astro-atmosphere-comments 0.4.2 → 0.6.0

package/routes/post.ts

@@ -5,7 +5,7 @@ import type { APIRoute } from "astro";
 import { json } from "../lib/http";
 import { publicProfile } from "../lib/profile";
 import { quotedPost } from "../lib/quoted";
-import { isSitePost } from "../lib/reader";
+import { isSitePost } from "../lib/uris";
 import settings from "../lib/settings";
 
 export const GET: APIRoute = async ({ url }) => {
@@ -18,6 +18,7 @@ export const GET: APIRoute = async ({ url }) => {
     return json({
       author: publicProfile(quoted.author),
       text: quoted.text,
+      indexedAt: quoted.indexedAt,
       ...(external && {
         external: {
           uri: external.uri,

package/routes/profile.ts

@@ -0,0 +1,20 @@
+// A signed-in reader's public profile, for the comment box and the account
+// menu: ?did=<DID> gives their handle, display name and avatar (through this
+// site, routes/media.ts). The page asks for it after the reader signs in in
+// their own browser; it's public, so no sign-in is needed to ask.
+import type { APIRoute } from "astro";
+import { rememberAvatar } from "../lib/avatars";
+import { addressOf, json, rateLimit } from "../lib/http";
+import { profileFor, publicProfile } from "../lib/profile";
+
+const DID = /^did:[a-z0-9]+:[a-zA-Z0-9._:%-]+$/;
+const perAddress = rateLimit(30, 300);
+
+export const GET: APIRoute = async (context) => {
+  const did = context.url.searchParams.get("did") ?? "";
+  if (!DID.test(did) || did.length > 200) return json({ error: "bad-request" }, 400);
+  if (perAddress(addressOf(context))) return json({ error: "too-many" }, 429);
+  const profile = await profileFor(did);
+  if (profile.avatarSource) rememberAvatar(did, profile.avatarSource);
+  return json(publicProfile(profile));
+};

package/routes/richtext.ts

@@ -0,0 +1,30 @@
+// Finds the links, @mentions and #hashtags in a comment before the reader's
+// browser posts it, as the Bluesky app does: POST { text } gives { text,
+// facets }. Mentions are looked up here (Bluesky's public API), so the
+// reader's browser doesn't contact Bluesky. Nothing is posted or kept.
+import { AtpAgent, RichText } from "@atproto/api";
+import type { APIRoute } from "astro";
+import { addressOf, fromThisSite, json, rateLimit } from "../lib/http";
+
+const publicAgent = new AtpAgent({ service: "https://public.api.bsky.app" });
+const perAddress = rateLimit(20, 200);
+
+export const POST: APIRoute = async (context) => {
+  const { request, url } = context;
+  if (!fromThisSite(request, url)) return json({ error: "forbidden" }, 403);
+  let text: unknown;
+  try {
+    ({ text } = await request.json());
+  } catch {
+    return json({ error: "bad-request" }, 400);
+  }
+  if (typeof text !== "string" || !text.trim() || text.length > 3000) return json({ error: "bad-request" }, 400);
+  if (perAddress(addressOf(context))) return json({ error: "too-many" }, 429);
+  const richText = new RichText({ text: text.trim() });
+  try {
+    await richText.detectFacets(publicAgent);
+  } catch {
+    richText.detectFacetsWithoutResolution();
+  }
+  return json({ text: richText.text, facets: richText.facets ?? [] });
+};

package/routes/thread.ts

@@ -3,11 +3,16 @@
 //   ?document=<at:// URI of the page's Standard.site record>, whose
 //   bskyPostRef names the announcement.
 // Only threads started by the site's own accounts are served.
+//
+// POST { root } forgets the cached copy of a thread, so a comment the
+// reader's browser has just posted shows when the page is next loaded.
 import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { isSitePost } from "../lib/reader";
+import { addressOf, fromThisSite, json, rateLimit } from "../lib/http";
+import { isSitePost } from "../lib/uris";
 import { announcementFromDocument, postUriFromUrl } from "../lib/resolve";
-import { getThread } from "../lib/thread";
+import { forgetThread, getThread } from "../lib/thread";
+
+const perAddress = rateLimit(10, 100);
 
