Lexicon Garden

fyi.opensocial.getGroupAuth

Obtain a DPoP-bound OAuth access token to act as the group DID. The host is the group's PDS and authorization server: the caller authenticates with their personal account (service auth) and presents a DPoP proof; the host issues a short-lived token for the group DID whose space: scopes are exactly what the caller's roles are granted by the space's access record. No group password is involved. The same token may write those kinds of record in the group's public repo too (repoCollections): publishing them, as the group. For someone's inbox (fyi.opensocial.invites), a caller whose roles may invite gets a token to write the group's invite there, and nothing in the group's repo.

Repository @lexicons.opensocial.fyi did:plc:2gqnilpksz2e7faj3bwvo6qc namespace authority
Details · procedure
Kindprocedure
Authorityopensocial.fyi
Indexed
Compare Edit in builder → Fork →

Procedure

procedure · POST

Input

application/json

group

requiredstring · did

space

requiredstring · space-ref

The space the caller intends to write into: one of the group's, where the scopes its access record grants the caller's roles bound the grant, or someone's inbox, to invite them.

Output

application/json

accessJwt

requiredstring

collections

requiredarray

Collections the caller's roles may write as the group in that space ('*' for any).

did

requiredstring · did

expiresAt

requiredstring · datetime

pds

requiredstring · uri

Where to use it: the group's PDS (this host).

repoCollections

array

Public-repo collections this token may also write.

scope

string

The token's OAuth scope string; the PDS enforces it.

Errors

Forbidden

No description in schema.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • fyi.opensocial.provisionGroup

    procedure

    Host-level: an app creates a group for a person and gets its own OAuth session on it. Authenticated twice: the person asking, by service auth from their PDS (they become the founder), and the app, by OAuth client authentication in the body (a client assertion for a confidential client) with a DPoP proof in the `DPoP` header, exactly as at the token endpoint. The app must be one this host provisions for. Returns the group and a token response bound to the proof's key, issued to the app's client i

  • fyi.opensocial.listGroupTokens

    query

    The OAuth sessions issued by this host for the group DID (apps acting as the group), plus recent activity. Requires group.configure.

  • social.colibri.beta.actor.grantSpaceAccess

    procedure

    Hands the AppView access to one of the requesting user's personal spaces. The client mints a delegation token on its own PDS for the space and passes it here, because a delegation token is single-use and short-lived and the AppView has no OAuth session of its own. The AppView exchanges the token for a space credential and syncs the space.

  • fyi.opensocial.getAuthorization

    query

    An app's pending request to sign in as a group, as the caller would approve it: the app, the groups the caller may act for, and for each one what the caller's roles let the app do. Called by the console's approval page, with service auth from the caller's own PDS.