From 00d67d4dfb30b73c5c4feb128b111697381fba2a Mon Sep 17 00:00:00 2001
From: scanash00 <scan@scanash.com>
Date: Fri, 12 Jun 2026 11:29:17 -0800
Subject: [PATCH] Restore authenticated microcosm batch path for personalized
 feeds

Reverts the earlier disabling. The 400 I saw was from testing with a fake JWT,
not from the authorization field being rejected outright - a bad inference. When
logged in we mint a real service-auth token (aud = feed generator DID, lxm =
app.bsky.feed.getFeedSkeleton) and forward it through Slingshot's batch proxy, so
personalized feeds use the fast one-request batch path. AppView fallback remains
for any feed/generator that rejects forwarded auth.
---
 src/lib/api/feed/custom.ts | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/src/lib/api/feed/custom.ts b/src/lib/api/feed/custom.ts
index 5ff27f7..497d700 100644
--- a/src/lib/api/feed/custom.ts
+++ b/src/lib/api/feed/custom.ts
@@ -52,16 +52,30 @@ export class CustomFeedAPI implements FeedAPI {
     cursor: string | undefined
     limit: number
   }): Promise<FeedAPIResponse> {
-    // Microcosm batch path: Slingshot proxies the feed generator's PUBLIC
-    // skeleton and fetches all post records in one request. Slingshot's batch
-    // proxy rejects a forwarded auth token (returns 400), so we only use this
-    // path logged out. Logged-in users go through the AppView below, which
-    // forwards the viewer's auth correctly (needed for personalized feeds).
-    if (MICROCOSM_ENABLED && !this.agent.did) {
+    // Microcosm batch path: Slingshot proxies the feed generator's skeleton and
+    // fetches all post records in one request. For personalized feeds we forward
+    // a service-auth token (aud = the feed generator's DID) so the generator can
+    // identify the viewer, exactly as the AppView would.
+    if (MICROCOSM_ENABLED) {
       try {
         const page = await buildCustomFeed(this.params.feed, {
+          viewerDid: this.agent.did,
           limit,
           cursor,
+          getAuthorization: this.agent.did
+            ? async (feedGenDid: string) => {
+                try {
+                  const {data} =
+                    await this.agent.com.atproto.server.getServiceAuth({
+                      aud: feedGenDid,
+                      lxm: 'app.bsky.feed.getFeedSkeleton',
+                    })
+                  return data.token
+                } catch {
+                  return undefined
+                }
+              }
+            : undefined,
         })
         if (page.feed.length) {
           return {cursor: page.cursor, feed: page.feed}
-- 
2.51.2