docs(auth): document programmatic/bot auth, slim stale provider docs#588
Merged
Conversation
- Add automation guidance: email+refresh loop, single-use refresh rotation, and the required x-tenant-id header - Document ATProto service-auth as the non-interactive bot path - Correct the provider list to what actually ships (Google, GitHub, Facebook, Bluesky); drop never-implemented Apple/Twitter boilerplate - Link the Auth guide from the top-level README
The ATProto service-auth path works for any AT Protocol account, not just Bluesky. Lead with that, and add a 'Finding the bot's PDS' step showing how to resolve a handle to its PDS (handle -> DID -> DID doc -> #atproto_pds) instead of hardcoding bsky.social. Verified end-to-end: discovery resolves both a bsky.social account and an account on our pds.opnmt.me PDS; createSession + getServiceAuth + exchange yields a usable OpenMeet JWT.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A community member automating event reminders for their Slack group hit two undocumented walls: the required
x-tenant-idheader, and refresh-token rotation (the old token is single-use). The auth doc also still described never-implemented Apple/Twitter flows inherited from the NestJS boilerplate, and omitted GitHub and Bluesky entirely.What
docs/auth.md— verified against the codebase, slimmed and corrected:x-tenant-idheader.POST /api/v1/auth/atproto/service-auth), with the exactaud/lxm=net.openmeet.authclaims and thegetServiceAuthexchange.src/auth-apple/src/auth-twittermodules) plus brocoders boilerplate screenshots/videos.tokenExpires) rather than a hardcoded value.README.md— added a Documentation subsection linking the Auth guide (the README had nodocs/link before).Test plan
Docs-only — no code paths touched.
auth.controller.ts,atproto-service-auth.service.ts,auth-bluesky/,did-web.controller.ts).database.md,serialization.md) and TOC anchors resolve.Follow-up (separate issue): purge leftover
APPLE_APP_AUDIENCE/TWITTER_*env vars fromenv-example*now that those providers are documented as not implemented.