From add1ff176b0e401c8d8ceeab1443b492974981ac Mon Sep 17 00:00:00 2001
From: nelind <nel.n.lindberg@gmail.com>
Date: Sat, 4 Apr 2026 00:47:09 +0200
Subject: [PATCH] fix(auth): keep lxm optional and dont default to * when no
 lxm is given in getServiceAuth

---
 crates/tranquil-api/src/moderation/mod.rs      | 5 +++--
 crates/tranquil-api/src/server/service_auth.rs | 3 +--
 crates/tranquil-auth/src/token.rs              | 9 +++++++--
 crates/tranquil-pds/src/api/proxy.rs           | 2 +-
 crates/tranquil-pds/tests/jwt_security.rs      | 9 +++++++--
 5 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/crates/tranquil-api/src/moderation/mod.rs b/crates/tranquil-api/src/moderation/mod.rs
index 3df4639..de8a715 100644
--- a/crates/tranquil-api/src/moderation/mod.rs
+++ b/crates/tranquil-api/src/moderation/mod.rs
@@ -138,7 +138,7 @@ async fn proxy_to_report_service(
     let service_token = match tranquil_pds::auth::create_service_token(
         &auth_user.did,
         service_did,
-        "com.atproto.moderation.createReport",
+        Some("com.atproto.moderation.createReport"),
         &key_bytes,
     ) {
         Ok(t) => t,
@@ -226,7 +226,8 @@ async fn create_report_locally(
     let subject_json = json!(input.subject);
 
     if let Err(e) = state
-        .repos.infra
+        .repos
+        .infra
         .insert_report(
             report_id,
             input.reason_type.as_str(),
diff --git a/crates/tranquil-api/src/server/service_auth.rs b/crates/tranquil-api/src/server/service_auth.rs
index aae6972..07ff609 100644
--- a/crates/tranquil-api/src/server/service_auth.rs
+++ b/crates/tranquil-api/src/server/service_auth.rs
@@ -112,7 +112,6 @@ pub async fn get_service_auth(
     };
 
     let lxm = params.lxm.as_ref();
-    let lxm_for_token = lxm.map_or("*", |v| v.as_str());
 
     if let Some(method) = lxm {
         if let Err(e) = tranquil_pds::auth::scope_check::check_rpc_scope(
@@ -173,7 +172,7 @@ pub async fn get_service_auth(
     let service_token = match tranquil_pds::auth::create_service_token(
         &auth.did,
         params.aud.as_str(),
-        lxm_for_token,
+        lxm.map(|v| v.as_str()),
         &key_bytes,
     ) {
         Ok(t) => t,
diff --git a/crates/tranquil-auth/src/token.rs b/crates/tranquil-auth/src/token.rs
index 1dfc113..ccc6640 100644
--- a/crates/tranquil-auth/src/token.rs
+++ b/crates/tranquil-auth/src/token.rs
@@ -74,7 +74,12 @@ pub fn create_refresh_token_with_metadata(
     )
 }
 
-pub fn create_service_token(did: &str, aud: &str, lxm: &str, key_bytes: &[u8]) -> Result<String> {
+pub fn create_service_token(
+    did: &str,
+    aud: &str,
+    lxm: Option<&str>,
+    key_bytes: &[u8],
+) -> Result<String> {
     let signing_key = SigningKey::from_slice(key_bytes)?;
 
     let expiration = Utc::now()
@@ -89,7 +94,7 @@ pub fn create_service_token(did: &str, aud: &str, lxm: &str, key_bytes: &[u8]) -
         exp: expiration,
         iat: Utc::now().timestamp(),
         scope: None,
-        lxm: Some(lxm.to_string()),
+        lxm: lxm.map(ToOwned::to_owned),
         jti: uuid::Uuid::new_v4().to_string(),
         act: None,
     };
diff --git a/crates/tranquil-pds/src/api/proxy.rs b/crates/tranquil-pds/src/api/proxy.rs
index cbef623..5c53005 100644
--- a/crates/tranquil-pds/src/api/proxy.rs
+++ b/crates/tranquil-pds/src/api/proxy.rs
@@ -290,7 +290,7 @@ async fn proxy_handler(
                 match crate::auth::create_service_token(
                     &auth_user.did,
                     &resolved.did,
-                    method,
+                    Some(method),
                     &key_bytes,
                 ) {
                     Ok(new_token) => {
diff --git a/crates/tranquil-pds/tests/jwt_security.rs b/crates/tranquil-pds/tests/jwt_security.rs
index a469607..94b83d2 100644
--- a/crates/tranquil-pds/tests/jwt_security.rs
+++ b/crates/tranquil-pds/tests/jwt_security.rs
@@ -166,8 +166,13 @@ fn test_token_type_confusion() {
             .contains("Invalid token type")
     );
 
-    let service_token =
-        create_service_token(did, "did:web:target", "com.example.method", &key_bytes).unwrap();
+    let service_token = create_service_token(
+        did,
+        "did:web:target",
+        Some("com.example.method"),
+        &key_bytes,
+    )
+    .unwrap();
     assert!(
         verify_access_token(&service_token, &key_bytes).is_err(),
         "Service token as access must be rejected"