limit(&client_key) { 1114 1114 + return Err(AppError::RateLimitExceeded); 1115 1115 + } 1116 1116 + // Check if the user is logged in 1117 1117 + match session.get::<String>("did").unwrap_or(None) { 1118 1118 + Some(did_string) => { 1119 1119 + let did = Did::new(did_string.clone()).expect("failed to parse did"); 1120 1120 + // gets the user's session from the session store to resume 1121 1121 + match oauth_client.restore(&did).await { 1122 1122 + Ok(session) => { 1123 1123 + let agent = Agent::new(session); 1124 1124 + 1125 1125 + // Calculate expiration time if provided 1126 1126 + let expires = form 1127 1127 + .expires_in 1128 1128 + .as_ref() 1129 1129 + .and_then(|exp| parse_duration(exp)) 1130 1130 + .and_then(|duration| { 1131 1131 + let expiry_time = chrono::Utc::now() + duration; 1132 1132 + // Convert to ATProto Datetime format (RFC3339) 1133 1133 + Some(Datetime::new(expiry_time.to_rfc3339().parse().ok()?)) 1134 1134 + }); 1135 1135 + 1136 1136 + //Creates a strongly typed ATProto record 1137 1137 + let status: KnownRecord = 1138 1138 + crate::lexicons::io::zzstoatzz::status::record::RecordData { 1139 1139 + created_at: Datetime::now(), 1140 1140 + emoji: form.status.clone(), 1141 1141 + text: form.text.clone(), 1142 1142 + expires, 1143 1143 + } 1144 1144 + .into(); 1145 1145 + 1146 1146 + // TODO no data validation yet from esquema 1147 1147 + // Maybe you'd like to add it? https://github.com/fatfingers23/esquema/issues/3 1148 1148 + 1149 1149 + let create_result = agent 1150 1150 + .api 1151 1151 + .com 1152 1152 + .atproto 1153 1153 + .repo 1154 1154 + .create_record( 1155 1155 + atrium_api::com::atproto::repo::create_record::InputData { 1156 1156 + collection: "io.zzstoatzz.status.record".parse().unwrap(), 1157 1157 + repo: did.into(), 1158 1158 + rkey: None, 1159 1159 + record: status.into(), 1160 1160 + swap_commit: None, 1161 1161 + validate: None, 1162 1162 + } 1163 1163 + .into(), 1164 1164 + ) 1165 1165 + .await; 1166 1166 + 1167 1167 + match create_result { 1168 1168 + Ok(record) => { 1169 1169 + let mut status = StatusFromDb::new( 1170 1170 + record.uri.clone(), 1171 1171 + did_string, 1172 1172 + form.status.clone(), 1173 1173 + ); 1174 1174 + 1175 1175 + // Set the text field if provided 1176 1176 + status.text = form.text.clone(); 1177 1177 + 1178 1178 + // Set the expiration time if provided 1179 1179 + if let Some(exp_str) = &form.expires_in { 1180 1180 + if let Some(duration) = parse_duration(exp_str) { 1181 1181 + status.expires_at = Some(chrono::Utc::now() + duration); 1182 1182 + } 1183 1183 + } 1184 1184 + 1185 1185 + let _ = status.save(db_pool).await; 1186 1186 + Ok(Redirect::to("/") 1187 1187 + .see_other() 1188 1188 + .respond_to(&request) 1189 1189 + .map_into_boxed_body()) 1190 1190 + } 1191 1191 + Err(err) => { 1192 1192 + log::error!("Error creating status: {err}"); 1193 1193 + let error_html = ErrorTemplate { 1194 1194 + title: "Error", 1195 1195 + error: "Was an error creating the status, please check the logs.", 1196 1196 + } 1197 1197 + .render() 1198 1198 + .expect("template should be valid"); 1199 1199 + Ok(HttpResponse::Ok().body(error_html)) 1200 1200 + } 1201 1201 + } 1202 1202 + } 1203 1203 + Err(err) => { 1204 1204 + // Destroys the system or you're in a loop 1205 1205 + session.purge(); 1206 1206 + log::error!( 1207 1207 + "Error restoring session, we are removing the session from the cookie: {err}" 1208 1208 + ); 1209 1209 + Err(AppError::AuthenticationError("Session error".to_string())) 1210 1210 + } 1211 1211 + } 1212 1212 + } 1213 1213 + None => Err(AppError::AuthenticationError( 1214 1214 + "You must be logged in to create a status.".to_string(), 1215 1215 + )), 1216 1216 + } 1217 1217 + }

+10 -181

src/db.rs src/db/models.rs

··· 1 1 use actix_web::web::Data; 2 2 use async_sqlite::{ 3 3 - Pool, rusqlite, 4 4 - rusqlite::{Error, Row}, 3 3 + Pool, 4 4 + rusqlite::{Error, Row, types::Type}, 5 5 }; 6 6 use atrium_api::types::string::Did; 7 7 use chrono::{DateTime, Utc}; 8 8 - use rusqlite::types::Type; 9 8 use serde::{Deserialize, Serialize}; 10 9 use std::{ 11 11 - fmt::Debug, 12 10 sync::Arc, 13 11 time::{SystemTime, UNIX_EPOCH}, 14 12 }; 15 13 16 16 - /// Creates the tables in the db. 17 17 - pub async fn create_tables_in_database(pool: &Pool) -> Result<(), async_sqlite::Error> { 18 18 - pool.conn(move |conn| { 19 19 - conn.execute("PRAGMA foreign_keys = ON", []).unwrap(); 20 20 - 21 21 - // status 22 22 - conn.execute( 23 23 - "CREATE TABLE IF NOT EXISTS status ( 24 24 - uri TEXT PRIMARY KEY, 25 25 - authorDid TEXT NOT NULL, 26 26 - emoji TEXT NOT NULL, 27 27 - text TEXT, 28 28 - startedAt INTEGER NOT NULL, 29 29 - expiresAt INTEGER, 30 30 - indexedAt INTEGER NOT NULL 31 31 - )", 32 32 - [], 33 33 - ) 34 34 - .unwrap(); 35 35 - 36 36 - // auth_session 37 37 - conn.execute( 38 38 - "CREATE TABLE IF NOT EXISTS auth_session ( 39 39 - key TEXT PRIMARY KEY, 40 40 - session TEXT NOT NULL 41 41 - )", 42 42 - [], 43 43 - ) 44 44 - .unwrap(); 45 45 - 46 46 - // auth_state 47 47 - conn.execute( 48 48 - "CREATE TABLE IF NOT EXISTS auth_state ( 49 49 - key TEXT PRIMARY KEY, 50 50 - state TEXT NOT NULL 51 51 - )", 52 52 - [], 53 53 - ) 54 54 - .unwrap(); 55 55 - 56 56 - // user_preferences 57 57 - conn.execute( 58 58 - "CREATE TABLE IF NOT EXISTS user_preferences ( 59 59 - did TEXT PRIMARY KEY, 60 60 - font_family TEXT DEFAULT 'system', 61 61 - accent_color TEXT DEFAULT '#1DA1F2', 62 62 - updated_at INTEGER NOT NULL 63 63 - )", 64 64 - [], 65 65 - ) 66 66 - .unwrap(); 67 67 - 68 68 - // Note: custom_emojis table removed - we serve emojis directly from static/emojis/ directory 69 69 - 70 70 - // Add indexes for performance optimization 71 71 - // Index on startedAt for feed queries (ORDER BY startedAt DESC) 72 72 - conn.execute( 73 73 - "CREATE INDEX IF NOT EXISTS idx_status_startedAt ON status(startedAt DESC)", 74 74 - [], 75 75 - ) 76 76 - .unwrap(); 77 77 - 78 78 - // Composite index for user status queries (WHERE authorDid = ? ORDER BY startedAt DESC) 79 79 - conn.execute( 80 80 - "CREATE INDEX IF NOT EXISTS idx_status_authorDid_startedAt ON status(authorDid, startedAt DESC)", 81 81 - [], 82 82 - ) 83 83 - .unwrap(); 84 84 - 85 85 - // Add hidden column for moderation (won't error if already exists) 86 86 - let _ = conn.execute( 87 87 - "ALTER TABLE status ADD COLUMN hidden BOOLEAN DEFAULT FALSE", 88 88 - [], 89 89 - ); 90 90 - 91 91 - Ok(()) 92 92 - }) 93 93 - .await?; 94 94 - Ok(()) 95 95 - } 96 96 - 97 97 - ///Status table datatype 98 14 #[derive(Debug, Clone, Deserialize, Serialize)] 99 15 pub struct StatusFromDb { 100 16 pub uri: String, ··· 107 23 pub handle: Option<String>, 108 24 } 109 25 110 110 - //Status methods 111 26 impl StatusFromDb { 112 27 /// Creates a new [StatusFromDb] 113 28 pub fn new(uri: String, author_did: String, status: String) -> Self { ··· 125 40 } 126 41 127 42 /// Helper to map from [Row] to [StatusDb] 128 128 - fn map_from_row(row: &Row) -> Result<Self, rusqlite::Error> { 43 43 + pub fn map_from_row(row: &Row) -> Result<Self, async_sqlite::rusqlite::Error> { 129 44 Ok(Self { 130 45 uri: row.get(0)?, 131 46 author_did: row.get(1)?, ··· 168 83 pool.conn(move |conn| { 169 84 conn.execute( 170 85 "INSERT INTO status (uri, authorDid, emoji, text, startedAt, expiresAt, indexedAt) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)", 171 171 - rusqlite::params![ 86 86 + async_sqlite::rusqlite::params![ 172 87 &cloned_self.uri, 173 88 &cloned_self.author_did, 174 89 &cloned_self.status, // emoji value ··· 194 109 true => { 195 110 let mut update_stmt = 196 111 conn.prepare("UPDATE status SET emoji = ?2, text = ?3, startedAt = ?4, expiresAt = ?5, indexedAt = ?6 WHERE uri = ?1")?; 197 197 - update_stmt.execute(rusqlite::params![ 112 112 + update_stmt.execute(async_sqlite::rusqlite::params![ 198 113 &cloned_self.uri, 199 114 &cloned_self.status, 200 115 &cloned_self.text, ··· 207 122 false => { 208 123 conn.execute( 209 124 "INSERT INTO status (uri, authorDid, emoji, text, startedAt, expiresAt, indexedAt) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)", 210 210 - rusqlite::params![ 125 125 + async_sqlite::rusqlite::params![ 211 126 &cloned_self.uri, 212 127 &cloned_self.author_did, 213 128 &cloned_self.status, // emoji value ··· 224 139 .await?; 225 140 Ok(()) 226 141 } 142 142 + 227 143 pub async fn delete_by_uri(pool: &Pool, uri: String) -> Result<(), async_sqlite::Error> { 228 144 pool.conn(move |conn| { 229 145 let mut stmt = conn.prepare("DELETE FROM status WHERE uri = ?1")?; ··· 266 182 "SELECT * FROM status WHERE (hidden IS NULL OR hidden = FALSE) ORDER BY startedAt DESC LIMIT ?1 OFFSET ?2" 267 183 )?; 268 184 let status_iter = stmt 269 269 - .query_map(rusqlite::params![limit, offset], |row| { 185 185 + .query_map(async_sqlite::rusqlite::params![limit, offset], |row| { 270 186 Ok(Self::map_from_row(row).unwrap()) 271 187 }) 272 188 .unwrap(); ··· 293 209 stmt.query_row([did.as_str()], Self::map_from_row) 294 210 .map(Some) 295 211 .or_else(|err| { 296 296 - if err == rusqlite::Error::QueryReturnedNoRows { 212 212 + if err == async_sqlite::rusqlite::Error::QueryReturnedNoRows { 297 213 Ok(None) 298 214 } else { 299 215 Err(err) ··· 518 434 } 519 435 } 520 436 521 521 - // CustomEmoji struct removed - we serve emojis directly from static/emojis/ directory 522 522 - 523 523 - /// Get the most frequently used emojis from all statuses 524 524 - pub async fn get_frequent_emojis( 525 525 - pool: &Pool, 526 526 - limit: usize, 527 527 - ) -> Result<Vec<String>, async_sqlite::Error> { 528 528 - pool.conn(move |conn| { 529 529 - let mut stmt = conn.prepare( 530 530 - "SELECT emoji, COUNT(*) as count 531 531 - FROM status 532 532 - GROUP BY emoji 533 533 - ORDER BY count DESC 534 534 - LIMIT ?1", 535 535 - )?; 536 536 - 537 537 - let emoji_iter = stmt.query_map([limit], |row| row.get::<_, String>(0))?; 538 538 - 539 539 - let mut emojis = Vec::new(); 540 540 - for emoji in emoji_iter { 541 541 - emojis.push(emoji?); 542 542 - } 543 543 - 544 544 - Ok(emojis) 545 545 - }) 546 546 - .await 547 547 - } 548 548 - 549 437 #[derive(Debug, Clone, Serialize, Deserialize)] 550 438 pub struct UserPreferences { 551 439 pub did: String, ··· 558 446 fn default() -> Self { 559 447 Self { 560 448 did: String::new(), 561 561 - font_family: "system".to_string(), 449 449 + font_family: "mono".to_string(), 562 450 accent_color: "#1DA1F2".to_string(), 563 451 updated_at: SystemTime::now() 564 452 .duration_since(UNIX_EPOCH) ··· 567 455 } 568 456 } 569 457 } 570 570 - 571 571 - /// Get user preferences for a given DID 572 572 - pub async fn get_user_preferences( 573 573 - pool: &Pool, 574 574 - did: &str, 575 575 - ) -> Result<UserPreferences, async_sqlite::Error> { 576 576 - let did = did.to_string(); 577 577 - pool.conn(move |conn| { 578 578 - let mut stmt = conn.prepare( 579 579 - "SELECT did, font_family, accent_color, updated_at 580 580 - FROM user_preferences 581 581 - WHERE did = ?1", 582 582 - )?; 583 583 - 584 584 - let result = stmt.query_row([&did], |row| { 585 585 - Ok(UserPreferences { 586 586 - did: row.get(0)?, 587 587 - font_family: row.get(1)?, 588 588 - accent_color: row.get(2)?, 589 589 - updated_at: row.get(3)?, 590 590 - }) 591 591 - }); 592 592 - 593 593 - match result { 594 594 - Ok(prefs) => Ok(prefs), 595 595 - Err(rusqlite::Error::QueryReturnedNoRows) => { 596 596 - // Return default preferences for new users 597 597 - Ok(UserPreferences { 598 598 - did: did.clone(), 599 599 - ..Default::default() 600 600 - }) 601 601 - } 602 602 - Err(e) => Err(e), 603 603 - } 604 604 - }) 605 605 - .await 606 606 - } 607 607 - 608 608 - /// Save user preferences 609 609 - pub async fn save_user_preferences( 610 610 - pool: &Pool, 611 611 - prefs: &UserPreferences, 612 612 - ) -> Result<(), async_sqlite::Error> { 613 613 - let prefs = prefs.clone(); 614 614 - pool.conn(move |conn| { 615 615 - conn.execute( 616 616 - "INSERT OR REPLACE INTO user_preferences (did, font_family, accent_color, updated_at) 617 617 - VALUES (?1, ?2, ?3, ?4)", 618 618 - ( 619 619 - &prefs.did, 620 620 - &prefs.font_family, 621 621 - &prefs.accent_color, 622 622 - &prefs.updated_at, 623 623 - ), 624 624 - )?; 625 625 - Ok(()) 626 626 - }) 627 627 - .await 628 628 - }

