Need clarification on xrpc api calls to pds and appview

[hsinyuu]

Hi everyone, I have been looking at the atproto documentation and some of the open sourced projects to understand how to code up an appview but I got a bit confused as to how to implement the appview.

In the bsky doc, it says "Authenticated requests are usually made to the user's PDS, with automatic service proxying. Authenticated requests can be used for both public and non-public endpoints." https://docs.bsky.app/docs/api/app-bsky-actor-get-preferences

1. Does that mean AppView is not supposed to handle authentications?
2. I will need to fork the PDS code and implement my own proxy to my appview?

Lastly, the doc also says public endpoint are made directly to bluesky's appview apis. For my own appview, how do I query my appview endpoint with my client?

In atproto readme (https://github.com/bluesky-social/atproto/blob/main/packages/api/README.md), it seems that we can do this to bluesky's endpoint, but is that because the ATPAgent has bluesky apis implemented...

const res3 = await agent.app.bsky.feed.post.create(
  { repo: alice.did },
  {
    text: 'Hello, world!',
    createdAt: new Date().toISOString(),
  },
)

3. Say for my appview I created an endpoint "app.helloworld.sayhello", do I access this endpoint with ATPAgent({"service": "localhost:8383"}).app.helloworld.sayhello?

[hsinyuu]

Just to elaborate on opensource project code. In whitewind blog, the BlogViewer makes queries like this, where the ATPBaseClient seems to be querying the user's pds.

      body = await client.com.whtwnd.blog.entry.get({ repo: authorInfo.did, rkey: aturi.rkey, cid: props.cid })

However, how does pds know where the appview is to query?

[yamarten]

Authentication is a feature of PDS, so when making a request with authentication, you need to go through PDS. Strictly speaking, appview authenticates using tokens issued by PDS and does not support password or OAuth.
In the current PDS transitional specification, the bsky API implicitly proxyes to the bsky appview, but the client can explicitly specify the proxy destination.

By the way, as written in the readme, agent.app.bsky.feed.post.create is the wrapper of createRecord. These are APIs that manipulate the repository that PDS has, so they do not connect to appview. Similarly, the entity of client.com.whtwnd.blog.entry.get is getRecord.