Upgrade to v0.2.0 by Kzoeps · Pull Request #29 · hypercerts-org/hypercerts-feed-service

Kzoeps · 2026-09-24T08:39:11Z

Summary by CodeRabbit

New Features
- Added optional AT Protocol service authentication for feed requests. Authenticated requests use the verified issuer as the viewer; anonymous requests must provide a viewer DID.
- Added a DID discovery document for supported did:web service identifiers.
- Added configuration for the service DID, token age limit, and DID resolution timeout.
Documentation
- Updated setup and deployment guidance, including the minimum Node.js version (22.19+).

merge dev to main

auth: add optional AT Protocol service authentication

changeset-bot · 2026-09-24T08:39:14Z

⚠️ No Changeset found

Latest commit: b6c9e7f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

coderabbitai · 2026-09-24T08:39:16Z

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 2fa74b22-aba4-4006-bb8b-5e342642907e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1a192705-863c-461e-bec1-69efe68aeca9

📥 Commits

Reviewing files that changed from the base of the PR and between 3fc2d50 and cd4ba58.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (27)

.changeset/optional-service-auth.md
.env.example
AGENTS.md
README.md
lexicons/org/hypercerts/feed/defs.json
lexicons/org/hypercerts/feed/getFeed.json
lexicons/org/hypercerts/feed/getFeedSkeleton.json
package.json
src/api/feed-procedure.ts
src/api/get-feed-skeleton.ts
src/api/get-feed.ts
src/app.ts
src/auth/input.ts
src/auth/service-auth.ts
src/config.ts
src/feed/query.ts
src/feed/types.ts
src/feed/validation.ts
src/server.ts
test/app.unit.test.ts
test/auth.unit.test.ts
test/config.unit.test.ts
test/database.unit.test.ts
test/feed.integration.test.ts
test/lexicon.unit.test.ts
test/query.unit.test.ts
test/release-workflow.unit.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The feed service adds optional AT Protocol service authentication. Authenticated requests use the verified issuer as the viewer and consume bounded, process-local replay entries. The app also publishes a configured did:web document and accepts authorization headers in feed CORS preflights.

Changes

Service Authentication and Feed Requests

Layer / File(s)	Summary
Viewer contract and runtime configuration `lexicons/org/hypercerts/feed/`, `src/feed/`, `src/config.ts`, `.env.example`, `package.json`, `test/config.unit.test.ts`, `test/lexicon.unit.test.ts`, `test/query.unit.test.ts`, `test/database.unit.test.ts`, `test/feed.integration.test.ts`, `test/release-workflow.unit.test.ts`, `README.md`	`viewerDid` is optional in the feed request contract. Configuration requires a valid `SERVICE_DID` and adds JWT-age and DID-resolution timeout settings. The Node.js minimum changes to 22.19.0.
JWT verification and replay protection `src/auth/service-auth.ts`, `package.json`, `test/auth.unit.test.ts`, `AGENTS.md`, `README.md`, `.changeset/optional-service-auth.md`	Optional bearer tokens are verified and bound to an endpoint. The verifier validates `jti`, rejects replays, and limits live entries to 512 per issuer and 4,096 total. A full replay store returns HTTP 503.
Authenticated viewer and feed procedure wiring `src/auth/input.ts`, `src/api/*`, `src/server.ts`, `src/app.ts`, `test/app.unit.test.ts`, `AGENTS.md`, `README.md`	Authenticated requests use the verified DID as `viewerDid` and reject a mismatched supplied value. Anonymous requests still require `viewerDid`. Both feed procedures use the shared registration helper and configured verifier.
DID discovery and HTTP request handling `src/app.ts`, `test/app.unit.test.ts`, `README.md`, `.changeset/optional-service-auth.md`	The app serves a DID document for a configured hostname-level `did:web` identifier. Feed CORS preflights permit `authorization`; buffered requests no longer forward the original abort signal.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~45 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant FeedApp
  participant OptionalServiceAuth
  participant ServiceAuthVerifier
  participant ReplayProtector
  participant FeedProcedure
  participant FeedService
  Client->>FeedApp: POST feed request with optional bearer token
  FeedApp->>OptionalServiceAuth: Authenticate request
  OptionalServiceAuth->>ServiceAuthVerifier: Verify token claims and signature
  ServiceAuthVerifier-->>OptionalServiceAuth: Return verified credentials
  OptionalServiceAuth->>ReplayProtector: Consume issuer DID and jti
  ReplayProtector-->>OptionalServiceAuth: Accept token or report replay
  OptionalServiceAuth-->>FeedApp: Return credentials or authentication error
  FeedApp->>FeedProcedure: Forward input and credentials
  FeedProcedure->>FeedProcedure: Apply authenticated viewer rules
  FeedProcedure->>FeedService: Execute feed request
  FeedService-->>FeedProcedure: Return feed result
  FeedProcedure-->>Client: Return parsed response

