From 013ad3128c23c598e20761746dda2c64aef6eeea Mon Sep 17 00:00:00 2001
From: Seongmin Lee <git@boltless.me>
Date: Sun, 25 Jan 2026 08:15:02 +0000
Subject: [PATCH] appview: don't trust `oauth.ClientSessionData`

`oauth.ClientSessionData.HostURL` is not validated after first session
creation. If user switches the PDS while logged in, `.HostURL` will
still point to old PDS, showing account management options for `tngl.sh`
users. This can confuse users to accidentally put account in odd state
(activated in both PDSes)

Instead, always resolve Handles and PDS hosts on-demand. Technically
`HostURL` is used on creating authorized atpclient, but that's ok
because request to old PDS will reject the request.

Ideally we should revoke user sessions on `#account` event, indigo
currently doesn't support DID based revoking.

Signed-off-by: Seongmin Lee <git@boltless.me>
---
 appview/ingester.go | 7 ++++++-
 appview/oauth/accounts.go | 7 -------
 appview/oauth/accounts_test.go | 2 +-
 appview/oauth/oauth.go | 2 --
 appview/pages/funcmap.go | 7 +++++++
 appview/pages/templates/user/settings/profile.html | 9 +++++----
 appview/settings/danger.go | 24 +++++++++++++++---------
 appview/settings/settings.go | 67 ++++++++++++++++++++++++++++++++++++++++++-------------------------
 appview/state/router.go | 13 +++++++------
 9 file(s) changed, 83 insertion(s)(+), 55 deletion(s)(-)

diff --git a/appview/ingester.go b/appview/ingester.go
--- a/appview/ingester.go
+++ b/appview/ingester.go
@@ -51,7 +51,12 @@
 		l := i.Logger.With("kind", e.Kind)
 		switch e.Kind {
 		case jmodels.EventKindAccount:
-			if !e.Account.Active && *e.Account.Status == "deactivated" {
+			// TODO: sync account state to db
+			if e.Account.Active {
+				break
+			}
+			// TODO: revoke sessions by DID
+			if *e.Account.Status == "deactivated" {
 				err = i.IdResolver.InvalidateIdent(ctx, e.Account.Did)
 			}
 		case jmodels.EventKindIdentity:
diff --git a/appview/oauth/accounts.go b/appview/oauth/accounts.go
--- a/appview/oauth/accounts.go
+++ b/appview/oauth/accounts.go
@@ -34,13 +34,6 @@ }
 	return m.Active.Did
 }
 
-func (m *MultiAccountUser) Pds() string {
-	if m.Active == nil {
-		return ""
-	}
-	return m.Active.Pds
-}
-
 func (o *OAuth) GetAccounts(r *http.Request) *AccountRegistry {
 	session, err := o.SessStore.Get(r, AccountsName)
 	if err != nil || session.IsNew {
diff --git a/appview/oauth/accounts_test.go b/appview/oauth/accounts_test.go
--- a/appview/oauth/accounts_test.go
+++ b/appview/oauth/accounts_test.go
@@ -249,7 +249,7 @@
 func TestMultiAccountUser_Did(t *testing.T) {
 	t.Run("with active user", func(t *testing.T) {
 		user := &MultiAccountUser{
-			Active: &User{Did: "did:plc:test", Pds: "https://bsky.social"},
+			Active: &User{Did: "did:plc:test"},
 		}
 		if user.Did() != "did:plc:test" {
 			t.Errorf("Did() = %s, want did:plc:test", user.Did())
diff --git a/appview/oauth/oauth.go b/appview/oauth/oauth.go
--- a/appview/oauth/oauth.go
+++ b/appview/oauth/oauth.go
@@ -239,7 +239,6 @@ }
 
 type User struct {
 	Did string
-	Pds string
 }
 
 func (o *OAuth) GetUser(r *http.Request) *User {
@@ -250,7 +249,6 @@ }
 
 	return &User{
 		Did: sess.Data.AccountDID.String(),
-		Pds: sess.Data.HostURL,
 	}
 }
 
diff --git a/appview/pages/funcmap.go b/appview/pages/funcmap.go
--- a/appview/pages/funcmap.go
+++ b/appview/pages/funcmap.go
@@ -81,6 +81,13 @@ }
 
 			return identity.Handle.String()
 		},
+		"resolvePds": func(s string) string {
+			identity, err := p.resolver.ResolveIdent(context.Background(), s)
+			if err != nil {
+				return ""
+			}
+			return identity.PDSEndpoint()
+		},
 		"ownerSlashRepo": func(repo *models.Repo) string {
 			ownerId, err := p.resolver.ResolveIdent(context.Background(), repo.Did)
 			if err != nil {
diff --git a/appview/pages/templates/user/settings/profile.html b/appview/pages/templates/user/settings/profile.html
--- a/appview/pages/templates/user/settings/profile.html
+++ b/appview/pages/templates/user/settings/profile.html
@@ -49,7 +49,7 @@ <span class="font-mono font-bold">{{ .LoggedInUser.Did }}</span>
       </div>
       <div class="flex flex-col gap-1 p-4">
         <span class="text-sm text-gray-500 dark:text-gray-400">Personal Data Server (PDS)</span>
-        <span class="font-bold">{{ .LoggedInUser.Pds }}</span>
+        <span class="font-bold">{{ resolvePds .LoggedInUser.Did }}</span>
       </div>
     </div>
     {{ if and .IsTnglSh .HandleOpen }}
@@ -132,9 +132,10 @@ </div>
 {{ end }}
 
