Evan JarrettandClaude Opus 5 9d4ad84a3e auth: surface read-only app passwords as 403, not 503 ...

A read-only app password authenticates fine via createSession but cannot
call com.atproto.server.getServiceAuth, which is privileged — the PDS
answers 403 InsufficientScope. That fell through to the generic non-200
path and became a 503, which invites the client to retry a request that
can never succeed, with no indication of what is actually wrong.

Classify it with a sentinel error and map it to a 403 at /auth/token,
carrying text that names the fix: use a full-access app password.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-09 20:52:59 -05:00

..

appview

appview: point the footer Bluesky link at the DID

2026-08-09 20:49:24 -05:00

atproto

auth: bound the PDS and hold HTTP clients on the token path

2026-08-09 20:52:13 -05:00

auth

auth: surface read-only app passwords as 403, not 503

2026-08-09 20:52:59 -05:00

billing

billing: escape the DID before interpolating it into a Stripe search

2026-08-09 20:51:31 -05:00

config

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

credhelper

credhelper: make config writes non-destructive

2026-08-02 19:19:40 -05:00

hold

admin: resolve handles after limiting top users

2026-08-09 20:22:46 -05:00

labeler

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

logging

convert alert to modal. go fix the codebase

2026-05-16 11:59:47 -05:00

s3

hold/gc: sweep orphaned scan and image config records

2026-08-08 21:24:00 -05:00

testpds

add more integration tests

2026-05-11 19:53:13 -05:00