From c5a2d01658a1f0532385bcbc9c228cbebe281185 Mon Sep 17 00:00:00 2001 From: zzstoatzz Date: Tue, 1 Sep 2026 02:16:08 -0500 Subject: [PATCH] check: skip listAppPasswords when the PDS rejects OAuth sessions the reference PDS explicitly forbids OAuth credentials on com.atproto.server.listAppPasswords ('OAuth credentials are not supported for this endpoint'), so a 403 from the checker's DPoP session is conformant behavior. treat it as a skip instead of a failure. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01WEGRiZrVy9BCS4sXh2BKbg --- apps/check/src/checks/account.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/apps/check/src/checks/account.ts b/apps/check/src/checks/account.ts index 79c3c48..8b534ca 100644 --- a/apps/check/src/checks/account.ts +++ b/apps/check/src/checks/account.ts @@ -146,6 +146,16 @@ const listAppPasswords: Check = { const client = authedClient(ctx.agent!); const res = await client.get("com.atproto.server.listAppPasswords", {}); if (!res.ok) { + // The reference PDS forbids OAuth credentials on this endpoint + // ("OAuth credentials are not supported for this endpoint"), so a + // 403 from our DPoP session is conformant behavior, not a failure. + if (res.status === 403) { + return { + status: "skip", + message: "endpoint rejects OAuth sessions (matches reference PDS)", + evidence: { response: { status: res.status, body: res.data } }, + }; + } return { status: "fail", message: `${res.data.error}: ${res.data.message ?? ""}`.trim(),