 export const GET: APIRoute = async ({ url }) => {
   const post = url.searchParams.get("post");
@@ -25,3 +30,18 @@ export const GET: APIRoute = async ({ url }) => {
   const thread = await getThread(uri);
   return thread ? json({ thread }) : json({ error: "unavailable" }, 502);
 };
+
+export const POST: APIRoute = async (context) => {
+  const { request, url } = context;
+  if (!fromThisSite(request, url)) return json({ error: "forbidden" }, 403);
+  let root: unknown;
+  try {
+    ({ root } = await request.json());
+  } catch {
+    return json({ error: "bad-request" }, 400);
+  }
+  if (!isSitePost(root)) return json({ error: "not-allowed" }, 400);
+  if (perAddress(addressOf(context))) return json({ error: "too-many" }, 429);
+  forgetThread(root);
+  return json({ ok: true });
+};

package/routes/typeahead.ts

@@ -6,15 +6,12 @@
 // proxy every visitor may share one address), so the site can't be used to
 // flood Bluesky's search. Answers are remembered for a minute.
 import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { rateLimit } from "../lib/reader";
+import { addressOf, json, rateLimit } from "../lib/http";
 import settings from "../lib/settings";
 import { rememberAvatar } from "../lib/avatars";
-import { signedInDid } from "../lib/visitor";
 
-const perReader = rateLimit(60, 1200);
-const perAddress = rateLimit(30, 300);
-const signedOutOverall = rateLimit(300, 6000);
+const perAddress = rateLimit(60, 600);
+const overall = rateLimit(600, 12000);
 
 type Actor = { did: string; handle: string; displayName?: string; avatar?: string };
 const recent = new Map<string, { actors: Actor[]; at: number }>();
@@ -36,23 +33,10 @@ async function search(q: string): Promise<Actor[]> {
   return actors;
 }
 
-export const GET: APIRoute = async ({ url, cookies, clientAddress }) => {
-  const q = (url.searchParams.get("q") ?? "").trim().replace(/^@/, "");
-  const did = await signedInDid(cookies);
-  // One letter is enough for an @mention; signing in needs two.
-  if (!q || (!did && q.length < 2) || q.length > 64 || /[\s<>"]/.test(q)) return json({ actors: [] });
-
-  if (did) {
-    if (perReader(did)) return json({ error: "too-many" }, 429);
-  } else {
-    let address = "unknown";
-    try {
-      address = clientAddress;
-    } catch {
-      // Some adapters can't tell; the overall cap still applies.
-    }
-    if (perAddress(address) || signedOutOverall("all")) return json({ error: "too-many" }, 429);
-  }
+export const GET: APIRoute = async (context) => {
+  const q = (context.url.searchParams.get("q") ?? "").trim().replace(/^@/, "");
+  if (!q || q.length > 64 || /[\s<>"]/.test(q)) return json({ actors: [] });
+  if (perAddress(addressOf(context)) || overall("all")) return json({ error: "too-many" }, 429);
 
   try {
     const actors = (await search(q)).map((actor) => {

package/virtual.d.ts

@@ -2,3 +2,8 @@ declare module "virtual:atmosphere-comments/settings" {
   const settings: import("./lib/settings").AtmosphereSettings;
   export default settings;
 }
+
+declare module "virtual:atmosphere-comments/public-settings" {
+  const settings: import("./lib/public-settings").PublicSettings;
+  export default settings;
+}

package/bin/cli.mjs

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-// npx astro-atmosphere-comments keygen
-//
-// Creates your site's private signing key and adds it to .env (in the folder
-// you run it from) as ATMOSPHERE_PRIVATE_JWK, without printing it. Account
-// hosts check your site's requests against the public half, which the
-// integration publishes at /atmosphere/jwks.json. It refuses if .env already
-// has a key: a new key signs every reader out.
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { JoseKey } from "@atproto/oauth-client-node";
-
-const [command] = process.argv.slice(2);
-if (command !== "keygen") {
-  console.log("Usage: npx astro-atmosphere-comments keygen\n\nAdds a new signing key to .env as ATMOSPHERE_PRIVATE_JWK.");
-  process.exit(command ? 1 : 0);
-}
-
-const envFile = ".env";
-const existing = existsSync(envFile) ? readFileSync(envFile, "utf8") : "";
-if (/^ATMOSPHERE_PRIVATE_JWK=.+/m.test(existing)) {
-  console.error("ATMOSPHERE_PRIVATE_JWK is already set in .env; leaving it alone.");
-  process.exit(1);
-}
-
-const key = await JoseKey.generate(["ES256"], "atmosphere-comments-1");
-const line = `ATMOSPHERE_PRIVATE_JWK='${JSON.stringify(key.privateJwk)}'`;
-const kept = existing.replace(/^ATMOSPHERE_PRIVATE_JWK=\s*$/m, "").replace(/\n*$/, existing ? "\n" : "");
-writeFileSync(envFile, `${kept}${line}\n`, { mode: 0o600 });
-console.log(
-  "Added ATMOSPHERE_PRIVATE_JWK to .env (not shown). Set the same value on your server, keep .env out of Git, and keep a backup somewhere safe.",
-);

