ai.newnal.illi.account.exchangeCode
Schema Diff
+9 -2
Compatibility Analysis
Breaking Changes Detected
1 breaking change, 1 non-breaking change.
Breaking Changes (1)
- RequiredEdgeAdded RequiredEdgeAdded { vertex_id: "ai.newnal.illi.account.exchangeCode:input", src: "ai.newnal.illi.account.exchangeCode:input", tgt: "ai.newnal.illi.account.exchangeCode:input.codeVerifier", kind: "prop", name: Some("codeVerifier") }
Non-Breaking Changes (1)
- AddedVertex AddedVertex { vertex_id: "ai.newnal.illi.account.exchangeCode:input.codeVerifier" }
Migration Guidance
Added Elements
AddedVertex { vertex_id: "ai.newnal.illi.account.exchangeCode:input.codeVerifier" }
Additional Notes
- Breaking: RequiredEdgeAdded { vertex_id: "ai.newnal.illi.account.exchangeCode:input", src: "ai.newnal.illi.account.exchangeCode:input", tgt: "ai.newnal.illi.account.exchangeCode:input.codeVerifier", kind: "prop", name: Some("codeVerifier") }
1
1
{
2
2
"$type": "com.atproto.lexicon.schema",
3
3
"defs": {
4
4
"main": {
5
-
"description": "Exchange the one-time code from a client=native sign-in (delivered on the app's App Link / Universal Link, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events (D-45).",
5
+
"description": "Exchange the one-time code from a client=native sign-in (delivered to the app at …/native/callback?code=…, 60 s, single use) for a session token, sent afterwards as Authorization: Bearer on every call and on /events (D-45). The code is bound to the code_challenge the app sent when it started the sign-in; codeVerifier proves it is the same app (D-76, PKCE-style S256), which stops a code obtained for another account from being injected into the app.",
6
6
"errors": [
7
7
{
8
8
"name": "InvalidCode"
9
9
},
10
10
{
11
11
"name": "RateLimitExceeded"
12
12
}
13
13
],
14
14
"input": {
15
15
"encoding": "application/json",
16
16
"schema": {
17
17
"properties": {
18
18
"code": {
19
19
"maxLength": 128,
20
20
"type": "string"
21
+
},
22
+
"codeVerifier": {
23
+
"description": "The random secret (RFC 7636 code verifier: 43-128 characters of A-Z a-z 0-9 - . _ ~) whose base64url(SHA-256) the app sent as code_challenge to /oauth/login or account.parent.startOAuth.",
24
+
"maxLength": 128,
25
+
"minLength": 43,
26
+
"type": "string"
21
27
}
22
28
},
23
29
"required": [
24
-
"code"
30
+
"code",
31
+
"codeVerifier"
25
32
],
26
33
"type": "object"
27
34
}
28
35
},
29
36
"output": {
30
37
"encoding": "application/json",
31
38
"schema": {
32
39
"properties": {
33
40
"app": {
34
41
"knownValues": [
35
42
"family",
36
43
"device"
37
44
],
38
45
"type": "string"
39
46
},
40
47
"did": {
41
48
"format": "did",
42
49
"type": "string"
43
50
},
44
51
"expiresAt": {
45
52
"format": "datetime",
46
53
"type": "string"
47
54
},
48
55
"token": {
49
56
"type": "string"
50
57
}
51
58
},
52
59
"required": [
53
60
"token",
54
61
"did",
55
62
"app",
56
63
"expiresAt"
57
64
],
58
65
"type": "object"
59
66
}
60
67
},
61
68
"type": "procedure"
62
69
}
63
70
},
64
71
"id": "ai.newnal.illi.account.exchangeCode",
65
72
"lexicon": 1
66
73
}