feat: add com.atproto.server.getServiceAuth endpoint

.changeset/video-upload-auth.md

@@ -0,0 +1,7 @@
+---
+"@ascorbic/pds": minor
+---
+
+Add `com.atproto.server.getServiceAuth` endpoint for video upload authentication
+
+This endpoint is required for video uploads. Clients call it to get a service JWT to authenticate with external services like the video service (`did:web:video.bsky.app`).

.github/workflows/update-lexicons.yml

@@ -15,6 +15,8 @@ jobs:
         uses: actions/checkout@v5
       - name: Update lexicon schemas
         run: ./packages/pds/scripts/update-lexicons.sh
+      - name: Check for missing references
+        run: ./packages/pds/scripts/check-lexicon-refs.sh
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v8
         with:

packages/pds/scripts/check-lexicon-refs.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+#
+# Check for missing lexicon references
+# This script scans all lexicon JSON files and reports any external refs
+# that don't have corresponding lexicon files.
+#
+
+set -e
+
+LEXICONS_DIR="$(cd "$(dirname "$0")/../src/lexicons" && pwd)"
+
+echo "Checking lexicon references in: $LEXICONS_DIR"
+echo ""
+
+# Extract all external refs (those with a namespace, not just #fragment)
+# Format: "app.bsky.foo.bar#baz" -> we need "app.bsky.foo.bar"
+refs=$(grep -roh '"ref": "[^#"]*#[^"]*"' "$LEXICONS_DIR"/*.json 2>/dev/null | \
+  grep -v '^"ref": "#' | \
+  sed 's/"ref": "\([^#]*\)#.*/\1/' | \
+  sort -u)
+
+missing=()
+
+for ref in $refs; do
+  file="$LEXICONS_DIR/${ref}.json"
+  if [ ! -f "$file" ]; then
+    missing+=("$ref")
+  fi
+done
+
+if [ ${#missing[@]} -eq 0 ]; then
+  echo "✓ All lexicon references are satisfied!"
+  echo ""
+  exit 0
+else
+  echo "✗ Missing lexicon files for the following refs:"
+  echo ""
+  for ref in "${missing[@]}"; do
+    echo "  - $ref"
+  done
+  echo ""
+  echo "Add these to scripts/update-lexicons.sh and run it to fetch them."
+  exit 1
+fi

packages/pds/scripts/update-lexicons.sh

@@ -23,15 +23,18 @@ schemas=(
   "app/bsky/feed/like"
   "app/bsky/feed/repost"
   "app/bsky/feed/threadgate"
+  "app/bsky/feed/defs"
 
   # Actor schemas
   "app/bsky/actor/profile"
+  "app/bsky/actor/defs"
 
   # Graph schemas
   "app/bsky/graph/follow"
   "app/bsky/graph/block"
   "app/bsky/graph/list"
   "app/bsky/graph/listitem"
+  "app/bsky/graph/defs"
 
   # Richtext schemas
   "app/bsky/richtext/facet"
@@ -41,6 +44,11 @@ schemas=(
   "app/bsky/embed/external"
   "app/bsky/embed/record"
   "app/bsky/embed/recordWithMedia"
+  "app/bsky/embed/video"
+  "app/bsky/embed/defs"
+
+  # Notification schemas (referenced by actor.defs)
+  "app/bsky/notification/defs"
 )
 
 # Fetch each schema

packages/pds/src/index.ts

@@ -215,6 +215,13 @@ app.get("/xrpc/com.atproto.server.getAccountStatus", requireAuth, (c) =>
 	server.getAccountStatus(c, getAccountDO(c.env)),
 );
 
+// Service auth - used by clients to get JWTs for external services (video, etc.)
+app.get(
+	"/xrpc/com.atproto.server.getServiceAuth",
+	requireAuth,
+	server.getServiceAuth,
+);
+
 // Actor preferences (stub - returns empty preferences)
 app.get("/xrpc/app.bsky.actor.getPreferences", requireAuth, (c) => {
 	return c.json({ preferences: [] });