Add OAuth 2.1 implementation for ATProto SDK - #636
Draft
zzstoatzz wants to merge 5 commits into
Draft
Conversation
Core OAuth 2.1 client for AT Protocol with PAR, PKCE, DPoP, and confidential client support. Includes auth server metadata discovery, token exchange/refresh/revocation, authenticated request helpers, and abstract session/state stores with in-memory implementations. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2 tasks
Generated via sphinx-apidoc (make -C docs gen). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
handle_callback() and refresh_session() both parsed expires_in from the auth server token response but never used it to set session.expires_at, leaving it permanently None. Callers had no way to know when to refresh. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a hand-written docs/source/atproto_oauth/index.rst with prose explaining the authorization flow, session management, custom stores, and confidential client setup. Registers atproto_oauth in the main SDK toctree so it appears alongside the other packages. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… narrowed exceptions - Re-verify DID→PDS→AuthServer chain after token exchange to prevent impersonation - Use hardened HTTP clients (redirect/connection limits) instead of plain httpx - Narrow bare `except Exception` to `except (ValueError, KeyError)` in DPoP - Add spec reference to confidential clients docs section - Add type annotations to client assertion builder - Fix misleading comment about implicit atproto scope - Update tests to mock the new re-verification step Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
hey @zzstoatzz @MarshalX any plans to merge this oauth implementation? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an
atproto_oauthpackage implementing OAuth 2.1 for the AT Protocol, aligned with the official TypeScript SDK.~2,100 lines (implementation + tests + docs) — scoped to match what the Go SDK (indigo) ships for OAuth.
What's included
none) and confidential (private_key_jwt) clientsWhat's NOT included (follow-up PRs)
@atproto/oauth-scopes) — available on theoauth-fullbranchComparison with other SDKs
Files
packages/atproto_oauth/— 11 source files (client, DPoP, PKCE, metadata, models, security, stores)tests/test_oauth_{client,dpop,pkce}.py— 29 testspyproject.toml— package entry + ruff per-file-ignoresdocs/source/atproto/— generated Sphinx autodoc (viamake -C docs gen)docs/source/atproto_oauth/index.rst— usage guide with quick start examplesdocs/source/index.rst— registered in SDK toctreeTest plan
ruff check+ruff format --checkpass🤖 Generated with Claude Code