+88

src/db/mod.rs

··· 1 1 + pub mod models; 2 2 + pub mod queries; 3 3 + 4 4 + pub use models::{AuthSession, AuthState, StatusFromDb}; 5 5 + pub use queries::{get_frequent_emojis, get_user_preferences, save_user_preferences}; 6 6 + 7 7 + use async_sqlite::Pool; 8 8 + 9 9 + /// Creates the tables in the db. 10 10 + pub async fn create_tables_in_database(pool: &Pool) -> Result<(), async_sqlite::Error> { 11 11 + pool.conn(move |conn| { 12 12 + conn.execute("PRAGMA foreign_keys = ON", []).unwrap(); 13 13 + 14 14 + // status 15 15 + conn.execute( 16 16 + "CREATE TABLE IF NOT EXISTS status ( 17 17 + uri TEXT PRIMARY KEY, 18 18 + authorDid TEXT NOT NULL, 19 19 + emoji TEXT NOT NULL, 20 20 + text TEXT, 21 21 + startedAt INTEGER NOT NULL, 22 22 + expiresAt INTEGER, 23 23 + indexedAt INTEGER NOT NULL 24 24 + )", 25 25 + [], 26 26 + ) 27 27 + .unwrap(); 28 28 + 29 29 + // auth_session 30 30 + conn.execute( 31 31 + "CREATE TABLE IF NOT EXISTS auth_session ( 32 32 + key TEXT PRIMARY KEY, 33 33 + session TEXT NOT NULL 34 34 + )", 35 35 + [], 36 36 + ) 37 37 + .unwrap(); 38 38 + 39 39 + // auth_state 40 40 + conn.execute( 41 41 + "CREATE TABLE IF NOT EXISTS auth_state ( 42 42 + key TEXT PRIMARY KEY, 43 43 + state TEXT NOT NULL 44 44 + )", 45 45 + [], 46 46 + ) 47 47 + .unwrap(); 48 48 + 49 49 + // user_preferences 50 50 + conn.execute( 51 51 + "CREATE TABLE IF NOT EXISTS user_preferences ( 52 52 + did TEXT PRIMARY KEY, 53 53 + font_family TEXT DEFAULT 'mono', 54 54 + accent_color TEXT DEFAULT '#1DA1F2', 55 55 + updated_at INTEGER NOT NULL 56 56 + )", 57 57 + [], 58 58 + ) 59 59 + .unwrap(); 60 60 + 61 61 + // Note: custom_emojis table removed - we serve emojis directly from static/emojis/ directory 62 62 + 63 63 + // Add indexes for performance optimization 64 64 + // Index on startedAt for feed queries (ORDER BY startedAt DESC) 65 65 + conn.execute( 66 66 + "CREATE INDEX IF NOT EXISTS idx_status_startedAt ON status(startedAt DESC)", 67 67 + [], 68 68 + ) 69 69 + .unwrap(); 70 70 + 71 71 + // Composite index for user status queries (WHERE authorDid = ? ORDER BY startedAt DESC) 72 72 + conn.execute( 73 73 + "CREATE INDEX IF NOT EXISTS idx_status_authorDid_startedAt ON status(authorDid, startedAt DESC)", 74 74 + [], 75 75 + ) 76 76 + .unwrap(); 77 77 + 78 78 + // Add hidden column for moderation (won't error if already exists) 79 79 + let _ = conn.execute( 80 80 + "ALTER TABLE status ADD COLUMN hidden BOOLEAN DEFAULT FALSE", 81 81 + [], 82 82 + ); 83 83 + 84 84 + Ok(()) 85 85 + }) 86 86 + .await?; 87 87 + Ok(()) 88 88 + }

+88

src/db/queries.rs

··· 1 1 + use async_sqlite::Pool; 2 2 + 3 3 + use super::models::UserPreferences; 4 4 + 5 5 + /// Get the most frequently used emojis from all statuses 6 6 + pub async fn get_frequent_emojis( 7 7 + pool: &Pool, 8 8 + limit: usize, 9 9 + ) -> Result<Vec<String>, async_sqlite::Error> { 10 10 + pool.conn(move |conn| { 11 11 + let mut stmt = conn.prepare( 12 12 + "SELECT emoji, COUNT(*) as count 13 13 + FROM status 14 14 + GROUP BY emoji 15 15 + ORDER BY count DESC 16 16 + LIMIT ?1", 17 17 + )?; 18 18 + 19 19 + let emoji_iter = stmt.query_map([limit], |row| row.get::<_, String>(0))?; 20 20 + 21 21 + let mut emojis = Vec::new(); 22 22 + for emoji in emoji_iter { 23 23 + emojis.push(emoji?); 24 24 + } 25 25 + 26 26 + Ok(emojis) 27 27 + }) 28 28 + .await 29 29 + } 30 30 + 31 31 + /// Get user preferences for a given DID 32 32 + pub async fn get_user_preferences( 33 33 + pool: &Pool, 34 34 + did: &str, 35 35 + ) -> Result<UserPreferences, async_sqlite::Error> { 36 36 + let did = did.to_string(); 37 37 + pool.conn(move |conn| { 38 38 + let mut stmt = conn.prepare( 39 39 + "SELECT did, font_family, accent_color, updated_at 40 40 + FROM user_preferences 41 41 + WHERE did = ?1", 42 42 + )?; 43 43 + 44 44 + let result = stmt.query_row([&did], |row| { 45 45 + Ok(UserPreferences { 46 46 + did: row.get(0)?, 47 47 + font_family: row.get(1)?, 48 48 + accent_color: row.get(2)?, 49 49 + updated_at: row.get(3)?, 50 50 + }) 51 51 + }); 52 52 + 53 53 + match result { 54 54 + Ok(prefs) => Ok(prefs), 55 55 + Err(async_sqlite::rusqlite::Error::QueryReturnedNoRows) => { 56 56 + // Return default preferences for new users 57 57 + Ok(UserPreferences { 58 58 + did: did.clone(), 59 59 + ..Default::default() 60 60 + }) 61 61 + } 62 62 + Err(e) => Err(e), 63 63 + } 64 64 + }) 65 65 + .await 66 66 + } 67 67 + 68 68 + /// Save user preferences 69 69 + pub async fn save_user_preferences( 70 70 + pool: &Pool, 71 71 + prefs: &UserPreferences, 72 72 + ) -> Result<(), async_sqlite::Error> { 73 73 + let prefs = prefs.clone(); 74 74 + pool.conn(move |conn| { 75 75 + conn.execute( 76 76 + "INSERT OR REPLACE INTO user_preferences (did, font_family, accent_color, updated_at) 77 77 + VALUES (?1, ?2, ?3, ?4)", 78 78 + ( 79 79 + &prefs.did, 80 80 + &prefs.font_family, 81 81 + &prefs.accent_color, 82 82 + &prefs.updated_at, 83 83 + ), 84 84 + )?; 85 85 + Ok(()) 86 86 + }) 87 87 + .await 88 88 + }

