feat: Implement production-ready OAuth authentication system with security hardening

This commit implements a complete, secure OAuth 2.0 + atProto authentication system
for Coves, including comprehensive security fixes based on code review.

## 📋 Core Features

### OAuth 2.0 + atProto Authentication
- **DPoP Token Binding (RFC 9449)**: Each session has unique cryptographic key
- **PKCE (RFC 7636)**: S256 challenge method prevents code interception
- **PAR (RFC 9126)**: Pre-registration of authorization requests
- **Complete OAuth Flow**: Login → Authorize → Callback → Session Management

### Implementation Architecture
- **Handlers**: [internal/api/handlers/oauth/](internal/api/handlers/oauth/)
- `login.go` - Initiates OAuth flow with handle resolution
- `callback.go` - Processes authorization code and creates session
- `logout.go` - Session termination
- `metadata.go` - RFC 7591 client metadata endpoint
- `jwks.go` - Public key exposure (JWK Set)

- **OAuth Client**: [internal/atproto/oauth/](internal/atproto/oauth/)
- `client.go` - OAuth HTTP client with PAR, token exchange, refresh
- `dpop.go` - DPoP proof generation (ES256 signatures)
- `pkce.go` - PKCE challenge generation

- **Session Management**: [internal/core/oauth/](internal/core/oauth/)
- `session.go` - OAuth data models (OAuthRequest, OAuthSession)
- `repository.go` - PostgreSQL storage with atomic operations
- `auth_service.go` - Authentication business logic

- **Middleware**: [internal/api/middleware/auth.go](internal/api/middleware/auth.go)
- `RequireAuth` - Enforces authentication
- `OptionalAuth` - Loads user context if available
- Automatic token refresh (< 5 min to expiry)

### Database Schema
- **oauth_requests**: Temporary state during authorization flow (10-min TTL)
- **oauth_sessions**: Long-lived authenticated sessions
- **Indexes**: Performance optimizations for session queries
- **Auto-cleanup**: Trigger-based expiration handling

### DPoP Transport
- **HTTP RoundTripper**: [internal/atproto/xrpc/dpop_transport.go](internal/atproto/xrpc/dpop_transport.go)
- Automatic DPoP proof injection on all requests
- Nonce rotation handling (automatic retry on 401)
- PDS and auth server nonce tracking

## 🔐 Security Features (PR Review Hardening)

### Critical Security Fixes
✅ **CSRF/Replay Protection**: Atomic `GetAndDeleteRequest()` prevents state reuse
✅ **Cookie Secret Validation**: Enforced minimum 32 bytes for session security
✅ **Error Sanitization**: No internal error details exposed to users
✅ **HTTPS Enforcement**: Production-only HTTPS cookies with explicit localhost checks
✅ **Clean Architecture**: Business logic extracted to `AuthService` layer

### Additional Security Measures
✅ **No Token Leakage**: Never log response bodies containing credentials
✅ **Race-Free**: Fixed concurrent access to DPoP nonces with proper mutex handling
✅ **Input Validation**: Handle format checking, state parameter verification
✅ **Session Isolation**: One active session per DID (upgradeable to multiple)
✅ **Automatic Cleanup**: Hourly background job removes expired sessions/requests

### Token Binding & Proof-of-Possession
- Each session generates unique ES256 key pair
- Access tokens cryptographically bound to client
- DPoP proofs include:
- JWK header (public key)
- HTTP method and URL (prevents token replay)
- Access token hash (`ath` claim)
- JTI (unique token ID)
- Server nonce (when required)

## 🎯 Configuration & Setup

### Environment Variables
```bash
# OAuth Configuration (.env.dev)
OAUTH_PRIVATE_JWK=base64:... # Client private key (ES256)
OAUTH_COOKIE_SECRET=... # Session cookie secret (min 32 bytes)
APPVIEW_PUBLIC_URL=http://127.0.0.1:8081
```

### Base64 Encoding Support
- Helper: `GetEnvBase64OrPlain()` supports both plain and base64-encoded values
- Prevents shell escaping issues with JSON in environment variables
- Format: `OAUTH_PRIVATE_JWK=base64:eyJhbGci...` or plain JSON

### Cookie Store Singleton
- Global singleton initialized at startup: `oauth.InitCookieStore(secret)`
- Shared across all handlers for consistent session management
- Validates secret length on initialization

### Database Migration
```sql
-- Migration 003: OAuth tables
-- Migration 004: Performance indexes
```

## 📊 Code Quality & Testing

### Test Coverage
- `env_test.go` - Base64 environment variable handling (8 test cases)
- `dpop_test.go` - DPoP proof structure validation
- `oauth_test.go` - Integration tests for OAuth endpoints

### Linter Compliance
- Fixed errcheck violations (defer close, error handling)
- Formatted with gofmt
- Added nolint directives where appropriate

### Constants & Configuration
- [constants.go](internal/api/handlers/oauth/constants.go) - Named configuration values
- `SessionMaxAge = 7 * 24 * 60 * 60`
- `TokenRefreshThreshold = 5 * time.Minute`
- `MinCookieSecretLength = 32`

## 🎓 Implementation Decisions

### Custom OAuth vs Indigo Library
- **Decision**: Implement custom OAuth client
- **Rationale**: Indigo OAuth library explicitly unstable; custom implementation gives full control over edge cases and nonce retry logic
- **Future**: Migrate when indigo reaches stable v1.0

### Session Storage
- **Decision**: PostgreSQL with one session per DID
- **Rationale**: Simple for initial implementation, easy to upgrade to multiple sessions later, transaction support

### DPoP Key Management
- **Decision**: Unique key per session, stored in database
- **Rationale**: RFC 9449 compliance, token binding security, survives server restarts

## 📈 Performance Optimizations

- `idx_oauth_sessions_did_expires` - Fast session expiry queries
- Partial index for active sessions (`WHERE expires_at > NOW()`)
- Hourly cleanup prevents table bloat
- Cookie store singleton reduces memory allocations

## ✅ Production Readiness

### Real-World Validation
✅ Successfully tested with live PDS: `https://pds.bretton.dev`
✅ Handle resolution: `bretton.dev` → DID → PDS discovery
✅ Complete authorization flow with DPoP nonce retry
✅ Session storage and retrieval validated
✅ Token refresh logic confirmed working

### Security Checklist
✅ DPoP token binding prevents theft/replay
✅ PKCE prevents authorization code interception
✅ PAR reduces attack surface
✅ Atomic state operations prevent CSRF
✅ HTTP-only, secure, SameSite cookies
✅ Private keys never exposed in public endpoints
✅ Automatic token expiration (60 min access, ~90 day refresh)

## 📦 Files Changed
- **27 files**: 3,130 additions, 1 deletion
- **New packages**: oauth handlers, OAuth client, auth middleware
- **New migrations**: OAuth tables + indexes
- **Updated**: main.go (OAuth initialization), .env.dev (configuration docs)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

.env.dev

···
 IDENTITY_CACHE_TTL=24h
 
 # =============================================================================
+# OAuth Configuration
+# =============================================================================
+# OAuth client private key (ES256 keypair - generate with: go run cmd/genjwks/main.go)
+# DO NOT commit this to version control in production!
+#
+# Supports two formats:
+# 1. Plain JSON (easier for local development):
+#    OAUTH_PRIVATE_JWK={"alg":"ES256","crv":"P-256",...}
+#
+# 2. Base64 encoded (recommended for production to avoid shell escaping):
+#    OAUTH_PRIVATE_JWK=base64:eyJhbGciOiJFUzI1NiIsImNydiI6IlAtMjU2Ii...
+#    Generate with: echo '{"alg":...}' | base64 -w 0
+#
+OAUTH_PRIVATE_JWK={"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}
+
+# Cookie secret for session encryption (generate with: openssl rand -hex 32)
+# Also supports base64: prefix for consistency
+OAUTH_COOKIE_SECRET=f1132c01b1a625a865c6c455a75ee793572cedb059cebe0c4c1ae4c446598f7d
+
+# AppView public URL (used for OAuth callback and client metadata)
+# Dev: http://127.0.0.1:8081 (use 127.0.0.1 instead of localhost per RFC 8252)
+# Prod: https://coves.social
+APPVIEW_PUBLIC_URL=http://127.0.0.1:8081
+
+# =============================================================================
 # Development Settings
 # =============================================================================
 # Environment

PRD.md

···
 ### Phase 1: Core Forum Platform (Web)
 
 #### Must Have:
-- **Indigo PDS Integration** - Use existing atProto infrastructure (no CAR file reimplementation!)
+- **Indigo PDS Integration**1 - Use existing atProto infrastructure (no CAR file reimplementation!)
 - User registration with phone verification (verified badge)
 - Community creation, subscription, and discovery
 - Post creation (text initially, then image/video/article)

cmd/genjwks/main.go

···
+package main
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"encoding/json"
+	"fmt"
+	"log"
+	"os"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
+
+// genjwks generates an ES256 keypair for OAuth client authentication
+// The private key is stored in the config/env, public key is served at /oauth/jwks.json
+//
+// Usage:
+//   go run cmd/genjwks/main.go
+//
+// This will output a JSON private key that should be stored in OAUTH_PRIVATE_JWK
+func main() {
+	fmt.Println("Generating ES256 keypair for OAuth client authentication...")
+
+	// Generate ES256 (NIST P-256) private key
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		log.Fatalf("Failed to generate private key: %v", err)
+	}
+
+	// Convert to JWK
+	jwkKey, err := jwk.FromRaw(privateKey)
+	if err != nil {
+		log.Fatalf("Failed to create JWK from private key: %v", err)
+	}
+
+	// Set key parameters
+	if err := jwkKey.Set(jwk.KeyIDKey, "oauth-client-key"); err != nil {
+		log.Fatalf("Failed to set kid: %v", err)
+	}
+	if err := jwkKey.Set(jwk.AlgorithmKey, "ES256"); err != nil {
+		log.Fatalf("Failed to set alg: %v", err)
+	}
+	if err := jwkKey.Set(jwk.KeyUsageKey, "sig"); err != nil {
+		log.Fatalf("Failed to set use: %v", err)
+	}
+
+	// Marshal to JSON
+	jsonData, err := json.MarshalIndent(jwkKey, "", "  ")
+	if err != nil {
+		log.Fatalf("Failed to marshal JWK: %v", err)
+	}
+
+	// Output instructions
+	fmt.Println("\n✅ ES256 keypair generated successfully!")
+	fmt.Println("\n📝 Add this to your .env.dev file:")
+	fmt.Println("\nOAUTH_PRIVATE_JWK='" + string(jsonData) + "'")
+	fmt.Println("\n⚠️  IMPORTANT:")
+	fmt.Println("   - Keep this private key SECRET")
+	fmt.Println("   - Never commit it to version control")
+	fmt.Println("   - Generate a new key for production")
+	fmt.Println("   - The public key will be automatically derived and served at /oauth/jwks.json")
+
+	// Optionally write to a file (not committed)
+	if len(os.Args) > 1 && os.Args[1] == "--save" {
+		filename := "oauth-private-key.json"
+		if err := os.WriteFile(filename, jsonData, 0600); err != nil {
+			log.Fatalf("Failed to write key file: %v", err)
+		}
+		fmt.Printf("\n💾 Private key saved to %s (remember to add to .gitignore!)\n", filename)
+	}
+}

cmd/server/main.go

···
 	_ "github.com/lib/pq"
 	"github.com/pressly/goose/v3"
 
+	"Coves/internal/api/handlers/oauth"
 	"Coves/internal/api/middleware"
 	"Coves/internal/api/routes"
 	"Coves/internal/atproto/identity"
 	"Coves/internal/atproto/jetstream"
+	oauthCore "Coves/internal/core/oauth"
 	"Coves/internal/core/users"
 	postgresRepo "Coves/internal/db/postgres"
 )
···
 	identityResolver := identity.NewResolver(db, identityConfig)
 	log.Println("Identity resolver initialized with PLC:", identityConfig.PLCURL)
 
+	// Initialize OAuth session store
+	sessionStore := oauthCore.NewPostgresSessionStore(db)
+	log.Println("OAuth session store initialized")
+
 	// Initialize repositories and services
 	userRepo := postgresRepo.NewUserRepository(db)
 	userService := users.NewUserService(userRepo, identityResolver, defaultPDS)
···
 	}()
 
 	log.Printf("Started Jetstream consumer: %s", jetstreamURL)
+
+	// Start OAuth cleanup background job
+	go func() {
+		ticker := time.NewTicker(1 * time.Hour)
+		defer ticker.Stop()
+		for range ticker.C {
+			if pgStore, ok := sessionStore.(*oauthCore.PostgresSessionStore); ok {
+				_ = pgStore.CleanupExpiredRequests(ctx)
+				_ = pgStore.CleanupExpiredSessions(ctx)
+				log.Println("OAuth cleanup completed")
+			}
+		}
+	}()
+
+	log.Println("Started OAuth cleanup background job (runs hourly)")
+
+	// Initialize OAuth cookie store (singleton)
+	cookieSecret, err := oauth.GetEnvBase64OrPlain("OAUTH_COOKIE_SECRET")
+	if err != nil {
+		log.Fatalf("Failed to load OAUTH_COOKIE_SECRET: %v", err)
+	}
+	if cookieSecret == "" {
+		log.Fatal("OAUTH_COOKIE_SECRET not configured")
+	}
+
+	if err := oauth.InitCookieStore(cookieSecret); err != nil {
+		log.Fatalf("Failed to initialize cookie store: %v", err)
+	}
+
+	// Initialize OAuth handlers
+	loginHandler := oauth.NewLoginHandler(identityResolver, sessionStore)
+	callbackHandler := oauth.NewCallbackHandler(sessionStore)
+	logoutHandler := oauth.NewLogoutHandler(sessionStore)
+
+	// OAuth routes (public endpoints)
+	r.Post("/oauth/login", loginHandler.HandleLogin)
+	r.Get("/oauth/callback", callbackHandler.HandleCallback)
+	r.Post("/oauth/logout", logoutHandler.HandleLogout)
+	r.Get("/oauth/client-metadata.json", oauth.HandleClientMetadata)
+	r.Get("/oauth/jwks.json", oauth.HandleJWKS)
+
+	log.Println("OAuth endpoints registered")
 
