I’m working through the technical details and want to confirm my understanding.
Currently it is not possible for a feed server to independently verify the membership of an identity to a space with formal protocol channels or mechanics.
- did:plc:foo authenticates with ExampleApp https://example.app/
- ExampleApp creates service-auth token for
getFeedSkeletonon behalf of did:plc:foo to FeedServer https://feeds.app/ - ExampleApp requests getFeedSkeleton from FeedServer https://feeds.app/ for did:plc:foo with the service-auth token
- FeedServer has no ability to determine if did:plc:foo is a member of space did:plc:bar/com.example.space/baz
For FeedServer to know if did:plc:foo is a member of space did:plc:bar/com.example.space/baz, one of these must happen:
- The feed server has its own auth where it gets an identity access token and can mint a space credential to test authentication. This sucks for a lot of reasons.
- The AppView sends additional data* that must be trusted that says the requesting identity has access to the space. This sucks for different reasons.
- The space must be configured with a membership-app that can be queried by FeedServer directly. This sucks also sucks for different reasons.
I propose that the checkUserAccess be implemented by the space host and can be queried with service authentication by members of the space. That would allow FeedServer to install a “service account” as a member of the space that could then make service auth requests as needed.