Struct OAuthSection 

pub struct OAuthSection {
    pub scope_ceiling: Option<Vec<String>>,
    pub pending_per_account: Option<usize>,
    pub pending_total: Option<usize>,
    pub dns_resolver: Option<String>,
    pub browser_session_ttl_secs: Option<u64>,
}

The authorization server’s own bounds: the scope ceiling every grant is narrowed to, how many decisions may sit undecided at once, and the resolver it finds a permission set’s authority through.

scope_ceiling is the one place this file names scopes, and it may only narrow. Whatever it holds is intersected with the compiled-in ceiling (didbot_serve::oauth::authorize::GrantAnyScope) before it is applied, so a configured value can shrink what an agent may hold and can never reach past what the binary already allows — the hard-blocked capabilities stay outside it whatever this section says. See the crate root’s doc for why that direction is the only one permitted.

Reload: needs a restart. The ceiling is built once and handed to the router’s OAuthState.

Fields

scope_ceiling: Option<Vec<String>>

The most any agent may be granted, as an enumeration of scope atoms — plan/scope-policy.md’s “a ceiling is an enumeration, not a pattern”. Absent leaves the compiled-in ceiling in place.

A seam, and the first half of that plan’s “from server configuration first, from the operator’s records second”: a ceiling read from policy records in the operator’s repository replaces this one at the same ScopePolicy interface, without either side changing. It is here so the boundary is testable before that source exists, not because a ceiling belongs in a configuration file.

pending_per_account: Option<usize>

How many decisions one account may have awaiting an answer before a further pushed authorization request is refused. Mirrors didbot_serve::oauth::decision::DEFAULT_PENDING_PER_ACCOUNT, 8.

Reasonable range: 1 to 64. At 1, a second sign-in started before the first is answered displaces it. Above 64, one account can hold many sign-ins nobody will answer, and a caller with no credential can push them.

pending_total: Option<usize>

How many decisions this server may hold in total, counting an answered one until its pushed request expires.

Left unset, the default is derived rather than fixed: didbot-pds computes [capacity] max_accounts * pending_per_account, floored at didbot_serve::oauth::decision::DEFAULT_PENDING_TOTAL, so a deployment sized above 64 accounts is not left with a total bound tighter than pending_per_account gives each one; with no max_accounts configured either, that same fixed default applies outright. A value written here is never adjusted against max_accounts – only checked, with a startup warning if it comes up short.

Reasonable range: max_accounts * pending_per_account to twice that. Below it, a full deployment refuses a push before every account has used its own bound. An answered decision is held until its pushed request expires, so some room above it keeps a busy deployment from refusing. Each one held is memory that POST /oauth/par, which needs no credential, can fill.

dns_resolver: Option<String>

The DNS-over-HTTPS resolver an include: scope’s permission set is found through: it is asked for the _lexicon TXT record under the set’s authority. com.atproto.identity.resolveHandle asks it for the _atproto TXT record of a handle no account here holds. Default https://cloudflare-dns.com/dns-query.

Reasonable range: an https:// DNS-over-HTTPS (RFC 8484) endpoint that also answers the JSON form, ?name=&type=TXT answered as application/dns-json: Cloudflare’s, Google’s at https://dns.google/resolve, or one on this deployment’s own network. Anything else refuses startup. The default is Cloudflare’s because it answers that form and is the resolver the operator’s own onboarding checks ask. Whoever runs the resolver sees which permission sets sign-ins here name, and which handles callers ask this server to resolve.

browser_session_ttl_secs: Option<u64>

How long a browser stays signed in as an account, in seconds, counted from the sign-in. Use does not extend it. Default 43_200, twelve hours, as an operator’s session.

Reasonable range: 300 to 86_400 — five minutes to a day. Below five minutes an agent signs its browser in again for most web sign-ins. Above a day a copied cookie outlives any session an agent has. Nothing enforces the range.

Trait Implementations

impl Clone for OAuthSection

fn clone(&self) -> OAuthSection

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OAuthSection

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OAuthSection

fn default() -> OAuthSection

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OAuthSection

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for OAuthSection

fn eq(&self, other: &OAuthSection) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for OAuthSection

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for OAuthSection

impl StructuralPartialEq for OAuthSection