 	// Register XRPC routes
 	routes.RegisterUserRoutes(r, userService)

go.mod

···
 require (
 	github.com/bluesky-social/indigo v0.0.0-20250621010046-488d1b91889b
 	github.com/go-chi/chi/v5 v5.2.1
+	github.com/gorilla/sessions v1.4.0
 	github.com/ipfs/go-cid v0.4.1
 	github.com/ipfs/go-ipld-cbor v0.1.0
 	github.com/ipfs/go-ipld-format v0.6.0
 	github.com/ipld/go-car v0.6.1-0.20230509095817-92d28eb23ba4
+	github.com/lestrrat-go/jwx/v2 v2.0.12
 	github.com/lib/pq v1.10.9
 	github.com/pressly/goose/v3 v3.22.1
 	github.com/whyrusleeping/cbor-gen v0.2.1-0.20241030202151-b7a6831be65e
···
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/carlmjohnson/versioninfo v0.22.5 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/gocql/gocql v1.7.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
 	github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
···
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/lestrrat-go/blackmagic v1.0.1 // indirect
+	github.com/lestrrat-go/httpcc v1.0.1 // indirect
+	github.com/lestrrat-go/httprc v1.0.4 // indirect
+	github.com/lestrrat-go/iter v1.0.2 // indirect
+	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-sqlite3 v1.14.22 // indirect
 	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
···
 	github.com/prometheus/common v0.45.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/rivo/uniseg v0.1.0 // indirect
+	github.com/segmentio/asm v1.2.0 // indirect
 	github.com/sethvargo/go-retry v0.3.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect

go.sum

···
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/decred/dcrd/crypto/blake256 v1.0.1/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
···
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/gocql/gocql v1.7.0 h1:O+7U7/1gSN7QTEAaMEsJc1Oq2QHXvCWoF3DFK9HDHus=
 github.com/gocql/gocql v1.7.0/go.mod h1:vnlvXyFZeLBF0Wy+RS8hrOdbn0UWsWtdg07XJnFxZ+4=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
···
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
+github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
 github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
 github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
···
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lestrrat-go/blackmagic v1.0.1 h1:lS5Zts+5HIC/8og6cGHb0uCcNCa3OUt1ygh3Qz2Fe80=
+github.com/lestrrat-go/blackmagic v1.0.1/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
+github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
+github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
+github.com/lestrrat-go/httprc v1.0.4 h1:bAZymwoZQb+Oq8MEbyipag7iSq6YIga8Wj6GOiJGdI8=
+github.com/lestrrat-go/httprc v1.0.4/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
+github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
+github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
+github.com/lestrrat-go/jwx/v2 v2.0.12 h1:3d589+5w/b9b7S3DneICPW16AqTyYXB7VRjgluSDWeA=
+github.com/lestrrat-go/jwx/v2 v2.0.12/go.mod h1:Mq4KN1mM7bp+5z/W5HS8aCNs5RKZ911G/0y2qUjAQuQ=
+github.com/lestrrat-go/option v1.0.0/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
+github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
+github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/libp2p/go-buffer-pool v0.1.0 h1:oK4mSFcQz7cTQIfqbe4MIj9gLW+mnanjyFtc6cdF0Y8=
···
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
+github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/sethvargo/go-retry v0.3.0 h1:EEt31A35QhrcRZtrYFDTBg91cqZVnFL2navjDrah2SE=
 github.com/sethvargo/go-retry v0.3.0/go.mod h1:mNX17F0C/HguQMyMyJxcnU471gOZGxCLyYaFyAZraas=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
···
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/urfave/cli v1.22.10/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
···
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b h1:CzigHMRySiX3drau9C6Q5CAbNIApmLdat5jPMqChvDA=
 gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b/go.mod h1:/y/V339mxv2sZmYYR64O07VuCpdNZqCTwO8ZcouTMI8=
 gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 h1:qwDnMxjkyLmAFgcfgTnfJrmYKWhHnci3GjDqcZp1M3Q=
···
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
 golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
 golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
 golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
···
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
···
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
 golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
 golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
···
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
 golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
 golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
 golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
···
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.15.0 h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=
 golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

internal/api/handlers/oauth/callback.go

···
+package oauth
+
+import (
+	"log"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"Coves/internal/atproto/oauth"
+	oauthCore "Coves/internal/core/oauth"
+)
+
+const (
+	sessionName = "coves_session"
+	sessionDID  = "did"
+)
+
+// CallbackHandler handles OAuth callback
+type CallbackHandler struct {
+	sessionStore oauthCore.SessionStore
+}
+
+// NewCallbackHandler creates a new callback handler
+func NewCallbackHandler(sessionStore oauthCore.SessionStore) *CallbackHandler {
+	return &CallbackHandler{
+		sessionStore: sessionStore,
+	}
+}
+
+// HandleCallback processes the OAuth callback
+// GET /oauth/callback?code=...&state=...&iss=...
+func (h *CallbackHandler) HandleCallback(w http.ResponseWriter, r *http.Request) {
+	// Extract query parameters
+	code := r.URL.Query().Get("code")
+	state := r.URL.Query().Get("state")
+	iss := r.URL.Query().Get("iss")
+	errorParam := r.URL.Query().Get("error")
+	errorDesc := r.URL.Query().Get("error_description")
+
+	// Check for authorization errors
+	if errorParam != "" {
+		log.Printf("OAuth error: %s - %s", errorParam, errorDesc)
+		http.Error(w, "Authorization failed", http.StatusBadRequest)
+		return
+	}
+
+	// Validate required parameters
+	if code == "" || state == "" || iss == "" {
+		http.Error(w, "Missing required OAuth parameters", http.StatusBadRequest)
+		return
+	}
+
+	// Retrieve and delete OAuth request atomically to prevent replay attacks
+	oauthReq, err := h.sessionStore.GetAndDeleteRequest(state)
+	if err != nil {
+		log.Printf("Failed to retrieve OAuth request for state %s: %v", state, err)
+		http.Error(w, "Invalid or expired authorization request", http.StatusBadRequest)
+		return
+	}
+
+	// Verify issuer matches
+	if iss != oauthReq.AuthServerIss {
+		log.Printf("Issuer mismatch: expected %s, got %s", oauthReq.AuthServerIss, iss)
+		http.Error(w, "Authorization server mismatch", http.StatusBadRequest)
+		return
+	}
+
+	// Get OAuth client configuration (supports base64 encoding)
+	privateJWK, err := GetEnvBase64OrPlain("OAUTH_PRIVATE_JWK")
+	if err != nil {
+		log.Printf("Failed to load OAuth private key: %v", err)
+		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)
+		return
+	}
+	if privateJWK == "" {
+		http.Error(w, "OAuth not configured", http.StatusInternalServerError)
+		return
+	}
+
+	privateKey, err := oauth.ParseJWKFromJSON([]byte(privateJWK))
+	if err != nil {
+		log.Printf("Failed to parse OAuth private key: %v", err)
+		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)
+		return
+	}
+
+	appviewURL := getAppViewURL()
+	clientID := getClientID(appviewURL)
+	redirectURI := appviewURL + "/oauth/callback"
+
+	// Create OAuth client
+	client := oauth.NewClient(clientID, privateKey, redirectURI)
+
+	// Parse DPoP key from OAuth request
+	dpopKey, err := oauth.ParseJWKFromJSON([]byte(oauthReq.DPoPPrivateJWK))
+	if err != nil {
+		log.Printf("Failed to parse DPoP key: %v", err)
+		http.Error(w, "Failed to restore session key", http.StatusInternalServerError)
+		return
+	}
+
+	// Exchange authorization code for tokens
+	tokenResp, err := client.InitialTokenRequest(
+		r.Context(),
+		code,
+		oauthReq.AuthServerIss,
+		oauthReq.PKCEVerifier,
+		oauthReq.DPoPAuthServerNonce,
+		dpopKey,
+	)
+	if err != nil {
+		log.Printf("Failed to exchange code for tokens: %v", err)
+		http.Error(w, "Failed to obtain access tokens", http.StatusInternalServerError)
+		return
+	}
+
+	// Verify token type is DPoP
+	if tokenResp.TokenType != "DPoP" {
+		log.Printf("Expected DPoP token type, got: %s", tokenResp.TokenType)
+		http.Error(w, "Invalid token type", http.StatusInternalServerError)
+		return
+	}
+
+	// Verify subject (DID) matches
+	if tokenResp.Sub != oauthReq.DID {
+		log.Printf("DID mismatch: expected %s, got %s", oauthReq.DID, tokenResp.Sub)
+		http.Error(w, "Identity verification failed", http.StatusBadRequest)
+		return
+	}
+
+	// Calculate token expiration
+	expiresAt := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)
+
+	// Serialize DPoP key for storage
+	dpopKeyJSON, err := oauth.JWKToJSON(dpopKey)
+	if err != nil {
+		log.Printf("Failed to serialize DPoP key: %v", err)
+		http.Error(w, "Failed to store session", http.StatusInternalServerError)
+		return
+	}
+
+	// Save OAuth session to database
+	session := &oauthCore.OAuthSession{
+		DID:                 oauthReq.DID,
+		Handle:              oauthReq.Handle,
+		PDSURL:              oauthReq.PDSURL,
+		AccessToken:         tokenResp.AccessToken,
+		RefreshToken:        tokenResp.RefreshToken,
+		DPoPPrivateJWK:      string(dpopKeyJSON),
+		DPoPAuthServerNonce: tokenResp.DpopAuthserverNonce,
+		DPoPPDSNonce:        "", // Will be populated on first PDS request
+		AuthServerIss:       oauthReq.AuthServerIss,
+		ExpiresAt:           expiresAt,
+	}
+
+	if err := h.sessionStore.SaveSession(session); err != nil {
+		log.Printf("Failed to save OAuth session: %v", err)
+		http.Error(w, "Failed to save session", http.StatusInternalServerError)
+		return
+	}
+
+	// Note: OAuth request already deleted atomically in GetAndDeleteRequest above
+
+	// Create HTTP session cookie
+	cookieStore := GetCookieStore()
+	httpSession, err := cookieStore.Get(r, sessionName)
+	if err != nil {
+		log.Printf("Failed to get cookie session: %v", err)
+		// Try to create a new session anyway
+		httpSession, _ = cookieStore.New(r, sessionName)
+	}
+
+	httpSession.Values[sessionDID] = oauthReq.DID
+	httpSession.Options.MaxAge = SessionMaxAge
+	httpSession.Options.HttpOnly = true
+	httpSession.Options.Secure = !isDevelopment() // HTTPS only in production
+	httpSession.Options.SameSite = http.SameSiteLaxMode
+
+	if err := httpSession.Save(r, w); err != nil {
+		log.Printf("Failed to save HTTP session: %v", err)
+		http.Error(w, "Failed to create session", http.StatusInternalServerError)
+		return
+	}
+
+	// Determine redirect URL
+	returnURL := oauthReq.ReturnURL
+	if returnURL == "" {
+		returnURL = "/"
+	}
+
+	// Redirect user back to application
+	http.Redirect(w, r, returnURL, http.StatusFound)
+}
+
+// isDevelopment checks if we're running in development mode
+func isDevelopment() bool {
+	// Explicitly check for localhost/127.0.0.1 on any port
+	appviewURL := os.Getenv("APPVIEW_PUBLIC_URL")
+	return appviewURL == "" ||
+		strings.HasPrefix(appviewURL, "http://localhost:") ||
+		strings.HasPrefix(appviewURL, "http://localhost/") ||
+		strings.HasPrefix(appviewURL, "http://127.0.0.1:") ||
+		strings.HasPrefix(appviewURL, "http://127.0.0.1/")
+}

internal/api/handlers/oauth/constants.go

···
+package oauth
+
+import "time"
+
+const (
+	// Session cookie configuration
+	SessionMaxAge = 7 * 24 * 60 * 60 // 7 days in seconds
+
+	// Minimum security requirements
+	MinCookieSecretLength = 32 // bytes
+)
+
+// Time-based constants
+var (
+	TokenRefreshThreshold = 5 * time.Minute
+	SessionDuration       = 7 * 24 * time.Hour
+)

internal/api/handlers/oauth/cookie.go

···
+package oauth
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/gorilla/sessions"
+)
+
+var (
+	// Global singleton cookie store
+	cookieStoreInstance *sessions.CookieStore
+	cookieStoreOnce     sync.Once
+	cookieStoreErr      error
+)
+
+// InitCookieStore initializes the global cookie store singleton
+// Must be called once at application startup before any handlers are created
+func InitCookieStore(secret string) error {
+	cookieStoreOnce.Do(func() {
+		if len(secret) < MinCookieSecretLength {
+			cookieStoreErr = fmt.Errorf("OAUTH_COOKIE_SECRET must be at least %d bytes for security", MinCookieSecretLength)
+			return
+		}
+		cookieStoreInstance = sessions.NewCookieStore([]byte(secret))
+	})
+	return cookieStoreErr
+}
+
+// GetCookieStore returns the global cookie store singleton
+// Panics if InitCookieStore has not been called successfully
+func GetCookieStore() *sessions.CookieStore {
+	if cookieStoreInstance == nil {
+		panic("cookie store not initialized - call InitCookieStore first")
+	}
+	return cookieStoreInstance
+}

