Bluesky provider

[joneslloyd]

Hello!

Would you consider adding Bluesky (@atproto/api) as a provider?

Thanks!

[ahudovich]

We need this feature!

[nolageek]

Please?

[justinmakaila]

I've been fiddling with this for the last day, just came to see that there is a discussion!

I stepped away from the computer for a bit, but can post the details of my immediate thoughts:

• Add a new "oauth-atproto" provider type.
• UI should be similar for the email provider and prompt for a handle.
• Handle should be resolved to a PDS URL with the atproto oauth client.
• Redirect to the URL, set the redirect to /api/auth/callback/atproto
• Invoke the callback on the client

That's surmised from here: https://github.com/bluesky-social/atproto/tree/main/packages/oauth/oauth-client-node#from-a-backend-service

Would need to figure out refreshing sessions too?

This would add the optional peer dependency for the atproto libraries for the provider to work properly.

ATProto is a slightly different OAuth-animal due to the distributed nature.

Happy for comments and some validation here. I can bang it out over the next couple days if we're interested.

[justinmakaila]

We'll also need to figure out session management and persistence...

I feel like we may be able to get around using the oauth client from @atproto because we really just need to resolve the PDS URL (which they also have a library for), but there's something nice about already having the client written and implemented, but there's associated dance to get the libraries work together might not be worth it.

[justinmakaila]

Ok so it appears I've initially overcomplicated it. I almost have a Bluesky provider done, which is a bit simpler. It asks the user for a handle or did, and then can do the oauth flow with the biggest change being the addition of PAR (pushed authorization requests). Almost everything is left as-is, besides some adjustments to the dance.

For ATProto at its core, we'll have to add a DID/handle resolution to PDS... it's not necessary for Bluesky because they have a virtual PDS entryway (bsky.social), but there are separate PDS's that may host users that are not resolved on the Bluesky network.

Hoping to have a draft PR filed today or tomorrow.