Evan JarrettandClaude Opus 5 9d4ad84a3e auth: surface read-only app passwords as 403, not 503 ...

A read-only app password authenticates fine via createSession but cannot
call com.atproto.server.getServiceAuth, which is privileged — the PDS
answers 403 InsufficientScope. That fell through to the generic non-200
path and became a 503, which invites the client to retry a request that
can never succeed, with no indication of what is actually wrong.

Classify it with a sentinel error and map it to a 403 at /auth/token,
carrying text that names the fix: use a full-access app password.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-09 20:52:59 -05:00

..

holdlocal

clean up old migration code. minor bug fixes with appview ui

2026-05-04 21:52:28 -05:00

oauth

auth: classify service-token failures structurally, not by string

2026-08-02 19:19:59 -05:00

token

auth: surface read-only app passwords as 403, not 503

2026-08-09 20:52:59 -05:00

appview_token_test.go

clean up some functions to use indigo helpers. make repomgr more sync1.1 compliant

2026-05-26 20:26:29 -05:00

appview_token.go

clean up some functions to use indigo helpers. make repomgr more sync1.1 compliant

2026-05-26 20:26:29 -05:00

cache_test.go

lots of new work for authenticating between appview -> hold. fixed quota handling, improve integration tests for round-trip push/pull/auth/quota checking

2026-05-11 09:20:55 -05:00

cache.go

lots of new work for authenticating between appview -> hold. fixed quota handling, improve integration tests for round-trip push/pull/auth/quota checking

2026-05-11 09:20:55 -05:00

hold_authorizer_test.go

unit tests

2025-10-28 17:40:11 -05:00

hold_authorizer.go

clean up old migration code. minor bug fixes with appview ui

2026-05-04 21:52:28 -05:00

hold_remote_test.go

clean up old migration code. minor bug fixes with appview ui

2026-05-04 21:52:28 -05:00

hold_remote.go

clean up old migration code. minor bug fixes with appview ui

2026-05-04 21:52:28 -05:00

scope_test.go

fix validation on dids with hyphens

2026-04-07 22:26:21 -05:00

scope.go

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

servicetoken_test.go

auth: evict app-password tokens a PDS reports stale, not just on 401

2026-08-08 23:27:49 -05:00

servicetoken.go

auth: surface read-only app passwords as 403, not 503

2026-08-09 20:52:59 -05:00

session_test.go

unit tests

2025-10-28 17:40:11 -05:00

session.go

auth: bound the PDS and hold HTTP clients on the token path

2026-08-09 20:52:13 -05:00

tokencache_test.go

unit tests

2025-10-28 17:40:11 -05:00

tokencache.go

initial commit

2025-10-02 11:03:59 -05:00