internal/api/handlers/oauth/env.go

···
+package oauth
+
+import (
+	"encoding/base64"
+	"fmt"
+	"os"
+	"strings"
+)
+
+// GetEnvBase64OrPlain retrieves an environment variable that may be base64 encoded.
+// If the value starts with "base64:", it will be decoded.
+// Otherwise, it returns the plain value.
+//
+// This allows storing sensitive values like JWKs in base64 format to avoid
+// shell escaping issues and newline handling problems.
+//
+// Example usage in .env:
+//
+//	OAUTH_PRIVATE_JWK={"alg":"ES256",...}  (plain JSON)
+//	OAUTH_PRIVATE_JWK=base64:eyJhbGc... (base64 encoded)
+func GetEnvBase64OrPlain(key string) (string, error) {
+	value := os.Getenv(key)
+	if value == "" {
+		return "", nil
+	}
+
+	// Check if value is base64 encoded
+	if strings.HasPrefix(value, "base64:") {
+		encoded := strings.TrimPrefix(value, "base64:")
+		decoded, err := base64.StdEncoding.DecodeString(encoded)
+		if err != nil {
+			return "", fmt.Errorf("invalid base64 encoding for %s: %w", key, err)
+		}
+		return string(decoded), nil
+	}
+
+	// Return plain value
+	return value, nil
+}

internal/api/handlers/oauth/env_test.go

···
+package oauth
+
+import (
+	"encoding/base64"
+	"os"
+	"testing"
+)
+
+func TestGetEnvBase64OrPlain(t *testing.T) {
+	tests := []struct {
+		name      string
+		envKey    string
+		envValue  string
+		want      string
+		wantError bool
+	}{
+		{
+			name:      "plain JSON value",
+			envKey:    "TEST_PLAIN_JSON",
+			envValue:  `{"alg":"ES256","kty":"EC"}`,
+			want:      `{"alg":"ES256","kty":"EC"}`,
+			wantError: false,
+		},
+		{
+			name:      "base64 encoded value",
+			envKey:    "TEST_BASE64_JSON",
+			envValue:  "base64:" + base64.StdEncoding.EncodeToString([]byte(`{"alg":"ES256","kty":"EC"}`)),
+			want:      `{"alg":"ES256","kty":"EC"}`,
+			wantError: false,
+		},
+		{
+			name:      "empty value",
+			envKey:    "TEST_EMPTY",
+			envValue:  "",
+			want:      "",
+			wantError: false,
+		},
+		{
+			name:      "invalid base64",
+			envKey:    "TEST_INVALID_BASE64",
+			envValue:  "base64:not-valid-base64!!!",
+			want:      "",
+			wantError: true,
+		},
+		{
+			name:      "plain string with special chars",
+			envKey:    "TEST_SPECIAL_CHARS",
+			envValue:  "secret-with-dashes_and_underscores",
+			want:      "secret-with-dashes_and_underscores",
+			wantError: false,
+		},
+		{
+			name:      "base64 encoded hex string",
+			envKey:    "TEST_BASE64_HEX",
+			envValue:  "base64:" + base64.StdEncoding.EncodeToString([]byte("f1132c01b1a625a865c6c455a75ee793")),
+			want:      "f1132c01b1a625a865c6c455a75ee793",
+			wantError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set environment variable
+			if tt.envValue != "" {
+				os.Setenv(tt.envKey, tt.envValue)
+				defer os.Unsetenv(tt.envKey)
+			}
+
+			got, err := GetEnvBase64OrPlain(tt.envKey)
+
+			if (err != nil) != tt.wantError {
+				t.Errorf("GetEnvBase64OrPlain() error = %v, wantError %v", err, tt.wantError)
+				return
+			}
+
+			if got != tt.want {
+				t.Errorf("GetEnvBase64OrPlain() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGetEnvBase64OrPlain_RealWorldJWK(t *testing.T) {
+	// Test with a real JWK (the one from .env.dev)
+	realJWK := `{"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}`
+
+	tests := []struct {
+		name     string
+		envValue string
+		want     string
+	}{
+		{
+			name:     "plain JWK",
+			envValue: realJWK,
+			want:     realJWK,
+		},
+		{
+			name:     "base64 encoded JWK",
+			envValue: "base64:" + base64.StdEncoding.EncodeToString([]byte(realJWK)),
+			want:     realJWK,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			os.Setenv("TEST_REAL_JWK", tt.envValue)
+			defer os.Unsetenv("TEST_REAL_JWK")
+
+			got, err := GetEnvBase64OrPlain("TEST_REAL_JWK")
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if got != tt.want {
+				t.Errorf("GetEnvBase64OrPlain() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

internal/api/handlers/oauth/jwks.go

···
+package oauth
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"Coves/internal/atproto/oauth"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
+
+// HandleJWKS serves the JSON Web Key Set (JWKS) containing the public key
+// GET /oauth/jwks.json
+func HandleJWKS(w http.ResponseWriter, r *http.Request) {
+	// Get private key from environment (supports base64 encoding)
+	privateJWK, err := GetEnvBase64OrPlain("OAUTH_PRIVATE_JWK")
+	if err != nil {
+		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)
+		return
+	}
+	if privateJWK == "" {
+		http.Error(w, "OAuth not configured", http.StatusInternalServerError)
+		return
+	}
+
+	// Parse private key
+	privateKey, err := oauth.ParseJWKFromJSON([]byte(privateJWK))
+	if err != nil {
+		http.Error(w, "Failed to parse private key", http.StatusInternalServerError)
+		return
+	}
+
+	// Get public key
+	publicKey, err := privateKey.PublicKey()
+	if err != nil {
+		http.Error(w, "Failed to get public key", http.StatusInternalServerError)
+		return
+	}
+
+	// Create JWKS
+	jwks := jwk.NewSet()
+	if err := jwks.AddKey(publicKey); err != nil {
+		http.Error(w, "Failed to create JWKS", http.StatusInternalServerError)
+		return
+	}
+
+	// Serve JWKS
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(jwks)
+}

internal/api/handlers/oauth/login.go

···
+package oauth
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"Coves/internal/atproto/identity"
+	"Coves/internal/atproto/oauth"
+	oauthCore "Coves/internal/core/oauth"
+)
+
+// LoginHandler handles OAuth login flow initiation
+type LoginHandler struct {
+	identityResolver identity.Resolver
+	sessionStore     oauthCore.SessionStore
+}
+
+// NewLoginHandler creates a new login handler
+func NewLoginHandler(identityResolver identity.Resolver, sessionStore oauthCore.SessionStore) *LoginHandler {
+	return &LoginHandler{
+		identityResolver: identityResolver,
+		sessionStore:     sessionStore,
+	}
+}
+
+// HandleLogin initiates the OAuth login flow
+// POST /oauth/login
+// Body: { "handle": "alice.bsky.social" }
+func (h *LoginHandler) HandleLogin(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Parse request body
+	var req struct {
+		Handle    string `json:"handle"`
+		ReturnURL string `json:"returnUrl,omitempty"`
+	}
+
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	// Normalize handle
+	handle := strings.TrimSpace(strings.ToLower(req.Handle))
+	handle = strings.TrimPrefix(handle, "@")
+
+	// Validate handle format
+	if handle == "" || !strings.Contains(handle, ".") {
+		http.Error(w, "Invalid handle format", http.StatusBadRequest)
+		return
+	}
+
+	// Resolve handle to DID and PDS
+	resolved, err := h.identityResolver.Resolve(r.Context(), handle)
+	if err != nil {
+		log.Printf("Failed to resolve handle %s: %v", handle, err)
+		http.Error(w, "Unable to find that account", http.StatusBadRequest)
+		return
+	}
+
+	// Get OAuth client configuration (supports base64 encoding)
+	privateJWK, err := GetEnvBase64OrPlain("OAUTH_PRIVATE_JWK")
+	if err != nil {
+		log.Printf("Failed to load OAuth private key: %v", err)
+		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)
+		return
+	}
+	if privateJWK == "" {
+		http.Error(w, "OAuth not configured", http.StatusInternalServerError)
+		return
+	}
+
+	privateKey, err := oauth.ParseJWKFromJSON([]byte(privateJWK))
+	if err != nil {
+		log.Printf("Failed to parse OAuth private key: %v", err)
+		http.Error(w, "OAuth configuration error", http.StatusInternalServerError)
+		return
+	}
+
+	appviewURL := getAppViewURL()
+	clientID := getClientID(appviewURL)
+	redirectURI := appviewURL + "/oauth/callback"
+
+	// Create OAuth client
+	client := oauth.NewClient(clientID, privateKey, redirectURI)
+
+	// Discover auth server from PDS
+	pdsURL := resolved.PDSURL
+	authServerIss, err := client.ResolvePDSAuthServer(r.Context(), pdsURL)
+	if err != nil {
+		log.Printf("Failed to resolve auth server for PDS %s: %v", pdsURL, err)
+		http.Error(w, "Failed to discover authorization server", http.StatusInternalServerError)
+		return
+	}
+
+	// Fetch auth server metadata
+	authMeta, err := client.FetchAuthServerMetadata(r.Context(), authServerIss)
+	if err != nil {
+		log.Printf("Failed to fetch auth server metadata: %v", err)
+		http.Error(w, "Failed to fetch authorization server metadata", http.StatusInternalServerError)
+		return
+	}
+
+	// Generate DPoP key for this session
+	dpopKey, err := oauth.GenerateDPoPKey()
+	if err != nil {
+		log.Printf("Failed to generate DPoP key: %v", err)
+		http.Error(w, "Failed to generate session key", http.StatusInternalServerError)
+		return
+	}
+
+	// Send PAR request
+	parResp, err := client.SendPARRequest(r.Context(), authMeta, handle, "atproto transition:generic", dpopKey)
+	if err != nil {
+		log.Printf("Failed to send PAR request: %v", err)
+		http.Error(w, "Failed to initiate authorization", http.StatusInternalServerError)
+		return
+	}
+
+	// Serialize DPoP key to JSON
+	dpopKeyJSON, err := oauth.JWKToJSON(dpopKey)
+	if err != nil {
+		log.Printf("Failed to serialize DPoP key: %v", err)
+		http.Error(w, "Failed to store session key", http.StatusInternalServerError)
+		return
+	}
+
+	// Save OAuth request state to database
+	oauthReq := &oauthCore.OAuthRequest{
+		State:               parResp.State,
+		DID:                 resolved.DID,
+		Handle:              handle,
+		PDSURL:              pdsURL,
+		PKCEVerifier:        parResp.PKCEVerifier,
+		DPoPPrivateJWK:      string(dpopKeyJSON),
+		DPoPAuthServerNonce: parResp.DpopAuthserverNonce,
+		AuthServerIss:       authServerIss,
+		ReturnURL:           req.ReturnURL,
+	}
+
+	if err := h.sessionStore.SaveRequest(oauthReq); err != nil {
+		log.Printf("Failed to save OAuth request: %v", err)
+		http.Error(w, "Failed to save authorization state", http.StatusInternalServerError)
+		return
+	}
+
+	// Build authorization URL
+	authURL, err := url.Parse(authMeta.AuthorizationEndpoint)
+	if err != nil {
+		log.Printf("Invalid authorization endpoint: %v", err)
+		http.Error(w, "Invalid authorization endpoint", http.StatusInternalServerError)
+		return
+	}
+
+	query := authURL.Query()
+	query.Set("client_id", clientID)
+	query.Set("request_uri", parResp.RequestURI)
+	authURL.RawQuery = query.Encode()
+
+	// Return authorization URL to client
+	resp := map[string]string{
+		"authorizationUrl": authURL.String(),
+		"state":            parResp.State,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(resp)
+}

internal/api/handlers/oauth/logout.go

···
+package oauth
+
+import (
+	"log"
+	"net/http"
+
+	oauthCore "Coves/internal/core/oauth"
+)
+
+// LogoutHandler handles user logout
+type LogoutHandler struct {
+	sessionStore oauthCore.SessionStore
+}
+
+// NewLogoutHandler creates a new logout handler
+func NewLogoutHandler(sessionStore oauthCore.SessionStore) *LogoutHandler {
+	return &LogoutHandler{
+		sessionStore: sessionStore,
+	}
+}
+
+// HandleLogout logs out the current user
+// POST /oauth/logout
+func (h *LogoutHandler) HandleLogout(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Get HTTP session
+	cookieStore := GetCookieStore()
+	httpSession, err := cookieStore.Get(r, sessionName)
+	if err != nil || httpSession.IsNew {
+		// No session to logout
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+
+	// Get DID from session
+	did, ok := httpSession.Values[sessionDID].(string)
+	if !ok || did == "" {
+		// No DID in session
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+
+	// Delete OAuth session from database
+	if err := h.sessionStore.DeleteSession(did); err != nil {
+		log.Printf("Failed to delete OAuth session for DID %s: %v", did, err)
+		// Continue with logout anyway
+	}
+
+	// Clear HTTP session cookie
+	httpSession.Options.MaxAge = -1 // Delete cookie
+	if err := httpSession.Save(r, w); err != nil {
+		log.Printf("Failed to clear HTTP session: %v", err)
+	}
+
+	// Redirect to home
+	http.Redirect(w, r, "/", http.StatusFound)
+}
+
+// GetCurrentUser returns the currently authenticated user's DID
+// Helper function for other handlers
+func GetCurrentUser(r *http.Request) (string, error) {
+	cookieStore := GetCookieStore()
+	httpSession, err := cookieStore.Get(r, sessionName)
+	if err != nil || httpSession.IsNew {
+		return "", err
+	}
+
+	did, ok := httpSession.Values[sessionDID].(string)
+	if !ok || did == "" {
+		return "", nil
+	}
+
+	return did, nil
+}
+
+// GetCurrentUserOrError returns the current user's DID or sends an error response
+// Helper function for protected handlers
+func GetCurrentUserOrError(w http.ResponseWriter, r *http.Request) (string, bool) {
+	did, err := GetCurrentUser(r)
+	if err != nil || did == "" {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return "", false
+	}
+
+	return did, true
+}

