Permissioned data by dholms · Pull Request #5187 · bluesky-social/atproto

dholms · 2026-07-02T23:13:20Z

⚠️ WIP ⚠️

Covers record CRUD, space management, credential flow, and sync protocol for the permissioned data ("spaces") system. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Multi-op atomic commits in oplog (rev + idx) - isMember flag on space table for membership lifecycle - Separate space_member_state table for owner-only commitment - JWT typ headers for domain discrimination (space_member_grant, space_credential) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

28 tasks across 7 phases: core refactoring, credentials, DB migration, actor store updates, lexicons, endpoints, tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Rename SpaceStorage interface to SpaceRepoStorage and MemoryStorage class to MemoryRepoStorage to better reflect their purpose and make room for SpaceMembersStorage. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add comprehensive tests for SpaceMembers class including member addition/removal, duplicate detection, order-independent setHash, and storage reload. Also add domain separation test verifying that commits created with 'records' scope cannot be verified with 'members' scope and vice versa. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Implements JWT creation and verification for two credential types: - MemberGrant: short-lived (5 min) token for members to request space credentials - SpaceCredential: longer-lived (2 hour default) token for space access Both use manual JWT encoding/decoding following atproto patterns, with proper signature verification, expiry checking, and type validation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Adds new database schema types for space repo state, member state, oplogs, and credential recipients. Updates migration 003 to restructure the space and space_member tables by moving setHash/rev to separate state tables and adding isMember flag to space table. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…or new table structure Updated SpaceReader to read from new space_repo and space_member_state tables: - getSpace() now returns isMember instead of setHash/rev - getSetHash() and getRev() read from space_repo table - Added getRepoState() and getMemberState() methods - Added getRepoOplog() and getMemberOplog() for oplog queries - Added getCredentialRecipients() for credential flow - listMembers() now includes memberRev field Updated SpaceTransactor with new commit and state management: - createSpace() now creates space_repo and space_member_state rows - Renamed applyCommit() to applyRepoCommit() with oplog tracking - Added applyMemberCommit() for member operations - Added updateMembership() to manage isMember flag - Added recordCredentialRecipient() for credential tracking - Updated deleteSpace() to clean up all related tables - Updated addMember() to include memberRev field Created new SQL storage adapters: - SqlRepoStorage implements SpaceRepoStorage - SqlMembersStorage implements SpaceMembersStorage - Replaced ScopedSpaceRepoStorage with SqlRepoStorage Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Updates PDS endpoints to use the restructured actor store: - Rename ScopedSpaceRepoStorage to SqlRepoStorage in CRUD endpoints - Replace applyCommit() with applyRepoCommit() - Replace getRev() with getRepoState() for swap commit checks - Update addMember/removeMember to use SpaceMembers class with proper set hash tracking and member commits - Update notifyMembership to use updateMembership() instead of deleteSpace() when removing membership, preserving data while updating membership flag Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…points Implements Tasks 21, 22, and 23 for the permissioned data protocol. Task 21: Created 5 sync endpoints: - getRepoState: Get sync state for a user's repo in a space - getRepoOplog: Get operation log for incremental repo sync - getMemberState: Get sync state for space member list - getMemberOplog: Get operation log for member list sync - getMembers: Get full member list for a space All sync endpoints use spaceCredentialAuth and validate that the credential's space matches the requested space. Member endpoints read from the space owner's actor store. Task 22: Created notifyWrite endpoint: - Uses serviceAuth for PDS-to-PDS communication - When space owner receives notification, fans out to credential recipients - Fire-and-forget delivery (best effort, not guaranteed) Task 23: Updated space/index.ts to register all new endpoints including getMemberGrant and getSpaceCredential that were created earlier. All endpoints properly handle branded string types (DidString, NsidString, etc.) from the generated lexicon types. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add comprehensive integration tests for the permissioned data protocol: - Oplog and state tracking: verify record operations produce oplog entries, setHash updates, and batch writes use same rev with different idx - Credential flow: test member grant/credential exchange, non-member rejection, and credential usage for sync endpoints - Sync flow: test full and incremental record sync via oplog, and member list sync Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…gration

matthieusieben

To me, it feels quite unintuitive that a space has to be created with com.atproto.simplespace.createSpace or app.example.complexspace.newSpace, and then retrieved with com.atproto.space.getSpace.

It feels even more unintuitive, and unfortunate, that a user can make their community go from "member based" to "public" to "private", but can never in the future go from simplespace to complexspace.

I am strongly against this dual way of configuring space access (the "polity type", and then the "policy type"'s config). Even naming them is awkward: is "simplespace" a "config", a "policy", a "policy type" ?. I think we should have only one way of configuring access:

Either have multiple policy types that have a single behavior each ("simplespace", "publicspace", "privatespace", "managedspace", and more custom 3rd party policies in the future)
Or a single policy type that has a configurable behavior (ie merge all the "simplespace" stuff under "com.atproto.space")

If we do the former (which I believe is the right call), spaces would all be created with com.atproto.space.createSpace. That endpoint would have a required policy property, that can be any string token (e.g. com.atproto.space.defs#publicspace).

