Module routes 

The router: every route the development server answers.

Modules

accounts 🔒

identity 🔒

oauth 🔒

preferences 🔒

repo 🔒

session 🔒

sync 🔒

Macros

xrpc_methods 🔒

The XRPC methods this server serves: for each one, the handler behind it and the credential it accepts.

Structs

AppState 🔒

Everything a handler needs.

AuthState

Session storage, the e-stop latch and the operator credential, bundled so a caller building app_with_auth hands them over together.

StrictTransportSecurity

A Strict-Transport-Security header; see [tls] hsts_max_age_secs and [tls] hsts_include_subdomains in didbot-config.

TurnSpan 🔒

The request span, carrying the turn when the client named one.

XrpcBody

A buffered request body, refused in the atproto shape.

Constants

APP_BSKY_CREDENTIALS

The credential each of those methods accepts: the ones getSession takes.

APP_BSKY_METHODS

The app.bsky.* methods this server serves itself rather than proxies, as the reference PDS does: the account’s preferences.

ATPROTO_CREDENTIALS

The credential each of those methods accepts. See auth::Credential for what each kind means, and that module’s “Why every public route is public” for why the read surface is Public on purpose: protocol-required for com.atproto.sync.* and com.atproto.repo.*’s reads, structurally required for describeServer and resolveHandle. The write half takes the agent token createAccount hands back, and routes::write_record / routes::apply_writes are where the authenticated DID is checked against the repository a write names. getSession takes the same credentials, and names the account they sign in as.

ATPROTO_METHODS

Every com.atproto.* method this router answers, in NSID order.

BOT_DID_CREDENTIALS

The credential each of those methods accepts.

BOT_DID_METHODS

The bot.did.* methods this server serves — its own account admin surface, alongside the com.atproto.* one ATPROTO_METHODS names.

CORS_ALLOWED_HEADERS

The request headers an atproto client sends and a preflight must name.

CORS_EXPOSED_HEADERS

The response headers a browser is allowed to show a script.

CORS_MAX_AGE

How long a browser may cache a preflight answer before asking again.

DEFAULT_MAX_ACCOUNTS

How many accounts a deployment may hold at once, absent --max-accounts or a [capacity] section; see AuthState::max_accounts.

DID_LOOKUP_LIMIT

How many DIDs hosted elsewhere one caller address may ask com.atproto.identity.resolveDid to fetch per DID_LOOKUP_WINDOW; see AuthState::did_lookup_limiter.

DID_LOOKUP_WINDOW

The window DID_LOOKUP_LIMIT is measured over.

HANDLE_LOOKUP_LIMIT

How many handles no account here holds one caller address may ask com.atproto.identity.resolveHandle to look up per HANDLE_LOOKUP_WINDOW; see AuthState::handle_lookup_limiter.

HANDLE_LOOKUP_WINDOW

The window HANDLE_LOOKUP_LIMIT is measured over.

MAX_REQUEST_BODY

The largest request body this server will hold in memory.

OPERATOR_LOGIN_LIMIT

How many GET /dashboard/login calls one caller address may make per OPERATOR_LOGIN_WINDOW; see AuthState::operator_login_limiter.

OPERATOR_LOGIN_WINDOW

The window OPERATOR_LOGIN_LIMIT is measured over.

PROVISION_RATE_LIMIT

How many bot.did.createAccount and bot.did.createSession calls one caller address may make per PROVISION_RATE_WINDOW, the two together.

PROVISION_RATE_WINDOW

The window PROVISION_RATE_LIMIT is measured over.

REQUEST_TIMEOUT

How long any one request may take before this router gives up on it and answers 503 with an empty body.

SYNC_READ_LIMIT

How many com.atproto.sync.* reads one caller address may make per SYNC_READ_WINDOW; see AuthState::sync_rate_limiter.

SYNC_READ_WINDOW

The window SYNC_READ_LIMIT is measured over.

TURN_HEADER

The header a client may name the turn a request belongs to in.

TURN_HEADER_MAX_LENGTH

The longest turn identifier this server will put in a log line.

Statics

SYNC_READ_CONCURRENCY 🔒

How many com.atproto.sync.* reads may hold a blocking-pool thread at once, across every caller.

Functions

app

Builds the router.

app_bsky_routes 🔒

The routes those names stand for.

app_with_auth

Builds the router with every collaborator supplied explicitly.

app_with_health

Builds the router with the health pulse wired to an existing producer.

app_with_repos

Builds the router with com.atproto.sync.subscribeRepos attached too.

atproto_did 🔒

GET /.well-known/atproto-did

atproto_routes 🔒

The routes those names stand for.

authorize_upload 🔒

Checks one upload against the scope of the token that presented it, and writes a refusal down the way authorize_write does.

authorize_write 🔒

Checks a write against the scope of the token that presented it — see auth::Writer::authorize — and writes a refusal to the evaluation log beside the policy’s own, so what a token was refused reads in one place.

blocking_task_failed 🔒

The 500 for a spawn_blocking task that panicked instead of answering.

bot_did_routes 🔒

The routes those names stand for.

cross_origin_layer

The cross-origin policy on the public protocol surface.

describe_server 🔒

GET /xrpc/com.atproto.server.describeServer

did_json 🔒

GET /.well-known/did.json

hand_out_nonce 🔒

Hands the client a DPoP nonce on the answer to any request that carried a DPoP proof, success and refusal alike, unless the answer names one already, as a nonce challenge does.

health 🔒

GET /health

host_without_port 🔒

Strips a port from a Host header value.

only_loopback_callers 🔒

Refuses a caller that is not on this host, when this deployment answers only callers that are; see AuthState::loopback_callers_only.

parse_body 🔒

Parses a JSON body, mapping any failure to a 400 in the atproto shape.

poll_operator_claim 🔒

POST /xrpc/bot.did.pollOperatorClaim

record_scope_refusal 🔒

The evaluation log’s row for a write outside its token’s scope, named auth::TOKEN_SCOPE_RULE where a tree’s row names a policy.

request_authority 🔒

The authority a request names, however its protocol version spells it.

request_too_large 🔒

RequestTooLarge: a body over MAX_REQUEST_BODY.

require_sync_budget 🔒

Spends one of the caller’s SYNC_READ_LIMIT sync reads, or answers the refusal.

resolve_identifier 🔒

Resolves identifier — a handle or a DID — to an account DID this deployment hosts.

resource_credential 🔒

Resolves a repo write route’s credential — an agent token or a DPoP-bound OAuth access token. See auth::require_agent_token_or_dpop.

security_headers 🔒

The headers every response this server sends carries.

stats 🔒

GET /xrpc/bot.did.stats

sync_read 🔒

Runs a com.atproto.sync read on the blocking pool.

too_many_provisioning_attempts 🔒

unknown_route 🔒

The answer for a path nothing serves, and for an XRPC call nothing proxies; see crate::proxy::fallback.

wrong_method 🔒

The fallback for the right path and the wrong method.

xrpc_health 🔒

GET /xrpc/_health