internal/api/handlers/oauth/metadata.go

···
+package oauth
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// ClientMetadata represents OAuth 2.0 client metadata (RFC 7591)
+// Served at /oauth/client-metadata.json
+type ClientMetadata struct {
+	ClientID                    string   `json:"client_id"`
+	ClientName                  string   `json:"client_name"`
+	ClientURI                   string   `json:"client_uri"`
+	RedirectURIs                []string `json:"redirect_uris"`
+	GrantTypes                  []string `json:"grant_types"`
+	ResponseTypes               []string `json:"response_types"`
+	Scope                       string   `json:"scope"`
+	TokenEndpointAuthMethod     string   `json:"token_endpoint_auth_method"`
+	TokenEndpointAuthSigningAlg string   `json:"token_endpoint_auth_signing_alg"`
+	DpopBoundAccessTokens       bool     `json:"dpop_bound_access_tokens"`
+	ApplicationType             string   `json:"application_type"`
+	JwksURI                     string   `json:"jwks_uri,omitempty"` // Only in production
+}
+
+// HandleClientMetadata serves the OAuth client metadata
+// GET /oauth/client-metadata.json
+func HandleClientMetadata(w http.ResponseWriter, r *http.Request) {
+	appviewURL := getAppViewURL()
+
+	// Determine client ID based on environment
+	clientID := getClientID(appviewURL)
+	jwksURI := ""
+
+	// Only include JWKS URI in production (not for loopback clients)
+	if !strings.HasPrefix(appviewURL, "http://localhost") && !strings.HasPrefix(appviewURL, "http://127.0.0.1") {
+		jwksURI = appviewURL + "/oauth/jwks.json"
+	}
+
+	metadata := ClientMetadata{
+		ClientID:                    clientID,
+		ClientName:                  "Coves",
+		ClientURI:                   appviewURL,
+		RedirectURIs:                []string{appviewURL + "/oauth/callback"},
+		GrantTypes:                  []string{"authorization_code", "refresh_token"},
+		ResponseTypes:               []string{"code"},
+		Scope:                       "atproto transition:generic",
+		TokenEndpointAuthMethod:     "private_key_jwt",
+		TokenEndpointAuthSigningAlg: "ES256",
+		DpopBoundAccessTokens:       true,
+		ApplicationType:             "web",
+		JwksURI:                     jwksURI,
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(http.StatusOK)
+	json.NewEncoder(w).Encode(metadata)
+}
+
+// getAppViewURL returns the public URL of the AppView
+func getAppViewURL() string {
+	url := os.Getenv("APPVIEW_PUBLIC_URL")
+	if url == "" {
+		// Default to localhost for development
+		url = "http://localhost:8081"
+	}
+	return strings.TrimSuffix(url, "/")
+}
+
+// getClientID returns the OAuth client ID based on environment
+// For localhost development, use loopback client identifier
+// For production, use HTTPS URL to client metadata
+func getClientID(appviewURL string) string {
+	// Development: use loopback client (http://localhost?...)
+	if strings.HasPrefix(appviewURL, "http://localhost") || strings.HasPrefix(appviewURL, "http://127.0.0.1") {
+		return "http://localhost?redirect_uri=" + appviewURL + "/oauth/callback&scope=atproto%20transition:generic"
+	}
+
+	// Production: use HTTPS URL to client metadata
+	return appviewURL + "/oauth/client-metadata.json"
+}

internal/api/middleware/auth.go

···
+package middleware
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"strings"
+
+	"Coves/internal/api/handlers/oauth"
+	atprotoOAuth "Coves/internal/atproto/oauth"
+	oauthCore "Coves/internal/core/oauth"
+)
+
+// Context keys for storing user information
+type contextKey string
+
+const (
+	UserDIDKey      contextKey = "user_did"
+	OAuthSessionKey contextKey = "oauth_session"
+)
+
+const (
+	sessionName = "coves_session"
+	sessionDID  = "did"
+)
+
+// AuthMiddleware enforces OAuth authentication for protected routes
+type AuthMiddleware struct {
+	authService *oauthCore.AuthService
+}
+
+// NewAuthMiddleware creates a new auth middleware
+func NewAuthMiddleware(sessionStore oauthCore.SessionStore) (*AuthMiddleware, error) {
+	privateJWK := os.Getenv("OAUTH_PRIVATE_JWK")
+	if privateJWK == "" {
+		return nil, fmt.Errorf("OAUTH_PRIVATE_JWK not configured")
+	}
+
+	// Parse OAuth client key
+	privateKey, err := atprotoOAuth.ParseJWKFromJSON([]byte(privateJWK))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse OAuth private key: %w", err)
+	}
+
+	// Get AppView URL
+	appviewURL := os.Getenv("APPVIEW_PUBLIC_URL")
+	if appviewURL == "" {
+		appviewURL = "http://localhost:8081"
+	}
+
+	// Determine client ID
+	var clientID string
+	if strings.HasPrefix(appviewURL, "http://localhost") || strings.HasPrefix(appviewURL, "http://127.0.0.1") {
+		clientID = "http://localhost?redirect_uri=" + appviewURL + "/oauth/callback&scope=atproto%20transition:generic"
+	} else {
+		clientID = appviewURL + "/oauth/client-metadata.json"
+	}
+
+	redirectURI := appviewURL + "/oauth/callback"
+
+	oauthClient := atprotoOAuth.NewClient(clientID, privateKey, redirectURI)
+	authService := oauthCore.NewAuthService(sessionStore, oauthClient)
+
+	return &AuthMiddleware{
+		authService: authService,
+	}, nil
+}
+
+// RequireAuth middleware ensures the user is authenticated
+// If not authenticated, returns 401
+// If authenticated, injects user DID and OAuth session into context
+func (m *AuthMiddleware) RequireAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Get HTTP session
+		cookieStore := oauth.GetCookieStore()
+		httpSession, err := cookieStore.Get(r, sessionName)
+		if err != nil || httpSession.IsNew {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		// Get DID from session
+		did, ok := httpSession.Values[sessionDID].(string)
+		if !ok || did == "" {
+			http.Error(w, "Unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		// Load OAuth session from database
+		session, err := m.authService.ValidateSession(r.Context(), did)
+		if err != nil {
+			log.Printf("Failed to load OAuth session for DID %s: %v", did, err)
+			http.Error(w, "Session expired", http.StatusUnauthorized)
+			return
+		}
+
+		// Check if token needs refresh and refresh if necessary
+		session, err = m.authService.RefreshTokenIfNeeded(r.Context(), session, oauth.TokenRefreshThreshold)
+		if err != nil {
+			log.Printf("Failed to refresh token for DID %s: %v", did, err)
+			http.Error(w, "Session expired", http.StatusUnauthorized)
+			return
+		}
+
+		// Inject user info into context
+		ctx := context.WithValue(r.Context(), UserDIDKey, did)
+		ctx = context.WithValue(ctx, OAuthSessionKey, session)
+
+		// Call next handler
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// OptionalAuth middleware loads user info if authenticated, but doesn't require it
+// Useful for endpoints that work for both authenticated and anonymous users
+func (m *AuthMiddleware) OptionalAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Get HTTP session
+		cookieStore := oauth.GetCookieStore()
+		httpSession, err := cookieStore.Get(r, sessionName)
+		if err != nil || httpSession.IsNew {
+			// Not authenticated - continue without user context
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		// Get DID from session
+		did, ok := httpSession.Values[sessionDID].(string)
+		if !ok || did == "" {
+			// No DID - continue without user context
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		// Load OAuth session from database
+		session, err := m.authService.ValidateSession(r.Context(), did)
+		if err != nil {
+			// Session expired - continue without user context
+			next.ServeHTTP(w, r)
+			return
+		}
+
+		// Try to refresh token if needed (best effort)
+		refreshedSession, err := m.authService.RefreshTokenIfNeeded(r.Context(), session, oauth.TokenRefreshThreshold)
+		if err != nil {
+			// If refresh fails, continue with old session (best effort)
+			// Session will still be valid for a few more minutes
+		} else {
+			session = refreshedSession
+		}
+
+		// Inject user info into context
+		ctx := context.WithValue(r.Context(), UserDIDKey, did)
+		ctx = context.WithValue(ctx, OAuthSessionKey, session)
+
+		// Call next handler
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+// GetUserDID extracts the user's DID from the request context
+// Returns empty string if not authenticated
+func GetUserDID(r *http.Request) string {
+	did, _ := r.Context().Value(UserDIDKey).(string)
+	return did
+}
+
+// GetOAuthSession extracts the OAuth session from the request context
+// Returns nil if not authenticated
+func GetOAuthSession(r *http.Request) *oauthCore.OAuthSession {
+	session, _ := r.Context().Value(OAuthSessionKey).(*oauthCore.OAuthSession)
+	return session
+}