 {{ define "accountActions" }}
+  {{ $isDeactivated := (and .IsTnglSh .IsDeactivated) }}
   <div>
     <h2 class="text-sm uppercase font-bold">Account</h2>
-    {{ if .IsDeactivated }}
+    {{ if $isDeactivated }}
       <div class="mt-2 p-3 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-700 rounded text-sm text-amber-700 dark:text-amber-300">
         Your account is deactivated. Your profile and repositories are currently inaccessible. Reactivate to restore access.
       </div>
@@ -147,7 +148,7 @@ class="btn flex items-center gap-2 text-sm cursor-pointer">
         {{ i "key" "size-4" }}
         change password
       </button>
-      {{ if .IsDeactivated }}
+      {{ if $isDeactivated }}
         <button
           popovertarget="reactivate-modal"
           popovertargetaction="toggle"
@@ -199,7 +200,7 @@ <div id="password-error" class="text-red-500 dark:text-red-400 text-sm empty:hidden"></div>
     </div>
   </div>
 
-  {{ if .IsDeactivated }}
+  {{ if $isDeactivated }}
     <div
       id="reactivate-modal"
       popover
diff --git a/appview/settings/danger.go b/appview/settings/danger.go
--- a/appview/settings/danger.go
+++ b/appview/settings/danger.go
@@ -8,6 +8,7 @@ "strings"
 	"time"
 
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/bluesky-social/indigo/xrpc"
 )
 
@@ -58,7 +59,7 @@ }
 
 func (s *Settings) requestPasswordReset(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		s.Pages.Notice(w, "password-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -99,7 +100,7 @@ }
 
 func (s *Settings) resetPassword(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		s.Pages.Notice(w, "password-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -133,7 +134,7 @@ }
 
 func (s *Settings) deactivateAccount(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		s.Pages.Notice(w, "deactivate-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -171,7 +172,7 @@ }
 
 func (s *Settings) requestAccountDelete(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		s.Pages.Notice(w, "delete-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -203,7 +204,7 @@ }
 
 func (s *Settings) deleteAccount(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		s.Pages.Notice(w, "delete-error", "Only available for tngl.sh accounts.")
 		return
 	}
@@ -243,13 +244,18 @@ }
 	s.Pages.HxRedirect(w, "/")
 }
 
-func (s *Settings) isAccountDeactivated(ctx context.Context, did, pdsHost string) bool {
+func (s *Settings) isAccountDeactivated(ctx context.Context, did syntax.DID) bool {
+	ident, err := s.IdResolver.ResolveIdent(ctx, did.String())
+	if err != nil {
+		s.Logger.Error("failed to resolve user did", "err", err)
+		return false
+	}
 	client := &xrpc.Client{
-		Host:   pdsHost,
+		Host:   ident.PDSEndpoint(),
 		Client: &http.Client{Timeout: 5 * time.Second},
 	}
 
-	_, err := comatproto.RepoDescribeRepo(ctx, client, did)
+	_, err = comatproto.RepoDescribeRepo(ctx, client, did.String())
 	if err == nil {
 		return false
 	}
@@ -263,7 +269,7 @@ }
 
 func (s *Settings) reactivateAccount(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		s.Pages.Notice(w, "reactivate-error", "Only available for tngl.sh accounts.")
 		return
 	}
diff --git a/appview/settings/settings.go b/appview/settings/settings.go
--- a/appview/settings/settings.go
+++ b/appview/settings/settings.go
@@ -25,6 +25,7 @@ "tangled.org/core/appview/models"
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/sites"
+	"tangled.org/core/idresolver"
 	"tangled.org/core/tid"
 
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
@@ -36,12 +37,13 @@ "github.com/google/uuid"
 )
 
 type Settings struct {
-	Db       *db.DB
-	OAuth    *oauth.OAuth
-	Pages    *pages.Pages
-	Config   *config.Config
-	CfClient *cloudflare.Client
-	Logger   *slog.Logger
+	Db         *db.DB
+	OAuth      *oauth.OAuth
+	Pages      *pages.Pages
+	Config     *config.Config
+	CfClient   *cloudflare.Client
+	IdResolver *idresolver.Resolver
+	Logger     *slog.Logger
 }
 
 func (s *Settings) Router() http.Handler {
@@ -90,6 +92,24 @@ r.Get("/handle", s.elevateForHandle)
 	r.Post("/handle", s.updateHandle)
 
