Summary#
- Implements POST /xrpc/com.atproto.server.createSession — the ATProto legacy password-based auth endpoint required by older clients
- Resolves identifier (handle or DID), verifies argon2id password hash, issues HS256 access JWT (2h) + refresh JWT (90d), persists sessions + refresh_tokens rows atomically
- Sliding-window rate limit: 5 failed attempts per identifier per 60s; unknown-identifier and wrong-password return the same error to prevent user enumeration
Test plan#
- cargo test -p relay routes::create_session — 9/9 pass
- cargo test -p relay — full suite green (352 tests)
- Manual: POST with valid credentials → accessJwt, refreshJwt, handle, did, email
- Manual: POST with wrong password → 401 AUTHENTICATION_REQUIRED
- Manual: POST 6× with wrong password → 6th returns 429 RATE_LIMITED