serviceDid

tcmts.atproto.serviceDid · #q6zkpead · function · runs anywhere

A server's identity in the service-auth tokens signed for it: the did:web of its URL's host, whatever the scheme and path. AT Protocol takes a port only on localhost (a PDS refuses did:web:host%3A8443), so this machine's own addresses (127.0.0.1, [::1]) are all did:web:localhost%3A<port>, and a URL with a port elsewhere throws Refused.

import { Refused } from "#codebase/tcmts/atproto";

export function serviceDid(url: string): string {
  const u = new URL(url);
  const local = u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]";
  if (u.port && !local)
    throw new Refused(
      `accounts can't sign in to ${u.host}: AT Protocol names a server by its domain alone, with no port (or localhost's), so it needs an address without one`,
    );
  return `did:web:${local ? "localhost" : u.hostname}${u.port ? `%3A${u.port}` : ""}`;
}

uses

used by