package/lib/oauth.ts

@@ -1,110 +0,0 @@
-// The AT Protocol OAuth client: how this site asks a reader's account host for
-// permission to post comments on their behalf.
-//
-// - Live, the site is a "confidential client": account hosts read its
-//   /oauth-client-metadata.json, and it proves who it is with a private key
-//   (ATMOSPHERE_PRIVATE_JWK, server-only). Sign-ins can then last for months.
-// - In `astro dev`, it uses the protocol's local-testing client (no key, no
-//   public address needed). Open the site at http://127.0.0.1:<port>, not
-//   localhost, because the host sends readers back to that address.
-import { requestLocalLock } from "@atproto/oauth-client";
-import {
-  buildAtprotoLoopbackClientMetadata,
-  JoseKey,
-  NodeOAuthClient,
-  type NodeSavedSession,
-  type NodeSavedState,
-} from "@atproto/oauth-client-node";
-import { getSecret } from "astro:env/server";
-import settings from "./settings";
-import { fileStore } from "./store";
-
-// Only what commenting needs: create posts, create (and delete again) likes
-// and reposts, and read posts as the reader sees them (to know whether they've
-// already liked or reposted), through Bluesky's AppView.
-export const SCOPE = [
-  "atproto",
-  "repo:app.bsky.feed.post?action=create",
-  "repo:app.bsky.feed.like?action=create&action=delete",
-  "repo:app.bsky.feed.repost?action=create&action=delete",
-  "rpc:app.bsky.feed.getPosts?aud=did:web:api.bsky.app%23bsky_appview",
-].join(" ");
-
-// Deleting posts is asked for separately, only when a reader first deletes a
-// comment here, so most readers never grant it. (A permission can only name a
-// kind of record, not particular posts: the delete route itself makes sure it
-// is only used on the reader's own comments under the site's posts.)
-export const DELETE_SCOPE = "repo:app.bsky.feed.post?action=delete";
-
-// Following (and unfollowing) the site's own accounts is asked for the same
-// way, the first time a reader presses Follow.
-export const FOLLOW_SCOPE = "repo:app.bsky.graph.follow?action=create&action=delete";
-
-// Everything the site may ask for, which its client metadata has to list.
-const ALL_SCOPES = `${SCOPE} ${DELETE_SCOPE} ${FOLLOW_SCOPE}`;
-
-const KEY_ID = "atmosphere-comments-1";
-
-export const callbackPath = `${settings.base}/callback`;
-
-export function clientMetadata() {
-  return {
-    // At the site's root, the address account hosts treat as the convention:
-    // Bluesky's approval page then shows just the site's address.
-    client_id: `${settings.site}/oauth-client-metadata.json`,
-    client_name: settings.clientName,
-    client_uri: settings.site,
-    ...(settings.logoUri && { logo_uri: settings.logoUri }),
-    ...(settings.policyUri && { policy_uri: settings.policyUri }),
-    ...(settings.tosUri && { tos_uri: settings.tosUri }),
-    redirect_uris: [`${settings.site}${callbackPath}`] as [string],
-    scope: ALL_SCOPES,
-    grant_types: ["authorization_code", "refresh_token"] as ["authorization_code", "refresh_token"],
-    response_types: ["code"] as ["code"],
-    application_type: "web" as const,
-    token_endpoint_auth_method: "private_key_jwt" as const,
-    token_endpoint_auth_signing_alg: "ES256",
-    dpop_bound_access_tokens: true,
-    jwks_uri: `${settings.site}${settings.base}/jwks.json`,
-  };
-}
-
-let keyPromise: Promise<JoseKey> | undefined;
-
-export function privateKey(): Promise<JoseKey> {
-  keyPromise ??= (async () => {
-    const jwk = getSecret("ATMOSPHERE_PRIVATE_JWK");
-    if (!jwk) throw new Error("ATMOSPHERE_PRIVATE_JWK is not set");
-    return JoseKey.fromImportable(jwk, KEY_ID);
-  })();
-  return keyPromise;
-}
-
-const stores = {
-  // A sign-in in progress: kept for an hour at most.
-  state: fileStore<NodeSavedState>("oauth-state", 60 * 60 * 1000),
-  // Each reader's tokens, by their DID.
-  session: fileStore<NodeSavedSession>("oauth-sessions"),
-};
-
-let clientPromise: Promise<NodeOAuthClient> | undefined;
-
-/** The OAuth client. `origin` is only used in `astro dev`, for the local callback address. */
-export function oauthClient(origin: string): Promise<NodeOAuthClient> {
-  clientPromise ??= (async () => {
-    const common = { stateStore: stores.state, sessionStore: stores.session, requestLock: requestLocalLock };
-    if (import.meta.env.DEV) {
-      const local = new URL(origin);
-      local.hostname = "127.0.0.1";
-      return new NodeOAuthClient({
-        ...common,
-        clientMetadata: buildAtprotoLoopbackClientMetadata({
-          scope: ALL_SCOPES,
-          redirect_uris: [`${local.origin}${callbackPath}`],
-        }),
-      });
-    }
-    return new NodeOAuthClient({ ...common, clientMetadata: clientMetadata(), keyset: [await privateKey()] });
-  })();
-  return clientPromise;
-}