+14 -1507

src/main.rs

··· 1 1 #![allow(clippy::collapsible_if)] 2 2 3 3 + use crate::resolver::HickoryDnsTxtResolver; 3 4 use crate::{ 4 4 - db::{StatusFromDb, create_tables_in_database}, 5 5 - error_handler::AppError, 5 5 + api::{HandleResolver, OAuthClientType}, 6 6 + db::create_tables_in_database, 6 7 ingester::start_ingester, 7 7 - lexicons::record::KnownRecord, 8 8 rate_limiter::RateLimiter, 9 9 storage::{SqliteSessionStore, SqliteStateStore}, 10 10 - templates::{FeedTemplate, LoginTemplate, StatusTemplate}, 11 10 }; 12 11 use actix_files::Files; 13 13 - use actix_session::{ 14 14 - Session, SessionMiddleware, config::PersistentSession, storage::CookieSessionStore, 15 15 - }; 12 12 + use actix_session::{SessionMiddleware, config::PersistentSession, storage::CookieSessionStore}; 16 13 use actix_web::{ 17 17 - App, HttpRequest, HttpResponse, HttpServer, Responder, Result, 14 14 + App, HttpServer, 18 15 cookie::{self, Key}, 19 19 - get, middleware, post, 20 20 - web::{self, Redirect}, 21 21 - }; 22 22 - use askama::Template; 23 23 - use async_sqlite::rusqlite; 24 24 - use async_sqlite::{Pool, PoolBuilder}; 25 25 - use atrium_api::{ 26 26 - agent::Agent, 27 27 - types::string::{Datetime, Did}, 16 16 + middleware, web, 28 17 }; 29 29 - use atrium_common::resolver::Resolver; 18 18 + use async_sqlite::PoolBuilder; 30 19 use atrium_identity::{ 31 20 did::{CommonDidResolver, CommonDidResolverConfig, DEFAULT_PLC_DIRECTORY_URL}, 32 21 handle::{AtprotoHandleResolver, AtprotoHandleResolverConfig}, 33 22 }; 34 23 use atrium_oauth::{ 35 35 - AtprotoClientMetadata, AtprotoLocalhostClientMetadata, AuthMethod, AuthorizeOptions, 36 36 - CallbackParams, DefaultHttpClient, GrantType, KnownScope, OAuthClient, OAuthClientConfig, 37 37 - OAuthResolverConfig, Scope, 24 24 + AtprotoClientMetadata, AtprotoLocalhostClientMetadata, AuthMethod, DefaultHttpClient, 25 25 + GrantType, KnownScope, OAuthClient, OAuthClientConfig, OAuthResolverConfig, Scope, 38 26 }; 39 27 use dotenv::dotenv; 40 40 - use resolver::HickoryDnsTxtResolver; 41 41 - use serde::{Deserialize, Serialize}; 42 42 - use std::{collections::HashMap, io::Error, sync::Arc, time::Duration}; 43 43 - use templates::{ErrorTemplate, Profile}; 28 28 + use std::{io::Error, sync::Arc, time::Duration}; 44 29 30 30 + mod api; 45 31 mod config; 46 32 mod db; 47 33 mod dev_utils; ··· 54 40 mod storage; 55 41 mod templates; 56 42 57 57 - /// OAuthClientType to make it easier to access the OAuthClient in web requests 58 58 - /// Custom OAuth callback parameters that can handle both success and error cases 59 59 - #[derive(Debug, Deserialize)] 60 60 - struct OAuthCallbackParams { 61 61 - state: Option<String>, 62 62 - iss: Option<String>, 63 63 - code: Option<String>, 64 64 - error: Option<String>, 65 65 - error_description: Option<String>, 66 66 - } 67 67 - 68 68 - type OAuthClientType = Arc< 69 69 - OAuthClient< 70 70 - SqliteStateStore, 71 71 - SqliteSessionStore, 72 72 - CommonDidResolver<DefaultHttpClient>, 73 73 - AtprotoHandleResolver<HickoryDnsTxtResolver, DefaultHttpClient>, 74 74 - >, 75 75 - >; 76 76 - 77 77 - /// HandleResolver to make it easier to access the OAuthClient in web requests 78 78 - type HandleResolver = Arc<CommonDidResolver<DefaultHttpClient>>; 79 79 - 80 80 - /// Admin DID for moderation 81 81 - const ADMIN_DID: &str = "did:plc:xbtmt2zjwlrfegqvch7fboei"; // zzstoatzz.io 82 82 - 83 83 - /// Check if a DID is the admin 84 84 - fn is_admin(did: &str) -> bool { 85 85 - did == ADMIN_DID 86 86 - } 87 87 - 88 88 - /// OAuth client metadata endpoint for production 89 89 - #[get("/oauth-client-metadata.json")] 90 90 - async fn client_metadata(config: web::Data<config::Config>) -> Result<HttpResponse> { 91 91 - let public_url = config.oauth_redirect_base.clone(); 92 92 - 93 93 - let metadata = serde_json::json!({ 94 94 - "client_id": format!("{}/oauth-client-metadata.json", public_url), 95 95 - "client_name": "Status Sphere", 96 96 - "client_uri": public_url.clone(), 97 97 - "redirect_uris": [format!("{}/oauth/callback", public_url)], 98 98 - "scope": "atproto repo:io.zzstoatzz.status.record rpc:app.bsky.actor.getProfile?aud=did:web:api.bsky.app#bsky_appview rpc:app.bsky.graph.getFollows?aud=did:web:api.bsky.app", 99 99 - "grant_types": ["authorization_code", "refresh_token"], 100 100 - "response_types": ["code"], 101 101 - "token_endpoint_auth_method": "none", 102 102 - "dpop_bound_access_tokens": true 103 103 - }); 104 104 - 105 105 - Ok(HttpResponse::Ok() 106 106 - .content_type("application/json") 107 107 - .body(metadata.to_string())) 108 108 - } 109 109 - 110 110 - // Removed STATUS_OPTIONS: emojis are now loaded client-side from CDN 111 111 - 112 112 - /// TS version https://github.com/bluesky-social/statusphere-example-app/blob/e4721616df50cd317c198f4c00a4818d5626d4ce/src/routes.ts#L71 113 113 - /// OAuth callback endpoint to complete session creation 114 114 - #[get("/oauth/callback")] 115 115 - async fn oauth_callback( 116 116 - request: HttpRequest, 117 117 - params: web::Query<OAuthCallbackParams>, 118 118 - oauth_client: web::Data<OAuthClientType>, 119 119 - session: Session, 120 120 - ) -> HttpResponse { 121 121 - // Check if there's an OAuth error from BlueSky 122 122 - if let Some(error) = &params.error { 123 123 - let error_msg = params 124 124 - .error_description 125 125 - .as_deref() 126 126 - .unwrap_or("An error occurred during authentication"); 127 127 - log::error!("OAuth error from BlueSky: {} - {}", error, error_msg); 128 128 - 129 129 - let html = ErrorTemplate { 130 130 - title: "Authentication Error", 131 131 - error: error_msg, 132 132 - }; 133 133 - return HttpResponse::BadRequest().body(html.render().expect("template should be valid")); 134 134 - } 135 135 - 136 136 - // Check if we have the required code field for a successful callback 137 137 - let code = match &params.code { 138 138 - Some(code) => code.clone(), 139 139 - None => { 140 140 - log::error!("OAuth callback missing required code parameter"); 141 141 - let html = ErrorTemplate { 142 142 - title: "Error", 143 143 - error: "Missing required OAuth code. Please try logging in again.", 144 144 - }; 145 145 - return HttpResponse::BadRequest() 146 146 - .body(html.render().expect("template should be valid")); 147 147 - } 148 148 - }; 149 149 - 150 150 - // Create CallbackParams for the OAuth client 151 151 - let callback_params = CallbackParams { 152 152 - code, 153 153 - state: params.state.clone(), 154 154 - iss: params.iss.clone(), 155 155 - }; 156 156 - 157 157 - //Processes the call back and parses out a session if found and valid 158 158 - match oauth_client.callback(callback_params).await { 159 159 - Ok((bsky_session, _)) => { 160 160 - let agent = Agent::new(bsky_session); 161 161 - match agent.did().await { 162 162 - Some(did) => { 163 163 - session.insert("did", did).unwrap(); 164 164 - Redirect::to("/") 165 165 - .see_other() 166 166 - .respond_to(&request) 167 167 - .map_into_boxed_body() 168 168 - } 169 169 - None => { 170 170 - let html = ErrorTemplate { 171 171 - title: "Error", 172 172 - error: "The OAuth agent did not return a DID. May try re-logging in.", 173 173 - }; 174 174 - HttpResponse::Ok().body(html.render().expect("template should be valid")) 175 175 - } 176 176 - } 177 177 - } 178 178 - Err(err) => { 179 179 - log::error!("Error: {err}"); 180 180 - let html = ErrorTemplate { 181 181 - title: "Error", 182 182 - error: "OAuth error, check the logs", 183 183 - }; 184 184 - HttpResponse::Ok().body(html.render().expect("template should be valid")) 185 185 - } 186 186 - } 187 187 - } 188 188 - 189 189 - /// TS version https://github.com/bluesky-social/statusphere-example-app/blob/e4721616df50cd317c198f4c00a4818d5626d4ce/src/routes.ts#L93 190 190 - /// Takes you to the login page 191 191 - #[get("/login")] 192 192 - async fn login() -> Result<impl Responder> { 193 193 - let html = LoginTemplate { 194 194 - title: "Log in", 195 195 - error: None, 196 196 - }; 197 197 - Ok(web::Html::new( 198 198 - html.render().expect("template should be valid"), 199 199 - )) 200 200 - } 201 201 - 202 202 - /// TS version https://github.com/bluesky-social/statusphere-example-app/blob/e4721616df50cd317c198f4c00a4818d5626d4ce/src/routes.ts#L93 203 203 - /// Logs you out by destroying your cookie on the server and web browser 204 204 - #[get("/logout")] 205 205 - async fn logout(request: HttpRequest, session: Session) -> HttpResponse { 206 206 - session.purge(); 207 207 - Redirect::to("/") 208 208 - .see_other() 209 209 - .respond_to(&request) 210 210 - .map_into_boxed_body() 211 211 - } 212 212 - 213 213 - /// The post body for logging in 214 214 - #[derive(Serialize, Deserialize, Clone)] 215 215 - struct LoginForm { 216 216 - handle: String, 217 217 - } 218 218 - 219 219 - /// TS version https://github.com/bluesky-social/statusphere-example-app/blob/e4721616df50cd317c198f4c00a4818d5626d4ce/src/routes.ts#L101 220 220 - /// Login endpoint 221 221 - #[post("/login")] 222 222 - async fn login_post( 223 223 - request: HttpRequest, 224 224 - params: web::Form<LoginForm>, 225 225 - oauth_client: web::Data<OAuthClientType>, 226 226 - ) -> HttpResponse { 227 227 - // This will act the same as the js method isValidHandle to make sure it is valid 228 228 - match atrium_api::types::string::Handle::new(params.handle.clone()) { 229 229 - Ok(handle) => { 230 230 - //Creates the oauth url to redirect to for the user to log in with their credentials 231 231 - let oauth_url = oauth_client 232 232 - .authorize( 233 233 - &handle, 234 234 - AuthorizeOptions { 235 235 - scopes: vec![ 236 236 - Scope::Known(KnownScope::Atproto), 237 237 - // Using granular scope for status records only 238 238 - // This replaces TransitionGeneric with specific permissions 239 239 - Scope::Unknown("repo:io.zzstoatzz.status.record".to_string()), 240 240 - // Need to read profiles for the feed page 241 241 - Scope::Unknown("rpc:app.bsky.actor.getProfile?aud=did:web:api.bsky.app#bsky_appview".to_string()), 242 242 - // Need to read following list for following feed 243 243 - Scope::Unknown("rpc:app.bsky.graph.getFollows?aud=did:web:api.bsky.app".to_string()), 244 244 - ], 245 245 - ..Default::default() 246 246 - }, 247 247 - ) 248 248 - .await; 249 249 - match oauth_url { 250 250 - Ok(url) => Redirect::to(url) 251 251 - .see_other() 252 252 - .respond_to(&request) 253 253 - .map_into_boxed_body(), 254 254 - Err(err) => { 255 255 - log::error!("Error: {err}"); 256 256 - let html = LoginTemplate { 257 257 - title: "Log in", 258 258 - error: Some("OAuth error"), 259 259 - }; 260 260 - HttpResponse::Ok().body(html.render().expect("template should be valid")) 261 261 - } 262 262 - } 263 263 - } 264 264 - Err(err) => { 265 265 - let html: LoginTemplate<'_> = LoginTemplate { 266 266 - title: "Log in", 267 267 - error: Some(err), 268 268 - }; 269 269 - HttpResponse::Ok().body(html.render().expect("template should be valid")) 270 270 - } 271 271 - } 272 272 - } 273 273 - 274 274 - /// Homepage - shows logged-in user's status, or owner's status if not logged in 275 275 - #[get("/")] 276 276 - async fn home( 277 277 - session: Session, 278 278 - _oauth_client: web::Data<OAuthClientType>, 279 279 - db_pool: web::Data<Arc<Pool>>, 280 280 - handle_resolver: web::Data<HandleResolver>, 281 281 - ) -> Result<impl Responder> { 282 282 - // Default owner of the domain 283 283 - const OWNER_HANDLE: &str = "zzstoatzz.io"; 284 284 - 285 285 - // Check if user is logged in 286 286 - match session.get::<String>("did").unwrap_or(None) { 287 287 - Some(did_string) => { 288 288 - // User is logged in - show their status page 289 289 - log::debug!