interaction_endpoint is the person-facing page, not the agent's reach API - #14
Merged
Merged
Conversation
… API
The field carried both roles while a 202 also sent `url=`. It no longer
does: a recipient composes `{interaction_endpoint}?code=` and sends the
PERSON there. mockin still published `POST /aauth/interaction` — the agent's
reach API — so an agent that composed a person URL from PS metadata landed on
a 404 for a POST-only route.
Publish `${ISSUER}/aauth/consent` there, matching Wallet's `${PERSON}/auth`,
and move the reach API to its own `reach_endpoint`.
Logged as an ambiguity in session 2 (aauth-mcp OVERNIGHT-LOG.md, Track N,
N7) and only reachable once a PS stopped sending `url=`.
241 passing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CRdau7tgZa1tPVzUdyNrHc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The field carried both roles while a 202 also sent
url=. It no longer does — a recipient composes{interaction_endpoint}?code=and sends the person there. mockin still publishedPOST /aauth/interaction, the agent's reach API, so an agent composing a person URL from PS metadata lands on a 404 for a POST-only route.Caught by the MCP e2e suite in
aauth-proxy: the agent got the connection 202, composedhttps://person.hello-dev.net/aauth/interaction?code=…, and the browser gotRoute GET:/aauth/interaction not found.This was logged as an open ambiguity in session 2 (
aauth-mcp/OVERNIGHT-LOG.md, Track N, item N7) — "the PS'sinteraction_endpointis today the relay POST target, and W2b makes it the user-facing page too — the same field in two roles ... only exercised once a PS stops sendingurl=". Wallet resolved it in #4269 by publishing${PERSON}/auth. mockin never did.interaction_endpointis now${ISSUER}/aauth/consent; the reach API moves to its ownreach_endpoint.241 passing.
🤖 Generated with Claude Code
https://claude.ai/code/session_01CRdau7tgZa1tPVzUdyNrHc