Mailbox <-> existing ATProto handle association

Parent: bug 3726817. Depends on: Permissions issue (tenant-owner gates). Decision locked: no mailbox without a DID. Admin supplies the user’s existing handle; server resolves handle -> DID and binds it.

Goal: Tenant admin creates a mailbox by typing the user’s existing handle (with typeahead); server resolves + validates to a DID before ProvisionAccount. Account page shows handle + DID. No spoofing, no orphan mailboxes.

Architecture: New internal/identity wrapper around indigo identity.Directory (handle -> DID -> DID doc, cache ≤1h per docs/02 §8). Reuse typeahead from commit 749bbae3. XRPC keeps did field but adds handle input; UI adds owner_handle field.

Tech Stack: Go, bluesky-social/indigo identity, internal/appview, internal/authbroker (check existing resolve helpers), templ UI.

---

Task 1: internal/identity resolve wrapper

Files: - Create: internal/identity/identity.go - Create: internal/identity/identity_test.go - Modify: go.mod (only if new indigo import needed — prefer existing)

• [ ] Step 1: Write failing test

func TestResolveHandle_OK(t *testing.T) {
    // stub directory returns did:plc:test for "alice.test"
    did, err := ResolveHandle(ctx, "alice.test")
    // expect did:plc:test, nil
}
func TestResolveHandle_BadHandle(t *testing.T) {
    // expect error, no DID
}

• [ ] Step 2: Run to verify it fails

Run: go test ./internal/identity/ -v Expected: FAIL (package undefined)

• [ ] Step 3: Minimal implementation

// internal/identity/identity.go
package identity
type Resolver interface { ResolveHandle(ctx context.Context, handle string) (string, error) }
func ResolveHandle(ctx context.Context, handle string) (string, error) {
    // normalize lowercase/trim; delegate to indigo identity.DefaultDirectory();
    // standard chain: DNS TXT _atproto.<handle> then HTTPS well-known;
    // cache successes ≤1h (small in-memory LRU); return DID string
}

Keep a RequireDNSTXT bool option stubbed (for future apex-ownership gating per ADR-0005) but default off for login-grade resolution.

• [ ] Step 4: Run tests

Run: go test ./internal/identity/ -v Expected: PASS

• [ ] Step 5: Commit

jj commit -m "feat(identity): handle->DID resolve wrapper with cache" internal/identity/identity.go internal/identity/identity_test.go

Task 2: Wire handle into creation (XRPC + provision)

Files: - Modify: internal/appview/provision.go (validate DID, reject empty) - Modify: internal/appview/mail_create_account.go - Modify: lexicons/at/sovrn/mail/createAccount.json + api/sovrn/mailcreateAccount.go (add handle? field) - Test: internal/appview/mail_create_account_test.go, provision_test.go

• [ ] Step 1: Write failing test

func TestCreateAccount_WithHandleResolvesDID(t *testing.T) {
    // in.Handle="alice.test" (stubbed resolver) -> mailbox DID == did:plc:test
}
func TestCreateAccount_BadHandleRejected(t *testing.T) {
    // in.Handle="not a handle!!" -> 400, no mailbox row
}
func TestCreateAccount_EmptyDIDRejected(t *testing.T) {
    // tenant-owner creates with neither did nor handle -> 400
}

• [ ] Step 2: Run to verify it fails

Run: go test ./internal/appview/ -run 'TestCreateAccount_WithHandle|TestCreateAccount_BadHandle|TestCreateAccount_EmptyDID' -v Expected: FAIL

• [ ] Step 3: Implement

// mail_create_account.go — after authz gate (Issue 1):
did := in.Did
if in.Handle != "" {
    resolved, err := identity.ResolveHandle(ctx, in.Handle)
    if err != nil { return badRequest("unknown handle") }
    did = resolved
}
if did == "" { return badRequest("did or handle required") }
// validate did: prefix (did:plc:|did:web:) before ProvisionAccount

• [ ] Step 4: Run tests

Run: go test ./internal/appview/ -v Expected: PASS

• [ ] Step 5: Commit

jj commit -m "feat(mail): createAccount binds existing handle->DID" internal/appview/provision.go internal/appview/mail_create_account.go lexicons/at/sovrn/mail/createAccount.json api/sovrn/mailcreateAccount.go internal/appview/mail_create_account_test.go

Task 3: Admin UI handle input + account display

Files: - Modify: internal/appview/ui/handler.go (createAccount) - Modify: internal/appview/ui/domain.templ (owner_handle input + typeahead), account.templ (show handle + DID) - Modify: internal/appview/ui/view.go - Test: internal/appview/ui/create_account_test.go, ui_test.go

• [ ] Step 1: Write failing test

func TestCreateAccountUI_HandleRequired(t *testing.T) {
    // POST /domains/{id}/accounts {address, owner_handle:"bad!!"} -> 400 + formError, no mailbox
}

• [ ] Step 2: Run to verify it fails

Run: go test ./internal/appview/ui/ -run TestCreateAccountUI_HandleRequired -v Expected: FAIL

• [ ] Step 3: Implement form + display

<!-- domain.templ Add-mailbox form: address input + owner_handle input (typeahead) -->
<!-- account.templ: Owner DID + handle (cached reverse lookup, best-effort) -->

// handler.go createAccount: read owner_handle, ResolveHandle, pass DID to ProvisionAccount

• [ ] Step 4: Run tests

Run: go test ./internal/appview/ui/ -v Expected: PASS

• [ ] Step 5: Commit

jj commit -m "feat(ui): admin handle input + owner DID/handle display" internal/appview/ui/handler.go internal/appview/ui/domain.templ internal/appview/ui/account.templ internal/appview/ui/view.go internal/appview/ui/create_account_test.go

Acceptance: - Admin types existing handle → mailbox bound to correct DID; bad handle → error, no row. - Account page shows owner handle + DID. - Non-owner did spoof still 403 (Issue 1 gates intact).