("Home: User is logged in with DID: {}", did_string); 290 290 - let did = Did::new(did_string.clone()).expect("failed to parse did"); 291 291 - 292 292 - // Get their handle 293 293 - let handle = match handle_resolver.resolve(&did).await { 294 294 - Ok(did_doc) => did_doc 295 295 - .also_known_as 296 296 - .and_then(|aka| aka.first().map(|h| h.replace("at://", ""))) 297 297 - .unwrap_or_else(|| did_string.clone()), 298 298 - Err(_) => did_string.clone(), 299 299 - }; 300 300 - 301 301 - // Get user's status 302 302 - let current_status = StatusFromDb::my_status(&db_pool, &did) 303 303 - .await 304 304 - .unwrap_or(None) 305 305 - .and_then(|s| { 306 306 - // Check if status is expired 307 307 - if let Some(expires_at) = s.expires_at { 308 308 - if chrono::Utc::now() > expires_at { 309 309 - return None; // Status expired 310 310 - } 311 311 - } 312 312 - Some(s) 313 313 - }); 314 314 - 315 315 - let history = StatusFromDb::load_user_statuses(&db_pool, &did, 10) 316 316 - .await 317 317 - .unwrap_or_else(|err| { 318 318 - log::error!("Error loading status history: {err}"); 319 319 - vec![] 320 320 - }); 321 321 - 322 322 - let html = StatusTemplate { 323 323 - title: "your status", 324 324 - handle, 325 325 - current_status, 326 326 - history, 327 327 - is_owner: true, // They're viewing their own status 328 328 - } 329 329 - .render() 330 330 - .expect("template should be valid"); 331 331 - 332 332 - Ok(web::Html::new(html)) 333 333 - } 334 334 - None => { 335 335 - // Not logged in - show owner's status 336 336 - // Resolve owner handle to DID 337 337 - let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 338 338 - dns_txt_resolver: HickoryDnsTxtResolver::default(), 339 339 - http_client: Arc::new(DefaultHttpClient::default()), 340 340 - }); 341 341 - 342 342 - let owner_handle = 343 343 - atrium_api::types::string::Handle::new(OWNER_HANDLE.to_string()).ok(); 344 344 - let owner_did = if let Some(handle) = owner_handle { 345 345 - atproto_handle_resolver.resolve(&handle).await.ok() 346 346 - } else { 347 347 - None 348 348 - }; 349 349 - 350 350 - let current_status = if let Some(ref did) = owner_did { 351 351 - StatusFromDb::my_status(&db_pool, did) 352 352 - .await 353 353 - .unwrap_or(None) 354 354 - .and_then(|s| { 355 355 - // Check if status is expired 356 356 - if let Some(expires_at) = s.expires_at { 357 357 - if chrono::Utc::now() > expires_at { 358 358 - return None; // Status expired 359 359 - } 360 360 - } 361 361 - Some(s) 362 362 - }) 363 363 - } else { 364 364 - None 365 365 - }; 366 366 - 367 367 - let history = if let Some(ref did) = owner_did { 368 368 - StatusFromDb::load_user_statuses(&db_pool, did, 10) 369 369 - .await 370 370 - .unwrap_or_else(|err| { 371 371 - log::error!("Error loading status history: {err}"); 372 372 - vec![] 373 373 - }) 374 374 - } else { 375 375 - vec![] 376 376 - }; 377 377 - 378 378 - let html = StatusTemplate { 379 379 - title: "nate's status", 380 380 - handle: OWNER_HANDLE.to_string(), 381 381 - current_status, 382 382 - history, 383 383 - is_owner: false, // Visitor viewing owner's status 384 384 - } 385 385 - .render() 386 386 - .expect("template should be valid"); 387 387 - 388 388 - Ok(web::Html::new(html)) 389 389 - } 390 390 - } 391 391 - } 392 392 - 393 393 - /// View a specific user's status page by handle 394 394 - #[get("/@{handle}")] 395 395 - async fn user_status_page( 396 396 - handle: web::Path<String>, 397 397 - session: Session, 398 398 - db_pool: web::Data<Arc<Pool>>, 399 399 - _handle_resolver: web::Data<HandleResolver>, 400 400 - ) -> Result<impl Responder> { 401 401 - let handle = handle.into_inner(); 402 402 - 403 403 - // Resolve handle to DID using ATProto handle resolution 404 404 - // First we need to create a handle resolver 405 405 - let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 406 406 - dns_txt_resolver: HickoryDnsTxtResolver::default(), 407 407 - http_client: Arc::new(DefaultHttpClient::default()), 408 408 - }); 409 409 - 410 410 - let handle_obj = atrium_api::types::string::Handle::new(handle.clone()).ok(); 411 411 - let did = match handle_obj { 412 412 - Some(h) => match atproto_handle_resolver.resolve(&h).await { 413 413 - Ok(did) => did, 414 414 - Err(_) => { 415 415 - // Could not resolve handle 416 416 - let html = ErrorTemplate { 417 417 - title: "User not found", 418 418 - error: &format!("Could not find user @{}. This handle may not exist or may not be using the ATProto network.", handle), 419 419 - } 420 420 - .render() 421 421 - .expect("template should be valid"); 422 422 - return Ok(web::Html::new(html)); 423 423 - } 424 424 - }, 425 425 - None => { 426 426 - // Invalid handle format 427 427 - let html = ErrorTemplate { 428 428 - title: "Invalid handle", 429 429 - error: &format!( 430 430 - "'{}' is not a valid handle format. Handles should be like 'alice.bsky.social'", 431 431 - handle 432 432 - ), 433 433 - } 434 434 - .render() 435 435 - .expect("template should be valid"); 436 436 - return Ok(web::Html::new(html)); 437 437 - } 438 438 - }; 439 439 - 440 440 - // Check if logged in user is viewing their own page 441 441 - let is_owner = match session.get::<String>("did").unwrap_or(None) { 442 442 - Some(session_did) => session_did == did.to_string(), 443 443 - None => false, 444 444 - }; 445 445 - 446 446 - // Get user's status 447 447 - let current_status = StatusFromDb::my_status(&db_pool, &did) 448 448 - .await 449 449 - .unwrap_or(None) 450 450 - .and_then(|s| { 451 451 - // Check if status is expired 452 452 - if let Some(expires_at) = s.expires_at { 453 453 - if chrono::Utc::now() > expires_at { 454 454 - return None; // Status expired 455 455 - } 456 456 - } 457 457 - Some(s) 458 458 - }); 459 459 - 460 460 - let history = StatusFromDb::load_user_statuses(&db_pool, &did, 10) 461 461 - .await 462 462 - .unwrap_or_else(|err| { 463 463 - log::error!("Error loading status history: {err}"); 464 464 - vec![] 465 465 - }); 466 466 - 467 467 - let html = StatusTemplate { 468 468 - title: &format!("@{} status", handle), 469 469 - handle: handle.clone(), 470 470 - current_status, 471 471 - history, 472 472 - is_owner, 473 473 - } 474 474 - .render() 475 475 - .expect("template should be valid"); 476 476 - 477 477 - Ok(web::Html::new(html)) 478 478 - } 479 479 - 480 480 - /// JSON API for the owner's status (top-level endpoint) 481 481 - #[get("/json")] 482 482 - async fn owner_status_json( 483 483 - db_pool: web::Data<Arc<Pool>>, 484 484 - _handle_resolver: web::Data<HandleResolver>, 485 485 - ) -> Result<impl Responder> { 486 486 - // Default owner of the domain 487 487 - const OWNER_HANDLE: &str = "zzstoatzz.io"; 488 488 - 489 489 - // Resolve handle to DID using ATProto handle resolution 490 490 - let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 491 491 - dns_txt_resolver: HickoryDnsTxtResolver::default(), 492 492 - http_client: Arc::new(DefaultHttpClient::default()), 493 493 - }); 494 494 - 495 495 - let did = match atproto_handle_resolver 496 496 - .resolve(&OWNER_HANDLE.parse().expect("failed to parse handle")) 497 497 - .await 498 498 - { 499 499 - Ok(d) => Some(d.to_string()), 500 500 - Err(e) => { 501 501 - log::error!("Failed to resolve handle {}: {}", OWNER_HANDLE, e); 502 502 - None 503 503 - } 504 504 - }; 505 505 - 506 506 - let current_status = if let Some(did) = did { 507 507 - let did = Did::new(did).expect("failed to parse did"); 508 508 - StatusFromDb::my_status(&db_pool, &did) 509 509 - .await 510 510 - .unwrap_or(None) 511 511 - .and_then(|s| { 512 512 - // Check if status is expired 513 513 - if let Some(expires_at) = s.expires_at { 514 514 - if chrono::Utc::now() > expires_at { 515 515 - return None; // Status expired 516 516 - } 517 517 - } 518 518 - Some(s) 519 519 - }) 520 520 - } else { 521 521 - None 522 522 - }; 523 523 - 524 524 - let response = if let Some(status_data) = current_status { 525 525 - serde_json::json!({ 526 526 - "handle": OWNER_HANDLE, 527 527 - "status": "known", 528 528 - "emoji": status_data.status, 529 529 - "text": status_data.text, 530 530 - "since": status_data.started_at.to_rfc3339(), 531 531 - "expires": status_data.expires_at.map(|e| e.to_rfc3339()), 532 532 - }) 533 533 - } else { 534 534 - serde_json::json!({ 535 535 - "handle": OWNER_HANDLE, 536 536 - "status": "unknown", 537 537 - "message": "No current status is known" 538 538 - }) 539 539 - }; 540 540 - 541 541 - Ok(web::Json(response)) 542 542 - } 543 543 - 544 544 - /// Get paginated statuses for infinite scrolling 545 545 - #[get("/api/feed")] 546 546 - async fn api_feed( 547 547 - query: web::Query<HashMap<String, String>>, 548 548 - db_pool: web::Data<Arc<Pool>>, 549 549 - handle_resolver: web::Data<HandleResolver>, 550 550 - config: web::Data<config::Config>, 551 551 - ) -> Result<impl Responder> { 552 552 - let offset = query 553 553 - .get("offset") 554 554 - .and_then(|s| s.parse::<i32>().ok()) 555 555 - .unwrap_or(0); 556 556 - let limit = query 557 557 - .get("limit") 558 558 - .and_then(|s| s.parse::<i32>().ok()) 559 559 - .unwrap_or(20) 560 560 - .min(50); // Cap at 50 items per request 561 561 - 562 562 - // Check if dev mode is requested 563 563 - let use_dev_mode = config.dev_mode && query.get("dev").is_some_and(|v| v == "true" || v == "1"); 564 564 - 565 565 - let mut statuses = if use_dev_mode && offset == 0 { 566 566 - // For first page in dev mode, mix dummy data with real data 567 567 - let mut real_statuses = StatusFromDb::load_statuses_paginated(&db_pool, 0, limit / 2) 568 568 - .await 569 569 - .unwrap_or_else(|err| { 570 570 - log::error!("Error loading paginated statuses: {err}"); 571 571 - vec![] 572 572 - }); 573 573 - let dummy_statuses = dev_utils::generate_dummy_statuses((limit / 2) as usize); 574 574 - real_statuses.extend(dummy_statuses); 575 575 - real_statuses.sort_by(|a, b| b.started_at.cmp(&a.started_at)); 576 576 - real_statuses 577 577 - } else { 578 578 - StatusFromDb::load_statuses_paginated(&db_pool, offset, limit) 579 579 - .await 580 580 - .unwrap_or_else(|err| { 581 581 - log::error!