package/lib/reader.ts

@@ -1,130 +0,0 @@
-// What every action needs: a request from this site, a signed-in reader, and
-// an OAuth session with all the permissions in SCOPE. Readers who signed in
-// before the site asked for more (likes and reposts were added later) are
-// asked to sign in again rather than meeting a confusing failure.
-import type { OAuthSession } from "@atproto/oauth-client-node";
-import type { AstroCookies } from "astro";
-import { fromThisSite, json } from "./http";
-import { oauthClient, SCOPE } from "./oauth";
-import settings from "./settings";
-import { signedInDid, signOut } from "./visitor";
-
-export type Reader = { did: string; session: OAuthSession; scopes: string[] };
-
-const APPVIEW_PROXY = "did:web:api.bsky.app#bsky_appview";
-const POST_URI = /^at:\/\/(did:[a-z0-9]+:[a-zA-Z0-9._:%-]+)\/app\.bsky\.feed\.post\/([a-zA-Z0-9._~-]+)$/;
-
-/** The reader, or the Response to send instead. */
-export async function reader(request: Request, url: URL, cookies: AstroCookies): Promise<Reader | Response> {
-  // Requests that change something must come from a page on this site.
-  // Browsers leave Origin off same-site GETs, and a GET only reads (other
-  // sites' scripts can't send the SameSite cookie or read the answer).
-  if (request.method !== "GET") {
-    if (!fromThisSite(request, url)) return json({ error: "forbidden" }, 403);
-    if (!request.headers.get("content-type")?.startsWith("application/json")) return json({ error: "bad-request" }, 415);
-  }
-  const did = await signedInDid(cookies);
-  if (!did) return json({ error: "signed-out" }, 401);
-  try {
-    const session = await (await oauthClient(url.origin)).restore(did);
-    // Compared by permission name ("repo:app.bsky.feed.like"), since a host
-    // may write the parameters after it differently.
-    const scopes = (await session.getTokenInfo(false)).scope.split(" ");
-    const granted = scopes.map((part) => part.split("?")[0]);
-    if (!SCOPE.split(" ").every((part) => granted.includes(part.split("?")[0]))) {
-      await signOut(cookies);
-      return json({ error: "new-permissions" }, 401);
-    }
-    return { did, session, scopes };
-  } catch {
-    // The grant has expired or been revoked: the reader needs to sign in again.
-    await signOut(cookies);
-    return json({ error: "signed-out" }, 401);
-  }
-}
-
-/**
- * Whether the reader's grant allows `action` on records of `collection`: a
- * repo permission for that collection (or all of them) listing the action,
- * or listing no actions, which means all of them.
- */
-export function allows(reader: Reader, collection: string, action: string): boolean {
-  return reader.scopes.some((scope) => {
-    const [name, query = ""] = scope.split("?");
-    if (name !== `repo:${collection}` && name !== "repo:*") return false;
-    const actions = new URLSearchParams(query).getAll("action");
-    return !actions.length || actions.includes(action);
-  });
-}
-
-/** True for a post by one of the site's own accounts (an announcement). */
-export function isSitePost(uri: unknown): uri is string {
