fix(auth): keep lxm optional and dont default to * when no lxm is given in getServiceAuth

crates/tranquil-api/src/moderation/mod.rs

@@ -138,7 +138,7 @@ async fn proxy_to_report_service(
     let service_token = match tranquil_pds::auth::create_service_token(
         &auth_user.did,
         service_did,
-        "com.atproto.moderation.createReport",
+        Some("com.atproto.moderation.createReport"),
         &key_bytes,
     ) {
         Ok(t) => t,
@@ -226,7 +226,8 @@ async fn create_report_locally(
     let subject_json = json!(input.subject);
 
     if let Err(e) = state
-        .repos.infra
+        .repos
+        .infra
         .insert_report(
             report_id,
             input.reason_type.as_str(),

crates/tranquil-api/src/server/service_auth.rs

@@ -112,7 +112,6 @@ pub async fn get_service_auth(
     };
 
     let lxm = params.lxm.as_ref();
-    let lxm_for_token = lxm.map_or("*", |v| v.as_str());
 
     if let Some(method) = lxm {
         if let Err(e) = tranquil_pds::auth::scope_check::check_rpc_scope(
@@ -173,7 +172,7 @@ pub async fn get_service_auth(
     let service_token = match tranquil_pds::auth::create_service_token(
         &auth.did,
         params.aud.as_str(),
-        lxm_for_token,
+        lxm.map(|v| v.as_str()),
         &key_bytes,
     ) {
         Ok(t) => t,

crates/tranquil-auth/src/token.rs

@@ -74,7 +74,12 @@ pub fn create_refresh_token_with_metadata(
     )
 }
 
-pub fn create_service_token(did: &str, aud: &str, lxm: &str, key_bytes: &[u8]) -> Result<String> {
+pub fn create_service_token(
+    did: &str,
+    aud: &str,
+    lxm: Option<&str>,
+    key_bytes: &[u8],
+) -> Result<String> {
     let signing_key = SigningKey::from_slice(key_bytes)?;
 
     let expiration = Utc::now()
@@ -89,7 +94,7 @@ pub fn create_service_token(did: &str, aud: &str, lxm: &str, key_bytes: &[u8]) -
         exp: expiration,
         iat: Utc::now().timestamp(),
         scope: None,
-        lxm: Some(lxm.to_string()),
+        lxm: lxm.map(ToOwned::to_owned),
         jti: uuid::Uuid::new_v4().to_string(),
         act: None,
     };

crates/tranquil-pds/src/api/proxy.rs

@@ -290,7 +290,7 @@ async fn proxy_handler(
                 match crate::auth::create_service_token(
                     &auth_user.did,
                     &resolved.did,
-                    method,
+                    Some(method),
                     &key_bytes,
                 ) {
                     Ok(new_token) => {

crates/tranquil-pds/tests/jwt_security.rs

@@ -166,8 +166,13 @@ fn test_token_type_confusion() {
             .contains("Invalid token type")
     );
 
-    let service_token =
-        create_service_token(did, "did:web:target", "com.example.method", &key_bytes).unwrap();
+    let service_token = create_service_token(
+        did,
+        "did:web:target",
+        Some("com.example.method"),
+        &key_bytes,
+    )
+    .unwrap();
     assert!(
         verify_access_token(&service_token, &key_bytes).is_err(),
         "Service token as access must be rejected"