("Error loading statuses: {err}"); 582 582 - vec![] 583 583 - }) 584 584 - }; 585 585 - 586 586 - // Resolve handles for each status 587 587 - let mut quick_resolve_map: HashMap<Did, String> = HashMap::new(); 588 588 - for db_status in &mut statuses { 589 589 - let authors_did = Did::new(db_status.author_did.clone()).expect("failed to parse did"); 590 590 - match quick_resolve_map.get(&authors_did) { 591 591 - None => {} 592 592 - Some(found_handle) => { 593 593 - db_status.handle = Some(found_handle.clone()); 594 594 - continue; 595 595 - } 596 596 - } 597 597 - db_status.handle = match handle_resolver.resolve(&authors_did).await { 598 598 - Ok(did_doc) => match did_doc.also_known_as { 599 599 - None => None, 600 600 - Some(also_known_as) => match also_known_as.is_empty() { 601 601 - true => None, 602 602 - false => { 603 603 - let full_handle = also_known_as.first().unwrap(); 604 604 - let handle = full_handle.replace("at://", ""); 605 605 - quick_resolve_map.insert(authors_did, handle.clone()); 606 606 - Some(handle) 607 607 - } 608 608 - }, 609 609 - }, 610 610 - Err(_) => None, 611 611 - }; 612 612 - } 613 613 - 614 614 - Ok(HttpResponse::Ok().json(statuses)) 615 615 - } 616 616 - 617 617 - /// Get the most frequently used emojis from all statuses 618 618 - #[get("/api/frequent-emojis")] 619 619 - async fn get_frequent_emojis(db_pool: web::Data<Arc<Pool>>) -> Result<impl Responder> { 620 620 - // Get top 20 most frequently used emojis 621 621 - let emojis = db::get_frequent_emojis(&db_pool, 20) 622 622 - .await 623 623 - .unwrap_or_else(|err| { 624 624 - log::error!("Failed to get frequent emojis: {}", err); 625 625 - Vec::new() 626 626 - }); 627 627 - 628 628 - // If we have less than 12 emojis, add some defaults to fill it out 629 629 - let mut result = emojis; 630 630 - if result.is_empty() { 631 631 - log::info!("No emoji usage data found, using defaults"); 632 632 - let defaults = vec![ 633 633 - "😊", "👍", "❤️", "😂", "🎉", "🔥", "✨", "💯", "🚀", "💪", "🙏", "👏", 634 634 - ]; 635 635 - result = defaults.into_iter().map(String::from).collect(); 636 636 - } else if result.len() < 12 { 637 637 - log::info!("Found {} emojis, padding with defaults", result.len()); 638 638 - let defaults = vec![ 639 639 - "😊", "👍", "❤️", "😂", "🎉", "🔥", "✨", "💯", "🚀", "💪", "🙏", "👏", 640 640 - ]; 641 641 - for emoji in defaults { 642 642 - if !result.contains(&emoji.to_string()) && result.len() < 20 { 643 643 - result.push(emoji.to_string()); 644 644 - } 645 645 - } 646 646 - } else { 647 647 - log::info!("Found {} frequently used emojis", result.len()); 648 648 - } 649 649 - 650 650 - Ok(web::Json(result)) 651 651 - } 652 652 - 653 653 - /// Get all custom emojis available on the site 654 654 - #[get("/api/custom-emojis")] 655 655 - async fn get_custom_emojis() -> Result<impl Responder> { 656 656 - use std::fs; 657 657 - 658 658 - #[derive(Serialize)] 659 659 - struct SimpleEmoji { 660 660 - name: String, 661 661 - filename: String, 662 662 - } 663 663 - 664 664 - let emojis_dir = "static/emojis"; 665 665 - let mut emojis = Vec::new(); 666 666 - 667 667 - if let Ok(entries) = fs::read_dir(emojis_dir) { 668 668 - for entry in entries.flatten() { 669 669 - if let Some(filename) = entry.file_name().to_str() { 670 670 - // Only include image files 671 671 - if filename.ends_with(".png") 672 672 - || filename.ends_with(".gif") 673 673 - || filename.ends_with(".jpg") 674 674 - || filename.ends_with(".webp") 675 675 - { 676 676 - // Remove file extension to get name 677 677 - let name = filename 678 678 - .rsplit_once('.') 679 679 - .map(|(name, _)| name) 680 680 - .unwrap_or(filename) 681 681 - .to_string(); 682 682 - emojis.push(SimpleEmoji { 683 683 - name: name.clone(), 684 684 - filename: filename.to_string(), 685 685 - }); 686 686 - } 687 687 - } 688 688 - } 689 689 - } 690 690 - 691 691 - // Sort by name 692 692 - emojis.sort_by(|a, b| a.name.cmp(&b.name)); 693 693 - 694 694 - Ok(HttpResponse::Ok().json(emojis)) 695 695 - } 696 696 - 697 697 - /// Get the DIDs of accounts the logged-in user follows 698 698 - #[get("/api/following")] 699 699 - async fn get_following( 700 700 - session: Session, 701 701 - _oauth_client: web::Data<OAuthClientType>, 702 702 - ) -> Result<impl Responder> { 703 703 - // Check if user is logged in 704 704 - let did = match session.get::<Did>("did").ok().flatten() { 705 705 - Some(did) => did, 706 706 - None => { 707 707 - return Ok(HttpResponse::Unauthorized().json(serde_json::json!({ 708 708 - "error": "Not logged in" 709 709 - }))); 710 710 - } 711 711 - }; 712 712 - 713 713 - // WORKAROUND: Call public API directly for getFollows since OAuth scope isn't working 714 714 - // Both getProfile and getFollows are public endpoints that don't require auth 715 715 - // but when called through OAuth, getFollows requires a scope that doesn't exist yet 716 716 - 717 717 - let mut all_follows = Vec::new(); 718 718 - let mut cursor: Option<String> = None; 719 719 - 720 720 - // Use reqwest to call the public API directly 721 721 - let client = reqwest::Client::new(); 722 722 - 723 723 - loop { 724 724 - let mut url = format!( 725 725 - "https://public.api.bsky.app/xrpc/app.bsky.graph.getFollows?actor={}", 726 726 - did.as_str() 727 727 - ); 728 728 - 729 729 - if let Some(c) = &cursor { 730 730 - url.push_str(&format!("&cursor={}", c)); 731 731 - } 732 732 - 733 733 - match client.get(&url).send().await { 734 734 - Ok(response) => { 735 735 - match response.json::<serde_json::Value>().await { 736 736 - Ok(json) => { 737 737 - // Extract follows 738 738 - if let Some(follows) = json["follows"].as_array() { 739 739 - for follow in follows { 740 740 - if let Some(did_str) = follow["did"].as_str() { 741 741 - all_follows.push(did_str.to_string()); 742 742 - } 743 743 - } 744 744 - } 745 745 - 746 746 - // Check for cursor 747 747 - cursor = json["cursor"].as_str().map(|s| s.to_string()); 748 748 - if cursor.is_none() { 749 749 - break; 750 750 - } 751 751 - } 752 752 - Err(err) => { 753 753 - log::error!("Failed to parse follows response: {}", err); 754 754 - return Ok(HttpResponse::InternalServerError().json(serde_json::json!({ 755 755 - "error": "Failed to parse follows" 756 756 - }))); 757 757 - } 758 758 - } 759 759 - } 760 760 - Err(err) => { 761 761 - log::error!("Failed to fetch follows from public API: {}", err); 762 762 - return Ok(HttpResponse::InternalServerError().json(serde_json::json!({ 763 763 - "error": "Failed to fetch follows" 764 764 - }))); 765 765 - } 766 766 - } 767 767 - } 768 768 - 769 769 - Ok(HttpResponse::Ok().json(serde_json::json!({ 770 770 - "follows": all_follows 771 771 - }))) 772 772 - } 773 773 - 774 774 - /// JSON API for a specific user's status 775 775 - #[get("/@{handle}/json")] 776 776 - async fn user_status_json( 777 777 - handle: web::Path<String>, 778 778 - db_pool: web::Data<Arc<Pool>>, 779 779 - _handle_resolver: web::Data<HandleResolver>, 780 780 - ) -> Result<impl Responder> { 781 781 - let handle = handle.into_inner(); 782 782 - 783 783 - // Resolve handle to DID using ATProto handle resolution 784 784 - // First we need to create a handle resolver 785 785 - let atproto_handle_resolver = AtprotoHandleResolver::new(AtprotoHandleResolverConfig { 786 786 - dns_txt_resolver: HickoryDnsTxtResolver::default(), 787 787 - http_client: Arc::new(DefaultHttpClient::default()), 788 788 - }); 789 789 - 790 790 - let handle_obj = atrium_api::types::string::Handle::new(handle.clone()).ok(); 791 791 - let did = match handle_obj { 792 792 - Some(h) => match atproto_handle_resolver.resolve(&h).await { 793 793 - Ok(did) => did, 794 794 - Err(_) => { 795 795 - return Ok(web::Json(serde_json::json!({ 796 796 - "status": "unknown", 797 797 - "message": format!("Could not resolve handle @{}", handle) 798 798 - }))); 799 799 - } 800 800 - }, 801 801 - None => { 802 802 - return Ok(web::Json(serde_json::json!({ 803 803 - "status": "unknown", 804 804 - "message": format!("Invalid handle format: @{}", handle) 805 805 - }))); 806 806 - } 807 807 - }; 808 808 - 809 809 - let current_status = StatusFromDb::my_status(&db_pool, &did) 810 810 - .await 811 811 - .unwrap_or(None) 812 812 - .and_then(|s| { 813 813 - // Check if status is expired 814 814 - if let Some(expires_at) = s.expires_at { 815 815 - if chrono::Utc::now() > expires_at { 816 816 - return None; // Status expired 817 817 - } 818 818 - } 819 819 - Some(s) 820 820 - }); 821 821 - 822 822 - let response = if let Some(status_data) = current_status { 823 823 - serde_json::json!({ 824 824 - "status": "known", 825 825 - "emoji": status_data.status, 826 826 - "text": status_data.text, 827 827 - "since": status_data.started_at.to_rfc3339(), 828 828 - "expires": status_data.expires_at.map(|e| e.to_rfc3339()), 829 829 - }) 830 830 - } else { 831 831 - serde_json::json!({ 832 832 - "status": "unknown", 833 833 - "message": format!("No current status is known for @{}", handle) 834 834 - }) 835 835 - }; 836 836 - 837 837 - Ok(web::Json(response)) 838 838 - } 839 839 - 840 840 - /// JSON API endpoint for status - returns current status or "unknown" 841 841 - #[get("/api/status")] 842 842 - async fn status_json(db_pool: web::Data<Arc<Pool>>) -> Result<impl Responder> { 843 843 - const OWNER_DID: &str = "did:plc:xbtmt2zjwlrfegqvch7fboei"; // zzstoatzz.io 844 844 - 845 845 - let owner_did = Did::new(OWNER_DID.to_string()).ok(); 846 846 - let current_status = if let Some(ref did) = owner_did { 847 847 - StatusFromDb::my_status(&db_pool, did) 848 848 - .await 849 849 - .unwrap_or(None) 850 850 - .and_then(|s| { 851 851 - // Check if status is expired 852 852 - if let Some(expires_at) = s.expires_at { 853 853 - if chrono::Utc::now() > expires_at { 854 854 - return None; // Status expired 855 855 - } 856 856 - } 857 857 - Some(s) 858 858 - }) 859 859 - } else { 860 860 - None 861 861 - }; 862 862 - 863 863 - let response = if let Some(status_data) = current_status { 864 864 - serde_json::json!({ 865 865 - "status": "known", 866 866 - "emoji": status_data.status, 867 867 - "text": status_data.text, 868 868 - "since": status_data.started_at.to_rfc3339(), 869 869 - "expires": status_data.expires_at.map(|e| e.to_rfc3339()), 870 870 - }) 871 871 - } else { 872 872 - serde_json::json!({ 873 873 - "status": "unknown", 874 874 - "message": "No current status is known" 875 875 - }) 876 876 - }; 877 877 - 878 878 - Ok(web::Json(response)) 879 879 - } 880 880 - 881 881 - /// Get user preferences 882 882 - #[get("/api/preferences")] 883 883 - async fn get_preferences( 884 884 - session: Session, 885 885 - db_pool: web::Data<Arc<Pool>>, 886 886 - ) -> Result<impl Responder> { 887 887 - let did = session.get::<Did>("did")?; 888 888 - 889 889 - if let Some(did) = did { 890 890 - let prefs = db::get_user_preferences(&db_pool, did.as_str()) 891 891 - .await 892 892 - .map_err(|e| AppError::DatabaseError(e.to_string()))?; 893 893 - Ok(web::Json(serde_json::json!({ 894 894 - "font_family": prefs.font_family, 895 895 - "accent_color": prefs.accent_color 896 896 - }))) 897 897 - } else { 898 898 - Ok(web::Json(serde_json::json!({ 899 899 - "error": "Not authenticated" 900 900 - }))) 901 901 - } 902 902 - } 903 903 - 904 904 - #[derive(Deserialize)] 905 905 - struct PreferencesUpdate { 906 906 - font_family: Option<String>, 907 907 - accent_color: Option<String>, 908 908 - } 909 909 - 910 910 - /// Save user preferences 911 911 - #[post("/api/preferences")] 912 912 - async fn save_preferences( 913 913 - session: Session, 914 914 - db_pool: web::Data<Arc<Pool>>, 915 915 - payload: web::Json<PreferencesUpdate>, 916 916 - ) -> Result<impl Responder> { 917 917 - let did = session.get::<Did>("did")?; 918 918 - 919 919 - if let Some(did) = did { 920 920 - let mut prefs = db::get_user_preferences(&db_pool, did.as_str()) 921 921 - .await 922 922 - .map_err(|e| AppError::DatabaseError(e.to_string()))?; 923 923 - 924 924 - if let Some(font) = &payload.font_family { 925 925 - prefs.font_family = font.clone(); 926 926 - } 927 927 - if let Some(color) = &payload.accent_color { 928 928 - prefs.accent_color = color.clone(); 929 929 - } 930 930 - prefs.updated_at = std::time::SystemTime::now() 931 931 - .duration_since(std::time::UNIX_EPOCH) 932 932 - .unwrap() 933 933 - .as_secs() as i64; 934 934 - 935 935 - db::save_user_preferences(&db_pool, &prefs) 936 936 - .await 937 937 - .map_err(|e| AppError::DatabaseError(e.to_string()))?; 938 938 - 939 939 - Ok(web::Json(serde_json::json!