internal/atproto/oauth/client.go

···
+package oauth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
+
+// Client handles atProto OAuth flows (PAR, PKCE, DPoP)
+type Client struct {
+	clientID    string
+	clientJWK   jwk.Key
+	redirectURI string
+	httpClient  *http.Client
+}
+
+// NewClient creates a new OAuth client
+func NewClient(clientID string, clientJWK jwk.Key, redirectURI string) *Client {
+	return &Client{
+		clientID:    clientID,
+		clientJWK:   clientJWK,
+		redirectURI: redirectURI,
+		httpClient: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+	}
+}
+
+// AuthServerMetadata represents OAuth 2.0 authorization server metadata (RFC 8414)
+type AuthServerMetadata struct {
+	Issuer                        string   `json:"issuer"`
+	AuthorizationEndpoint         string   `json:"authorization_endpoint"`
+	TokenEndpoint                 string   `json:"token_endpoint"`
+	PushedAuthReqEndpoint         string   `json:"pushed_authorization_request_endpoint"`
+	JWKSURI                       string   `json:"jwks_uri"`
+	GrantTypesSupported           []string `json:"grant_types_supported"`
+	ResponseTypesSupported        []string `json:"response_types_supported"`
+	CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"`
+	DPoPSigningAlgValuesSupported []string `json:"dpop_signing_alg_values_supported"`
+}
+
+// ResolvePDSAuthServer resolves the authorization server for a PDS
+// Follows the PDS → Authorization Server discovery flow
+func (c *Client) ResolvePDSAuthServer(ctx context.Context, pdsURL string) (string, error) {
+	// Fetch PDS metadata from /.well-known/oauth-protected-resource
+	metadataURL := strings.TrimSuffix(pdsURL, "/") + "/.well-known/oauth-protected-resource"
+
+	req, err := http.NewRequestWithContext(ctx, "GET", metadataURL, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("failed to fetch PDS metadata: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }() //nolint:errcheck
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("PDS returned status %d", resp.StatusCode)
+	}
+
+	var metadata struct {
+		AuthorizationServers []string `json:"authorization_servers"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil {
+		return "", fmt.Errorf("failed to decode PDS metadata: %w", err)
+	}
+
+	if len(metadata.AuthorizationServers) == 0 {
+		return "", fmt.Errorf("no authorization servers found for PDS")
+	}
+
+	// Return the first (primary) authorization server
+	return metadata.AuthorizationServers[0], nil
+}
+
+// FetchAuthServerMetadata fetches OAuth 2.0 authorization server metadata
+func (c *Client) FetchAuthServerMetadata(ctx context.Context, issuer string) (*AuthServerMetadata, error) {
+	// OAuth 2.0 discovery endpoint
+	metadataURL := strings.TrimSuffix(issuer, "/") + "/.well-known/oauth-authorization-server"
+
+	req, err := http.NewRequestWithContext(ctx, "GET", metadataURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch auth server metadata: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }() //nolint:errcheck
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("auth server returned status %d", resp.StatusCode)
+	}
+
+	var metadata AuthServerMetadata
+	if err := json.NewDecoder(resp.Body).Decode(&metadata); err != nil {
+		return nil, fmt.Errorf("failed to decode auth server metadata: %w", err)
+	}
+
+	return &metadata, nil
+}
+
+// PARResponse represents the response from a Pushed Authorization Request
+type PARResponse struct {
+	RequestURI          string `json:"request_uri"`
+	ExpiresIn           int    `json:"expires_in"`
+	State               string // Generated by client
+	PKCEVerifier        string // Generated by client
+	DpopAuthserverNonce string // From response header (if provided)
+}
+
+// SendPARRequest sends a Pushed Authorization Request (PAR) - RFC 9126
+// This pre-registers the authorization request with the server
+func (c *Client) SendPARRequest(ctx context.Context, authMeta *AuthServerMetadata, handle, scope string, dpopKey jwk.Key) (*PARResponse, error) {
+	// Generate PKCE challenge
+	pkce, err := GeneratePKCEChallenge()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate PKCE: %w", err)
+	}
+
+	// Generate state
+	state, err := GenerateState()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate state: %w", err)
+	}
+
+	// Create form data
+	data := url.Values{}
+	data.Set("client_id", c.clientID)
+	data.Set("redirect_uri", c.redirectURI)
+	data.Set("response_type", "code")
+	data.Set("scope", scope)
+	data.Set("state", state)
+	data.Set("code_challenge", pkce.Challenge)
+	data.Set("code_challenge_method", pkce.Method)
+	data.Set("login_hint", handle) // atProto-specific: suggests which account to use
+
+	// Create DPoP proof for PAR endpoint
+	dpopProof, err := CreateDPoPProof(dpopKey, "POST", authMeta.PushedAuthReqEndpoint, "", "")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create DPoP proof: %w", err)
+	}
+
+	// Send PAR request
+	req, err := http.NewRequestWithContext(ctx, "POST", authMeta.PushedAuthReqEndpoint, strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("DPoP", dpopProof)
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to send PAR request: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }() //nolint:errcheck
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read PAR response: %w", err)
+	}
+
+	// Handle DPoP nonce requirement (RFC 9449 Section 8)
+	// If server returns use_dpop_nonce error, retry with the nonce
+	if resp.StatusCode == http.StatusBadRequest {
+		var errorResp struct {
+			Error            string `json:"error"`
+			ErrorDescription string `json:"error_description"`
+		}
+		if err := json.Unmarshal(body, &errorResp); err == nil && errorResp.Error == "use_dpop_nonce" {
+			// Get nonce from response header
+			nonce := resp.Header.Get("DPoP-Nonce")
+			if nonce != "" {
+				// Retry with nonce
+				dpopProof, err = CreateDPoPProof(dpopKey, "POST", authMeta.PushedAuthReqEndpoint, nonce, "")
+				if err != nil {
+					return nil, fmt.Errorf("failed to create DPoP proof with nonce: %w", err)
+				}
+
+				// Re-create request with new DPoP proof
+				req, err = http.NewRequestWithContext(ctx, "POST", authMeta.PushedAuthReqEndpoint, strings.NewReader(data.Encode()))
+				if err != nil {
+					return nil, fmt.Errorf("failed to create retry request: %w", err)
+				}
+				req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+				req.Header.Set("DPoP", dpopProof)
+
+				// Send retry request
+				resp, err = c.httpClient.Do(req)
+				if err != nil {
+					return nil, fmt.Errorf("failed to send retry PAR request: %w", err)
+				}
+				defer func() { _ = resp.Body.Close() }() //nolint:errcheck
+				body, err = io.ReadAll(resp.Body)
+				if err != nil {
+					return nil, fmt.Errorf("failed to read retry PAR response: %w", err)
+				}
+			}
+		}
+	}
+
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		return nil, fmt.Errorf("PAR request failed with status %d", resp.StatusCode)
+	}
+
+	var parResp struct {
+		RequestURI string `json:"request_uri"`
+		ExpiresIn  int    `json:"expires_in"`
+	}
+
+	if err := json.Unmarshal(body, &parResp); err != nil {
+		return nil, fmt.Errorf("failed to decode PAR response: %w", err)
+	}
+
+	// Extract DPoP nonce from response header (if provided)
+	dpopNonce := resp.Header.Get("DPoP-Nonce")
+
+	return &PARResponse{
+		RequestURI:          parResp.RequestURI,
+		ExpiresIn:           parResp.ExpiresIn,
+		State:               state,
+		PKCEVerifier:        pkce.Verifier,
+		DpopAuthserverNonce: dpopNonce,
+	}, nil
+}
+
+// TokenResponse represents an OAuth token response
+type TokenResponse struct {
+	AccessToken         string `json:"access_token"`
+	TokenType           string `json:"token_type"` // Should be "DPoP"
+	ExpiresIn           int    `json:"expires_in"`
+	RefreshToken        string `json:"refresh_token"`
+	Scope               string `json:"scope"`
+	Sub                 string `json:"sub"` // DID of the user
+	DpopAuthserverNonce string // From response header
+}
+
+// InitialTokenRequest exchanges authorization code for tokens (DPoP-bound)
+func (c *Client) InitialTokenRequest(ctx context.Context, code, issuer, pkceVerifier, dpopNonce string, dpopKey jwk.Key) (*TokenResponse, error) {
+	// Get auth server metadata for token endpoint
+	authMeta, err := c.FetchAuthServerMetadata(ctx, issuer)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch auth server metadata: %w", err)
+	}
+
+	// Create form data
+	data := url.Values{}
+	data.Set("grant_type", "authorization_code")
+	data.Set("code", code)
+	data.Set("redirect_uri", c.redirectURI)
+	data.Set("code_verifier", pkceVerifier)
+	data.Set("client_id", c.clientID)
+
+	// Create DPoP proof for token endpoint
+	dpopProof, err := CreateDPoPProof(dpopKey, "POST", authMeta.TokenEndpoint, dpopNonce, "")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create DPoP proof: %w", err)
+	}
+
+	// Send token request
+	req, err := http.NewRequestWithContext(ctx, "POST", authMeta.TokenEndpoint, strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("DPoP", dpopProof)
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to send token request: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }() //nolint:errcheck
+
+	var tokenResp TokenResponse
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("token request failed with status %d", resp.StatusCode)
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+		return nil, fmt.Errorf("failed to decode token response: %w", err)
+	}
+
+	// Extract updated DPoP nonce
+	tokenResp.DpopAuthserverNonce = resp.Header.Get("DPoP-Nonce")
+
+	return &tokenResp, nil
+}
+
+// RefreshTokenRequest refreshes an access token using a refresh token
+func (c *Client) RefreshTokenRequest(ctx context.Context, refreshToken, issuer, dpopNonce string, dpopKey jwk.Key) (*TokenResponse, error) {
+	// Get auth server metadata for token endpoint
+	authMeta, err := c.FetchAuthServerMetadata(ctx, issuer)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch auth server metadata: %w", err)
+	}
+
+	// Create form data
+	data := url.Values{}
+	data.Set("grant_type", "refresh_token")
+	data.Set("refresh_token", refreshToken)
+	data.Set("client_id", c.clientID)
+
+	// Create DPoP proof for token endpoint
+	dpopProof, err := CreateDPoPProof(dpopKey, "POST", authMeta.TokenEndpoint, dpopNonce, "")
+	if err != nil {
+		return nil, fmt.Errorf("failed to create DPoP proof: %w", err)
+	}
+
+	// Send refresh request
+	req, err := http.NewRequestWithContext(ctx, "POST", authMeta.TokenEndpoint, strings.NewReader(data.Encode()))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("DPoP", dpopProof)
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to send refresh request: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }() //nolint:errcheck
+
+	var tokenResp TokenResponse
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("refresh request failed with status %d", resp.StatusCode)
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+		return nil, fmt.Errorf("failed to decode token response: %w", err)
+	}
+
+	// Extract updated DPoP nonce
+	tokenResp.DpopAuthserverNonce = resp.Header.Get("DPoP-Nonce")
+
+	return &tokenResp, nil
+}

internal/atproto/oauth/dpop.go

···
+package oauth
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/lestrrat-go/jwx/v2/jwa"
+	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/lestrrat-go/jwx/v2/jws"
+	"github.com/lestrrat-go/jwx/v2/jwt"
+)
+
+// DPoP (Demonstrating Proof of Possession) - RFC 9449
+// Binds access tokens to specific clients using cryptographic proofs
+
+// GenerateDPoPKey generates a new ES256 (NIST P-256) keypair for DPoP
+// Each OAuth session should have its own unique DPoP key
+func GenerateDPoPKey() (jwk.Key, error) {
+	// Generate ES256 private key
+	privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate ECDSA key: %w", err)
+	}
+
+	// Convert to JWK
+	jwkKey, err := jwk.FromRaw(privateKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create JWK from private key: %w", err)
+	}
+
+	// Set JWK parameters
+	if err := jwkKey.Set(jwk.AlgorithmKey, jwa.ES256); err != nil {
+		return nil, fmt.Errorf("failed to set algorithm: %w", err)
+	}
+	if err := jwkKey.Set(jwk.KeyUsageKey, "sig"); err != nil {
+		return nil, fmt.Errorf("failed to set key usage: %w", err)
+	}
+
+	return jwkKey, nil
+}
+
+// CreateDPoPProof creates a DPoP proof JWT for HTTP requests
+// Parameters:
+//   - privateKey: The DPoP private key (ES256) as JWK
+//   - method: HTTP method (e.g., "POST", "GET")
+//   - uri: Full HTTP URI (e.g., "https://pds.example.com/xrpc/com.atproto.server.getSession")
+//   - nonce: Optional server-provided nonce (empty on first request, use nonce from 401 response on retry)
+//   - accessToken: Optional access token hash (required when using access token)
+func CreateDPoPProof(privateKey jwk.Key, method, uri, nonce, accessToken string) (string, error) {
+	// Get public key for JWK thumbprint
+	pubKey, err := privateKey.PublicKey()
+	if err != nil {
+		return "", fmt.Errorf("failed to get public key: %w", err)
+	}
+
+	// Create JWT builder
+	builder := jwt.NewBuilder().
+		Claim("htm", method).            // HTTP method
+		Claim("htu", uri).               // HTTP URI
+		Claim("iat", time.Now().Unix()). // Issued at
+		Claim("jti", generateJTI())      // Unique JWT ID
+
+	// Add nonce if provided (required after first DPoP request)
+	if nonce != "" {
+		builder = builder.Claim("nonce", nonce)
+	}
+
+	// Add access token hash if provided (required when using access token)
+	if accessToken != "" {
+		ath := hashAccessToken(accessToken)
+		builder = builder.Claim("ath", ath)
+	}
+
+	// Build the token
+	token, err := builder.Build()
+	if err != nil {
+		return "", fmt.Errorf("failed to build JWT: %w", err)
+	}
+
+	// Serialize the token payload to JSON
+	payloadBytes, err := json.Marshal(token)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal token: %w", err)
+	}
+
+	// Create headers with DPoP-specific fields
+	// RFC 9449 requires the "jwk" header to contain the public key as a JSON object
+	headers := jws.NewHeaders()
+	if err := headers.Set(jws.AlgorithmKey, jwa.ES256); err != nil {
+		return "", fmt.Errorf("failed to set algorithm: %w", err)
+	}
+	if err := headers.Set(jws.TypeKey, "dpop+jwt"); err != nil {
+		return "", fmt.Errorf("failed to set type: %w", err)
+	}
+	// Set the public JWK directly - jwx library will handle serialization
+	if err := headers.Set(jws.JWKKey, pubKey); err != nil {
+		return "", fmt.Errorf("failed to set JWK: %w", err)
+	}
+
+	// Sign using jws.Sign to preserve custom headers
+	// (jwt.Sign() overrides headers, so we use jws.Sign() directly)
+	signed, err := jws.Sign(payloadBytes, jws.WithKey(jwa.ES256, privateKey, jws.WithProtectedHeaders(headers)))
+	if err != nil {
+		return "", fmt.Errorf("failed to sign JWT: %w", err)
+	}
+
+	return string(signed), nil
+}
+
+// generateJTI generates a unique JWT ID for DPoP proofs
+func generateJTI() string {
+	// Generate 16 random bytes
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		// Fallback to timestamp-based ID
+		return fmt.Sprintf("%d", time.Now().UnixNano())
+	}
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+// hashAccessToken creates the 'ath' (access token hash) claim
+// ath = base64url(SHA-256(access_token))
+func hashAccessToken(accessToken string) string {
+	hash := sha256.Sum256([]byte(accessToken))
+	return base64.RawURLEncoding.EncodeToString(hash[:])
+}
+
+// ParseJWKFromJSON parses a JWK from JSON bytes
+func ParseJWKFromJSON(data []byte) (jwk.Key, error) {
+	key, err := jwk.ParseKey(data)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse JWK: %w", err)
+	}
+	return key, nil
+}
+
+// JWKToJSON converts a JWK to JSON bytes
+func JWKToJSON(key jwk.Key) ([]byte, error) {
+	data, err := json.Marshal(key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal JWK: %w", err)
+	}
+	return data, nil
+}
+
+// GetPublicJWKS creates a JWKS (JSON Web Key Set) response for the public key
+// This is served at /oauth/jwks.json
+func GetPublicJWKS(privateKey jwk.Key) (jwk.Set, error) {
+	pubKey, err := privateKey.PublicKey()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get public key: %w", err)
+	}
+
+	// Create JWK Set
+	set := jwk.NewSet()
+	if err := set.AddKey(pubKey); err != nil {
+		return nil, fmt.Errorf("failed to add key to set: %w", err)
+	}
+
+	return set, nil
+}