 	return r
+}
+
+func (s *Settings) isTnglHandle(ctx context.Context, did syntax.DID) (bool, error) {
+	userIdent, err := s.IdResolver.ResolveIdent(ctx, did.String())
+	if err != nil {
+		s.Logger.Error("failed to resolve user ident", "err", err)
+		return false, err
+	}
+	return strings.HasSuffix(userIdent.Handle.String(), s.Config.Pds.UserDomain), nil
+}
+
+func (s *Settings) isTnglShUser(ctx context.Context, did syntax.DID) (bool, error) {
+	userIdent, err := s.IdResolver.ResolveIdent(ctx, did.String())
+	if err != nil {
+		s.Logger.Error("failed to resolve user ident", "err", err)
+		return false, err
+	}
+	return strings.TrimRight(userIdent.PDSEndpoint(), "/") == strings.TrimRight(s.Config.Pds.Host, "/"), nil
 }
 
 func (s *Settings) sitesSettings(w http.ResponseWriter, r *http.Request) {
@@ -103,13 +123,7 @@ }
 
 	// determine whether the active account has a tngl.sh handle, in which
 	// case their sites domain is automatically their handle domain.
-	isTnglHandle := false
-	for _, acc := range user.Accounts {
-		if acc.Did == user.Active.Did {
-			isTnglHandle = strings.HasSuffix(acc.Handle, s.Config.Pds.UserDomain)
-			break
-		}
-	}
+	isTnglHandle, _ := s.isTnglHandle(r.Context(), syntax.DID(user.Active.Did))
 
 	s.Pages.UserSiteSettings(w, pages.UserSiteSettingsParams{
 		LoggedInUser: user,
@@ -179,14 +193,14 @@ s.Pages.Notice(w, "settings-sites-error", "Domain cannot be empty.")
 		return
 	}
 
-	for _, acc := range user.Accounts {
-		if acc.Did == user.Active.Did {
-			if strings.HasSuffix(acc.Handle, s.Config.Pds.UserDomain) {
-				s.Pages.Notice(w, "settings-sites-error", "Your tngl.sh domain is tied to your handle and cannot be released here.")
-				return
-			}
-			break
-		}
+	isTnglHandle, err := s.isTnglHandle(r.Context(), syntax.DID(user.Active.Did))
+	if err != nil {
+		s.Pages.Notice(w, "settings-sites-error", "Unable to resolve user identity")
+		return
+	}
+	if isTnglHandle {
+		s.Pages.Notice(w, "settings-sites-error", "Your tngl.sh domain is tied to your handle and cannot be released here.")
+		return
 	}
 
 	if err := db.ReleaseDomain(s.Db, user.Active.Did, domain); err != nil {
@@ -251,12 +265,15 @@ if err != nil {
 		log.Printf("failed to get users punchcard preferences: %s", err)
 	}
 
-	isDeactivated := s.Config.Pds.IsTnglShUser(user.Pds()) && s.isAccountDeactivated(r.Context(), user.Did(), user.Pds())
+	isTnglSh, err := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did))
+
+	// TODO: bring the user state from DB instead of PDS request
+	isDeactivated := s.isAccountDeactivated(r.Context(), syntax.DID(user.Active.Did))
 
 	s.Pages.UserProfileSettings(w, pages.UserProfileSettingsParams{
 		LoggedInUser:        user,
 		PunchcardPreference: punchcardPreferences,
-		IsTnglSh:            s.Config.Pds.IsTnglShUser(user.Pds()),
+		IsTnglSh:            isTnglSh,
 		IsDeactivated:       isDeactivated,
 		HandleOpen:          r.URL.Query().Get("handle") == "1",
 	})
@@ -716,7 +733,7 @@ }
 
 func (s *Settings) elevateForHandle(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		http.Redirect(w, r, "/settings/profile", http.StatusSeeOther)
 		return
 	}
@@ -744,7 +761,7 @@ }
 
 func (s *Settings) updateHandle(w http.ResponseWriter, r *http.Request) {
 	user := s.OAuth.GetMultiAccountUser(r)
-	if !s.Config.Pds.IsTnglShUser(user.Pds()) {
+	if isTngl, _ := s.isTnglShUser(r.Context(), syntax.DID(user.Active.Did)); !isTngl {
 		s.Pages.Notice(w, "handle-error", "Handle changes are only available for tngl.sh accounts.")
 		return
 	}
diff --git a/appview/state/router.go b/appview/state/router.go
--- a/appview/state/router.go
+++ b/appview/state/router.go
@@ -238,12 +238,13 @@ }
 
 func (s *State) SettingsRouter() http.Handler {
 	settings := &settings.Settings{
-		Db:       s.db,
-		OAuth:    s.oauth,
-		Pages:    s.pages,
-		Config:   s.config,
-		CfClient: s.cfClient,
-		Logger:   log.SubLogger(s.logger, "settings"),
+		Db:         s.db,
+		OAuth:      s.oauth,
+		Pages:      s.pages,
+		Config:     s.config,
+		CfClient:   s.cfClient,
+		Logger:     log.SubLogger(s.logger, "settings"),
+		IdResolver: s.idResolver,
 	}
 
 	return settings.Router()

--
tangled.sh