Fix OAuth service-proxying audience for combined did#serviceId scopes (bluesky-social#4992)

devinivy · claude · web-flow · commit 622d365aeb24 · 2026-05-23T23:51:02.000-04:00
* feat(did): add AtprotoDidRefAbsolute, DidRefRelative, AtprotoScopeAud, AtprotoTokenAud Renames AtprotoAudience to AtprotoDidRefAbsolute (kept as deprecated alias), adds DidRefRelative + isDidRefRelative for #fragment-only references, and introduces use-site unions: AtprotoScopeAud (always combined, for OAuth scopes) and AtprotoTokenAud (bare DID or combined, for service-auth JWT audience claims). Lays the groundwork for Phase 1 of proposal 0014. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(did): cover new DID-reference predicates Tightens isAtprotoDidRefAbsolute to reject empty fragments (`did:plc:abc#`), aligning it with isDidRefRelative which already rejects bare `#`. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(oauth-scopes): use AtprotoScopeAud / isAtprotoDidRefAbsolute Switches from the legacy AtprotoAudience names to the renamed canonical forms. Behavior unchanged; the deprecated alias from @atproto/did keeps external consumers compiling. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(lexicons): loosen getServiceAuth.aud to accept did or did#serviceId The 'format: did' constraint excluded the combined did#serviceId syntax that OAuth-scoped credentials grant via 'rpc:lxm?aud=did#service'. Loosens to a plain string with a maxLength cap; handler-side validation will enforce that the value is either a bare atproto DID or an AtprotoDidRefAbsolute. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(lexicons): tighten getServiceAuth.aud description and maxLength Drops the internal "Phase 1" reference from the user-facing description and bumps maxLength from 1024 to 2048 to accommodate the spec maximum DID length plus a service-id fragment. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(pds): accept did#serviceId aud in getServiceAuth handler Validates that the caller-supplied aud is a valid atproto DID or AtprotoDidRefAbsolute, then passes the original string straight through to permissions.assertRpc and createServiceJwt. Combined-aud OAuth scopes now match (resolves part of bluesky-social#4850); password-session callers continue to use bare DID. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(pds): pass combined did#serviceId aud to pipethrough scope check parseProxyInfo and parseProxyHeader now return the serviceId alongside the did and url. The proxyHandler uses the combined did#serviceId form when calling permissions.assertRpc, so OAuth credentials with 'rpc:lxm?aud=did#service' scopes succeed (resolves the proxy half of bluesky-social#4850). The outbound service-auth JWT keeps bare-DID aud — Slice D adds the operator-visible flag to flip that. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(pds): rename scopeAud/tokenAud to clarify Phase 1 asymmetry Names the Phase 1 audience asymmetry structurally rather than relying on a comment to document it. The scope check uses the combined did#serviceId form; the outbound JWT keeps bare-DID aud. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(pds): assert parseProxyHeader returns serviceId Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(oauth-scopes): cover combined-aud assertRpc match (issue bluesky-social#4850) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(pds): validate getServiceAuth aud for all caller types Moves the aud predicate check from the OAuth-only authorize callback into the shared handler body, so app-password and session callers also get syntactic validation — restoring the coverage that the lexicon's format: did constraint provided before Slice A loosened it to a plain string with maxLength. Also updates app-passwords tests to use valid atproto DIDs instead of did:example:test, which now correctly fails the predicate check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * Address review feedback for service-auth oauth fix - Annotate non-self-documenting checks in isAtprotoDidRefAbsolute and isDidRefRelative with terse case-name comments. - Spell out "Phase 1 of service auth updates" in the proxyHandler asymmetry comment. - Drop the issue-number reference from the assertRpc combined-aud describe block. - Mirror PR bluesky-social#4602's createReport pattern: use scopeAud/tokenAud naming to make the bare-DID JWT audience structurally clear. - Add a proxyHandler regression test that fails when scope-check aud reverts to bare DID. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(pds): use bare-DID aud in get/putPreferences proxy fallback When getPreferences/putPreferences proxy to a non-default appview, they were sending the combined did#serviceId form as the JWT audience. This contradicts the Phase 1 convention used elsewhere (proxyHandler, pipethrough(), createReport) where the scope check sees the combined form but the outbound service-auth JWT keeps bare-DID aud. Adds a small bareDidFromProxyTo() helper in pipethrough.ts and uses it at both call sites. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(pds): use real AppContext + override only authorization Replaces the proxy-oauth-aud test's stub-AppContext with a real TestNetworkNoAppView. Only AuthVerifier.authorization is overridden to drive the OAuth path off an x-test-scope header — every other ctx field stays real and real-typed. The override's signature is constrained by the real method type, so future shape changes (renames, output type restructures) break the test at compile time rather than silently diverging. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(pds): tighten proxy-oauth-aud cases Drops the lastAud capture (a 200 already implies combined-form aud reached the scope check) and replaces the bare-DID-aud negative case with a different-service-id negative case. Bare-DID aud isn't a valid rpc scope — isAudParam rejects it at parse time — so the prior negative case wasn't actually exercising audience matching. The new case (`upstream.did#atproto_other`) parses valid and proves the runtime aud's service id is being compared. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: add changesets for service-auth oauth fix Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * test(pds): cover getServiceAuth aud handling Adds five integration cases: bare-DID and combined did#serviceId aud both produce a token whose aud claim equals the input; malformed, non-atproto, and empty-fragment aud values are rejected. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: pnpm style:fix Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(pds): revert scopeAud/tokenAud rename in handlers without both The naming pair was meant to disambiguate when scope-check and JWT audiences appear in the same scope. In get/putPreferences and createReport only one of the two is in scope at a time, so the rename adds noise without clarifying anything. proxyHandler keeps both names since they sit side-by-side there. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(did): drop OAuth-flavored types; remove deprecated AtprotoAudience Removes AtprotoScopeAud, AtprotoTokenAud, AtprotoAudience, and isAtprotoAudience from @atproto/did. The only consumer (oauth-scopes) now uses AtprotoDidRefAbsolute / isAtprotoDidRefAbsolute directly via its own AudParam alias. Keeps @atproto/did focused on DID-level primitives without OAuth or service-auth concepts. The AtprotoAudience/isAtprotoAudience deprecated aliases are dropped outright (breaking) — migration is a single import swap. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(did): split did-ref.ts into atproto-agnostic primitives did-ref.ts now hosts generic DidRefAbsolute / DidRefRelative primitives (and their predicates) parameterized on a DID method. The atproto-flavored AtprotoDidRefAbsolute moves to atproto.ts alongside the other Atproto* helpers, defined as DidRefAbsolute<AtprotoIdentityDidMethods>. Public API surface is unchanged (both still flow through the package barrel). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor(did): use String.includes for double-hash check Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: changeset for oauth-scopes breaking re-export change Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(oauth-scopes): tighten scopeNeededFor casts back to concrete types The casts `as AudParam`/`as LxmParam` widened to include `'*'`, which is wrong inside scopeNeededFor — it's constructing the specific scope for a single call, never a wildcard. Restore the original AtprotoDidRefAbsolute / Nsid casts. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: lead BREAKING-change changesets with **BREAKING:** marker Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
diff --git a/.changeset/crisp-bridges-dream.md b/.changeset/crisp-bridges-dream.md
@@ -0,0 +1,5 @@
+---
+'@atproto/pds': patch
+---
+
+Fix OAuth service-proxying audience check to use combined `did#serviceId` form, matching the shape of granted `rpc:` scopes.
diff --git a/.changeset/plain-rivers-glow.md b/.changeset/plain-rivers-glow.md
@@ -0,0 +1,5 @@
+---
+'@atproto/oauth-scopes': minor
+---
+
+**BREAKING:** Remove the `AtprotoAudience` and `isAtprotoAudience` re-exports. They are superseded by `AtprotoDidRefAbsolute` and `isAtprotoDidRefAbsolute`, also re-exported from this package.
diff --git a/.changeset/quiet-bridges-hum.md b/.changeset/quiet-bridges-hum.md
@@ -0,0 +1,5 @@
+---
+'@atproto/did': minor
+---
+
+**BREAKING:** Remove `AtprotoAudience` and `isAtprotoAudience`. They are superseded by `AtprotoDidRefAbsolute` and `isAtprotoDidRefAbsolute`. Adds the related `DidRefAbsolute` and `DidRefRelative` types and predicates.
diff --git a/.changeset/quiet-rivers-dance.md b/.changeset/quiet-rivers-dance.md
@@ -0,0 +1,5 @@
+---
+'@atproto/pds': patch
+---
+
+`getServiceAuth` now accepts the combined `did#serviceId` form for its `aud` parameter, in addition to the bare DID form.
diff --git a/lexicons/com/atproto/server/getServiceAuth.json b/lexicons/com/atproto/server/getServiceAuth.json
@@ -11,8 +11,8 @@
         "properties": {
           "aud": {
             "type": "string",
-            "format": "did",
-            "description": "The DID of the service that the token will be used to authenticate with"
+            "maxLength": 2048,
+            "description": "The DID or `did#serviceId` reference of the service that the token will be used to authenticate with."
           },
           "exp": {
             "type": "integer",
diff --git a/packages/did/src/atproto.ts b/packages/did/src/atproto.ts
@@ -1,8 +1,9 @@
 import { z } from 'zod'
 import { DidDocument, DidService } from './did-document.js'
 import { DidError, InvalidDidError } from './did-error.js'
+import { DidRefAbsolute, isDidRefAbsolute } from './did-ref.js'
 import { Did } from './did.js'
-import { canParse, isFragment } from './lib/uri.js'
+import { canParse } from './lib/uri.js'
 import {
   DID_PLC_PREFIX,
   DID_WEB_PREFIX,
@@ -115,17 +116,6 @@ function isDidWebWithHttpsPort(did: Did<'web'>): boolean {
   return hasPort
 }
 
