atradio/apps/web/src/lib/atproto/ at main · atradio.fm/atradio · Tangled

atradio.fm / atradio

7

A social internet radio platform built on AT Protocol. atradio.fm

atproto radio

7

atradio / apps / web / src / lib / atproto /

at main 6 files

Tsiry Sandratraina refactor(web): migrate onto @atradio/sdk 1d ago

fix(connect): request the rpc OAuth scope with a did#serviceId audience OAuth sessions need an `rpc:fm.atradio.connect?aud=…` scope to mint the service-auth token that authenticates the Connect WebSocket. The audience must be a DID *service reference* (`did:web:api.atradio.fm#atradio_appview`) — atproto's scope parser rejects a bare DID, so the authorization server silently dropped the scope and getServiceAuth failed with ScopeMissingError. - api: add CONNECT_SERVICE_AUD (bare DID + #atradio_appview); the hub verifies the JWT aud against it; /health exposes connectAud; did.json id stays the bare DID. - web: CONNECT_SERVICE_AUD drives the requested scope, client-metadata.json, and the getServiceAuth aud; PermissionBanner keys off the exact scope token; drop the /health aud discovery in favor of the fixed constant. - cli: request the scope and mint the token with the fragmented aud. - also surface the new scope in the re-auth banner (en/fr/pt). Requires re-authentication (log out + in) to mint a session carrying the corrected scope.

2 days ago

feat: AT Proto social platform — OAuth, PDS-backed data, Jetstream AppView Turn atradio.fm into a social, AT-Protocol-native app. Web (apps/web): - Browser OAuth login (@atcute/oauth-browser-client), Atmosphere login modal - Gate favoriting/add/remove behind login; public browse/search/playback - Favorites + user stations stored as fm.atradio.* records in the user's PDS (optimistic writes, loaded on login) - Profile shows real display name/handle/avatar; public /profile/:did|:handle Lexicons (packages/lexicons): - fm.atradio.{station,favorite,getFavorites,getStations} authored in Pkl (pkl eval -> JSON) + TS types/zod/mappers API (apps/api) — Express + Drizzle + Postgres AppView: - Jetstream consumer across all 4 official hosts, idempotent upserts, cursor - XRPC getFavorites/getStations (+ discovery), open CORS - Production TuneIn + ICY media proxies (moved off Vite dev middleware) Ops & tooling: - systemd units (api + jetstream) - tools/console: Babashka + Clojure + rebel REPL command hub, root ./console - mise pins java/clojure/babashka; consola logging throughout

5 days ago

refactor(web): migrate onto @atradio/sdk The web now consumes the official TypeScript SDK for all record I/O: - Add an agentAtom that wraps the OAuth-authenticated atcute client via AtradioAgent.fromClient(client, did) — the single entry point for reads/writes. - lib/atproto/records.ts becomes a thin facade delegating to the agent, keeping its (client, did, …) signatures so no consumer changed; favoriteRkey and StoredStation are re-exported from the SDK. - favorites.ts uses agent.favorite/unfavorite directly (the SDK bundles the idempotent write + stationId reconcile), dropping the local putFavorite + pruneFavoriteDuplicates. - Extend @atradio/sdk with the verbs the web needs: reaction, updateComment, deleteComment, generic deleteRecord, listFavorites/listStations (+ StoredStation), getAudioSettingsRecord. The favorite record-key logic now has one source of truth (the SDK) shared by web, CLI (Rust), and the Go/TS SDKs. Web typecheck + all 29 tests pass.

1 day ago

feat: AT Proto social platform — OAuth, PDS-backed data, Jetstream AppView Turn atradio.fm into a social, AT-Protocol-native app. Web (apps/web): - Browser OAuth login (@atcute/oauth-browser-client), Atmosphere login modal - Gate favoriting/add/remove behind login; public browse/search/playback - Favorites + user stations stored as fm.atradio.* records in the user's PDS (optimistic writes, loaded on login) - Profile shows real display name/handle/avatar; public /profile/:did|:handle Lexicons (packages/lexicons): - fm.atradio.{station,favorite,getFavorites,getStations} authored in Pkl (pkl eval -> JSON) + TS types/zod/mappers API (apps/api) — Express + Drizzle + Postgres AppView: - Jetstream consumer across all 4 official hosts, idempotent upserts, cursor - XRPC getFavorites/getStations (+ discovery), open CORS - Production TuneIn + ICY media proxies (moved off Vite dev middleware) Ops & tooling: - systemd units (api + jetstream) - tools/console: Babashka + Clojure + rebel REPL command hub, root ./console - mise pins java/clojure/babashka; consola logging throughout

5 days ago

feat(comments): clickable mentions + auto-linked URLs - Restyle @mentions to synth-purple and keep them linking to the mentioned user's profile - Detect http(s) URLs in comment text and render them as synth-blue links that open in a new tab (rel=noreferrer noopener nofollow), trimming trailing punctuation and coexisting with mention facets

3 days ago

fix(connect): recover gracefully from stale OAuth sessions + extend lifetime Device discovery silently broke once a user's OAuth session went stale: minting the service-auth JWT that authenticates the Connect WebSocket started failing, and both clients just reconnect-looped forever, so the device never joined the hub roster (invisible on web and CLI). Only a manual re-login fixed it. Web: - ConnectClient surfaces auth failures instead of looping silently: a hub AuthFailed hard-stops and prompts re-login; repeated token-mint failures fire onAuthError (once) while still slow-retrying transient blips. - restoreSession() validates/refreshes on restore and drops a dead session (TokenRefreshError) so it can't masquerade as logged-in; transient errors fall back to the stale session for offline use. - SessionRefresher keeps the session rolling (~30s before expiry) so an idle-but- open tab doesn't drift until its refresh token lapses. - PermissionBanner now also shows an "expired session" re-login prompt (en/fr/pt). CLI: - remote.rs mints the token before connect_once so an auth/session failure is distinguishable from a transient WS drop; emits RemoteEvent::AuthExpired once. - TUI toasts and the daemon prints "session expired — run atradio login". - Nudge app-password logins (long-lived) for unattended daemons; OAuth kept. - Document the app-password recommendation for the headless daemon in the README.

2 days ago