getting oauth going

apps/web/client.ts

···
   type OAuthClientMetadataInput,
 } from "@atproto/oauth-client-node";
 import { PUBLIC_URL, PRIVATE_KEYS } from "@tealfmbot/common/constants.ts";
-import type { Database } from "@tealfmbot/database/types.ts";
+import { db } from "@tealfmbot/database/db.ts";
 import assert from "node:assert";
 
 import { SessionStore, StateStore } from "./storage";
 
-export async function createOauthClient(db: Database) {
-  const keyset =
-    PUBLIC_URL && PRIVATE_KEYS
-      ? new Keyset(await Promise.all(PRIVATE_KEYS.map((jwk) => JoseKey.fromJWK(jwk))))
-      : undefined;
+const keyset =
+  PUBLIC_URL && PRIVATE_KEYS
+    ? new Keyset(await Promise.all(PRIVATE_KEYS.map((jwk) => JoseKey.fromJWK(jwk))))
+    : undefined;
 
-  assert(!PUBLIC_URL || keyset?.size, "PRIVATE_KEYS environment variable must be set");
+assert(!PUBLIC_URL || keyset?.size, "PRIVATE_KEYS environment variable must be set");
 
-  const pk = keyset?.findPrivateKey({ usage: "sign" });
+const pk = keyset?.findPrivateKey({ usage: "sign" });
 
-  const clientMetadata: OAuthClientMetadataInput = PUBLIC_URL
-    ? {
-        client_name: "Teal.fm Discord Bot",
-        client_id: `${PUBLIC_URL}/oauth-client-metadata.json`,
-        jwks_uri: `${PUBLIC_URL}/.well-known/jwks.json`,
-        redirect_uris: [`${PUBLIC_URL}/oauth/callback`],
-        scope: "atproto transition:generic",
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-        application_type: "web",
-        token_endpoint_auth_method: pk ? "private_key_jwt" : "none",
-        token_endpoint_auth_signing_alg: pk ? pk.alg : undefined,
-        dpop_bound_access_tokens: true,
-      }
-    : atprotoLoopbackClientMetadata(
-        `http://localhost?${new URLSearchParams([
-          ["redirect_uri", "http://127.0.0.1:8002/oauth/callback"],
-          ["scope", "atproto transition:generic"],
-        ])}`,
-      );
+const metadata: OAuthClientMetadataInput = PUBLIC_URL
+  ? {
+      client_name: "Teal.fm Discord Bot",
+      client_id: `${PUBLIC_URL}/oauth-client-metadata.json`,
+      jwks_uri: `${PUBLIC_URL}/.well-known/jwks.json`,
+      redirect_uris: [`${PUBLIC_URL}/oauth/callback`],
+      scope: "atproto transition:generic",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      application_type: "web",
+      token_endpoint_auth_method: pk ? "private_key_jwt" : "none",
+      token_endpoint_auth_signing_alg: pk ? pk.alg : undefined,
+      dpop_bound_access_tokens: true,
+    }
+  : atprotoLoopbackClientMetadata(
+      `http://localhost?${new URLSearchParams([
+        ["redirect_uri", "http://127.0.0.1:8002/oauth/callback"],
+        ["scope", "atproto transition:generic"],
+      ])}`,
+    );
 
-  return new NodeOAuthClient({
-    ...(typeof keyset !== "undefined" ? { keyset } : undefined),
-    clientMetadata,
-    stateStore: new StateStore(db),
-    sessionStore: new SessionStore(db),
-  });
-}
+export const client = new NodeOAuthClient({
+  ...(typeof keyset !== "undefined" ? { keyset } : undefined),
+  clientMetadata: metadata,
+  stateStore: new StateStore(db),
+  sessionStore: new SessionStore(db),
+});

apps/web/index.ts

···
 import { Hono } from "hono";
 import pinoHttpLogger from "pino-http";
 
+import { client } from "./client";
+import { createSession, MAX_AGE } from "./utils";
+import { getSignedCookie } from "hono/cookie";
+import { COOKIE_SECRET } from "@tealfmbot/common/constants.js";
+
 type Variables = {
   logger: typeof logger;
 };
···
   return c.text("yo!!");
 });
 
-serve({
+app.get("/oauth-client-metadata.json", (c) => {
+  c.header("Cache-Control", `max-age=${MAX_AGE}, public`);
+  return c.json(client.clientMetadata);
+});
+
+app.get("/.well-known/jwks.json", (c) => {
+  c.header("Cache-Control", `max-age=${MAX_AGE}, public`);
+  return c.json(client.jwks);
+});
+
+app.get("/oauth/callback", async (c) => {
+  c.header("Cache-Control", "no-store")
+  const params = new URLSearchParams(c.req.url.split("?")[1])
+
+  try {
+    const session = await getSignedCookie(c, COOKIE_SECRET, "__teal_fm_bot_session")
+    if (session) {
+      try {
+        const oauthSession = await client.restore(session)
+        if (oauthSession) oauthSession.signOut()
+      } catch {
+        logger.warn("oauth restore failed")
+      }
+    }
+    const oauth = await client.callback(params)
+    await createSession(oauth.session.did);
+
+  } catch {
+    logger.error("oauth callback failed")
+  }
+
+  return c.redirect("/")
+})
+
+const server = serve({
   fetch: app.fetch,
   port: 8002,
 });
+
+process.on("SIGINT", () => {
+  server.close();
+  process.exit(0);
+});
+process.on("SIGTERM", () => {
+  server.close((err) => {
+    if (err) {
+      console.error(err);
+      process.exit(1);
+    }
+    process.exit(0);
+  });
+});

