@atproto/pds 0.5.0 → 0.5.1

package/src/mailer/templates/confirm-email.hbs

@@ -4,14 +4,12 @@
     <meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
     <meta name="x-apple-disable-message-reformatting" />
     <title>Confirm your email</title>
-    <meta
-      name="description"
-      content="To confirm your email, enter the code provided in the app."
-    />
+    <meta name="description" content="{{token}} is your verification code." />
   </head>
   <div
     style="display:none;overflow:hidden;line-height:1px;opacity:0;max-height:0;max-width:0"
-  >To confirm your email, enter the code provided in the app.<div
+  >{{token}}
+    is your verification code.<div
     > ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏ ‌​‍‎‏</div>
   </div>
 
@@ -42,8 +40,8 @@
               <tbody>
                 <tr>
                   <td><img
-                      alt="Bluesky"
-                      src="https://bsky.social/about/images/email/email_logo_default.png"
+                      alt="{{config.serviceName}}"
+                      src="{{config.logoUrl}}"
                       style="display:block;outline:none;border:none;text-decoration:none;width:110px;margin:0 auto"
                     /></td>
                 </tr>
@@ -67,12 +65,15 @@
                     <p
                       style="font-size:16px;line-height:1.4;margin:0px 0px;letter-spacing:0.25px;color:hsl(211, 24%, 34.2%);font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;padding-top:12px;padding-bottom:12px;padding-right:32px"
                     >To confirm this email for your account, please enter the
-                      code below in the app or<!-- -->
-                      <a
-                        href="https://bsky.app/intent/verify-email?code={{token}}"
-                        style="color:#067df7;text-decoration:none;text-decoration-line:underline;font-size:16px;letter-spacing:0.25px"
-                        target="_blank"
-                      >click here.</a></p><code
+                      code below in the app{{#if
+                        config.showBskyAppEmailConfirmationLink
+                      }}
+                        or<!-- -->
+                        <a
+                          href="https://bsky.app/intent/verify-email?code={{token}}"
+                          style="color:{{config.primaryColor}};text-decoration:none;text-decoration-line:underline;font-size:16px;letter-spacing:0.25px"
+                          target="_blank"
+                        >click here</a>{{/if}}.</p><code
                       style="display:block;padding:16px;border-radius:8px;border-width:1px;border-style:solid;background-color:hsl(211, 20%, 95.3%);border-color:hsl(211, 20%, 85.89999999999999%);font-size:14px;letter-spacing:0.25px;font-family:monospace;text-transform:uppercase"
                     >{{token}}</code>
                     <p
@@ -109,17 +110,17 @@
                                     <p
                                       style="font-size:14px;line-height:1.4;margin:0px 0px;color:hsl(211, 20%, 53%);font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;letter-spacing:0.25px"
                                     ><a
-                                        href="https://bsky.app"
+                                        href="{{config.homeUrl}}"
                                         style="color:hsl(211, 20%, 53%);text-decoration:none;text-decoration-line:underline;font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;margin:0px 0px;line-height:1.0;font-size:14px;letter-spacing:0.25px"
                                         target="_blank"
-                                      >Bluesky</a>, the social internet</p>
+                                      >{{config.serviceName}}</a></p>
                                   </td>
                                   <td
                                     data-id="__react-email-column"
                                     style="width:24px"
                                   ><img
-                                      alt="🦋"
-                                      src="https://bsky.social/about/images/email/email_mark_dark.png"
+                                      alt="{{config.serviceName}}"
+                                      src="{{config.markUrl}}"
                                       style="display:block;outline:none;border:none;text-decoration:none;width:24px"
                                     /></td>
                                 </tr>

package/src/mailer/templates/delete-account.hbs

@@ -43,8 +43,8 @@
               <tbody>
                 <tr>
                   <td><img
-                      alt="Bluesky"
-                      src="https://bsky.social/about/images/email/email_logo_default.png"
+                      alt="{{config.serviceName}}"
+                      src="{{config.logoUrl}}"
                       style="display:block;outline:none;border:none;text-decoration:none;width:110px;margin:0 auto"
                     /></td>
                 </tr>
@@ -108,17 +108,17 @@
                                     <p
                                       style="font-size:14px;line-height:1.4;margin:0px 0px;color:hsl(211, 20%, 53%);font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;letter-spacing:0.25px"
                                     ><a
-                                        href="https://bsky.app"
+                                        href="{{config.homeUrl}}"
                                         style="color:hsl(211, 20%, 53%);text-decoration:none;text-decoration-line:underline;font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;margin:0px 0px;line-height:1.0;font-size:14px;letter-spacing:0.25px"
                                         target="_blank"
-                                      >Bluesky</a>, the social internet</p>
+                                      >{{config.serviceName}}</a></p>
                                   </td>
                                   <td
                                     data-id="__react-email-column"
                                     style="width:24px"
                                   ><img
-                                      alt="🦋"
-                                      src="https://bsky.social/about/images/email/email_mark_dark.png"
+                                      alt="{{config.serviceName}}"
+                                      src="{{config.markUrl}}"
                                       style="display:block;outline:none;border:none;text-decoration:none;width:24px"
                                     /></td>
                                 </tr>

package/src/mailer/templates/plc-operation.hbs

@@ -42,8 +42,8 @@
               <tbody>
                 <tr>
                   <td><img
-                      alt="Bluesky"
-                      src="https://bsky.social/about/images/email/email_logo_default.png"
+                      alt="{{config.serviceName}}"
+                      src="{{config.logoUrl}}"
                       style="display:block;outline:none;border:none;text-decoration:none;width:110px;margin:0 auto"
                     /></td>
                 </tr>
@@ -105,17 +105,17 @@
                                     <p
                                       style="font-size:14px;line-height:1.4;margin:0px 0px;color:hsl(211, 20%, 53%);font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;letter-spacing:0.25px"
                                     ><a
-                                        href="https://bsky.app"
+                                        href="{{config.homeUrl}}"
                                         style="color:hsl(211, 20%, 53%);text-decoration:none;text-decoration-line:underline;font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;margin:0px 0px;line-height:1.0;font-size:14px;letter-spacing:0.25px"
                                         target="_blank"
-                                      >Bluesky</a>, the social internet</p>
+                                      >{{config.serviceName}}</a></p>
                                   </td>
                                   <td
                                     data-id="__react-email-column"
                                     style="width:24px"
                                   ><img
-                                      alt="🦋"
-                                      src="https://bsky.social/about/images/email/email_mark_dark.png"
+                                      alt="{{config.serviceName}}"
+                                      src="{{config.markUrl}}"
                                       style="display:block;outline:none;border:none;text-decoration:none;width:24px"
                                     /></td>
                                 </tr>

package/src/mailer/templates/reset-password.hbs

@@ -42,8 +42,8 @@
               <tbody>
                 <tr>
                   <td><img
-                      alt="Bluesky"
-                      src="https://bsky.social/about/images/email/email_logo_default.png"
+                      alt="{{config.serviceName}}"
+                      src="{{config.logoUrl}}"
                       style="display:block;outline:none;border:none;text-decoration:none;width:110px;margin:0 auto"
                     /></td>
                 </tr>
@@ -68,7 +68,7 @@
                       style="font-size:16px;line-height:1.4;margin:0px 0px;letter-spacing:0.25px;color:hsl(211, 24%, 34.2%);font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;padding-top:12px;padding-bottom:12px"
                     >We received a request to reset the password for the account<!-- -->
                       <span
-                        style="color:hsl(211, 99%, 53%)"
+                        style="color:{{config.primaryColor}}"
                       >@<!-- -->{{handle}}<!-- -->.</span></p><code
                       style="display:block;padding:16px;border-radius:8px;border-width:1px;border-style:solid;background-color:hsl(211, 20%, 95.3%);border-color:hsl(211, 20%, 85.89999999999999%);font-size:14px;letter-spacing:0.25px;font-family:monospace;text-transform:uppercase"
                     >{{token}}</code>
@@ -106,17 +106,17 @@
                                     <p
                                       style="font-size:14px;line-height:1.4;margin:0px 0px;color:hsl(211, 20%, 53%);font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;letter-spacing:0.25px"
                                     ><a
-                                        href="https://bsky.app"
+                                        href="{{config.homeUrl}}"
                                         style="color:hsl(211, 20%, 53%);text-decoration:none;text-decoration-line:underline;font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;margin:0px 0px;line-height:1.0;font-size:14px;letter-spacing:0.25px"
                                         target="_blank"
-                                      >Bluesky</a>, the social internet</p>
+                                      >{{config.serviceName}}</a></p>
                                   </td>
                                   <td
                                     data-id="__react-email-column"
                                     style="width:24px"
                                   ><img
-                                      alt="🦋"
-                                      src="https://bsky.social/about/images/email/email_mark_dark.png"
+                                      alt="{{config.serviceName}}"
+                                      src="{{config.markUrl}}"
                                       style="display:block;outline:none;border:none;text-decoration:none;width:24px"
                                     /></td>
                                 </tr>

package/src/mailer/templates/update-email.hbs

@@ -43,8 +43,8 @@
               <tbody>
                 <tr>
                   <td><img
-                      alt="Bluesky"
-                      src="https://bsky.social/about/images/email/email_logo_default.png"
+                      alt="{{config.serviceName}}"
+                      src="{{config.logoUrl}}"
                       style="display:block;outline:none;border:none;text-decoration:none;width:110px;margin:0 auto"
                     /></td>
                 </tr>
@@ -105,17 +105,17 @@
                                     <p
                                       style="font-size:14px;line-height:1.4;margin:0px 0px;color:hsl(211, 20%, 53%);font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;letter-spacing:0.25px"
                                     ><a
-                                        href="https://bsky.app"
+                                        href="{{config.homeUrl}}"
                                         style="color:hsl(211, 20%, 53%);text-decoration:none;text-decoration-line:underline;font-family:-apple-system, BlinkMacSystemFont, &#x27;Roboto&#x27;, &#x27;Oxygen&#x27;, &#x27;Ubuntu&#x27;, &#x27;Cantarell&#x27;, &#x27;Fira Sans&#x27;, &#x27;Droid Sans&#x27;, &#x27;Helvetica Neue&#x27;, sans-serif;margin:0px 0px;line-height:1.0;font-size:14px;letter-spacing:0.25px"
                                         target="_blank"
-                                      >Bluesky</a>, the social internet</p>
+                                      >{{config.serviceName}}</a></p>
                                   </td>
                                   <td
                                     data-id="__react-email-column"
                                     style="width:24px"
                                   ><img
-                                      alt="🦋"
-                                      src="https://bsky.social/about/images/email/email_mark_dark.png"
+                                      alt="{{config.serviceName}}"
+                                      src="{{config.markUrl}}"
                                       style="display:block;outline:none;border:none;text-decoration:none;width:24px"
                                     /></td>
                                 </tr>

package/src/mailer/templates.ts

@@ -3,3 +3,15 @@ export { default as deleteAccount } from './templates/delete-account.js'
 export { default as confirmEmail } from './templates/confirm-email.js'
 export { default as updateEmail } from './templates/update-email.js'
 export { default as plcOperation } from './templates/plc-operation.js'
+
+/**
+ * Common config variable that will be injected into all templates.
+ */
+export type Config = {
+  serviceName: string
+  homeUrl: string
+  logoUrl: string
+  markUrl: string
+  primaryColor: string
+  showBskyAppEmailConfirmationLink: boolean
+}

package/src/pipethrough.ts

@@ -56,9 +56,23 @@ export const proxyHandler = (ctx: AppContext): CatchallHandler => {
         throw new InvalidRequestError('Bad token method', 'InvalidToken')
       }
 
-      const { url: origin, did: aud } = await parseProxyInfo(ctx, req, lxm)
-
-      const authResult = await performAuth({ req, res, params: { lxm, aud } })
+      const {
+        url: origin,
+        did,
+        serviceId,
+      } = await parseProxyInfo(ctx, req, lxm)
+      // Phase 1 of service auth updates: the scope check sees the combined
+      // did#serviceId form (so OAuth callers' rpc:?aud=did#service scopes
+      // match), while the outbound service-auth JWT keeps bare-DID aud
+      // regardless of session type.
+      const scopeAud = `${did}#${serviceId}`
+      const tokenAud = did
+
+      const authResult = await performAuth({
+        req,
+        res,
+        params: { lxm, aud: scopeAud },
+      })
 
       const { credentials } = excludeErrorResult(authResult)
 
@@ -80,7 +94,7 @@ export const proxyHandler = (ctx: AppContext): CatchallHandler => {
         'content-encoding': body && req.headers['content-encoding'],
         'content-length': body && req.headers['content-length'],
 
-        authorization: `Bearer ${await ctx.serviceAuthJwt(credentials.did, aud, lxm)}`,
+        authorization: `Bearer ${await ctx.serviceAuthJwt(credentials.did, tokenAud, lxm)}`,
       }
 
       const dispatchOptions: Dispatcher.RequestOptions = {
@@ -216,18 +230,25 @@ export function computeProxyTo(
   throw new InvalidRequestError(`No service configured for ${lxm}`)
 }
 
+// Bare-DID portion of `proxyTo`, suitable as a service-auth JWT audience
+// (Phase 1 of service auth updates).
+export function bareDidFromProxyTo(proxyTo: string): string {
+  const hashIndex = proxyTo.indexOf('#')
+  return hashIndex === -1 ? proxyTo : proxyTo.slice(0, hashIndex)
+}
+
 export async function parseProxyInfo(
   ctx: AppContext,
   req: Request,
   lxm: string,
-): Promise<{ url: string; did: string }> {
+): Promise<{ url: string; did: string; serviceId: string }> {
   // /!\ Hot path
 
   const proxyToHeader = req.header('atproto-proxy')
   if (proxyToHeader) return parseProxyHeader(ctx, proxyToHeader)
 
-  const { serviceInfo } = defaultService(ctx, lxm)
-  if (serviceInfo) return serviceInfo
+  const { serviceId, serviceInfo } = defaultService(ctx, lxm)
+  if (serviceInfo) return { ...serviceInfo, serviceId }
 
   throw new InvalidRequestError(`No service configured for ${lxm}`)
 }
@@ -236,7 +257,7 @@ export const parseProxyHeader = async (
   // Using subset of AppContext for testing purposes
   ctx: Pick<AppContext, 'cfg' | 'idResolver'>,
   proxyTo: string,
-): Promise<{ did: string; url: string }> => {
+): Promise<{ did: string; url: string; serviceId: string }> => {
   // /!\ Hot path
 
   const hashIndex = proxyTo.indexOf('#')
@@ -260,13 +281,14 @@ export const parseProxyHeader = async (
   }
 
   const did = proxyTo.slice(0, hashIndex)
+  const serviceId = proxyTo.slice(hashIndex + 1)
 
   // Special case a configured appview, while still proxying correctly any other appview
   if (
     ctx.cfg.bskyAppView &&
     proxyTo === `${ctx.cfg.bskyAppView.did}#bsky_appview`
   ) {
-    return { did, url: ctx.cfg.bskyAppView.url }
+    return { did, url: ctx.cfg.bskyAppView.url, serviceId }
   }
 
   const didDoc = await ctx.idResolver.did.resolve(did)
@@ -274,13 +296,12 @@ export const parseProxyHeader = async (
     throw new InvalidRequestError('could not resolve proxy did')
   }
 
-  const serviceId = proxyTo.slice(hashIndex)
-  const url = getServiceEndpoint(didDoc, { id: serviceId })
+  const url = getServiceEndpoint(didDoc, { id: `#${serviceId}` })
   if (!url) {
     throw new InvalidRequestError('could not resolve proxy did service url')
   }
 