({ 940 940 - "success": true 941 941 - }))) 942 942 - } else { 943 943 - Ok(web::Json(serde_json::json!({ 944 944 - "error": "Not authenticated" 945 945 - }))) 946 946 - } 947 947 - } 948 948 - 949 949 - /// Feed page - shows all users' statuses 950 950 - #[get("/feed")] 951 951 - async fn feed( 952 952 - request: HttpRequest, 953 953 - session: Session, 954 954 - oauth_client: web::Data<OAuthClientType>, 955 955 - db_pool: web::Data<Arc<Pool>>, 956 956 - handle_resolver: web::Data<HandleResolver>, 957 957 - config: web::Data<config::Config>, 958 958 - ) -> Result<impl Responder> { 959 959 - // This is essentially the old home function 960 960 - const TITLE: &str = "status feed"; 961 961 - 962 962 - // Check if dev mode is active 963 963 - let query = request.query_string(); 964 964 - let use_dev_mode = config.dev_mode && dev_utils::is_dev_mode_requested(query); 965 965 - 966 966 - let mut statuses = if use_dev_mode { 967 967 - // Mix dummy data with real data for testing 968 968 - let mut real_statuses = StatusFromDb::load_latest_statuses(&db_pool) 969 969 - .await 970 970 - .unwrap_or_else(|err| { 971 971 - log::error!("Error loading statuses: {err}"); 972 972 - vec![] 973 973 - }); 974 974 - let dummy_statuses = dev_utils::generate_dummy_statuses(15); 975 975 - real_statuses.extend(dummy_statuses); 976 976 - // Resort by started_at 977 977 - real_statuses.sort_by(|a, b| b.started_at.cmp(&a.started_at)); 978 978 - real_statuses 979 979 - } else { 980 980 - StatusFromDb::load_latest_statuses(&db_pool) 981 981 - .await 982 982 - .unwrap_or_else(|err| { 983 983 - log::error!("Error loading statuses: {err}"); 984 984 - vec![] 985 985 - }) 986 986 - }; 987 987 - 988 988 - let mut quick_resolve_map: HashMap<Did, String> = HashMap::new(); 989 989 - for db_status in &mut statuses { 990 990 - let authors_did = Did::new(db_status.author_did.clone()).expect("failed to parse did"); 991 991 - match quick_resolve_map.get(&authors_did) { 992 992 - None => {} 993 993 - Some(found_handle) => { 994 994 - db_status.handle = Some(found_handle.clone()); 995 995 - continue; 996 996 - } 997 997 - } 998 998 - db_status.handle = match handle_resolver.resolve(&authors_did).await { 999 999 - Ok(did_doc) => match did_doc.also_known_as { 1000 1000 - None => None, 1001 1001 - Some(also_known_as) => match also_known_as.is_empty() { 1002 1002 - true => None, 1003 1003 - false => { 1004 1004 - let full_handle = also_known_as.first().unwrap(); 1005 1005 - let handle = full_handle.replace("at://", ""); 1006 1006 - quick_resolve_map.insert(authors_did, handle.clone()); 1007 1007 - Some(handle) 1008 1008 - } 1009 1009 - }, 1010 1010 - }, 1011 1011 - Err(err) => { 1012 1012 - log::error!("Error resolving did: {err}"); 1013 1013 - None 1014 1014 - } 1015 1015 - }; 1016 1016 - } 1017 1017 - 1018 1018 - match session.get::<String>("did").unwrap_or(None) { 1019 1019 - Some(did_string) => { 1020 1020 - log::debug!("Feed: User has session with DID: {}", did_string); 1021 1021 - let did = Did::new(did_string.clone()).expect("failed to parse did"); 1022 1022 - let _my_status = StatusFromDb::my_status(&db_pool, &did) 1023 1023 - .await 1024 1024 - .unwrap_or_else(|err| { 1025 1025 - log::error!("Error loading my status: {err}"); 1026 1026 - None 1027 1027 - }); 1028 1028 - 1029 1029 - log::debug!( 1030 1030 - "Feed: Attempting to restore OAuth session for DID: {}", 1031 1031 - did_string 1032 1032 - ); 1033 1033 - match oauth_client.restore(&did).await { 1034 1034 - Ok(session) => { 1035 1035 - log::debug!("Feed: Successfully restored OAuth session"); 1036 1036 - let agent = Agent::new(session); 1037 1037 - let profile = agent 1038 1038 - .api 1039 1039 - .app 1040 1040 - .bsky 1041 1041 - .actor 1042 1042 - .get_profile( 1043 1043 - atrium_api::app::bsky::actor::get_profile::ParametersData { 1044 1044 - actor: atrium_api::types::string::AtIdentifier::Did(did.clone()), 1045 1045 - } 1046 1046 - .into(), 1047 1047 - ) 1048 1048 - .await; 1049 1049 - 1050 1050 - let is_admin = is_admin(did.as_str()); 1051 1051 - let html = FeedTemplate { 1052 1052 - title: TITLE, 1053 1053 - profile: match profile { 1054 1054 - Ok(profile) => { 1055 1055 - let profile_data = Profile { 1056 1056 - did: profile.did.to_string(), 1057 1057 - display_name: profile.display_name.clone(), 1058 1058 - }; 1059 1059 - Some(profile_data) 1060 1060 - } 1061 1061 - Err(err) => { 1062 1062 - log::error!("Error accessing profile: {err}"); 1063 1063 - None 1064 1064 - } 1065 1065 - }, 1066 1066 - statuses, 1067 1067 - is_admin, 1068 1068 - dev_mode: use_dev_mode, 1069 1069 - } 1070 1070 - .render() 1071 1071 - .expect("template should be valid"); 1072 1072 - 1073 1073 - Ok(web::Html::new(html)) 1074 1074 - } 1075 1075 - Err(err) => { 1076 1076 - // Don't purge the session - OAuth tokens might be expired but user is still logged in 1077 1077 - log::warn!("Could not restore OAuth session for feed: {:?}", err); 1078 1078 - 1079 1079 - // Show feed without profile info instead of error page 1080 1080 - let html = FeedTemplate { 1081 1081 - title: TITLE, 1082 1082 - profile: None, 1083 1083 - statuses, 1084 1084 - is_admin: is_admin(did.as_str()), 1085 1085 - dev_mode: use_dev_mode, 1086 1086 - } 1087 1087 - .render() 1088 1088 - .expect("template should be valid"); 1089 1089 - 1090 1090 - Ok(web::Html::new(html)) 1091 1091 - } 1092 1092 - } 1093 1093 - } 1094 1094 - None => { 1095 1095 - let html = FeedTemplate { 1096 1096 - title: TITLE, 1097 1097 - profile: None, 1098 1098 - statuses, 1099 1099 - is_admin: false, 1100 1100 - dev_mode: use_dev_mode, 1101 1101 - } 1102 1102 - .render() 1103 1103 - .expect("template should be valid"); 1104 1104 - 1105 1105 - Ok(web::Html::new(html)) 1106 1106 - } 1107 1107 - } 1108 1108 - } 1109 1109 - 1110 1110 - /// The post body for changing your status 1111 1111 - #[derive(Serialize, Deserialize, Clone)] 1112 1112 - struct StatusForm { 1113 1113 - status: String, 1114 1114 - text: Option<String>, 1115 1115 - expires_in: Option<String>, // e.g., "1h", "30m", "1d", etc. 1116 1116 - } 1117 1117 - 1118 1118 - /// The post body for deleting a specific status 1119 1119 - #[derive(Serialize, Deserialize)] 1120 1120 - struct DeleteRequest { 1121 1121 - uri: String, 1122 1122 - } 1123 1123 - 1124 1124 - /// Parse duration string like "1h", "30m", "1d" into chrono::Duration 1125 1125 - fn parse_duration(duration_str: &str) -> Option<chrono::Duration> { 1126 1126 - if duration_str.is_empty() { 1127 1127 - return None; 1128 1128 - } 1129 1129 - 1130 1130 - let (num_str, unit) = duration_str.split_at(duration_str.len() - 1); 1131 1131 - let num: i64 = num_str.parse().ok()?; 1132 1132 - 1133 1133 - match unit { 1134 1134 - "m" => Some(chrono::Duration::minutes(num)), 1135 1135 - "h" => Some(chrono::Duration::hours(num)), 1136 1136 - "d" => Some(chrono::Duration::days(num)), 1137 1137 - "w" => Some(chrono::Duration::weeks(num)), 1138 1138 - _ => None, 1139 1139 - } 1140 1140 - } 1141 1141 - 1142 1142 - /// Clear the user's status by deleting the ATProto record 1143 1143 - #[post("/status/clear")] 1144 1144 - async fn clear_status( 1145 1145 - request: HttpRequest, 1146 1146 - session: Session, 1147 1147 - oauth_client: web::Data<OAuthClientType>, 1148 1148 - db_pool: web::Data<Arc<Pool>>, 1149 1149 - ) -> HttpResponse { 1150 1150 - // Check if the user is logged in 1151 1151 - match session.get::<String>("did").unwrap_or(None) { 1152 1152 - Some(did_string) => { 1153 1153 - let did = Did::new(did_string.clone()).expect("failed to parse did"); 1154 1154 - 1155 1155 - // Get the user's current status to find the record key 1156 1156 - match StatusFromDb::my_status(&db_pool, &did).await { 1157 1157 - Ok(Some(current_status)) => { 1158 1158 - // Extract the record key from the URI 1159 1159 - // URI format: at://did:plc:xxx/io.zzstoatzz.status.record/rkey 1160 1160 - let parts: Vec<&str> = current_status.uri.split('/').collect(); 1161 1161 - if let Some(rkey) = parts.last() { 1162 1162 - // Get OAuth session 1163 1163 - match oauth_client.restore(&did).await { 1164 1164 - Ok(session) => { 1165 1165 - let agent = Agent::new(session); 1166 1166 - 1167 1167 - // Delete the record from ATProto using com.atproto.repo.deleteRecord 1168 1168 - let delete_request = 1169 1169 - atrium_api::com::atproto::repo::delete_record::InputData { 1170 1170 - collection: atrium_api::types::string::Nsid::new( 1171 1171 - "io.zzstoatzz.status.record".to_string(), 1172 1172 - ) 1173 1173 - .expect("valid nsid"), 1174 1174 - repo: did.clone().into(), 1175 1175 - rkey: atrium_api::types::string::RecordKey::new( 1176 1176 - rkey.to_string(), 1177 1177 - ) 1178 1178 - .expect("valid rkey"), 1179 1179 - swap_commit: None, 1180 1180 - swap_record: None, 1181 1181 - }; 1182 1182 - match agent 1183 1183 - .api 1184 1184 - .com 1185 1185 - .atproto 1186 1186 - .repo 1187 1187 - .delete_record(delete_request.into()) 1188 1188 - .await 1189 1189 - { 1190 1190 - Ok(_) => { 1191 1191 - // Also remove from local database 1192 1192 - let _ = StatusFromDb::delete_by_uri( 1193 1193 - &db_pool, 1194 1194 - current_status.uri, 1195 1195 - ) 1196 1196 - .await; 1197 1197 - 1198 1198 - Redirect::to("/") 1199 1199 - .see_other() 1200 1200 - .respond_to(&request) 1201 1201 - .map_into_boxed_body() 1202 1202 - } 1203 1203 - Err(e) => { 1204 1204 - log::error!("Failed to delete status from ATProto: {e}"); 1205 1205 - HttpResponse::InternalServerError() 1206 1206 - .body("Failed to clear status") 1207 1207 - } 1208 1208 - } 1209 1209 - } 1210 1210 - Err(e) => { 1211 1211 - log::error!("Failed to restore OAuth session: {e}"); 1212 1212 - HttpResponse::InternalServerError().body("Session error") 1213 1213 - } 1214 1214 - } 1215 1215 - } else { 1216 1216 - HttpResponse::BadRequest().body("Invalid status URI") 1217 1217 - } 1218 1218 - } 1219 1219 - Ok(None) => { 1220 1220 - // No status to clear 1221 1221 - Redirect::to("/") 1222 1222 - .see_other() 1223 1223 - .respond_to(&request) 1224 1224 - .map_into_boxed_body() 1225 1225 - } 1226 1226 - Err(e) => { 1227 1227 - log::error!("Database error: {e}"); 1228 1228 - HttpResponse::InternalServerError().body("Database error") 1229 1229 - } 1230 1230 - } 1231 1231 - } 1232 1232 - None => { 1233 1233 - // Not logged in 1234 1234 - Redirect::to("/login") 1235 1235 - .see_other() 1236 1236 - .respond_to(&request) 1237 1237 - .map_into_boxed_body() 1238 1238 - } 1239 1239 - } 1240 1240 - } 1241 1241 - 1242 1242 - /// Delete a specific status by URI (JSON endpoint) 1243 1243 - #[post("/status/delete")] 1244 1244 - async fn delete_status( 1245 1245 - session: Session, 1246 1246 - oauth_client: web::Data<OAuthClientType>, 1247 1247 - db_pool: web::Data<Arc<Pool>>, 1248 1248 - req: web::Json<DeleteRequest>, 1249 1249 - ) -> HttpResponse { 1250 1250 - // Check if the user is logged in 1251 1251 - match session.get::<String>("did").unwrap_or(None) { 1252 1252 - Some(did_string) => { 1253 1253 - let did = Did::new(did_string.clone()).expect("failed to parse did"); 1254 1254 - 1255 1255 - // Parse the URI to verify it belongs to this user 1256 1256 - // URI format: at://did:plc:xxx/io.zzstoatzz.status.record/rkey 1257 1257 - let uri_parts: Vec<&str> = req.uri.split('/').collect(); 1258 1258 - if uri_parts.len() < 5 { 1259 1259 - return HttpResponse::BadRequest().json(serde_json::json!