-export type AtprotoAudience = `${AtprotoDid}#${string}`
-export const isAtprotoAudience = (value: unknown): value is AtprotoAudience => {
-  if (typeof value !== 'string') return false
-  const hashIndex = value.indexOf('#')
-  if (hashIndex === -1) return false
-  if (value.indexOf('#', hashIndex + 1) !== -1) return false
-  return (
-    isFragment(value, hashIndex + 1) && isAtprotoDid(value.slice(0, hashIndex))
-  )
-}
-
 export type AtprotoData<
   M extends AtprotoIdentityDidMethods = AtprotoIdentityDidMethods,
 > = {
@@ -231,3 +221,15 @@ export function isAtprotoVerificationMethod<
     matchesIdentifier(this.id, 'atproto', method.id)
   )
 }
+
+/**
+ * An atproto-constrained absolute DID reference: `${AtprotoDid}#${fragment}`.
+ */
+export type AtprotoDidRefAbsolute = DidRefAbsolute<AtprotoIdentityDidMethods>
+
+export function isAtprotoDidRefAbsolute(
+  value: unknown,
+): value is AtprotoDidRefAbsolute {
+  if (!isDidRefAbsolute(value)) return false
+  return isAtprotoDid(value.slice(0, value.indexOf('#')))
+}
diff --git a/packages/did/src/did-ref.ts b/packages/did/src/did-ref.ts
@@ -0,0 +1,37 @@
+import { Did, isDid } from './did.js'
+import { isFragment } from './lib/uri.js'
+
+/**
+ * An absolute DID reference: `${Did}#${fragment}`.
+ *
+ * @see {@link https://www.w3.org/TR/did-core/#did-url-syntax}
+ */
+export type DidRefAbsolute<M extends string = string> = `${Did<M>}#${string}`
+
+export const isDidRefAbsolute = (value: unknown): value is DidRefAbsolute => {
+  if (typeof value !== 'string') return false
+  const hashIndex = value.indexOf('#')
+  if (hashIndex === -1) return false // no '#'
+  if (hashIndex === value.length - 1) return false // empty fragment
+  if (value.includes('#', hashIndex + 1)) return false // more than one '#'
+  return isFragment(value, hashIndex + 1) && isDid(value.slice(0, hashIndex))
+}
+
+/**
+ * A relative DID reference (a `#fragment` resolved against the surrounding
+ * DID document's `id`). The optional `id` parameter narrows the fragment.
+ */
+export type DidRefRelative<I extends string = string> = `#${I}`
+
+export function isDidRefRelative<I extends string = string>(
+  value: unknown,
+  id?: I,
+): value is DidRefRelative<I> {
+  if (typeof value !== 'string') return false
+  if (value.charCodeAt(0) !== 35 /* '#' */) return false // doesn't start with '#'
+  if (value.length < 2) return false // empty fragment
+  if (value.includes('#', 1)) return false // more than one '#'
+  if (!isFragment(value, 1)) return false
+  if (id !== undefined && value !== `#${id}`) return false // id mismatch
+  return true
+}
diff --git a/packages/did/src/index.ts b/packages/did/src/index.ts
@@ -1,6 +1,7 @@
 export * from './atproto.js'
 export * from './did-document.js'
 export * from './did-error.js'
+export * from './did-ref.js'
 export * from './did.js'
 export * from './methods.js'
 export * from './utils.js'
diff --git a/packages/did/tests/did-ref.test.ts b/packages/did/tests/did-ref.test.ts
@@ -0,0 +1,69 @@
+import { isAtprotoDidRefAbsolute } from '../src/atproto.js'
+import { isDidRefRelative } from '../src/did-ref.js'
+
+describe('isAtprotoDidRefAbsolute', () => {
+  it('accepts well-formed absolute references', () => {
+    expect(
+      isAtprotoDidRefAbsolute('did:plc:l3rouwludahu3ui3bt66mfvj#atproto'),
+    ).toBe(true)
+    expect(isAtprotoDidRefAbsolute('did:web:example.com#service_id')).toBe(true)
+    expect(isAtprotoDidRefAbsolute('did:web:example.com#atproto_label')).toBe(
+      true,
+    )
+  })
+
+  it('rejects bare DIDs', () => {
+    expect(isAtprotoDidRefAbsolute('did:plc:l3rouwludahu3ui3bt66mfvj')).toBe(
+      false,
+    )
+    expect(isAtprotoDidRefAbsolute('did:web:example.com')).toBe(false)
+  })
