From looking at the code, image display relies on the server sending a thumb property, which isn't part of the AT standard and thus isn't present when probing the "real" API. The 'proper' way is via /xrpc/com.atproto.sync.getBlob?did=[user DID]&cid=[image 'link'] which given that AT by design doesn't really have read authentication for the atproto endpoints, can just be blindly spewed into the src= tag (so no server-side requests!)
And at least at the moment, bsky sets access-control-allowed-origin to * for images, so just adding some smarts to build the link from the post object should work just fine. Actually, from what I can tell every xrpc endpoint returns that, so you can probably just wantonly smack at the API from with the client's browser.
technically you're supposed to cache it all on your "homeserver" when prodding the sync API, but in reality since bsky is the only operating instance, I don't think anyone would really care if you just prodded their API directly and let the browser do the caching...
Might do a PR if I have the time, but probably not.
EDIT: got terms mixed up, posts don't have a DID; it's the user's DID that's used for fetching images.
From looking at the code, image display relies on the server sending a
thumbproperty, which isn't part of the AT standard and thus isn't present when probing the "real" API. The 'proper' way is via/xrpc/com.atproto.sync.getBlob?did=[user DID]&cid=[image 'link']which given that AT by design doesn't really have read authentication for the atproto endpoints, can just be blindly spewed into thesrc=tag (so no server-side requests!)And at least at the moment, bsky sets access-control-allowed-origin to
*for images, so just adding some smarts to build the link from the post object should work just fine. Actually, from what I can tell every xrpc endpoint returns that, so you can probably just wantonly smack at the API from with the client's browser.technically you're supposed to cache it all on your "homeserver" when prodding the sync API, but in reality since bsky is the only operating instance, I don't think anyone would really care if you just prodded their API directly and let the browser do the caching...
Might do a PR if I have the time, but probably not. EDIT: got terms mixed up, posts don't have a DID; it's the user's DID that's used for fetching images.