1ce5d9150d
Both POST /:did/webhooks and DELETE /:did/webhooks were unauthenticated: anyone could register a webhook for someone else's DID (privacy leak) or wipe a DID's webhook list (DoS on legitimate subscribers). Now both endpoints require a Bluesky session bearer token, verified end-to-end against the DID's PDS via the existing authenticateRequest helper, and the verified DID must match the URL :did.
litenote-jetstream
Backend for Remanso, a blogging platform on the AT
Protocol. Listens to the Jetstream firehose for space.remanso.note records and
serves them via a REST API.
Prerequisites
Setup
# Initialize the SQLite database
deno task migrate
Development
# Run the Jetstream listener (with watch)
deno task jetstream
# Run the API server (with watch)
deno task server
Production
# Run both processes
deno task jetstream:prod & deno task server:prod
Docker
docker build -t litenote-jetstream .
docker run -p 8080:8080 -v litenote-data:/data litenote-jetstream
API
| Endpoint | Description |
|---|---|
GET /notes?cursor=&limit= |
Paginated notes from all users |
GET /:did/notes?cursor=&limit= |
Paginated notes for a specific DID |
Environment Variables
| Variable | Default | Description |
|---|---|---|
SQLITE_PATH |
notes.db |
Path to the SQLite database file |