apps/web/package.json

···
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@atproto/api": "^0.18.8",
     "@atproto/oauth-client-node": "^0.3.13",
     "@hono/node-server": "^1.19.7",
     "@tealfmbot/common": "workspace:*",
-    "@tealfmbot/tsconfig": "workspace:*",
     "@tealfmbot/database": "workspace:*",
+    "@tealfmbot/tsconfig": "workspace:*",
     "hono": "^4.11.3",
     "pino-http": "^11.0.0"
   },

apps/web/utils.ts

···
+import { COOKIE_SECRET } from "@tealfmbot/common/constants.ts";
+import type { Context } from "hono";
+import { deleteCookie, generateSignedCookie, getSignedCookie } from "hono/cookie";
+import { client } from "./client";
+import { Agent } from "@atproto/api";
+import { logger } from "@tealfmbot/common/logger.js";
+
+export const MAX_AGE = process.env.NODE_ENV === "production" ? 60 : 0;
+
+export async function createSession(value: string) {
+  const cookie = await generateSignedCookie("__teal_fm_bot_session", value, COOKIE_SECRET, {
+    path: "/",
+    secure: process.env.NODE_ENV === "development" ? false : true,
+    httpOnly: true,
+    sameSite: "lax",
+  });
+
+  return cookie;
+}
+
+export async function getSessionAgent(c: Context) {
+  c.header("Vary", "Cookie")
+  const session = await getSignedCookie(c, COOKIE_SECRET, "__teal_fm_bot_session")
+  if (!session) return null;
+  c.header("Cache-Control", `max-age=${MAX_AGE}, private`)
+
+  try {
+    const oauthSession = await client.restore(session)
+    return oauthSession ? new Agent(oauthSession) : null
+  } catch {
+    logger.warn("oauth restore failed")
+    deleteCookie(c, "__teal_fm_bot_session")
+    return null;
+  }
+}

packages/common/constants.ts

···
 export const TAP_ADMIN_PASSWORD = process.env.TAP_ADMIN_PASSWORD as string;
 export const DATABASE_URL = process.env.DATABASE_URL as string;
 export const PUBLIC_URL = process.env.PUBLIC_URL as string;
+export const COOKIE_SECRET = process.env.COOKIE_SECRET as string;
 export const PRIVATE_KEYS = process.env.PRIVATE_KEYS as unknown as string[];

packages/database/types.ts

···
+// @ts-nocheck
 import type { Artists, Plays } from "kysely-codegen";
 
 import { db } from "./db.ts";

pnpm-lock.yaml

···
 
   apps/web:
     dependencies:
+      '@atproto/api':
+        specifier: ^0.18.8
+        version: 0.18.8
       '@atproto/oauth-client-node':
         specifier: ^0.3.13
         version: 0.3.13
···
 
   '@atproto-labs/simple-store@0.3.0':
     resolution: {integrity: sha512-nOb6ONKBRJHRlukW1sVawUkBqReLlLx6hT35VS3imaNPwiXDxLnTK7lxw3Lrl9k5yugSBDQAkZAq3MPTEFSUBQ==}
+
+  '@atproto/api@0.18.8':
+    resolution: {integrity: sha512-Qo3sGd1N5hdHTaEWUBgptvPkULt2SXnMcWRhveSyctSd/IQwTMyaIH6E62A1SU+8xBSN5QLpoUJNE7iSrYM2Zg==}
 
   '@atproto/common-web@0.4.7':
     resolution: {integrity: sha512-vjw2+81KPo2/SAbbARGn64Ln+6JTI0FTI4xk8if0ebBfDxFRmHb2oSN1y77hzNq/ybGHqA2mecfhS03pxC5+lg==}
···
   atomic-sleep@1.0.0:
     resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
     engines: {node: '>=8.0.0'}
+
+  await-lock@2.2.2:
+    resolution: {integrity: sha512-aDczADvlvTGajTDjcjpJMqRkOF6Qdz3YbPZm/PyW6tKPkx2hlYBzxMhEywM/tU72HrVZjgl5VCdRuMlA7pZ8Gw==}
 
   balanced-match@1.0.2:
     resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
···
     resolution: {integrity: sha512-/RX9RzeH2xU5ADE7n2Ykvmi9ED3FBGPAjw9u3zucrNNaEBIO0HPSYgL0NT7+3p147ojeSdaVu08F6hjpv31HJg==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
+  tlds@1.261.0:
+    resolution: {integrity: sha512-QXqwfEl9ddlGBaRFXIvNKK6OhipSiLXuRuLJX5DErz0o0Q0rYxulWLdFryTkV5PkdZct5iMInwYEGe/eR++1AA==}
+    hasBin: true
+
   to-regex-range@5.0.1:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
     engines: {node: '>=8.0'}
···
 
   '@atproto-labs/simple-store@0.3.0': {}
 
+  '@atproto/api@0.18.8':
+    dependencies:
+      '@atproto/common-web': 0.4.7
+      '@atproto/lexicon': 0.6.0
+      '@atproto/syntax': 0.4.2
+      '@atproto/xrpc': 0.7.7
+      await-lock: 2.2.2
+      multiformats: 9.9.0
+      tlds: 1.261.0
+      zod: 3.25.76
+
   '@atproto/common-web@0.4.7':
     dependencies:
       '@atproto/lex-data': 0.0.3
···
   argparse@2.0.1: {}
 
   atomic-sleep@1.0.0: {}
+
+  await-lock@2.2.2: {}
 
   balanced-match@1.0.2: {}
 
···
   tinyexec@1.0.2: {}
 
   tinypool@2.0.0: {}
+
+  tlds@1.261.0: {}
 
   to-regex-range@5.0.1:
     dependencies: