fix: resolve handles through authoritative HTTPS #77

Merged

starsetbyte merged 1 commit from fix/authoritative-handle-resolution into feat/device-trust-foundation

2026-07-11 21:21:28 +00:00

starsetbyte commented

2026-07-11 21:11:59 +00:00

Owner

Continuation from density/P1 handoff

This branch picks up the authoritative handle-resolution item in docs/plans/2026-07-11-density-pass-handoff.md.

Policy

Try https://<handle>/.well-known/atproto-did first.
For arbitrary custom domains, fail closed if the authoritative endpoint is absent; never ask the centralized Bluesky resolver to vouch for them.
Retain centralized com.atproto.identity.resolveHandle only as an explicit compatibility fallback for bsky.social and *.bsky.social.
Preserve bidirectional DID-document alsoKnownAs verification.

Changes

Added authoritative HTTPS resolution and first-party fallback policy to HandleResolver.
Added handle normalization/validation and response-body ownership via use.
Added MockWebServer tests for authoritative success, custom-domain failure, first-party fallback, and malformed responses.
Updated existing OAuth discovery tests for the new request sequence.

Verification

./gradlew :app:testDebugUnitTest :app:lintDebug :app:assembleDebug --no-daemon

BUILD SUCCESSFUL.

## Continuation from density/P1 handoff This branch picks up the authoritative handle-resolution item in `docs/plans/2026-07-11-density-pass-handoff.md`. ### Policy - Try `https://<handle>/.well-known/atproto-did` first. - For arbitrary custom domains, fail closed if the authoritative endpoint is absent; never ask the centralized Bluesky resolver to vouch for them. - Retain centralized `com.atproto.identity.resolveHandle` only as an explicit compatibility fallback for `bsky.social` and `*.bsky.social`. - Preserve bidirectional DID-document `alsoKnownAs` verification. ### Changes - Added authoritative HTTPS resolution and first-party fallback policy to `HandleResolver`. - Added handle normalization/validation and response-body ownership via `use`. - Added MockWebServer tests for authoritative success, custom-domain failure, first-party fallback, and malformed responses. - Updated existing OAuth discovery tests for the new request sequence. ### Verification `./gradlew :app:testDebugUnitTest :app:lintDebug :app:assembleDebug --no-daemon` **BUILD SUCCESSFUL**.

starsetbyte added 2 commits

2026-07-11 21:11:59 +00:00