+
+  it('rejects relative references', () => {
+    expect(isAtprotoDidRefAbsolute('#atproto')).toBe(false)
+  })
+
+  it('rejects malformed input', () => {
+    expect(isAtprotoDidRefAbsolute('')).toBe(false)
+    expect(isAtprotoDidRefAbsolute('did:plc:l3rouwludahu3ui3bt66mfvj#')).toBe(
+      false,
+    )
+    expect(
+      isAtprotoDidRefAbsolute('did:plc:l3rouwludahu3ui3bt66mfvj##foo'),
+    ).toBe(false)
+    expect(
+      isAtprotoDidRefAbsolute('did:plc:l3rouwludahu3ui3bt66mfvj#a#b'),
+    ).toBe(false)
+    expect(isAtprotoDidRefAbsolute('did:foo:bar#baz')).toBe(false)
+    expect(isAtprotoDidRefAbsolute(null)).toBe(false)
+    expect(isAtprotoDidRefAbsolute(123)).toBe(false)
+  })
+})
+
+describe('isDidRefRelative', () => {
+  it('accepts well-formed relative references', () => {
+    expect(isDidRefRelative('#atproto')).toBe(true)
+    expect(isDidRefRelative('#atproto_label')).toBe(true)
+    expect(isDidRefRelative('#a')).toBe(true)
+  })
+
+  it('narrows on a specific id when supplied', () => {
+    expect(isDidRefRelative('#atproto', 'atproto')).toBe(true)
+    expect(isDidRefRelative('#atproto_label', 'atproto')).toBe(false)
+  })
+
+  it('rejects absolute references and bare strings', () => {
+    expect(isDidRefRelative('did:plc:l3rouwludahu3ui3bt66mfvj#atproto')).toBe(
+      false,
+    )
+    expect(isDidRefRelative('atproto')).toBe(false)
+  })
+
+  it('rejects malformed input', () => {
+    expect(isDidRefRelative('')).toBe(false)
+    expect(isDidRefRelative('#')).toBe(false)
+    expect(isDidRefRelative('#a#b')).toBe(false)
+    expect(isDidRefRelative(null)).toBe(false)
+    expect(isDidRefRelative(123)).toBe(false)
+  })
+})
diff --git a/packages/oauth/oauth-scopes/src/scope-permissions.test.ts b/packages/oauth/oauth-scopes/src/scope-permissions.test.ts
@@ -264,4 +264,40 @@ describe('ScopePermissions', () => {
       ).toBe(false)
     })
   })
+
+  describe('assertRpc combined-aud', () => {
+    it('allows did#serviceId aud when scope grants the same combined form', () => {
+      const set = new ScopePermissions(
+        'rpc:app.bsky.feed.getFeed?aud=did:web:example.com%23bsky_appview',
+      )
+      expect(() =>
+        set.assertRpc({
+          aud: 'did:web:example.com#bsky_appview',
+          lxm: 'app.bsky.feed.getFeed',
+        }),
+      ).not.toThrow()
+    })
+
+    it('rejects bare-DID aud when scope grants a combined form', () => {
+      const set = new ScopePermissions(
+        'rpc:app.bsky.feed.getFeed?aud=did:web:example.com%23bsky_appview',
+      )
+      expect(() =>
+        set.assertRpc({
+          aud: 'did:web:example.com',
+          lxm: 'app.bsky.feed.getFeed',
+        }),
+      ).toThrow()
+    })
+
+    it('allows wildcard aud against a combined-form match', () => {
+      const set = new ScopePermissions('rpc:app.bsky.feed.getFeed?aud=*')
+      expect(() =>
+        set.assertRpc({
+          aud: 'did:web:example.com#bsky_appview',
+          lxm: 'app.bsky.feed.getFeed',
+        }),
+      ).not.toThrow()
+    })
+  })
 })
diff --git a/packages/oauth/oauth-scopes/src/scopes/include-scope.ts b/packages/oauth/oauth-scopes/src/scopes/include-scope.ts
@@ -1,4 +1,3 @@
-import { AtprotoAudience, isAtprotoAudience } from '@atproto/did'
 import { LexiconPermission, LexiconPermissionSet } from '../lib/lexicon.js'
 import { Nsid, isNsid } from '../lib/nsid.js'
 import { Parser } from '../lib/parser.js'
@@ -11,7 +10,11 @@ import {
   isScopeSyntaxFor,
 } from '../lib/syntax.js'
 import { RepoPermission } from './repo-permission.js'
-import { RpcPermission } from './rpc-permission.js'
+import {
+  AtprotoDidRefAbsolute,
+  RpcPermission,
+  isAtprotoDidRefAbsolute,
+} from './rpc-permission.js'
 
