Pds: MapAtProtoPds cannot exclude or override individual XRPC endpoints #39

New issue

Open

opened 2026-06-10 22:46:51 +00:00 by Grandiras · 0 comments

Grandiras commented

2026-06-10 22:46:51 +00:00

Owner

MapAtProtoPds() maps all PDS XRPC endpoints unconditionally. There is no way to exclude, replace, or wrap a single endpoint — attempting to map the same route yourself produces an ambiguous-match conflict.

Concrete need: Updraft must own com.atproto.server.createAccount to enforce real invite-code validation (see the invite-codes issue). The only way today is terminal middleware registered before MapAtProtoPds() that matches the path manually and never calls next() — workable, but it bypasses endpoint routing (no endpoint metadata, no route-level auth policies, easy to get subtly wrong).

Suggestion, either of:

MapAtProtoPds(options => options.Exclude("com.atproto.server.createAccount")) so consumers can map their own implementation, or
first-class hooks on PdsService (e.g. an IAccountCreationGuard invoked inside CreateAccountAsync) so the default endpoint stays but policy is pluggable.

The hook approach composes better with the invite-store suggestion; the exclude approach is more general.

`MapAtProtoPds()` maps all PDS XRPC endpoints unconditionally. There is no way to exclude, replace, or wrap a single endpoint — attempting to map the same route yourself produces an ambiguous-match conflict. Concrete need: Updraft must own `com.atproto.server.createAccount` to enforce real invite-code validation (see the invite-codes issue). The only way today is terminal middleware registered before `MapAtProtoPds()` that matches the path manually and never calls `next()` — workable, but it bypasses endpoint routing (no endpoint metadata, no route-level auth policies, easy to get subtly wrong). Suggestion, either of: - `MapAtProtoPds(options => options.Exclude("com.atproto.server.createAccount"))` so consumers can map their own implementation, or - first-class hooks on `PdsService` (e.g. an `IAccountCreationGuard` invoked inside `CreateAccountAsync`) so the default endpoint stays but policy is pluggable. The hook approach composes better with the invite-store suggestion; the exclude approach is more general.