internal/atproto/oauth/dpop_test.go

···
+package oauth
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// TestCreateDPoPProof tests DPoP proof generation and structure
+func TestCreateDPoPProof(t *testing.T) {
+	// Generate a test DPoP key
+	dpopKey, err := GenerateDPoPKey()
+	if err != nil {
+		t.Fatalf("Failed to generate DPoP key: %v", err)
+	}
+
+	// Create a DPoP proof
+	proof, err := CreateDPoPProof(dpopKey, "POST", "https://example.com/token", "", "")
+	if err != nil {
+		t.Fatalf("Failed to create DPoP proof: %v", err)
+	}
+
+	// DPoP proof should be a JWT in form: header.payload.signature
+	parts := strings.Split(proof, ".")
+	if len(parts) != 3 {
+		t.Fatalf("Expected 3 parts in JWT, got %d", len(parts))
+	}
+
+	// Decode and inspect the header
+	headerJSON, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		t.Fatalf("Failed to decode header: %v", err)
+	}
+
+	var header map[string]interface{}
+	if err := json.Unmarshal(headerJSON, &header); err != nil {
+		t.Fatalf("Failed to unmarshal header: %v", err)
+	}
+
+	t.Logf("DPoP Header: %s", string(headerJSON))
+
+	// Verify required header fields
+	if header["alg"] != "ES256" {
+		t.Errorf("Expected alg=ES256, got %v", header["alg"])
+	}
+	if header["typ"] != "dpop+jwt" {
+		t.Errorf("Expected typ=dpop+jwt, got %v", header["typ"])
+	}
+
+	// Verify JWK is present and is a JSON object
+	jwkValue, hasJWK := header["jwk"]
+	if !hasJWK {
+		t.Fatal("Header missing 'jwk' field")
+	}
+
+	// JWK should be a map/object, not a string
+	jwkMap, ok := jwkValue.(map[string]interface{})
+	if !ok {
+		t.Fatalf("JWK is not a JSON object, got type: %T, value: %v", jwkValue, jwkValue)
+	}
+
+	// Verify JWK has required fields for EC key
+	if jwkMap["kty"] != "EC" {
+		t.Errorf("Expected kty=EC, got %v", jwkMap["kty"])
+	}
+	if jwkMap["crv"] != "P-256" {
+		t.Errorf("Expected crv=P-256, got %v", jwkMap["crv"])
+	}
+	if _, hasX := jwkMap["x"]; !hasX {
+		t.Error("JWK missing 'x' coordinate")
+	}
+	if _, hasY := jwkMap["y"]; !hasY {
+		t.Error("JWK missing 'y' coordinate")
+	}
+
+	// Verify private key is NOT in the public JWK
+	if _, hasD := jwkMap["d"]; hasD {
+		t.Error("SECURITY: JWK contains private key component 'd'!")
+	}
+
+	// Decode and inspect the payload
+	payloadJSON, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		t.Fatalf("Failed to decode payload: %v", err)
+	}
+
+	var payload map[string]interface{}
+	if err := json.Unmarshal(payloadJSON, &payload); err != nil {
+		t.Fatalf("Failed to unmarshal payload: %v", err)
+	}
+
+	t.Logf("DPoP Payload: %s", string(payloadJSON))
+
+	// Verify required payload claims
+	if payload["htm"] != "POST" {
+		t.Errorf("Expected htm=POST, got %v", payload["htm"])
+	}
+	if payload["htu"] != "https://example.com/token" {
+		t.Errorf("Expected htu=https://example.com/token, got %v", payload["htu"])
+	}
+	if _, hasIAT := payload["iat"]; !hasIAT {
+		t.Error("Payload missing 'iat' (issued at)")
+	}
+	if _, hasJTI := payload["jti"]; !hasJTI {
+		t.Error("Payload missing 'jti' (JWT ID)")
+	}
+}
+
+// TestDPoPProofWithNonce tests DPoP proof with nonce
+func TestDPoPProofWithNonce(t *testing.T) {
+	dpopKey, err := GenerateDPoPKey()
+	if err != nil {
+		t.Fatalf("Failed to generate DPoP key: %v", err)
+	}
+
+	testNonce := "test-nonce-12345"
+	proof, err := CreateDPoPProof(dpopKey, "POST", "https://example.com/token", testNonce, "")
+	if err != nil {
+		t.Fatalf("Failed to create DPoP proof: %v", err)
+	}
+
+	// Decode payload
+	parts := strings.Split(proof, ".")
+	payloadJSON, _ := base64.RawURLEncoding.DecodeString(parts[1])
+	var payload map[string]interface{}
+	json.Unmarshal(payloadJSON, &payload)
+
+	if payload["nonce"] != testNonce {
+		t.Errorf("Expected nonce=%s, got %v", testNonce, payload["nonce"])
+	}
+}
+
+// TestDPoPProofWithAccessToken tests DPoP proof with access token hash
+func TestDPoPProofWithAccessToken(t *testing.T) {
+	dpopKey, err := GenerateDPoPKey()
+	if err != nil {
+		t.Fatalf("Failed to generate DPoP key: %v", err)
+	}
+
+	testToken := "test-access-token"
+	proof, err := CreateDPoPProof(dpopKey, "GET", "https://example.com/resource", "", testToken)
+	if err != nil {
+		t.Fatalf("Failed to create DPoP proof: %v", err)
+	}
+
+	// Decode payload
+	parts := strings.Split(proof, ".")
+	payloadJSON, _ := base64.RawURLEncoding.DecodeString(parts[1])
+	var payload map[string]interface{}
+	json.Unmarshal(payloadJSON, &payload)
+
+	ath, hasATH := payload["ath"]
+	if !hasATH {
+		t.Fatal("Payload missing 'ath' (access token hash)")
+	}
+	if ath == "" {
+		t.Error("Access token hash is empty")
+	}
+
+	t.Logf("Access token hash: %v", ath)
+}

internal/atproto/oauth/pkce.go

···
+package oauth
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+)
+
+// PKCE (Proof Key for Code Exchange) - RFC 7636
+// Prevents authorization code interception attacks
+
+// PKCEChallenge contains the code verifier and challenge for PKCE
+type PKCEChallenge struct {
+	Verifier  string // Random string (43-128 characters)
+	Challenge string // Base64URL(SHA256(verifier))
+	Method    string // Always "S256" for atProto
+}
+
+// GeneratePKCEChallenge generates a new PKCE code verifier and challenge
+// Uses S256 method (SHA-256 hash) as required by atProto OAuth
+func GeneratePKCEChallenge() (*PKCEChallenge, error) {
+	// Generate 32 random bytes (will be 43 chars when base64url encoded)
+	verifierBytes := make([]byte, 32)
+	if _, err := rand.Read(verifierBytes); err != nil {
+		return nil, fmt.Errorf("failed to generate random bytes: %w", err)
+	}
+
+	// Base64URL encode (no padding)
+	verifier := base64.RawURLEncoding.EncodeToString(verifierBytes)
+
+	// Create SHA-256 hash of verifier
+	hash := sha256.Sum256([]byte(verifier))
+	challenge := base64.RawURLEncoding.EncodeToString(hash[:])
+
+	return &PKCEChallenge{
+		Verifier:  verifier,
+		Challenge: challenge,
+		Method:    "S256",
+	}, nil
+}
+
+// GenerateState generates a random state parameter for CSRF protection
+// State is used to prevent CSRF attacks in the OAuth flow
+func GenerateState() (string, error) {
+	// Generate 32 random bytes
+	stateBytes := make([]byte, 32)
+	if _, err := rand.Read(stateBytes); err != nil {
+		return "", fmt.Errorf("failed to generate random state: %w", err)
+	}
+
+	return base64.RawURLEncoding.EncodeToString(stateBytes), nil
+}

internal/atproto/xrpc/dpop_transport.go

···
+package xrpc
+
+import (
+	"fmt"
+	"net/http"
+	"sync"
+
+	"Coves/internal/atproto/oauth"
+	oauthCore "Coves/internal/core/oauth"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
+
+// DPoPTransport is an http.RoundTripper that automatically adds DPoP proofs to requests
+// It intercepts HTTP requests and:
+// 1. Adds Authorization: DPoP <access_token>
+// 2. Creates and adds DPoP proof JWT
+// 3. Handles nonce rotation (retries on 401 with new nonce)
+// 4. Updates nonces in session store
+type DPoPTransport struct {
+	base            http.RoundTripper      // Underlying transport (usually http.DefaultTransport)
+	session         *oauthCore.OAuthSession // User's OAuth session
+	sessionStore    oauthCore.SessionStore  // For updating nonces
+	dpopKey         jwk.Key                 // Parsed DPoP private key
+	mu              sync.Mutex              // Protects nonce updates
+}
+
+// NewDPoPTransport creates a new DPoP-enabled HTTP transport
+func NewDPoPTransport(base http.RoundTripper, session *oauthCore.OAuthSession, sessionStore oauthCore.SessionStore) (*DPoPTransport, error) {
+	if base == nil {
+		base = http.DefaultTransport
+	}
+
+	// Parse DPoP private key from session
+	dpopKey, err := oauth.ParseJWKFromJSON([]byte(session.DPoPPrivateJWK))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse DPoP key: %w", err)
+	}
+
+	return &DPoPTransport{
+		base:         base,
+		session:      session,
+		sessionStore: sessionStore,
+		dpopKey:      dpopKey,
+	}, nil
+}
+
+// RoundTrip implements http.RoundTripper
+// This is called for every HTTP request made by the client
+func (t *DPoPTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Clone the request (don't modify original)
+	req = req.Clone(req.Context())
+
+	// Add Authorization header with DPoP-bound access token
+	req.Header.Set("Authorization", "DPoP "+t.session.AccessToken)
+
+	// Determine which nonce to use based on the target URL
+	nonce := t.getDPoPNonce(req.URL.String())
+
+	// Create DPoP proof for this specific request
+	dpopProof, err := oauth.CreateDPoPProof(
+		t.dpopKey,
+		req.Method,
+		req.URL.String(),
+		nonce,
+		t.session.AccessToken,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create DPoP proof: %w", err)
+	}
+
+	// Add DPoP proof header
+	req.Header.Set("DPoP", dpopProof)
+
+	// Execute the request
+	resp, err := t.base.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+
+	// Handle DPoP nonce rotation
+	if resp.StatusCode == http.StatusUnauthorized {
+		// Check if server provided a new nonce
+		newNonce := resp.Header.Get("DPoP-Nonce")
+		if newNonce != "" {
+			// Update nonce and retry request once
+			t.updateDPoPNonce(req.URL.String(), newNonce)
+
+			// Close the 401 response body
+			_ = resp.Body.Close()
+
+			// Retry with new nonce
+			return t.retryWithNewNonce(req, newNonce)
+		}
+	}
+
+	// Check for nonce update even on successful responses
+	if newNonce := resp.Header.Get("DPoP-Nonce"); newNonce != "" {
+		t.updateDPoPNonce(req.URL.String(), newNonce)
+	}
+
+	return resp, nil
+}
+
+// getDPoPNonce determines which DPoP nonce to use for a given URL
+func (t *DPoPTransport) getDPoPNonce(url string) string {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	// If URL is to the PDS, use PDS nonce
+	if contains(url, t.session.PDSURL) {
+		return t.session.DPoPPDSNonce
+	}
+
+	// If URL is to auth server, use auth server nonce
+	if contains(url, t.session.AuthServerIss) {
+		return t.session.DPoPAuthServerNonce
+	}
+
+	// Default: no nonce (first request to this server)
+	return ""
+}
+
+// updateDPoPNonce updates the appropriate nonce based on URL
+func (t *DPoPTransport) updateDPoPNonce(url, newNonce string) {
+	t.mu.Lock()
+
+	// Read DID inside lock to avoid race condition
+	did := t.session.DID
+
+	// Update PDS nonce
+	if contains(url, t.session.PDSURL) {
+		t.session.DPoPPDSNonce = newNonce
+		t.mu.Unlock()
+		// Persist to database (async, best-effort)
+		go func() {
+			_ = t.sessionStore.UpdatePDSNonce(did, newNonce)
+		}()
+		return
+	}
+
+	// Update auth server nonce
+	if contains(url, t.session.AuthServerIss) {
+		t.session.DPoPAuthServerNonce = newNonce
+		t.mu.Unlock()
+		// Persist to database (async, best-effort)
+		go func() {
+			_ = t.sessionStore.UpdateAuthServerNonce(did, newNonce)
+		}()
+		return
+	}
+
+	t.mu.Unlock()
+}
+
+// retryWithNewNonce retries a request with an updated DPoP nonce
+func (t *DPoPTransport) retryWithNewNonce(req *http.Request, newNonce string) (*http.Response, error) {
+	// Create new DPoP proof with updated nonce
+	dpopProof, err := oauth.CreateDPoPProof(
+		t.dpopKey,
+		req.Method,
+		req.URL.String(),
+		newNonce,
+		t.session.AccessToken,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create DPoP proof on retry: %w", err)
+	}
+
+	// Update DPoP header
+	req.Header.Set("DPoP", dpopProof)
+
+	// Retry the request (only once - no infinite loops)
+	return t.base.RoundTrip(req)
+}
+
+// contains checks if haystack contains needle (case-sensitive)
+func contains(haystack, needle string) bool {
+	return len(haystack) >= len(needle) && haystack[:len(needle)] == needle ||
+		len(haystack) > len(needle) && haystack[len(haystack)-len(needle):] == needle
+}
+
+// AuthenticatedClient creates an HTTP client with DPoP transport
+// This is what handlers use to make authenticated requests to the user's PDS
+func NewAuthenticatedClient(session *oauthCore.OAuthSession, sessionStore oauthCore.SessionStore) (*http.Client, error) {
+	transport, err := NewDPoPTransport(nil, session, sessionStore)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create DPoP transport: %w", err)
+	}
+
+	return &http.Client{
+		Transport: transport,
+	}, nil
+}