-  const match = typeof uri === "string" ? POST_URI.exec(uri) : null;
-  return !!match && settings.allowedAuthors.includes(match[1]);
-}
-
-export const isPostUri = (uri: unknown): uri is string => typeof uri === "string" && POST_URI.test(uri);
-
-/** True for one of the site's announcements, or a comment somewhere under one. */
-export const inSiteThread = (view: PostView): boolean =>
-  isSitePost(view.uri) || isSitePost(view.record?.reply?.root?.uri);
-
-export type PostView = {
-  uri: string;
-  cid: string;
-  record?: { reply?: { root?: { uri?: string } } };
-  viewer?: { like?: string; repost?: string };
-};
-
-/** Posts as the reader sees them (including whether they've liked or reposted them). */
-export async function postsAsReader(session: OAuthSession, uris: string[]): Promise<PostView[]> {
-  const views: PostView[] = [];
-  // Bluesky answers for at most 25 posts at a time.
-  for (let start = 0; start < uris.length; start += 25) {
-    const query = uris
-      .slice(start, start + 25)
-      .map((uri) => `uris=${encodeURIComponent(uri)}`)
-      .join("&");
-    const response = await session.fetchHandler(`/xrpc/app.bsky.feed.getPosts?${query}`, {
-      headers: { "atproto-proxy": APPVIEW_PROXY },
-    });
-    if (!response.ok) throw new Error(`getPosts ${response.status}`);
-    views.push(...(((await response.json()) as { posts?: PostView[] }).posts ?? []));
-  }
-  return views;
-}
-
-export async function createRecord(reader: Reader, collection: string, record: Record<string, unknown>) {
-  const response = await reader.session.fetchHandler("/xrpc/com.atproto.repo.createRecord", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ repo: reader.did, collection, record }),
-  });
-  if (!response.ok) throw new Error(`createRecord ${response.status} ${await response.text().catch(() => "")}`);
-  return (await response.json()) as { uri: string; cid: string };
-}
-
-/** Deletes one of the reader's own records, given its AT URI. */
-export async function deleteRecord(reader: Reader, uri: string) {
-  const [, repo, collection, rkey] = uri.match(/^at:\/\/([^/]+)\/([^/]+)\/([^/]+)$/) ?? [];
-  if (repo !== reader.did || !collection || !rkey) throw new Error("not the reader's record");
-  const response = await reader.session.fetchHandler("/xrpc/com.atproto.repo.deleteRecord", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ repo: reader.did, collection, rkey }),
-  });
-  if (!response.ok) throw new Error(`deleteRecord ${response.status}`);
-}
-
-/** A simple per-account limit: at most `perMinute` a minute and `perHour` an hour. */
-export function rateLimit(perMinute: number, perHour: number) {
-  const recent = new Map<string, number[]>();
-  return (did: string): boolean => {
-    const now = Date.now();
-    const times = (recent.get(did) ?? []).filter((time) => now - time < 60 * 60 * 1000);
-    recent.set(did, times);
-    if (times.length >= perHour || times.filter((time) => now - time < 60 * 1000).length >= perMinute) return true;
-    times.push(now);
-    return false;
-  };
-}