Merge Risk: ⚪ Minimal · up to cd4ba

The feed service now accepts optional AT Protocol service authentication. For authenticated requests, the verified caller becomes the viewer, and each token can be used only once per running process. The service also publishes a did:web discovery document. Operators must set SERVICE_DID before upgrading, as the release notes state. No concrete defect remains, so the change appears ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies a version upgrade, which is consistent with the release-oriented changes. It is broad and does not name the main service-authentication feature, but it remains related to the chan…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-09-24T08:39:21Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@atproto-labs/did-resolver@0.3.7 ⏵ 0.3.9	⁺¹³		⁺²
@atproto-labs/fetch-node@0.3.7
@atproto/lex-server@0.1.9 ⏵ 0.1.19	⁺¹		⁺¹
@atproto/crypto@0.5.4 ⏵ 0.5.5	⁺⁸		⁺²
@atproto/syntax@0.7.5 ⏵ 0.7.6	⁺¹	⁺¹	⁺¹

View full report

greptile-apps · 2026-09-24T08:42:20Z

Confidence Score: 5/5

The PR appears safe to merge based on this review; no new actionable issue remains.

Summary

The PR adds optional AT Protocol service authentication to both feed procedures, binds authenticated viewers to verified issuers, publishes a did:web discovery document, and updates configuration and runtime guidance. Since the previous review, it aligns the stated Node.js minimum with the new dependency and documents the accepted replay-store capacity risk.

_{Reviews (2) · Last reviewed commit: "Merge pull request #30 from hypercerts-o..."}

auth: align Node minimum with service-auth dependency

Kzoeps · 2026-09-24T09:31:35Z

@greptileai review

Release

sonarqubecloud · 2026-09-24T12:26:02Z

Quality Gate failed

Failed conditions
3.2% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

Kzoeps and others added 10 commits September 11, 2026 11:09

Merge pull request #24 from hypercerts-org/dev

40fae5b

merge dev to main

auth: add optional AT Protocol service authentication

0c8b281

api: extract shared feed procedure registration

af17033

auth: add bounded per-issuer replay quotas

754cecc

docs: clarify jti replay and service audiences

d09d80a

auth: publish feed service did document

3c15283

auth: derive service endpoint from configured did

3ecee4d

auth: preserve signed POST verification after body read

60dec4d

auth: declare crypto test dependency and verify HTTP bearer header

643a012

Merge pull request #22 from hypercerts-org/auth/optional-service-auth

3379e66

auth: add optional AT Protocol service authentication

Kzoeps changed the title ~~Upgrade to v0.1.2~~ Upgrade to v0.2.0 Sep 24, 2026

greptile-apps Bot reviewed Sep 24, 2026

View reviewed changes

Comment thread src/auth/service-auth.ts

Comment thread package.json

Kzoeps and others added 3 commits September 24, 2026 14:51

auth: align Node minimum and document replay capacity risk

0d6b10b

Merge pull request #30 from hypercerts-org/auth/align-node-minimum

cd4ba58

auth: align Node minimum with service-auth dependency

release: version packages

ebd5110

Merge pull request #28 from hypercerts-org/changeset-release/main

b6c9e7f

Release

Kzoeps merged commit b168b86 into dev Sep 24, 2026
8 of 9 checks passed

Navigation Menu

Repository navigation

Upgrade to v0.2.0 - #29

Upgrade to v0.2.0#29
Kzoeps merged 14 commits into
devfrom
main

Kzoeps commented Sep 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading

Review skipped

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

socket-security Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Kzoeps commented Sep 24, 2026

Uh oh!

sonarqubecloud Bot commented Sep 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Kzoeps commented Sep 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

coderabbitai Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

socket-security Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Uh oh!

Uh oh!

Uh oh!

Kzoeps commented Sep 24, 2026

Uh oh!

sonarqubecloud Bot commented Sep 24, 2026

Quality Gate failed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Kzoeps commented Sep 24, 2026 •

edited by coderabbitai Bot

Loading

changeset-bot Bot commented Sep 24, 2026 •

edited

Loading

coderabbitai Bot commented Sep 24, 2026 •

edited

Loading

socket-security Bot commented Sep 24, 2026 •

edited

Loading

greptile-apps Bot commented Sep 24, 2026 •

edited

Loading