Then, based on that policy value, more endpoints become available to configure the space:

simplespace enables the member list management endpoints (addMember, etc.)
managedspace has endpoints to configure the managing app (like getConfig, setManagingApp, etc.)
publicspace and privatespace might not really need any config

We could codify this under a new lexicon type but I don't think we need to go that way. A simple convention around "policy X enables endpoints Y" (which can be setup as each TOKEN's description) is enough IMO.

matthieusieben · 2026-07-03T08:49:21Z

+      for (const collection of def.collections) {
+        yield collection
+      }


Suggested change

for (const collection of def.collections) {

yield collection

}

yield* def.collections

matthieusieben · 2026-07-03T08:55:16Z

+  "lexicon": 1,
+  "id": "com.atproto.space.defs",
+  "defs": {
+    "signedCommit": {


Why not make this it's own lexicon document:

$type: "com.atproto.space.signedCommit"

instead of:

$type: "com.atproto.space.defs#signedCommit"

matthieusieben · 2026-07-03T09:08:12Z

@@ -0,0 +1,80 @@
+import { IdResolver, getHandle } from '@atproto/identity'


Note that I've been trying to avoid @atproto/identity because it does not support "safeFetch" and is suceptible to SSRF attacks.

See @atproto-labs/handle-resolver-node and @atproto-labs/identity-resolver for alternatives that support custom (safe) fetch implementation

dholms and others added 30 commits April 2, 2026 11:48

package structure

d076958

big picture doc

5a84455

first pass at permissioned repo

e752d96

some sample lexicons

a5c9a8d

first pass pds

c8a4bdb

tidy some stuff

8557023

lint"

8aaf5b4

create/list spaces

e3cb74f

some simple tests

6af5e46

space uri syntax + add/removeMember & notifyMembership

f35d1bd

Add permissioned data PDS implementation design spec

146cfa8

Covers record CRUD, space management, credential flow, and sync protocol for the permissioned data ("spaces") system. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add permissioned data PDS implementation plan

f23f6c0

28 tasks across 7 phases: core refactoring, credentials, DB migration, actor store updates, lexicons, endpoints, tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

refactor: rename Repo to SpaceRepo in @atproto/space

bc91b75

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

refactor: rename SpaceStorage to SpaceRepoStorage

5c72a37

Rename SpaceStorage interface to SpaceRepoStorage and MemoryStorage class to MemoryRepoStorage to better reflect their purpose and make room for SpaceMembersStorage. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add scope to SpaceContext and member operation types

23143d5

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add SpaceMembersStorage interface and MemoryMembersStorage

f5a54ce

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add SpaceMembers class for member list management

d381c2e

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add lexicons for space credentials, sync, and notifications

db34711

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: run codegen for new space lexicons

b18490d

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add space credential auth verifier and credential flow endpoints

3c99e85

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fix: filter listSpaces to only show active memberships

377f474

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

notify writes + repo param on get/list records

ac8b96d

dholms added 4 commits June 23, 2026 14:00

space writer table

8fe7bfc

merge main

a90c369

Merge branch 'permissioned-data' into permissioned-data-proposal-inte…

27ceb52

…gration

update kysely syntax

2c662dc

dholms mentioned this pull request Jul 2, 2026

Permissioned data bluesky-social/proposals#94

Merged

dholms added 2 commits July 2, 2026 18:29

bring lexicons up to date with spec

5696336

bring impl up to date with lexicons & proposal

3f6c96d

matthieusieben reviewed Jul 3, 2026

View reviewed changes

zzstoatzz mentioned this pull request Jul 9, 2026

permissioned-spaces client drifted from current ZDS surface (createSpace + member-grant flow removed) zzstoatzz/plyr.fm#1656

Closed

dholms added 7 commits July 29, 2026 19:51

cleaning up spaces

4d1cbe2

tidy up sync package

830088b

fix up at uris

64853ba

fix up some lex stuff

b03d7e5

space refs & other uri fixes

24a81bf

fix bugs/security issues with space credcs

d784974

oauth ui

47205c4

jeherve mentioned this pull request Jul 31, 2026

Jetpack integration: deliver gated content as AT Protocol permissioned data Automattic/wordpress-atmosphere#226

Open

dholms added 11 commits July 31, 2026 11:36

fix read_self scopes

b9efd3d

client attestation verifier

b76a4cf

tighten space scope validation

c5962d7

refactor lexicons, implement blobs

48261c5

merge prepare writes

a8653ac

refactor & buff up simplespace impl

8dabda7

bunch of cleanup & refactoiring in actor store

657824e

more tidying of actor store

6eee6e8

fix up auth verifier + enforce takedowns

341b0f9

dont fan notifySpaceDelete out to other repo hosts

12e225b

misc fixes

20d7ed4

dholms mentioned this pull request Aug 7, 2026

0016 Permissioned Data: misc fixes with alpha impl bluesky-social/proposals#100

Open

revamp tests

2f22565

Navigation Menu

Uh oh!

Permissioned data - #5187

Permissioned data#5187
dholms wants to merge 93 commits into
mainfrom
permissioned-data

dholms commented Jul 2, 2026

Uh oh!

matthieusieben left a comment •

edited

Loading

Uh oh!

matthieusieben Jul 3, 2026

Uh oh!

matthieusieben Jul 3, 2026

Uh oh!

matthieusieben Jul 3, 2026

Uh oh!

matthieusieben Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,80 @@
		import { IdResolver, getHandle } from '@atproto/identity'

Uh oh!

Conversation

dholms commented Jul 2, 2026

Uh oh!

matthieusieben left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

matthieusieben Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

matthieusieben Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

matthieusieben Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

matthieusieben Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

matthieusieben left a comment •

edited

Loading