package/lib/store.ts

@@ -1,46 +0,0 @@
-// Small file-based stores for sign-in data, one JSON file per key.
-//
-// They hold OAuth tokens, so the folder and files are readable only by the
-// site's own user (0700 / 0600), and file names are hashes, never handles or
-// cookie values. Set ATMOSPHERE_DATA_DIR to a folder outside the release, so
-// deploys don't sign everyone out (default: .data/atmosphere in the project).
-import { createHash } from "node:crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { getSecret } from "astro:env/server";
-
-const root = path.resolve(getSecret("ATMOSPHERE_DATA_DIR") || ".data/atmosphere");
-
-const fileFor = (folder: string, key: string) =>
-  path.join(root, folder, `${createHash("sha256").update(key).digest("hex")}.json`);
-
-type Stored<V> = { value: V; expiresAt?: number };
-
-export function fileStore<V>(folder: string, lifetimeMs?: number) {
-  return {
-    async get(key: string): Promise<V | undefined> {
-      try {
-        const stored = JSON.parse(await readFile(fileFor(folder, key), "utf8")) as Stored<V>;
-        if (stored.expiresAt && stored.expiresAt < Date.now()) {
-          await rm(fileFor(folder, key), { force: true });
-          return undefined;
-        }
-        return stored.value;
-      } catch {
-        return undefined;
-      }
-    },
-    async set(key: string, value: V): Promise<void> {
-      const file = fileFor(folder, key);
-      await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-      const stored: Stored<V> = { value, ...(lifetimeMs && { expiresAt: Date.now() + lifetimeMs }) };
-      // Write then rename, so a crash never leaves half a file.
-      const temporary = `${file}.${process.pid}.tmp`;
-      await writeFile(temporary, JSON.stringify(stored), { mode: 0o600 });
-      await rename(temporary, file);
-    },
-    async del(key: string): Promise<void> {
-      await rm(fileFor(folder, key), { force: true });
-    },
-  };
-}

package/lib/visitor.ts

@@ -1,42 +0,0 @@
-// Who is signed in on this browser.
-//
-// The cookie holds only a random value. The server keeps which account that
-// value belongs to, so signing out really ends it, and the cookie is useless
-// to anyone who copies it after that. HttpOnly keeps it away from page
-// scripts; SameSite=Lax lets it come back with the reader from their account
-// host (a top-level navigation) but not with other sites' form posts.
-import { randomBytes } from "node:crypto";
-import type { AstroCookies } from "astro";
-import { fileStore } from "./store";
-
-const COOKIE = "atmosphere_session";
-const LIFETIME_MS = 60 * 24 * 60 * 60 * 1000; // 60 days
-
-type Visitor = { did: string; signedInAt: string };
-
-const visitors = fileStore<Visitor>("visitors", LIFETIME_MS);
-
-export async function signIn(cookies: AstroCookies, url: URL, did: string): Promise<void> {
-  const token = randomBytes(32).toString("base64url");
-  await visitors.set(token, { did, signedInAt: new Date().toISOString() });
-  cookies.set(COOKIE, token, {
-    path: "/",
-    httpOnly: true,
-    sameSite: "lax",
-    secure: url.protocol === "https:",
-    maxAge: LIFETIME_MS / 1000,
-  });
-}
-
-/** The signed-in account's DID, if any. */
-export async function signedInDid(cookies: AstroCookies): Promise<string | undefined> {
-  const token = cookies.get(COOKIE)?.value;
-  if (!token || token.length > 100) return undefined;
-  return (await visitors.get(token))?.did;
-}
-
-export async function signOut(cookies: AstroCookies): Promise<void> {
-  const token = cookies.get(COOKIE)?.value;
-  if (token && token.length <= 100) await visitors.del(token);
-  cookies.delete(COOKIE, { path: "/" });
-}

package/routes/callback.ts

@@ -1,30 +0,0 @@
-// The reader's account host sends them back here after they approve (or
-// decline) this site's request. On success they are signed in on this site
-// and returned to the post they were reading.
-import type { APIRoute } from "astro";
-import { safeReturnPath, withStatus } from "../lib/http";
-import { oauthClient } from "../lib/oauth";
-import { signIn } from "../lib/visitor";
-
-function returnPathFrom(state: unknown): string {
-  try {
-    return safeReturnPath((JSON.parse(String(state)) as { returnTo?: unknown }).returnTo);
-  } catch {
-    return "/";
-  }
-}
-
-export const GET: APIRoute = async ({ url, cookies, redirect }) => {
-  try {
-    const client = await oauthClient(url.origin);
-    const { session, state } = await client.callback(url.searchParams);
-    await signIn(cookies, url, session.did);
-    return redirect(withStatus(returnPathFrom(state), "signed-in"), 303);
-  } catch (error) {
-    // The reader declined, took too long, or something went wrong. The
-    // library's error still carries our state, so they can go back.
-    const state = (error as { state?: unknown }).state;
-    console.warn("[atmosphere] sign-in failed:", error instanceof Error ? error.message : error);
-    return redirect(withStatus(returnPathFrom(state), "sign-in-failed"), 303);
-  }
-};