 export { type LexiconPermission, type LexiconPermissionSet, type Nsid, isNsid }
 
@@ -23,7 +26,7 @@ export { type LexiconPermission, type LexiconPermissionSet, type Nsid, isNsid }
 export class IncludeScope {
   constructor(
     public readonly nsid: Nsid,
-    public readonly aud: undefined | AtprotoAudience = undefined,
+    public readonly aud: undefined | AtprotoDidRefAbsolute = undefined,
   ) {}
 
   toString() {
@@ -166,7 +169,7 @@ export class IncludeScope {
       aud: {
         multiple: false,
         required: false,
-        validate: isAtprotoAudience,
+        validate: isAtprotoDidRefAbsolute,
       },
     },
     'nsid',
diff --git a/packages/oauth/oauth-scopes/src/scopes/rpc-permission.ts b/packages/oauth/oauth-scopes/src/scopes/rpc-permission.ts
@@ -1,18 +1,23 @@
-import { AtprotoAudience, isAtprotoAudience } from '@atproto/did'
+import { AtprotoDidRefAbsolute, isAtprotoDidRefAbsolute } from '@atproto/did'
 import { Nsid, isNsid } from '../lib/nsid.js'
 import { Parser } from '../lib/parser.js'
 import { ResourcePermission } from '../lib/resource-permission.js'
 import { ScopeStringSyntax } from '../lib/syntax-string.js'
 import { NeRoArray, ScopeSyntax, isScopeStringFor } from '../lib/syntax.js'
 
-export { type AtprotoAudience, type Nsid, isAtprotoAudience, isNsid }
+export {
+  type AtprotoDidRefAbsolute,
+  type Nsid,
+  isAtprotoDidRefAbsolute,
+  isNsid,
+}
 
 export type LxmParam = '*' | Nsid
 export const isLxmParam = (value: unknown): value is LxmParam =>
   value === '*' || isNsid(value)
-export type AudParam = '*' | AtprotoAudience
+export type AudParam = '*' | AtprotoDidRefAbsolute
 export const isAudParam = (value: unknown): value is AudParam =>
-  value === '*' || isAtprotoAudience(value)
+  value === '*' || isAtprotoDidRefAbsolute(value)
 
 export type RpcPermissionMatch = {
   lxm: string
@@ -23,8 +28,8 @@ export class RpcPermission
   implements ResourcePermission<'rpc', RpcPermissionMatch>
 {
   constructor(
-    public readonly aud: '*' | AtprotoAudience,
-    public readonly lxm: NeRoArray<'*' | Nsid>,
+    public readonly aud: AudParam,
+    public readonly lxm: NeRoArray<LxmParam>,
   ) {}
 
   matches(options: RpcPermissionMatch) {
@@ -78,7 +83,7 @@ export class RpcPermission
 