-  return { did, url }
+  return { did, url, serviceId }
 }
 
 /**

package/tests/app-passwords.test.ts

@@ -115,7 +115,7 @@ describe('app_passwords', () => {
   it('restricts service auth token methods for non-privileged access tokens', async () => {
     const attemptCaseSensitive = appAgent.api.com.atproto.server.getServiceAuth(
       {
-        aud: 'did:example:test',
+        aud: network.pds.ctx.cfg.service.did,
         lxm: 'com.atproto.server.createAccount',
       },
     )
@@ -124,7 +124,7 @@ describe('app_passwords', () => {
     )
     const attemptCaseInsensitive =
       appAgent.api.com.atproto.server.getServiceAuth({
-        aud: 'did:example:test',
+        aud: network.pds.ctx.cfg.service.did,
         lxm: 'com.atproto.server.createaccount',
       })
     await expect(attemptCaseInsensitive).rejects.toThrow(
@@ -134,7 +134,7 @@ describe('app_passwords', () => {
 
   it('allows privileged service auth token scopes for privileged access tokens', async () => {
     await priviAgent.api.com.atproto.server.getServiceAuth({
-      aud: 'did:example:test',
+      aud: network.pds.ctx.cfg.service.did,
       lxm: 'com.atproto.server.createAccount',
     })
   })
@@ -165,7 +165,7 @@ describe('app_passwords', () => {
 
     // allows privileged app passwords or higher
     const priviAttempt = appAgent.api.com.atproto.server.getServiceAuth({
-      aud: 'did:example:test',
+      aud: network.pds.ctx.cfg.service.did,
       lxm: 'com.atproto.server.createAccount',
     })
     await expect(priviAttempt).rejects.toThrow(
@@ -211,7 +211,7 @@ describe('app_passwords', () => {
 
     // allows privileged app passwords or higher
     await priviAgent.api.com.atproto.server.getServiceAuth({
-      aud: 'did:example:test',
+      aud: network.pds.ctx.cfg.service.did,
     })
 
     // allows only full access auth

package/tests/get-service-auth.test.ts

@@ -0,0 +1,81 @@
+import * as jose from 'jose'
+import { AtpAgent } from '@atproto/api'
+import { TestNetworkNoAppView } from '@atproto/dev-env'
+
+describe('com.atproto.server.getServiceAuth', () => {
+  let network: TestNetworkNoAppView
+  let agent: AtpAgent
+  let aliceDid: string
+  let pdsDid: string
+
+  beforeAll(async () => {
+    network = await TestNetworkNoAppView.create({
+      dbPostgresSchema: 'get_service_auth',
+    })
+    pdsDid = network.pds.ctx.cfg.service.did
+    agent = network.pds.getAgent()
+    const session = await agent.createAccount({
+      handle: 'alice.test',
+      email: 'alice@test.com',
+      password: 'alice-pass',
+    })
+    aliceDid = session.data.did
+  })
+
+  afterAll(async () => {
+    await network.close()
+  })
+
+  it('issues a token whose aud matches a bare-DID input', async () => {
+    const res = await agent.api.com.atproto.server.getServiceAuth({
+      aud: pdsDid,
+      lxm: 'com.atproto.server.describeServer',
+    })
+    const decoded = jose.decodeJwt(res.data.token)
+    expect(decoded.aud).toBe(pdsDid)
+    expect(decoded.iss).toBe(aliceDid)
+    expect(decoded.lxm).toBe('com.atproto.server.describeServer')
+  })
+
+  it('issues a token whose aud matches a combined did#serviceId input', async () => {
+    const aud = `${pdsDid}#atproto_pds`
+    const res = await agent.api.com.atproto.server.getServiceAuth({
+      aud,
+      lxm: 'com.atproto.server.describeServer',
+    })
+    const decoded = jose.decodeJwt(res.data.token)
+    expect(decoded.aud).toBe(aud)
+    expect(decoded.iss).toBe(aliceDid)
+    expect(decoded.lxm).toBe('com.atproto.server.describeServer')
+  })
+
+  it('rejects malformed aud with InvalidRequest', async () => {
+    const attempt = agent.api.com.atproto.server.getServiceAuth({
+      aud: 'not-a-did',
+      lxm: 'com.atproto.server.describeServer',
+    })
+    await expect(attempt).rejects.toThrow(
+      /aud must be a valid atproto DID or did#serviceId reference/,
+    )
+  })
+
+  it('rejects an aud with a non-atproto DID method', async () => {
+    const attempt = agent.api.com.atproto.server.getServiceAuth({
+      aud: 'did:foo:bar',
+      lxm: 'com.atproto.server.describeServer',
+    })
+    await expect(attempt).rejects.toThrow(
+      /aud must be a valid atproto DID or did#serviceId reference/,
+    )
+  })
+
+  it('rejects an aud with empty fragment', async () => {
+    const attempt = agent.api.com.atproto.server.getServiceAuth({
+      aud: `${pdsDid}#`,
+      lxm: 'com.atproto.server.describeServer',
+    })
+    await expect(attempt).rejects.toThrow(
+      /aud must be a valid atproto DID or did#serviceId reference/,
+    )
+  })
+})

