maarcadetweet: initial commit

AT Protocol PDS + AppView + Tauri Desktop Client, 160-char post limit. - PDS (Rust + axum + sqlx) - Auth: createAccount, createSession, refreshSession - Records: createRecord, deleteRecord (race-safe via SELECT FOR UPDATE) - Feed: feed.like.create, feed.repost.create - Sync: getRepo, getBlocks, getLatestCommit, getRecord (with MST proof), listRepos - Identity: resolveHandle - MST: spec-conformant (at-mst crate, 27 tests) - Repo: signed commits, TID counter (monotonic, 4096 wrap safe) - AppView (Rust + axum + sqlx) - Jetstream consumer (WebSocket, exponential backoff, 38k+ events indexed) - REST API: timeline/home (graph-aware), profile, search, post (with thread hydration) - Handle-sync worker (did:plc + did:web) - JSONB embed storage + thread columns (migration 0003) - Like/repost counter cache (migration 0004) - Tauri 2 + Svelte 5 Desktop Client - System tray (Show/Compose/Quit menu) - OS notifications (tauri-plugin-notification) - Auto-update (tauri-plugin-updater, placeholder endpoint) - Window-state (tauri-plugin-window-state) - 160-char compose with live counter - Image/Link embed rendering - LocalStorage-persisted like state - Timeline with poll (prepend new posts) - Custom TitleBar (transparent, no decorations) - Orange/IBM Plex Mono maarcade design Tests: 231 Rust + 9 vitest = 240 passed.
2026-07-05 20:01:31 +02:00
commit c586fd39c9
134 changed files with 35279 additions and 0 deletions
@@ -0,0 +1,72 @@
+use anyhow::Result;
+use at_crypto::jwt::JwtClaims;
+use at_crypto::ecdsa::P256Keypair;
+use at_shared::config::AppConfig;
+
+pub fn server_p256_keypair(cfg: &AppConfig) -> Result<P256Keypair> {
+    use p256::elliptic_curve::sec1::ToEncodedPoint;
+    let raw = hex::decode(cfg.pds_jwt_secret.trim_start_matches("0x"))?;
+    if raw.len() < 32 {
+        anyhow::bail!("PDS_JWT_SECRET must be ≥ 32 bytes for P-256 key");
+    }
+    let mut bytes = [0u8; 32];
+    bytes.copy_from_slice(&raw[..32]);
+    let sk = p256::SecretKey::from_bytes((&bytes).into())
+        .map_err(|e| anyhow::anyhow!("p256 sk: {e}"))?;
+    let vk = sk.public_key();
+    let pt = vk.to_encoded_point(false);
+    let mut mb_raw = vec![0x80u8, 0x12u8];
+    mb_raw.extend_from_slice(pt.x().unwrap());
+    mb_raw.extend_from_slice(pt.y().unwrap());
+    let secret_hex = hex::encode(sk.to_bytes());
+    let public_multibase = at_crypto::multibase_util::encode_b58btc(&mb_raw);
+    Ok(P256Keypair {
+        secret_hex,
+        public_multibase,
+    })
+}
+
+pub fn server_p256_public_multibase(cfg: &AppConfig) -> Result<String> {
+    Ok(server_p256_keypair(cfg)?.public_multibase)
+}
+
+pub fn issue_access_jwt(
+    cfg: &AppConfig,
+    did: &str,
+    _handle: &str,
+) -> Result<(String, i64)> {
+    let kp = server_p256_keypair(cfg)?;
+    let now = chrono::Utc::now().timestamp();
+    let exp = now + 3600;
+    let claims = JwtClaims {
+        iss: format!("did:web:{}", cfg.pds_public_url.trim_start_matches("http://").trim_start_matches("https://")),
+        sub: did.to_string(),
+        aud: "did:web:appview.maarcadetweet.local".into(),
+        iat: now,
+        exp,
+        jti: Some(uuid::Uuid::new_v4().to_string()),
+        scope: Some("com.atproto.access".into()),
+    };
+    let token = at_crypto::jwt::issue_jwt(&kp, &claims)?;
+    Ok((token, exp))
+}
+
+pub fn issue_refresh_jwt(
+    cfg: &AppConfig,
+    did: &str,
+) -> Result<(String, i64)> {
+    let kp = server_p256_keypair(cfg)?;
+    let now = chrono::Utc::now().timestamp();
+    let exp = now + 90 * 24 * 3600;
+    let claims = JwtClaims {
+        iss: "did:web:refresh.maarcadetweet.local".into(),
+        sub: did.to_string(),
+        aud: "did:web:refresh.maarcadetweet.local".into(),
+        iat: now,
+        exp,
+        jti: Some(uuid::Uuid::new_v4().to_string()),
+        scope: Some("com.atproto.refresh".into()),
+    };
+    let token = at_crypto::jwt::issue_jwt(&kp, &claims)?;
+    Ok((token, exp))
+}