use std::ops::Not; use std::str::FromStr; use std::sync::Arc; use std::sync::atomic::{AtomicUsize, Ordering}; use std::time::Duration; use jacquard_common::Data; use jacquard_common::IntoStatic; use jacquard_common::types::crypto::PublicKey; use jacquard_common::types::ident::AtIdentifier; use jacquard_common::types::string::Did; use jacquard_common::types::string::Handle; use jacquard_identity::JacquardResolver; use jacquard_identity::resolver::{ IdentityError, IdentityErrorKind, IdentityResolver, PlcSource, ResolverOptions, }; use miette::{Diagnostic, IntoDiagnostic}; use reqwest::StatusCode; use reqwest::redirect::Policy; use scc::HashCache; use smol_str::SmolStr; use thiserror::Error; use url::Url; use crate::util::url_to_fluent_uri; // as per spec: https://web.plc.directory/spec/v0.1/did-plc // "As an anti-abuse mechanism, operations have a maximum size when encoded as // DAG-CBOR. The current limit is 7500 bytes." const MAX_DID_DOC_BYTES: usize = 16384; // this is generous i think but we deal with json so.. #[derive(Debug, Diagnostic, Error)] pub enum ResolverError { #[error("{0}")] Generic(miette::Report), #[error("too many requests")] Ratelimited, #[error("transport error: {0}")] Transport(SmolStr), } impl From for ResolverError { fn from(e: IdentityError) -> Self { match e.kind() { IdentityErrorKind::HttpStatus(reqwest::StatusCode::TOO_MANY_REQUESTS) => { Self::Ratelimited } IdentityErrorKind::Transport(msg) => Self::Transport(msg.clone()), _ => Self::Generic(e.into()), } } } impl From for ResolverError { fn from(report: miette::Report) -> Self { ResolverError::Generic(report) } } #[derive(Clone)] pub struct MiniDoc { pub pds: Url, pub handle: Option>, pub key: Option>, } struct ResolverInner { jacquards: Vec, next_idx: AtomicUsize, cache: HashCache, MiniDoc>, } #[derive(Clone)] pub struct Resolver { inner: Arc, } impl Resolver { pub fn new(plc_urls: Vec, identity_cache_size: u64) -> Self { let http = reqwest::Client::builder() .redirect(Policy::none()) .timeout(Duration::from_secs(20)) .build() .expect("resolver HTTP client configuration should be valid"); let mut jacquards = Vec::with_capacity(plc_urls.len()); for url in plc_urls { let opts = ResolverOptions { plc_source: PlcSource::PlcDirectory { base: url_to_fluent_uri(&url), }, request_timeout: Some(Duration::from_secs(3)), ..Default::default() }; jacquards.push(JacquardResolver::new(http.clone(), opts).with_system_dns()); } if jacquards.is_empty() { panic!("at least one PLC URL must be provided"); } Self { inner: Arc::new(ResolverInner { jacquards, next_idx: AtomicUsize::new(0), cache: HashCache::with_capacity( std::cmp::min(1000, (identity_cache_size / 100) as usize), identity_cache_size as usize, ), }), } } pub async fn invalidate(&self, did: &Did<'_>) { self.inner .cache .remove_async(&did.clone().into_static()) .await; } pub fn invalidate_sync(&self, did: &Did<'_>) { self.inner.cache.remove_sync(&did.clone().into_static()); } async fn req<'r, T, Fut>( &'r self, is_plc: bool, f: impl Fn(&'r JacquardResolver) -> Fut, ) -> Result where Fut: Future>, { let mut idx = self.inner.next_idx.fetch_add(1, Ordering::Relaxed) % self.inner.jacquards.len(); let mut try_count = 0; loop { let res = f(&self.inner.jacquards[idx]).await; try_count += 1; // retry these with the different plc resolvers if is_plc { let is_retriable = matches!( res.as_ref().map_err(|e| e.kind()), Err(IdentityErrorKind::HttpStatus(StatusCode::TOO_MANY_REQUESTS) | IdentityErrorKind::Transport(_)) ); // check if retriable and we haven't gone through all the plc resolvers if is_retriable && try_count < self.inner.jacquards.len() { idx = (idx + 1) % self.inner.jacquards.len(); continue; } } return res.map_err(Into::into); } } pub async fn resolve_did( &self, identifier: &AtIdentifier<'_>, ) -> Result, ResolverError> { match identifier { AtIdentifier::Did(did) => Ok(did.clone().into_static()), AtIdentifier::Handle(handle) => { let did = self.req(false, |j| j.resolve_handle(handle)).await?; Ok(did.into_static()) } } } pub async fn resolve_doc(&self, did: &Did<'_>) -> Result { let did_static = did.clone().into_static(); if let Some(entry) = self.inner.cache.get_async(&did_static).await { return Ok(entry.get().clone()); } let doc_resp = self .req(did.starts_with("did:plc:"), |j| j.resolve_did_doc(did)) .await?; let doc = doc_resp.parse()?; let pds = doc .pds_endpoint() .ok_or_else(|| miette::miette!("no PDS service found in DID Doc for {did}"))?; let mut handles = doc.handles(); let handle = handles .is_empty() .not() .then(|| handles.remove(0).into_static()); let key = doc.atproto_public_key().ok().flatten(); let mini = MiniDoc { pds: Url::from_str(pds.as_str()).expect("that url is valid"), handle, key, }; let _ = self.inner.cache.put_async(did_static, mini.clone()).await; Ok(mini) } pub async fn resolve_identity_info( &self, did: &Did<'_>, ) -> Result<(Url, Option>), ResolverError> { let mini = self.resolve_doc(did).await?; Ok((mini.pds, mini.handle)) } pub async fn resolve_signing_key( &self, did: &Did<'_>, ) -> Result, ResolverError> { let did = did.clone().into_static(); let mini = self.resolve_doc(&did).await?; Ok(mini.key.ok_or(NoSigningKeyError(did)).into_diagnostic()?) } /// resolves the full DID document as raw [`Data`] without caching, and /// extracts the first `alsoKnownAs` handle if present. pub async fn resolve_raw_doc( &self, did: &Did<'_>, ) -> Result<(Data<'static>, Option>), ResolverError> { let doc_resp = self .req(did.starts_with("did:plc:"), |j| j.resolve_did_doc(did)) .await?; if doc_resp.buffer.len() > MAX_DID_DOC_BYTES { return Err(ResolverError::Generic(miette::miette!( "DID doc response exceeds {} byte limit", MAX_DID_DOC_BYTES ))); } let doc = doc_resp.parse_validated()?; let mut handles = doc.handles(); let handle = handles .is_empty() .not() .then(|| handles.remove(0).into_static()); let data: Data<'_> = serde_json::from_slice(&doc_resp.buffer) .map_err(|e| ResolverError::Generic(miette::miette!("failed to parse DID doc: {e}")))?; Ok((data.into_static(), handle)) } /// returns `true` if the given handle bi-directionally resolves to `did`. pub async fn verify_handle( &self, did: &Did<'_>, handle: &Handle<'_>, ) -> Result { let id = AtIdentifier::Handle(handle.clone().into_static()); let resolved_did = self.resolve_did(&id).await?; Ok(resolved_did.as_str() == did.as_str()) } } #[derive(Debug, Diagnostic, Error)] #[error("no atproto signing key in DID doc for {0}")] pub struct NoSigningKeyError(Did<'static>);