@alteran/astro 0.1.13 → 0.1.14

package/README.md

@@ -200,7 +200,7 @@ wrangler secret put ACCESS_TOKEN_SECRET --env production
 wrangler secret put REFRESH_TOKEN_SECRET --env production
 wrangler secret put REPO_SIGNING_KEY --env production
 # Optional: publish public key for DID document
-wrangler secret put REPO_SIGNING_PUBLIC_KEY --env production
+wrangler secret put REPO_SIGNING_KEY_PUBLIC --env production
 ```
 
 ### Using Cloudflare Secret Store (optional)
@@ -373,7 +373,7 @@ wrangler secret put USER_PASSWORD     # Login password
 wrangler secret put ACCESS_TOKEN_SECRET
 wrangler secret put REFRESH_TOKEN_SECRET
 # Optional: publish raw public key for DID document
-wrangler secret put REPO_SIGNING_PUBLIC_KEY
+wrangler secret put REPO_SIGNING_KEY_PUBLIC
 ```
 
 **For Local Development (.dev.vars):**
@@ -382,7 +382,7 @@ PDS_DID=did:plc:your-did-here
 PDS_HANDLE=your-handle.bsky.social
 REPO_SIGNING_KEY=<base64-key-from-step-1>
 # Optional: publish raw 32-byte public key in did.json
-REPO_SIGNING_PUBLIC_KEY=<base64-raw-public-key>
+REPO_SIGNING_KEY_PUBLIC=<base64-raw-public-key>
 USER_PASSWORD=your-password
 ACCESS_TOKEN_SECRET=your-access-secret
 REFRESH_TOKEN_SECRET=your-refresh-secret

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alteran/astro",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Astro integration for running a Cloudflare-hosted Bluesky PDS with Alteran.",
   "module": "index.js",
   "types": "index.d.ts",

package/src/lib/auth.ts

@@ -6,7 +6,10 @@ export async function isAuthorized(request: Request, env: any): Promise<boolean>
   if (!auth || !auth.startsWith('Bearer ')) return false;
   const token = auth.slice(7);
   // Prefer JWT
-  const ver = await verifyJwt(env, token).catch(() => null);
+  const ver = await verifyJwt(env, token).catch((err) => {
+    console.error('JWT verification error:', err);
+    return null;
+  });
   if (ver && ver.valid && ver.payload.t === 'access') return true;
   // Back-compat local escape hatch if explicitly enabled
   const allowDev = (env as any).PDS_ALLOW_DEV_TOKEN === '1';

package/src/lib/jwt.ts

@@ -127,22 +127,28 @@ async function eddsaJwtVerify(data: string, sigB64: string, env: Env): Promise<b
   const enc = new TextEncoder();
 
   // Import Ed25519 public key from env
-  const keyData = await getRuntimeString(env, 'REPO_SIGNING_PUBLIC_KEY');
+  const keyData = await getRuntimeString(env, 'REPO_SIGNING_KEY_PUBLIC');
   if (!keyData) {
+    console.error('EdDSA JWT verification failed: REPO_SIGNING_KEY_PUBLIC not configured');
     return false;
   }
 
-  const keyBytes = b64urlDecode(keyData);
-  const key = await crypto.subtle.importKey(
-    'raw',
-    keyBytes,
-    { name: 'Ed25519', namedCurve: 'Ed25519' } as any,
-    false,
-    ['verify']
-  );
+  try {
+    const keyBytes = b64urlDecode(keyData);
+    const key = await crypto.subtle.importKey(
+      'raw',
+      keyBytes,
+      { name: 'Ed25519', namedCurve: 'Ed25519' } as any,
+      false,
+      ['verify']
+    );
 
-  const ok = await crypto.subtle.verify('Ed25519', key, b64urlDecode(sigB64), enc.encode(data));
-  return !!ok;
+    const ok = await crypto.subtle.verify('Ed25519', key, b64urlDecode(sigB64), enc.encode(data));
+    return !!ok;
+  } catch (error) {
+    console.error('EdDSA JWT verification error:', error);
+    return false;
+  }
 }
 
 function b64url(bytes: ArrayBuffer | Uint8Array): string {

package/src/lib/secrets.ts

@@ -9,7 +9,7 @@ const SECRET_KEYS = [
   'ACCESS_TOKEN_SECRET',
   'REFRESH_TOKEN_SECRET',
   'REPO_SIGNING_KEY',
-  'REPO_SIGNING_PUBLIC_KEY',
+  'REPO_SIGNING_KEY_PUBLIC',
 ] as const satisfies readonly (keyof Env)[];
 
 function isSecretStoreBinding(value: unknown): value is SecretsStoreSecret {

package/src/pages/xrpc/com.atproto.identity.getRecommendedDidCredentials.ts

@@ -21,9 +21,9 @@ export async function GET({ locals, request }: APIContext) {
 
     // Get signing key if available
     let signingKey: string | undefined;
-    if (env.REPO_SIGNING_PUBLIC_KEY) {
+    if (env.REPO_SIGNING_KEY_PUBLIC) {
       // Convert raw public key to multibase format
-      const pubKeyStr = String(env.REPO_SIGNING_PUBLIC_KEY);
+      const pubKeyStr = String(env.REPO_SIGNING_KEY_PUBLIC);
       const pubKeyBytes = Uint8Array.from(atob(pubKeyStr), c => c.charCodeAt(0));
 
       // Ed25519 multicodec prefix (0xed01) + public key

package/types/env.d.ts

@@ -33,7 +33,7 @@ declare global {
     PDS_REFRESH_TTL_SEC?: string;
     JWT_ALGORITHM?: string;
     REPO_SIGNING_KEY?: string | SecretsStoreSecret;
-    REPO_SIGNING_PUBLIC_KEY?: string | SecretsStoreSecret;
+    REPO_SIGNING_KEY_PUBLIC?: string | SecretsStoreSecret;
     PDS_RATE_LIMIT_PER_MIN?: string;
     PDS_MAX_JSON_BYTES?: string;
     PDS_CORS_ORIGIN?: string;