Lexicon Garden

fyi.opensocial.getGroupAuth

Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publishing them, as the group. For someone's inbox (fyi.opensocial.invites), a caller whose roles may invite gets a token to write the group's invite there, and nothing in the group's repo.

Repository @lexicons.opensocial.fyi did:plc:2gqnilpksz2e7faj3bwvo6qc namespace authority
Details · procedure
Kindprocedure
Authorityopensocial.fyi
Indexed
Compare Edit in builder → Fork →
cid bafyreig6hzefnukswg7pofikebu2lo37v5lz7ero6ys36ib5y2quqop6ru

Checks

Valid
  • unlimited-string defs.main.output.schema.properties.accessJwtNo maxLength, maxGraphemes or format limits this string.
  • unlimited-string defs.main.output.schema.properties.scopeNo maxLength, maxGraphemes or format limits this string.
JSONDownload
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publishing them, as the group. For someone's inbox (fyi.opensocial.invites), a caller whose roles may invite gets a token to write the group's invite there, and nothing in the group's repo.",
      "errors": [
        {
          "name": "Forbidden"
        }
      ],
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "group": {
              "format": "did",
              "type": "string"
            },
            "space": {
              "description": "The space the caller intends to write into: one of the group's, where the scopes its access record grants the caller's roles bound the grant, or someone's inbox, to invite them.",
              "format": "space-ref",
              "type": "string"
            }
          },
          "required": [
            "group",
            "space"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "accessJwt": {
              "type": "string"
            },
            "collections": {
              "description": "Collections the caller's roles may write as the group in that space ('*' for any).",
              "items": {
                "ref": "fyi.opensocial.defs#collectionRef",
                "type": "ref"
              },
              "type": "array"
            },
            "did": {
              "format": "did",
              "type": "string"
            },
            "expiresAt": {
              "format": "datetime",
              "type": "string"
            },
            "pds": {
              "description": "Where to use it: the group's PDS (this host).",
              "format": "uri",
              "type": "string"
            },
            "repoCollections": {
              "description": "Public-repo collections this token may also write.",
              "items": {
                "ref": "fyi.opensocial.defs#collectionRef",
                "type": "ref"
              },
              "type": "array"
            },
            "scope": {
              "description": "The token's OAuth scope string; the PDS enforces it.",
              "type": "string"
            }
          },
          "required": [
            "did",
            "accessJwt",
            "pds",
            "collections",
            "expiresAt"
          ],
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "fyi.opensocial.getGroupAuth",
  "lexicon": 1
}