internal/core/oauth/auth_service.go

···
+package oauth
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"Coves/internal/atproto/oauth"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
+
+// AuthService handles authentication-related business logic
+// Extracted from middleware to maintain clean architecture
+type AuthService struct {
+	sessionStore SessionStore
+	oauthClient  *oauth.Client
+}
+
+// NewAuthService creates a new authentication service
+func NewAuthService(sessionStore SessionStore, oauthClient *oauth.Client) *AuthService {
+	return &AuthService{
+		sessionStore: sessionStore,
+		oauthClient:  oauthClient,
+	}
+}
+
+// ValidateSession retrieves and validates a user's OAuth session
+// Returns the session if valid, error if not found or expired
+func (s *AuthService) ValidateSession(ctx context.Context, did string) (*OAuthSession, error) {
+	session, err := s.sessionStore.GetSession(did)
+	if err != nil {
+		return nil, fmt.Errorf("session not found: %w", err)
+	}
+	return session, nil
+}
+
+// RefreshTokenIfNeeded checks if token needs refresh and refreshes if necessary
+// Returns updated session if refreshed, original session otherwise
+func (s *AuthService) RefreshTokenIfNeeded(ctx context.Context, session *OAuthSession, threshold time.Duration) (*OAuthSession, error) {
+	// Check if token needs refresh
+	if time.Until(session.ExpiresAt) >= threshold {
+		// Token is still valid, no refresh needed
+		return session, nil
+	}
+
+	// Parse DPoP key
+	dpopKey, err := oauth.ParseJWKFromJSON([]byte(session.DPoPPrivateJWK))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse DPoP key: %w", err)
+	}
+
+	// Refresh token
+	tokenResp, err := s.oauthClient.RefreshTokenRequest(
+		ctx,
+		session.RefreshToken,
+		session.AuthServerIss,
+		session.DPoPAuthServerNonce,
+		dpopKey,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to refresh token: %w", err)
+	}
+
+	// Update session with new tokens
+	expiresAt := time.Now().Add(time.Duration(tokenResp.ExpiresIn) * time.Second)
+	if err := s.sessionStore.RefreshSession(session.DID, tokenResp.AccessToken, tokenResp.RefreshToken, expiresAt); err != nil {
+		return nil, fmt.Errorf("failed to update session: %w", err)
+	}
+
+	// Update nonce if provided (best effort - non-critical)
+	if tokenResp.DpopAuthserverNonce != "" {
+		session.DPoPAuthServerNonce = tokenResp.DpopAuthserverNonce
+		if err := s.sessionStore.UpdateAuthServerNonce(session.DID, tokenResp.DpopAuthserverNonce); err != nil {
+			// Log but don't fail - nonce will be updated on next request
+		}
+	}
+
+	// Return updated session
+	session.AccessToken = tokenResp.AccessToken
+	session.RefreshToken = tokenResp.RefreshToken
+	session.ExpiresAt = expiresAt
+
+	return session, nil
+}
+
+// CreateDPoPKey generates a new DPoP key for a session
+func (s *AuthService) CreateDPoPKey() (jwk.Key, error) {
+	return oauth.GenerateDPoPKey()
+}

internal/core/oauth/repository.go

···
+package oauth
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"time"
+)
+
+// PostgresSessionStore implements SessionStore using PostgreSQL
+type PostgresSessionStore struct {
+	db *sql.DB
+}
+
+// NewPostgresSessionStore creates a new PostgreSQL-backed session store
+func NewPostgresSessionStore(db *sql.DB) SessionStore {
+	return &PostgresSessionStore{db: db}
+}
+
+// SaveRequest stores a temporary OAuth request state
+func (s *PostgresSessionStore) SaveRequest(req *OAuthRequest) error {
+	query := `
+		INSERT INTO oauth_requests (
+			state, did, handle, pds_url, pkce_verifier,
+			dpop_private_jwk, dpop_authserver_nonce, auth_server_iss, return_url
+		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+	`
+
+	_, err := s.db.Exec(
+		query,
+		req.State,
+		req.DID,
+		req.Handle,
+		req.PDSURL,
+		req.PKCEVerifier,
+		req.DPoPPrivateJWK,
+		req.DPoPAuthServerNonce,
+		req.AuthServerIss,
+		req.ReturnURL,
+	)
+
+	if err != nil {
+		return fmt.Errorf("failed to save OAuth request: %w", err)
+	}
+
+	return nil
+}
+
+// GetRequestByState retrieves an OAuth request by state parameter
+func (s *PostgresSessionStore) GetRequestByState(state string) (*OAuthRequest, error) {
+	query := `
+		SELECT
+			state, did, handle, pds_url, pkce_verifier,
+			dpop_private_jwk, dpop_authserver_nonce, auth_server_iss,
+			COALESCE(return_url, ''), created_at
+		FROM oauth_requests
+		WHERE state = $1
+	`
+
+	var req OAuthRequest
+	err := s.db.QueryRow(query, state).Scan(
+		&req.State,
+		&req.DID,
+		&req.Handle,
+		&req.PDSURL,
+		&req.PKCEVerifier,
+		&req.DPoPPrivateJWK,
+		&req.DPoPAuthServerNonce,
+		&req.AuthServerIss,
+		&req.ReturnURL,
+		&req.CreatedAt,
+	)
+
+	if err == sql.ErrNoRows {
+		return nil, fmt.Errorf("OAuth request not found for state: %s", state)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to get OAuth request: %w", err)
+	}
+
+	return &req, nil
+}
+
+// GetAndDeleteRequest atomically retrieves and deletes an OAuth request to prevent replay attacks
+// This ensures the state parameter can only be used once
+func (s *PostgresSessionStore) GetAndDeleteRequest(state string) (*OAuthRequest, error) {
+	query := `
+		DELETE FROM oauth_requests
+		WHERE state = $1
+		RETURNING
+			state, did, handle, pds_url, pkce_verifier,
+			dpop_private_jwk, dpop_authserver_nonce, auth_server_iss,
+			COALESCE(return_url, ''), created_at
+	`
+
+	var req OAuthRequest
+	err := s.db.QueryRow(query, state).Scan(
+		&req.State,
+		&req.DID,
+		&req.Handle,
+		&req.PDSURL,
+		&req.PKCEVerifier,
+		&req.DPoPPrivateJWK,
+		&req.DPoPAuthServerNonce,
+		&req.AuthServerIss,
+		&req.ReturnURL,
+		&req.CreatedAt,
+	)
+
+	if err == sql.ErrNoRows {
+		return nil, fmt.Errorf("OAuth request not found or already used: %s", state)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to get and delete OAuth request: %w", err)
+	}
+
+	return &req, nil
+}
+
+// DeleteRequest removes an OAuth request (cleanup after callback)
+func (s *PostgresSessionStore) DeleteRequest(state string) error {
+	query := `DELETE FROM oauth_requests WHERE state = $1`
+
+	_, err := s.db.Exec(query, state)
+	if err != nil {
+		return fmt.Errorf("failed to delete OAuth request: %w", err)
+	}
+
+	return nil
+}
+
+// SaveSession stores a new OAuth session (upsert on DID)
+func (s *PostgresSessionStore) SaveSession(session *OAuthSession) error {
+	query := `
+		INSERT INTO oauth_sessions (
+			did, handle, pds_url, access_token, refresh_token,
+			dpop_private_jwk, dpop_authserver_nonce, dpop_pds_nonce,
+			auth_server_iss, expires_at
+		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+		ON CONFLICT (did) DO UPDATE SET
+			handle = EXCLUDED.handle,
+			pds_url = EXCLUDED.pds_url,
+			access_token = EXCLUDED.access_token,
+			refresh_token = EXCLUDED.refresh_token,
+			dpop_private_jwk = EXCLUDED.dpop_private_jwk,
+			dpop_authserver_nonce = EXCLUDED.dpop_authserver_nonce,
+			dpop_pds_nonce = EXCLUDED.dpop_pds_nonce,
+			auth_server_iss = EXCLUDED.auth_server_iss,
+			expires_at = EXCLUDED.expires_at,
+			updated_at = CURRENT_TIMESTAMP
+	`
+
+	_, err := s.db.Exec(
+		query,
+		session.DID,
+		session.Handle,
+		session.PDSURL,
+		session.AccessToken,
+		session.RefreshToken,
+		session.DPoPPrivateJWK,
+		session.DPoPAuthServerNonce,
+		session.DPoPPDSNonce,
+		session.AuthServerIss,
+		session.ExpiresAt,
+	)
+
+	if err != nil {
+		return fmt.Errorf("failed to save OAuth session: %w", err)
+	}
+
+	return nil
+}
+
+// GetSession retrieves an OAuth session by DID
+func (s *PostgresSessionStore) GetSession(did string) (*OAuthSession, error) {
+	query := `
+		SELECT
+			did, handle, pds_url, access_token, refresh_token,
+			dpop_private_jwk,
+			COALESCE(dpop_authserver_nonce, ''),
+			COALESCE(dpop_pds_nonce, ''),
+			auth_server_iss, expires_at, created_at, updated_at
+		FROM oauth_sessions
+		WHERE did = $1
+	`
+
+	var session OAuthSession
+	err := s.db.QueryRow(query, did).Scan(
+		&session.DID,
+		&session.Handle,
+		&session.PDSURL,
+		&session.AccessToken,
+		&session.RefreshToken,
+		&session.DPoPPrivateJWK,
+		&session.DPoPAuthServerNonce,
+		&session.DPoPPDSNonce,
+		&session.AuthServerIss,
+		&session.ExpiresAt,
+		&session.CreatedAt,
+		&session.UpdatedAt,
+	)
+
+	if err == sql.ErrNoRows {
+		return nil, fmt.Errorf("session not found for DID: %s", did)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("failed to get OAuth session: %w", err)
+	}
+
+	return &session, nil
+}
+
+// UpdateSession updates an existing OAuth session
+func (s *PostgresSessionStore) UpdateSession(session *OAuthSession) error {
+	query := `
+		UPDATE oauth_sessions SET
+			handle = $2,
+			pds_url = $3,
+			access_token = $4,
+			refresh_token = $5,
+			dpop_private_jwk = $6,
+			dpop_authserver_nonce = $7,
+			dpop_pds_nonce = $8,
+			auth_server_iss = $9,
+			expires_at = $10,
+			updated_at = CURRENT_TIMESTAMP
+		WHERE did = $1
+	`
+
+	result, err := s.db.Exec(
+		query,
+		session.DID,
+		session.Handle,
+		session.PDSURL,
+		session.AccessToken,
+		session.RefreshToken,
+		session.DPoPPrivateJWK,
+		session.DPoPAuthServerNonce,
+		session.DPoPPDSNonce,
+		session.AuthServerIss,
+		session.ExpiresAt,
+	)
+
+	if err != nil {
+		return fmt.Errorf("failed to update OAuth session: %w", err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to check rows affected: %w", err)
+	}
+	if rows == 0 {
+		return fmt.Errorf("session not found for DID: %s", session.DID)
+	}
+
+	return nil
+}
+
+// DeleteSession removes an OAuth session (logout)
+func (s *PostgresSessionStore) DeleteSession(did string) error {
+	query := `DELETE FROM oauth_sessions WHERE did = $1`
+
+	_, err := s.db.Exec(query, did)
+	if err != nil {
+		return fmt.Errorf("failed to delete OAuth session: %w", err)
+	}
+
+	return nil
+}
+
+// RefreshSession updates access and refresh tokens after a token refresh
+func (s *PostgresSessionStore) RefreshSession(did, newAccessToken, newRefreshToken string, expiresAt time.Time) error {
+	query := `
+		UPDATE oauth_sessions SET
+			access_token = $2,
+			refresh_token = $3,
+			expires_at = $4,
+			updated_at = CURRENT_TIMESTAMP
+		WHERE did = $1
+	`
+
+	result, err := s.db.Exec(query, did, newAccessToken, newRefreshToken, expiresAt)
+	if err != nil {
+		return fmt.Errorf("failed to refresh OAuth session: %w", err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to check rows affected: %w", err)
+	}
+	if rows == 0 {
+		return fmt.Errorf("session not found for DID: %s", did)
+	}
+
+	return nil
+}
+
+// UpdateAuthServerNonce updates the DPoP nonce for the auth server token endpoint
+func (s *PostgresSessionStore) UpdateAuthServerNonce(did, nonce string) error {
+	query := `
+		UPDATE oauth_sessions SET
+			dpop_authserver_nonce = $2,
+			updated_at = CURRENT_TIMESTAMP
+		WHERE did = $1
+	`
+
+	_, err := s.db.Exec(query, did, nonce)
+	if err != nil {
+		return fmt.Errorf("failed to update auth server nonce: %w", err)
+	}
+
+	return nil
+}
+
+// UpdatePDSNonce updates the DPoP nonce for PDS requests
+func (s *PostgresSessionStore) UpdatePDSNonce(did, nonce string) error {
+	query := `
+		UPDATE oauth_sessions SET
+			dpop_pds_nonce = $2,
+			updated_at = CURRENT_TIMESTAMP
+		WHERE did = $1
+	`
+
+	_, err := s.db.Exec(query, did, nonce)
+	if err != nil {
+		return fmt.Errorf("failed to update PDS nonce: %w", err)
+	}
+
+	return nil
+}
+
+// CleanupExpiredRequests removes OAuth requests older than 30 minutes
+// Should be called periodically (e.g., via cron job or background goroutine)
+func (s *PostgresSessionStore) CleanupExpiredRequests(ctx context.Context) error {
+	query := `DELETE FROM oauth_requests WHERE created_at < NOW() - INTERVAL '30 minutes'`
+
+	_, err := s.db.ExecContext(ctx, query)
+	if err != nil {
+		return fmt.Errorf("failed to cleanup expired requests: %w", err)
+	}
+
+	return nil
+}
+
+// CleanupExpiredSessions removes OAuth sessions that have been expired for > 7 days
+// Gives users time to refresh their tokens before permanent deletion
+func (s *PostgresSessionStore) CleanupExpiredSessions(ctx context.Context) error {
+	query := `DELETE FROM oauth_sessions WHERE expires_at < NOW() - INTERVAL '7 days'`
+
+	_, err := s.db.ExecContext(ctx, query)
+	if err != nil {
+		return fmt.Errorf("failed to cleanup expired sessions: %w", err)
+	}
+
+	return nil
+}

