Continuing the discussion from Sketching com.atproto.server.createActorAuth:
@dholms.xyz so Nick managed to archive the previous discussion before i had a chance to answer your questions about Tranquils existing delegation support so time for a new thread (moved it to Discussion since I think that’s probably a better place for it for now).
Yes! It’s quite literally just using an atproto OAuth flow as the authn mechanism for the delegated accounts OAuth flow. Alternatively since we also support granularly permissioned app-passwords (as a replacement for the lack of API keys in the protocol at large) we also sometimes use app-passwords created by a controller to access clients that still don’t support OAuth.
A bit ago I did an overview write up with some design background and a few things you might want to read Account delegation for atproto: orgs, aliases, alts and more - Nel Ramblings .
To be honest the main rough edge has probably just been clients that don’t support OAuth yet but scoped app-passwords have been a fine stop gap there. The implementation itself is of course also juggling a few different things so isn’t the simplest part of our OAuth stack.
Another thing is that since controller access scoping is also done through OAuth scopes (since otherwise it wouldn’t really be possible to do this with properly permissioned access) that ends up bringing the act of putting together a permission set right up to a user level action, where it’s otherwise a thing an app dev would do. Representing the complexity of that in a way that’s easy to use for users has been … troublesome. To the point where we actually don’t yet, in the UI, expose the full expressiveness of the implementation. Tranquils user base may be currently dominated by technical people working in the atproto space but we want your average user to be able to confidently use its power features too. Some ideas I’ve had here and want to explore is giving app clients more access to the delegation such that, apps that want to provide good support, can give users an easy to understand UI for changing controllers permissions for a delegated account in the context of that app specifically. There’s some API design work to be done there.
In general this has been part of the stuff I’ve been thinking about for a “v2” of sorts, together with the rest of the extensions I mention at the end of that blog post. The v2 would have the overall goal of getting the feature from “works with everything” to “works with everything but works really well with clients that want to provide dedicated support”. Cleaning up the rough edges a bit, making some nice XRPC and OAuth APIs for managing all this, etc.
