From 41c9d0ba5ef2bcebdde5c393ce4802bbf6062a15 Mon Sep 17 00:00:00 2001
From: bryan newbold <bnewbold@robocracy.org>
Date: Tue, 20 Jan 2026 21:27:59 -0800
Subject: [PATCH] more 'accept' blob syntax checks, and test

---
 atproto/auth/permission_test.go | 25 +++++++++++++++++++++++++
 atproto/auth/permission_util.go |  4 ++--
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/atproto/auth/permission_test.go b/atproto/auth/permission_test.go
index dcb64553..d514a102 100644
--- a/atproto/auth/permission_test.go
+++ b/atproto/auth/permission_test.go
@@ -144,3 +144,28 @@ func TestInteropPermissionInvalid(t *testing.T) {
 	}
 	assert.NoError(scanner.Err())
 }
+
+func TestValidBlobAccept(t *testing.T) {
+	assert := assert.New(t)
+
+	validAccepts := []string{
+		"text/plain",
+		"text/*",
+	}
+	invalidAccepts := []string{
+		"",
+		"*/png",
+		"/plain",
+		"text/",
+		"text/**",
+	}
+
+	for _, val := range validAccepts {
+		assert.True(validBlobAccept(val), val)
+	}
+
+	for _, val := range invalidAccepts {
+		assert.False(validBlobAccept(val), val)
+	}
+
+}
diff --git a/atproto/auth/permission_util.go b/atproto/auth/permission_util.go
index 4c733a3a..28a3da26 100644
--- a/atproto/auth/permission_util.go
+++ b/atproto/auth/permission_util.go
@@ -60,10 +60,10 @@ func validBlobAccept(accept string) bool {
 	if len(parts) != 2 {
 		return false
 	}
-	if parts[0] == "*" {
+	if parts[0] == "*" || parts[0] == "" {
 		return false
 	}
-	if parts[1] == "**" {
+	if parts[1] == "**" || parts[1] == "" {
 		return false
 	}
 	return true
-- 
2.51.2