({ 1260 1260 - "error": "Invalid status URI format" 1261 1261 - })); 1262 1262 - } 1263 1263 - 1264 1264 - // Extract DID from URI (at://did:plc:xxx/...) 1265 1265 - let uri_did_part = uri_parts[2]; 1266 1266 - if uri_did_part != did_string { 1267 1267 - return HttpResponse::Forbidden().json(serde_json::json!({ 1268 1268 - "error": "You can only delete your own statuses" 1269 1269 - })); 1270 1270 - } 1271 1271 - 1272 1272 - // Extract record key 1273 1273 - if let Some(rkey) = uri_parts.last() { 1274 1274 - // Get OAuth session 1275 1275 - match oauth_client.restore(&did).await { 1276 1276 - Ok(session) => { 1277 1277 - let agent = Agent::new(session); 1278 1278 - 1279 1279 - // Delete the record from ATProto 1280 1280 - let delete_request = 1281 1281 - atrium_api::com::atproto::repo::delete_record::InputData { 1282 1282 - collection: atrium_api::types::string::Nsid::new( 1283 1283 - "io.zzstoatzz.status.record".to_string(), 1284 1284 - ) 1285 1285 - .expect("valid nsid"), 1286 1286 - repo: did.clone().into(), 1287 1287 - rkey: atrium_api::types::string::RecordKey::new(rkey.to_string()) 1288 1288 - .expect("valid rkey"), 1289 1289 - swap_commit: None, 1290 1290 - swap_record: None, 1291 1291 - }; 1292 1292 - 1293 1293 - match agent 1294 1294 - .api 1295 1295 - .com 1296 1296 - .atproto 1297 1297 - .repo 1298 1298 - .delete_record(delete_request.into()) 1299 1299 - .await 1300 1300 - { 1301 1301 - Ok(_) => { 1302 1302 - // Also remove from local database 1303 1303 - let _ = 1304 1304 - StatusFromDb::delete_by_uri(&db_pool, req.uri.clone()).await; 1305 1305 - 1306 1306 - HttpResponse::Ok().json(serde_json::json!({ 1307 1307 - "success": true 1308 1308 - })) 1309 1309 - } 1310 1310 - Err(e) => { 1311 1311 - log::error!("Failed to delete status from ATProto: {e}"); 1312 1312 - HttpResponse::InternalServerError().json(serde_json::json!({ 1313 1313 - "error": "Failed to delete status" 1314 1314 - })) 1315 1315 - } 1316 1316 - } 1317 1317 - } 1318 1318 - Err(e) => { 1319 1319 - log::error!("Failed to restore OAuth session: {e}"); 1320 1320 - HttpResponse::InternalServerError().json(serde_json::json!({ 1321 1321 - "error": "Session error" 1322 1322 - })) 1323 1323 - } 1324 1324 - } 1325 1325 - } else { 1326 1326 - HttpResponse::BadRequest().json(serde_json::json!({ 1327 1327 - "error": "Invalid status URI" 1328 1328 - })) 1329 1329 - } 1330 1330 - } 1331 1331 - None => { 1332 1332 - // Not logged in 1333 1333 - HttpResponse::Unauthorized().json(serde_json::json!({ 1334 1334 - "error": "Not authenticated" 1335 1335 - })) 1336 1336 - } 1337 1337 - } 1338 1338 - } 1339 1339 - 1340 1340 - /// Hide/unhide a status (admin only) 1341 1341 - #[derive(Deserialize)] 1342 1342 - struct HideStatusRequest { 1343 1343 - uri: String, 1344 1344 - hidden: bool, 1345 1345 - } 1346 1346 - 1347 1347 - #[post("/admin/hide-status")] 1348 1348 - async fn hide_status( 1349 1349 - session: Session, 1350 1350 - db_pool: web::Data<Arc<Pool>>, 1351 1351 - req: web::Json<HideStatusRequest>, 1352 1352 - ) -> HttpResponse { 1353 1353 - // Check if the user is logged in and is admin 1354 1354 - match session.get::<String>("did").unwrap_or(None) { 1355 1355 - Some(did_string) => { 1356 1356 - if !is_admin(&did_string) { 1357 1357 - return HttpResponse::Forbidden().json(serde_json::json!({ 1358 1358 - "error": "Admin access required" 1359 1359 - })); 1360 1360 - } 1361 1361 - 1362 1362 - // Update the hidden status in the database 1363 1363 - let uri = req.uri.clone(); 1364 1364 - let hidden = req.hidden; 1365 1365 - 1366 1366 - let result = db_pool 1367 1367 - .conn(move |conn| { 1368 1368 - conn.execute( 1369 1369 - "UPDATE status SET hidden = ?1 WHERE uri = ?2", 1370 1370 - rusqlite::params![hidden, uri], 1371 1371 - ) 1372 1372 - }) 1373 1373 - .await; 1374 1374 - 1375 1375 - match result { 1376 1376 - Ok(rows_affected) if rows_affected > 0 => { 1377 1377 - HttpResponse::Ok().json(serde_json::json!({ 1378 1378 - "success": true, 1379 1379 - "message": if hidden { "Status hidden" } else { "Status unhidden" } 1380 1380 - })) 1381 1381 - } 1382 1382 - Ok(_) => HttpResponse::NotFound().json(serde_json::json!({ 1383 1383 - "error": "Status not found" 1384 1384 - })), 1385 1385 - Err(err) => { 1386 1386 - log::error!("Error updating hidden status: {}", err); 1387 1387 - HttpResponse::InternalServerError().json(serde_json::json!({ 1388 1388 - "error": "Database error" 1389 1389 - })) 1390 1390 - } 1391 1391 - } 1392 1392 - } 1393 1393 - None => HttpResponse::Unauthorized().json(serde_json::json!({ 1394 1394 - "error": "Not authenticated" 1395 1395 - })), 1396 1396 - } 1397 1397 - } 1398 1398 - 1399 1399 - /// TS version https://github.com/bluesky-social/statusphere-example-app/blob/e4721616df50cd317c198f4c00a4818d5626d4ce/src/routes.ts#L208 1400 1400 - /// Creates a new status 1401 1401 - #[post("/status")] 1402 1402 - async fn status( 1403 1403 - request: HttpRequest, 1404 1404 - session: Session, 1405 1405 - oauth_client: web::Data<OAuthClientType>, 1406 1406 - db_pool: web::Data<Arc<Pool>>, 1407 1407 - form: web::Form<StatusForm>, 1408 1408 - rate_limiter: web::Data<RateLimiter>, 1409 1409 - ) -> Result<HttpResponse, AppError> { 1410 1410 - // Apply rate limiting 1411 1411 - let client_key = RateLimiter::get_client_key(&request); 1412 1412 - if !rate_limiter.check_rate_limit(&client_key) { 1413 1413 - return Err(AppError::RateLimitExceeded); 1414 1414 - } 1415 1415 - // Check if the user is logged in 1416 1416 - match session.get::<String>("did").unwrap_or(None) { 1417 1417 - Some(did_string) => { 1418 1418 - let did = Did::new(did_string.clone()).expect("failed to parse did"); 1419 1419 - // gets the user's session from the session store to resume 1420 1420 - match oauth_client.restore(&did).await { 1421 1421 - Ok(session) => { 1422 1422 - let agent = Agent::new(session); 1423 1423 - 1424 1424 - // Calculate expiration time if provided 1425 1425 - let expires = form 1426 1426 - .expires_in 1427 1427 - .as_ref() 1428 1428 - .and_then(|exp| parse_duration(exp)) 1429 1429 - .and_then(|duration| { 1430 1430 - let expiry_time = chrono::Utc::now() + duration; 1431 1431 - // Convert to ATProto Datetime format (RFC3339) 1432 1432 - Some(Datetime::new(expiry_time.to_rfc3339().parse().ok()?)) 1433 1433 - }); 1434 1434 - 1435 1435 - //Creates a strongly typed ATProto record 1436 1436 - let status: KnownRecord = lexicons::io::zzstoatzz::status::record::RecordData { 1437 1437 - created_at: Datetime::now(), 1438 1438 - emoji: form.status.clone(), 1439 1439 - text: form.text.clone(), 1440 1440 - expires, 1441 1441 - } 1442 1442 - .into(); 1443 1443 - 1444 1444 - // TODO no data validation yet from esquema 1445 1445 - // Maybe you'd like to add it? https://github.com/fatfingers23/esquema/issues/3 1446 1446 - 1447 1447 - let create_result = agent 1448 1448 - .api 1449 1449 - .com 1450 1450 - .atproto 1451 1451 - .repo 1452 1452 - .create_record( 1453 1453 - atrium_api::com::atproto::repo::create_record::InputData { 1454 1454 - collection: "io.zzstoatzz.status.record".parse().unwrap(), 1455 1455 - repo: did.into(), 1456 1456 - rkey: None, 1457 1457 - record: status.into(), 1458 1458 - swap_commit: None, 1459 1459 - validate: None, 1460 1460 - } 1461 1461 - .into(), 1462 1462 - ) 1463 1463 - .await; 1464 1464 - 1465 1465 - match create_result { 1466 1466 - Ok(record) => { 1467 1467 - let mut status = StatusFromDb::new( 1468 1468 - record.uri.clone(), 1469 1469 - did_string, 1470 1470 - form.status.clone(), 1471 1471 - ); 1472 1472 - 1473 1473 - // Set the text field if provided 1474 1474 - status.text = form.text.clone(); 1475 1475 - 1476 1476 - // Set the expiration time if provided 1477 1477 - if let Some(exp_str) = &form.expires_in { 1478 1478 - if let Some(duration) = parse_duration(exp_str) { 1479 1479 - status.expires_at = Some(chrono::Utc::now() + duration); 1480 1480 - } 1481 1481 - } 1482 1482 - 1483 1483 - let _ = status.save(db_pool).await; 1484 1484 - Ok(Redirect::to("/") 1485 1485 - .see_other() 1486 1486 - .respond_to(&request) 1487 1487 - .map_into_boxed_body()) 1488 1488 - } 1489 1489 - Err(err) => { 1490 1490 - log::error!("Error creating status: {err}"); 1491 1491 - let error_html = ErrorTemplate { 1492 1492 - title: "Error", 1493 1493 - error: "Was an error creating the status, please check the logs.", 1494 1494 - } 1495 1495 - .render() 1496 1496 - .expect("template should be valid"); 1497 1497 - Ok(HttpResponse::Ok().body(error_html)) 1498 1498 - } 1499 1499 - } 1500 1500 - } 1501 1501 - Err(err) => { 1502 1502 - // Destroys the system or you're in a loop 1503 1503 - session.purge(); 1504 1504 - log::error!( 1505 1505 - "Error restoring session, we are removing the session from the cookie: {err}" 1506 1506 - ); 1507 1507 - Err(AppError::AuthenticationError("Session error".to_string())) 1508 1508 - } 1509 1509 - } 1510 1510 - } 1511 1511 - None => Err(AppError::AuthenticationError( 1512 1512 - "You must be logged in to create a status.".to_string(), 1513 1513 - )), 1514 1514 - } 1515 1515 - } 1516 1516 - 1517 43 #[actix_web::main] 1518 44 async fn main() -> std::io::Result<()> { 1519 45 dotenv().ok(); ··· 1558 84 plc_directory_url: DEFAULT_PLC_DIRECTORY_URL.to_string(), 1559 85 http_client: http_client.clone(), 1560 86 }); 1561 1561 - let handle_resolver = Arc::new(handle_resolver); 87 87 + let handle_resolver: HandleResolver = Arc::new(handle_resolver); 1562 88 1563 89 // Create a new OAuth client 1564 90 let http_client = Arc::new(DefaultHttpClient::default()); ··· 1685 211 ) 1686 212 .service(Files::new("/static", "static").show_files_listing()) 1687 213 .service(Files::new("/emojis", "static/emojis").show_files_listing()) 1688 1688 - .service(client_metadata) 1689 1689 - .service(oauth_callback) 1690 1690 - .service(login) 1691 1691 - .service(login_post) 1692 1692 - .service(logout) 1693 1693 - .service(home) 1694 1694 - .service(feed) 1695 1695 - .service(status_json) 1696 1696 - .service(owner_status_json) 1697 1697 - .service(get_custom_emojis) 1698 1698 - .service(get_frequent_emojis) 1699 1699 - .service(get_following) 1700 1700 - .service(api_feed) 1701 1701 - .service(get_preferences) 1702 1702 - .service(save_preferences) 1703 1703 - .service(user_status_page) 1704 1704 - .service(user_status_json) 1705 1705 - .service(status) 1706 1706 - .service(clear_status) 1707 1707 - .service(delete_status) 1708 1708 - .service(hide_status) 214 214 + .configure(api::configure_routes) 1709 215 }) 1710 216 .bind((host.as_str(), port))? 1711 217 .run() ··· 1715 221 #[cfg(test)] 1716 222 mod tests { 1717 223 use super::*; 224 224 + use crate::api::status::get_custom_emojis; 1718 225 use actix_web::{App, test}; 1719 226 1720 227 #[actix_web::test]