package/routes/comment.ts

@@ -1,97 +0,0 @@
-// Posts as the signed-in reader, to their own account:
-// - a comment: a reply to the post's announcement (`root`), or to one of the
-//   comments under it (`parent`);
-// - a quote post (`quote: true`): their own post quoting the announcement.
-import { AtpAgent, RichText } from "@atproto/api";
-import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { profileFor, publicProfile } from "../lib/profile";
-import { createRecord, isPostUri, isSitePost, postsAsReader, rateLimit, reader } from "../lib/reader";
-import { forgetThread } from "../lib/thread";
-
-const MAX_GRAPHEMES = 300; // Bluesky's limit for a post
-
-const tooMany = rateLimit(5, 30);
-const publicAgent = new AtpAgent({ service: "https://public.api.bsky.app" });
-const graphemes = new Intl.Segmenter();
-
-export const POST: APIRoute = async ({ request, url, cookies }) => {
-  const signedIn = await reader(request, url, cookies);
-  if (signedIn instanceof Response) return signedIn;
-
-  let body: { text?: unknown; root?: unknown; parent?: unknown; quote?: unknown };
-  try {
-    body = await request.json();
-  } catch {
-    return json({ error: "bad-request" }, 400);
-  }
-
-  const text = typeof body.text === "string" ? body.text.trim() : "";
-  const length = [...graphemes.segment(text)].length;
-  if (!length) return json({ error: "empty" }, 400);
-  if (length > MAX_GRAPHEMES) return json({ error: "too-long" }, 400);
-
-  // Only this site's own announcements (and comments under them) can be
-  // replied to or quoted from here.
-  const root = body.root;
-  if (!isSitePost(root)) return json({ error: "not-allowed" }, 400);
-  const quote = body.quote === true;
-  const parent = !quote && body.parent !== undefined && body.parent !== root ? body.parent : undefined;
-  if (parent !== undefined && !isPostUri(parent)) return json({ error: "not-allowed" }, 400);
-
-  if (tooMany(signedIn.did)) return json({ error: "too-many" }, 429);
-
-  let posts;
-  try {
-    posts = await postsAsReader(signedIn.session, parent ? [root, parent] : [root]);
-  } catch {
-    return json({ error: "unavailable" }, 502);
-  }
-  const rootPost = posts.find((post) => post.uri === root);
-  const parentPost = parent ? posts.find((post) => post.uri === parent) : rootPost;
-  if (!rootPost || !parentPost) return json({ error: "not-found" }, 404);
-  // A comment being replied to must belong to this announcement's thread.
-  if (parent && parentPost.record?.reply?.root?.uri !== root) return json({ error: "not-allowed" }, 400);
-
-  // Links, @mentions and #tags become proper links, as in the Bluesky app.
-  const richText = new RichText({ text });
-  try {
-    await richText.detectFacets(publicAgent);
-  } catch {
-    richText.detectFacetsWithoutResolution();
-  }
-
-  const record = {
-    $type: "app.bsky.feed.post",
-    text: richText.text,
-    ...(richText.facets?.length && { facets: richText.facets }),
-    ...(quote
-      ? { embed: { $type: "app.bsky.embed.record", record: { uri: rootPost.uri, cid: rootPost.cid } } }
-      : {
-          reply: {
-            root: { uri: rootPost.uri, cid: rootPost.cid },
-            parent: { uri: parentPost.uri, cid: parentPost.cid },
-          },
-        }),
-    createdAt: new Date().toISOString(),
-  };
-
-  let created;
-  try {
-    created = await createRecord(signedIn, "app.bsky.feed.post", record);
-  } catch (error) {
-    console.warn("[atmosphere] post failed:", error instanceof Error ? error.message : error);
-    return json({ error: "post-failed" }, 502);
-  }
-  forgetThread(root);
-  const profile = await profileFor(signedIn.did);
-  return json({
-    uri: created.uri,
-    url: `https://bsky.app/profile/${profile.handle}/post/${created.uri.split("/").pop()}`,
-    text: richText.text,
-    author: publicProfile(profile),
-    createdAt: record.createdAt,
-    quote,
-    parent: parent ?? null,
-  });
-};