package/tests/proxied/proxy-header.test.ts

@@ -77,6 +77,7 @@ describe('proxy header', () => {
     ).resolves.toEqual({
       did: proxyServer.did,
       url: proxyServer.url,
+      serviceId: 'atproto_test',
     })
   })
 

package/tests/proxied/proxy-oauth-aud.test.ts

@@ -0,0 +1,175 @@
+import { once } from 'node:events'
+import http from 'node:http'
+import { AddressInfo } from 'node:net'
+import * as plc from '@did-plc/lib'
+import express from 'express'
+import { Keypair } from '@atproto/crypto'
+import { SeedClient, TestNetworkNoAppView, usersSeed } from '@atproto/dev-env'
+import { ScopePermissions } from '@atproto/oauth-scopes'
+import { DidString } from '@atproto/syntax'
+import { AppContext } from '../../src/context.js'
+import { proxyHandler } from '../../src/pipethrough.js'
+
+// Regression test for the OAuth service-proxying audience fix.
+//
+// Before the fix, proxyHandler passed a bare DID as `aud` to the rpc scope
+// check. An OAuth caller granted `rpc:<lxm>?aud=<did>#<serviceId>` (the
+// canonical scope shape used in atproto OAuth) had no way to match, so
+// proxied calls failed at the scope check. The fix combines the proxied
+// service id into the scope-check audience as `<did>#<serviceId>`.
+//
+// We use a real PDS AppContext (so every field is real-typed). Only the
+// `authVerifier.authorization` method is replaced, with a thin stub that
+// drives the OAuth path off an `x-test-scope` request header — letting us
+// exercise the rpc scope check without minting a real OAuth token. A
+// separate express app mounts a fresh proxyHandler against the real ctx
+// and forwards to a real upstream ProxyServer.
+
+describe('proxy oauth audience', () => {
+  let network: TestNetworkNoAppView
+  let sc: SeedClient
+  let alice: string
+  let upstream: ProxyServer
+  let server: http.Server
+  let serverUrl: string
+
+  beforeAll(async () => {
+    network = await TestNetworkNoAppView.create({
+      dbPostgresSchema: 'proxy_oauth_aud',
+    })
+    sc = network.getSeedClient()
+    await usersSeed(sc)
+    alice = sc.dids.alice
+    upstream = await ProxyServer.create(
+      network.pds.ctx.plcClient,
+      network.pds.ctx.plcRotationKey,
+      'atproto_test',
+    )
+
+    // Replace only the `authorization` method on the real AuthVerifier so
+    // every other ctx field stays real and real-typed. The override's
+    // signature is constrained by AuthVerifier['authorization']: an OAuth
+    // shape change in the real verifier breaks the body of this stub at
+    // compile time.
+    const stubAuthorization: typeof network.pds.ctx.authVerifier.authorization =
+      ({ authorize }) => {
+        return async (ctx) => {
+          const scopeHeader = ctx.req.headers['x-test-scope'] as
+            | string
+            | undefined
+          const permissions = new ScopePermissions(
+            scopeHeader?.split(' ') ?? [],
+          )
+          await authorize(permissions, ctx)
+          return {
+            credentials: {
+              type: 'oauth',
+              did: alice as DidString,
+              permissions,
+            },
+          }
+        }
+      }
+    network.pds.ctx.authVerifier.authorization = stubAuthorization
+
+    const app = express()
+    // dev-env exports AppContext from its built dist/, while we import