+1 -1

templates/base.html

··· 30 30 <script> 31 31 // Apply saved settings immediately to prevent flash 32 32 (function() { 33 33 - const savedFont = localStorage.getItem('fontFamily') || 'system'; 33 33 + const savedFont = localStorage.getItem('fontFamily') || 'mono'; 34 34 const savedAccent = localStorage.getItem('accentColor') || '#1DA1F2'; 35 35 36 36 const fontMap = {

+1 -1

templates/feed.html

··· 770 770 // Simple settings 771 771 const initSettings = async () => { 772 772 // Try to load from API first, fall back to localStorage 773 773 - let savedFont = localStorage.getItem('fontFamily') || 'system'; 773 773 + let savedFont = localStorage.getItem('fontFamily') || 'mono'; 774 774 let savedAccent = localStorage.getItem('accentColor') || '#1DA1F2'; 775 775 776 776 // If user is logged in, fetch from API

+1 -1

templates/status.html

··· 1223 1223 // Simple settings 1224 1224 const initSettings = async () => { 1225 1225 // Try to load from API first, fall back to localStorage 1226 1226 - let savedFont = localStorage.getItem('fontFamily') || 'system'; 1226 1226 + let savedFont = localStorage.getItem('fontFamily') || 'mono'; 1227 1227 let savedAccent = localStorage.getItem('accentColor') || '#1DA1F2'; 1228 1228 1229 1229 // If user is logged in, fetch from API