Module proxy 

atproto-proxy: an XRPC call this server does not serve, forwarded to the service a DID document names.

The XRPC spec’s “Service Proxying”. The header names a DID and a service id, as did:web:api.bsky.app#bsky_appview does. This server resolves the DID, takes the service entry with that id, and forwards the method, the query and the body there with a service-auth token signed as the calling account: iss the account, aud the header’s DID and service id, lxm the method. The answer streams back.

The call is authorized as crate::service_auth::authorize authorizes one, before anything is resolved, so a caller with no credential makes this server fetch nothing. Both fetches go through didbot_http::pinned_client, and neither may reach this server itself. Which headers cross in each direction are the reference PDS’s (packages/pds/src/pipethrough.ts).

Each account’s calls are bounded by ProxyLimits: a call over its rate, or past its own, its tree’s or the server’s share of calls in flight, is refused 429 before anything is resolved. A call takes its place once its body is read, so a slow upload holds none.

Re-exports

pub use limits::ProxyLimits;

pub use limits::ProxySettings;

Modules

limits 🔒

What one account may spend of the proxy: a rate, a number of calls in flight, and a cache of where its targets live.

Structs

Target 🔒

Where a call goes: the DID and the service id an PROXY_HEADER names.

Constants

BODY_HEADERS 🔒

The headers that describe a procedure’s body, carried with it.

CONTENT_HEADERS 🔒

The headers that describe a successful answer’s body, carried with it.

FORWARDED_REQUEST_HEADERS 🔒

Request headers a proxied call carries on, beside every x-atproto-* header. Accept-Encoding is carried too, as identity when absent.

FORWARDED_RESPONSE_HEADERS 🔒

Response headers carried back, on a failure as on a success.

MAX_PROXIED_RESPONSE

The most of one proxied answer this server passes back, in bytes.

PROXY_HEADER

The request header naming the service a call is for.

PROXY_TIMEOUT

How long one proxied call may take, from connecting to the last byte of the answer.

Functions

admit 🔒

Spends one of did’s proxied calls, or answers the refusal.

answer 🔒

A successful answer, streamed back under MAX_PROXIED_RESPONSE.

app_view 🔒

Where an app.bsky.* call at path goes when it names no service: the configured ProxySettings::app_view. None for any other method.

fallback 🔒

The router’s fallback: a path nothing serves, or an XRPC call this server does not serve.

forward 🔒

Forwards one XRPC call, or answers why it is not forwarded.

forwarded_request_headers 🔒

The headers a call carries on to the service; see FORWARDED_REQUEST_HEADERS.

proxy 🔒

refuse_this_server 🔒

Refuses a URL on a name this deployment answers to: a call proxied there is a call this server makes of itself.

resolve 🔒

The service’s endpoint origin, and a client pinned to it. The origin is the one ProxyLimits keeps for the target, or else resolve_endpoint’s; neither it nor the document is on this server.

resolve_endpoint 🔒

The origin the target’s DID document names for its service id, fetched through a pinned client from a host that is not this server.

status_name 🔒

The name XRPC gives a status, for a failure that names none: the reference client’s httpResponseCodeToName.

tree_of 🔒

The account tree did is in, named by its topmost account below this server’s own: the account the operator admitted, read up the parent chain. An account with no parent but this server is its own tree.

unreachable_target 🔒

The answer for a target this server will not, or cannot, reach.

upstream_error 🔒

A failed answer, passed back as an XRPC error: the service’s own status, error and message, except that its 500 is this server’s 502.