   static scopeNeededFor(options: RpcPermissionMatch): string {
     return RpcPermission.parser.format({
-      aud: options.aud as AtprotoAudience,
+      aud: options.aud as AtprotoDidRefAbsolute,
       lxm: [options.lxm as Nsid],
     })
   }
diff --git a/packages/pds/package.json b/packages/pds/package.json
@@ -39,6 +39,7 @@
     "@atproto/aws": "workspace:^",
     "@atproto/common": "workspace:^",
     "@atproto/crypto": "workspace:^",
+    "@atproto/did": "workspace:^",
     "@atproto/identity": "workspace:^",
     "@atproto/lex": "workspace:^",
     "@atproto/lex-cbor": "workspace:^",
diff --git a/packages/pds/src/api/app/bsky/actor/getPreferences.ts b/packages/pds/src/api/app/bsky/actor/getPreferences.ts
@@ -2,7 +2,11 @@ import { Server } from '@atproto/xrpc-server'
 import { AuthScope, isAccessFull } from '../../../../auth-scope.js'
 import { AppContext } from '../../../../context.js'
 import { app } from '../../../../lexicons/index.js'
-import { computeProxyTo, pipethrough } from '../../../../pipethrough.js'
+import {
+  bareDidFromProxyTo,
+  computeProxyTo,
+  pipethrough,
+} from '../../../../pipethrough.js'
 
 export default function (server: Server, ctx: AppContext) {
   const { bskyAppView } = ctx
@@ -26,7 +30,12 @@ export default function (server: Server, ctx: AppContext) {
       const lxm = app.bsky.actor.getPreferences.$lxm
       const aud = computeProxyTo(ctx, req, lxm)
       if (aud !== `${bskyAppView.did}#bsky_appview`) {
-        return pipethrough(ctx, req, { iss: did, aud, lxm })
+        // Phase 1 of service auth updates: outbound JWT keeps bare-DID aud.
+        return pipethrough(ctx, req, {
+          iss: did,
+          aud: bareDidFromProxyTo(aud),
+          lxm,
+        })
       }
 
       const hasAccessFull =
diff --git a/packages/pds/src/api/app/bsky/actor/putPreferences.ts b/packages/pds/src/api/app/bsky/actor/putPreferences.ts
@@ -3,7 +3,11 @@ import { AccountPreference } from '../../../../actor-store/preference/reader.js'
 import { isAccessFull } from '../../../../auth-scope.js'
 import { AppContext } from '../../../../context.js'
 import { app } from '../../../../lexicons/index.js'
-import { computeProxyTo, pipethrough } from '../../../../pipethrough.js'
+import {
+  bareDidFromProxyTo,
+  computeProxyTo,
+  pipethrough,
+} from '../../../../pipethrough.js'
 
 export default function (server: Server, ctx: AppContext) {
   const { bskyAppView } = ctx
@@ -27,7 +31,12 @@ export default function (server: Server, ctx: AppContext) {
       const lxm = app.bsky.actor.putPreferences.$lxm
       const aud = computeProxyTo(ctx, req, lxm)
       if (aud !== `${bskyAppView.did}#bsky_appview`) {
-        return pipethrough(ctx, req, { iss: did, aud, lxm })
+        // Phase 1 of service auth updates: outbound JWT keeps bare-DID aud.
+        return pipethrough(ctx, req, {
+          iss: did,
+          aud: bareDidFromProxyTo(aud),
+          lxm,
+        })
       }
 
       const checkedPreferences: AccountPreference[] = []
diff --git a/packages/pds/src/api/com/atproto/server/getServiceAuth.ts b/packages/pds/src/api/com/atproto/server/getServiceAuth.ts
diff --git a/packages/pds/src/pipethrough.ts b/packages/pds/src/pipethrough.ts
diff --git a/packages/pds/tests/app-passwords.test.ts b/packages/pds/tests/app-passwords.test.ts
diff --git a/packages/pds/tests/get-service-auth.test.ts b/packages/pds/tests/get-service-auth.test.ts
diff --git a/packages/pds/tests/proxied/proxy-header.test.ts b/packages/pds/tests/proxied/proxy-header.test.ts
diff --git a/packages/pds/tests/proxied/proxy-oauth-aud.test.ts b/packages/pds/tests/proxied/proxy-oauth-aud.test.ts
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +'@atproto/pds': patch
 +---
++
 +Fix OAuth service-proxying audience check to use combined `did#serviceId` form, matching the shape of granted `rpc:` scopes.