+    // proxyHandler from src/. Cast at this boundary to bridge the two
+    // identical shapes; downstream behavior is real.
+    app.all('/xrpc/*', proxyHandler(network.pds.ctx as unknown as AppContext))
+    app.use(
+      (
+        err: Error & { status?: number; statusCode?: number },
+        _req: express.Request,
+        res: express.Response,
+        _next: express.NextFunction,
+      ) => {
+        if (res.headersSent) return
+        res.status(err.status ?? err.statusCode ?? 500).end()
+      },
+    )
+    server = app.listen(0)
+    await once(server, 'listening')
+    serverUrl = `http://localhost:${(server.address() as AddressInfo).port}`
+  })
+
+  afterAll(async () => {
+    await new Promise<void>((resolve) => server.close(() => resolve()))
+    await upstream.close()
+    await network.close()
+  })
+
+  it('matches an OAuth rpc scope granted with combined did#serviceId aud', async () => {
+    // Pre-fix this would have rejected because the scope check received
+    // bare-DID aud and never matched the combined-form scope. A 200 here
+    // implies the scope check ran with combined-form aud.
+    const res = await fetch(`${serverUrl}/xrpc/app.bsky.feed.getFeed`, {
+      headers: {
+        'atproto-proxy': `${upstream.did}#atproto_test`,
+        'x-test-scope': `rpc:app.bsky.feed.getFeed?aud=${encodeURIComponent(`${upstream.did}#atproto_test`)}`,
+      },
+    })
+    expect(res.status).toBe(200)
+  })
+
+  it('rejects an OAuth rpc scope granted for a different service id', async () => {
+    // Same DID, different service id — both forms parse as valid scope
+    // audiences, but the runtime aud (`upstream.did#atproto_test`) doesn't
+    // match the granted aud (`upstream.did#atproto_other`).
+    const res = await fetch(`${serverUrl}/xrpc/app.bsky.feed.getFeed`, {
+      headers: {
+        'atproto-proxy': `${upstream.did}#atproto_test`,
+        'x-test-scope': `rpc:app.bsky.feed.getFeed?aud=${encodeURIComponent(`${upstream.did}#atproto_other`)}`,
+      },
+    })
+    expect([401, 403]).toContain(res.status)
+  })
+})
+
+class ProxyServer {
+  constructor(
+    public server: http.Server,
+    public url: string,
+    public did: string,
+  ) {}
+
+  static async create(
+    plcClient: plc.Client,
+    keypair: Keypair,
+    serviceId: string,
+  ): Promise<ProxyServer> {
+    const app = express()
+    app.all('*', (_req, res) => res.sendStatus(200))
+
+    const server = app.listen(0)
+    await once(server, 'listening')
+
+    const { port } = server.address() as AddressInfo
+    const url = `http://localhost:${port}`
+    const plcOp = await plc.signOperation(
+      {
+        type: 'plc_operation',
+        rotationKeys: [keypair.did()],
+        alsoKnownAs: [],
+        verificationMethods: {},
+        services: {
+          [serviceId]: {
+            type: 'TestAtprotoService',
+            endpoint: url,
+          },
+        },
+        prev: null,
+      },
+      keypair,
+    )
+    const did = await plc.didForCreateOp(plcOp)
+    await plcClient.sendOperation(did, plcOp)
+    return new ProxyServer(server, url, did)
+  }
+
+  close(): Promise<void> {
+    return new Promise<void>((resolve) => {
+      this.server.close(() => resolve())
+    })
+  }
+}