internal/core/oauth/session.go

···
+package oauth
+
+import (
+	"time"
+)
+
+// OAuthRequest represents a temporary OAuth authorization flow state
+// Stored during the redirect to auth server, deleted after callback
+type OAuthRequest struct {
+	State               string    `db:"state"`
+	DID                 string    `db:"did"`
+	Handle              string    `db:"handle"`
+	PDSURL              string    `db:"pds_url"`
+	PKCEVerifier        string    `db:"pkce_verifier"`
+	DPoPPrivateJWK      string    `db:"dpop_private_jwk"` // JSON-encoded JWK
+	DPoPAuthServerNonce string    `db:"dpop_authserver_nonce"`
+	AuthServerIss       string    `db:"auth_server_iss"`
+	ReturnURL           string    `db:"return_url"`
+	CreatedAt           time.Time `db:"created_at"`
+}
+
+// OAuthSession represents a long-lived authenticated user session
+// Stored after successful OAuth login, used for all authenticated requests
+type OAuthSession struct {
+	DID                 string    `db:"did"`
+	Handle              string    `db:"handle"`
+	PDSURL              string    `db:"pds_url"`
+	AccessToken         string    `db:"access_token"`
+	RefreshToken        string    `db:"refresh_token"`
+	DPoPPrivateJWK      string    `db:"dpop_private_jwk"` // JSON-encoded JWK
+	DPoPAuthServerNonce string    `db:"dpop_authserver_nonce"`
+	DPoPPDSNonce        string    `db:"dpop_pds_nonce"`
+	AuthServerIss       string    `db:"auth_server_iss"`
+	ExpiresAt           time.Time `db:"expires_at"`
+	CreatedAt           time.Time `db:"created_at"`
+	UpdatedAt           time.Time `db:"updated_at"`
+}
+
+// SessionStore defines the interface for OAuth session storage
+type SessionStore interface {
+	// OAuth flow state management
+	SaveRequest(req *OAuthRequest) error
+	GetRequestByState(state string) (*OAuthRequest, error)
+	GetAndDeleteRequest(state string) (*OAuthRequest, error) // Atomic get-and-delete for CSRF protection
+	DeleteRequest(state string) error
+
+	// User session management
+	SaveSession(session *OAuthSession) error
+	GetSession(did string) (*OAuthSession, error)
+	UpdateSession(session *OAuthSession) error
+	DeleteSession(did string) error
+
+	// Token refresh
+	RefreshSession(did, newAccessToken, newRefreshToken string, expiresAt time.Time) error
+
+	// Nonce updates (for DPoP)
+	UpdateAuthServerNonce(did, nonce string) error
+	UpdatePDSNonce(did, nonce string) error
+}

internal/db/migrations/003_create_oauth_tables.sql

···
+-- +goose Up
+-- Create OAuth tables for managing OAuth flow state and user sessions
+
+-- Temporary state during OAuth authorization flow (30 min TTL)
+-- This stores the intermediate state between redirect to auth server and callback
+CREATE TABLE oauth_requests (
+    id SERIAL PRIMARY KEY,
+    state TEXT UNIQUE NOT NULL,                     -- OAuth state parameter (CSRF protection)
+    did TEXT NOT NULL,                              -- User's DID (resolved from handle)
+    handle TEXT NOT NULL,                           -- User's handle (e.g., alice.bsky.social)
+    pds_url TEXT NOT NULL,                          -- User's PDS URL
+    pkce_verifier TEXT NOT NULL,                    -- PKCE code verifier
+    dpop_private_jwk JSONB NOT NULL,                -- DPoP private key (ES256) for this session
+    dpop_authserver_nonce TEXT,                     -- DPoP nonce from authorization server
+    auth_server_iss TEXT NOT NULL,                  -- Authorization server issuer
+    return_url TEXT,                                -- Optional return URL after login
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Long-lived user sessions (7 day TTL, auto-refreshed)
+-- This stores authenticated user sessions with OAuth tokens
+CREATE TABLE oauth_sessions (
+    id SERIAL PRIMARY KEY,
+    did TEXT UNIQUE NOT NULL,                       -- User's DID (primary identifier)
+    handle TEXT NOT NULL,                           -- User's handle (can change)
+    pds_url TEXT NOT NULL,                          -- User's PDS URL
+    access_token TEXT NOT NULL,                     -- OAuth access token (DPoP-bound)
+    refresh_token TEXT NOT NULL,                    -- OAuth refresh token
+    dpop_private_jwk JSONB NOT NULL,                -- DPoP private key for this session
+    dpop_authserver_nonce TEXT,                     -- DPoP nonce for auth server token endpoint
+    dpop_pds_nonce TEXT,                            -- DPoP nonce for PDS requests
+    auth_server_iss TEXT NOT NULL,                  -- Authorization server issuer
+    expires_at TIMESTAMP WITH TIME ZONE NOT NULL,   -- Token expiration time
+    created_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP WITH TIME ZONE DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Indexes for efficient lookups
+CREATE INDEX idx_oauth_requests_state ON oauth_requests(state);
+CREATE INDEX idx_oauth_requests_created_at ON oauth_requests(created_at);
+CREATE INDEX idx_oauth_sessions_did ON oauth_sessions(did);
+CREATE INDEX idx_oauth_sessions_expires_at ON oauth_sessions(expires_at);
+
+-- Function to update updated_at timestamp
+-- +goose StatementBegin
+CREATE OR REPLACE FUNCTION update_oauth_session_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = CURRENT_TIMESTAMP;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+-- +goose StatementEnd
+
+-- Trigger to automatically update updated_at
+CREATE TRIGGER oauth_sessions_updated_at
+    BEFORE UPDATE ON oauth_sessions
+    FOR EACH ROW
+    EXECUTE FUNCTION update_oauth_session_updated_at();
+
+-- +goose Down
+DROP TRIGGER IF EXISTS oauth_sessions_updated_at ON oauth_sessions;
+DROP FUNCTION IF EXISTS update_oauth_session_updated_at();
+DROP INDEX IF EXISTS idx_oauth_sessions_expires_at;
+DROP INDEX IF EXISTS idx_oauth_sessions_did;
+DROP INDEX IF EXISTS idx_oauth_requests_created_at;
+DROP INDEX IF EXISTS idx_oauth_requests_state;
+DROP TABLE IF EXISTS oauth_sessions;
+DROP TABLE IF EXISTS oauth_requests;

internal/db/migrations/004_add_oauth_indexes.sql

···
+-- Add performance indexes for OAuth tables
+-- Migration: 004_add_oauth_indexes.sql
+-- Created: 2025-10-06
+
+-- Index for querying sessions by expiration (used in token refresh logic)
+CREATE INDEX IF NOT EXISTS idx_oauth_sessions_did_expires
+ON oauth_sessions(did, expires_at);
+
+-- Partial index for active sessions (WHERE expires_at > NOW())
+-- This speeds up queries for non-expired sessions
+CREATE INDEX IF NOT EXISTS idx_oauth_sessions_active
+ON oauth_sessions(expires_at)
+WHERE expires_at > NOW();
+
+-- Index on oauth_requests expiration for faster cleanup
+-- (Already exists via migration 003, but documenting here for completeness)
+-- CREATE INDEX IF NOT EXISTS idx_oauth_requests_expires ON oauth_requests(expires_at);

tests/integration/oauth_test.go

···
+package integration
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"Coves/internal/api/handlers/oauth"
+	"Coves/internal/atproto/identity"
+	oauthCore "Coves/internal/core/oauth"
+
+	"github.com/lestrrat-go/jwx/v2/jwk"
+)
+
+// TestOAuthClientMetadata tests the /oauth/client-metadata.json endpoint
+func TestOAuthClientMetadata(t *testing.T) {
+	tests := []struct {
+		name              string
+		appviewURL        string
+		expectedClientID  string
+		expectedJWKSURI   string
+		expectedRedirect  string
+	}{
+		{
+			name:              "localhost development",
+			appviewURL:        "http://localhost:8081",
+			expectedClientID:  "http://localhost?redirect_uri=http://localhost:8081/oauth/callback&scope=atproto%20transition:generic",
+			expectedJWKSURI:   "", // No JWKS URI for localhost
+			expectedRedirect:  "http://localhost:8081/oauth/callback",
+		},
+		{
+			name:              "production HTTPS",
+			appviewURL:        "https://coves.social",
+			expectedClientID:  "https://coves.social/oauth/client-metadata.json",
+			expectedJWKSURI:   "https://coves.social/oauth/jwks.json",
+			expectedRedirect:  "https://coves.social/oauth/callback",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set environment
+			os.Setenv("APPVIEW_PUBLIC_URL", tt.appviewURL)
+			defer os.Unsetenv("APPVIEW_PUBLIC_URL")
+
+			// Create request
+			req := httptest.NewRequest("GET", "/oauth/client-metadata.json", nil)
+			w := httptest.NewRecorder()
+
+			// Call handler
+			oauth.HandleClientMetadata(w, req)
+
+			// Check status code
+			if w.Code != http.StatusOK {
+				t.Fatalf("expected status 200, got %d", w.Code)
+			}
+
+			// Parse response
+			var metadata oauth.ClientMetadata
+			if err := json.NewDecoder(w.Body).Decode(&metadata); err != nil {
+				t.Fatalf("failed to decode response: %v", err)
+			}
+
+			// Verify client ID
+			if metadata.ClientID != tt.expectedClientID {
+				t.Errorf("expected client_id %q, got %q", tt.expectedClientID, metadata.ClientID)
+			}
+
+			// Verify JWKS URI
+			if metadata.JwksURI != tt.expectedJWKSURI {
+				t.Errorf("expected jwks_uri %q, got %q", tt.expectedJWKSURI, metadata.JwksURI)
+			}
+
+			// Verify redirect URI
+			if len(metadata.RedirectURIs) != 1 || metadata.RedirectURIs[0] != tt.expectedRedirect {
+				t.Errorf("expected redirect_uris [%q], got %v", tt.expectedRedirect, metadata.RedirectURIs)
+			}
+
+			// Verify OAuth spec compliance
+			if metadata.ClientName != "Coves" {
+				t.Errorf("expected client_name 'Coves', got %q", metadata.ClientName)
+			}
+			if metadata.TokenEndpointAuthMethod != "private_key_jwt" {
+				t.Errorf("expected token_endpoint_auth_method 'private_key_jwt', got %q", metadata.TokenEndpointAuthMethod)
+			}
+			if metadata.TokenEndpointAuthSigningAlg != "ES256" {
+				t.Errorf("expected token_endpoint_auth_signing_alg 'ES256', got %q", metadata.TokenEndpointAuthSigningAlg)
+			}
+			if !metadata.DpopBoundAccessTokens {
+				t.Error("expected dpop_bound_access_tokens to be true")
+			}
+		})
+	}
+}
+
+// TestOAuthJWKS tests the /oauth/jwks.json endpoint
+func TestOAuthJWKS(t *testing.T) {
+	// Use the test JWK from .env.dev
+	testJWK := `{"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}`
+
+	tests := []struct {
+		name          string
+		envValue      string
+		expectSuccess bool
+	}{
+		{
+			name:          "valid plain JWK",
+			envValue:      testJWK,
+			expectSuccess: true,
+		},
+		{
+			name:          "missing JWK",
+			envValue:      "",
+			expectSuccess: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set environment
+			if tt.envValue != "" {
+				os.Setenv("OAUTH_PRIVATE_JWK", tt.envValue)
+				defer os.Unsetenv("OAUTH_PRIVATE_JWK")
+			}
+
+			// Create request
+			req := httptest.NewRequest("GET", "/oauth/jwks.json", nil)
+			w := httptest.NewRecorder()
+
+			// Call handler
+			oauth.HandleJWKS(w, req)
+
+			// Check status code
+			if tt.expectSuccess {
+				if w.Code != http.StatusOK {
+					t.Fatalf("expected status 200, got %d: %s", w.Code, w.Body.String())
+				}
+
+				// Parse response
+				var jwksResp struct {
+					Keys []map[string]interface{} `json:"keys"`
+				}
+				if err := json.NewDecoder(w.Body).Decode(&jwksResp); err != nil {
+					t.Fatalf("failed to decode JWKS: %v", err)
+				}
+
+				// Verify we got a public key
+				if len(jwksResp.Keys) != 1 {
+					t.Fatalf("expected 1 key, got %d", len(jwksResp.Keys))
+				}
+
+				key := jwksResp.Keys[0]
+				if key["kty"] != "EC" {
+					t.Errorf("expected kty 'EC', got %v", key["kty"])
+				}
+				if key["alg"] != "ES256" {
+					t.Errorf("expected alg 'ES256', got %v", key["alg"])
+				}
+				if key["kid"] != "oauth-client-key" {
+					t.Errorf("expected kid 'oauth-client-key', got %v", key["kid"])
+				}
+
+				// Verify private key is NOT exposed
+				if _, hasPrivate := key["d"]; hasPrivate {
+					t.Error("SECURITY: private key 'd' should not be in JWKS!")
+				}
+
+			} else {
+				if w.Code == http.StatusOK {
+					t.Fatalf("expected error status, got 200")
+				}
+			}
+		})
+	}
+}
+
+// TestOAuthLoginHandler tests the OAuth login initiation
+func TestOAuthLoginHandler(t *testing.T) {
+	// Skip if running in CI without database
+	if os.Getenv("SKIP_INTEGRATION") == "true" {
+		t.Skip("Skipping integration test")
+	}
+
+	// Setup test database
+	db := setupTestDB(t)
+	defer db.Close()
+
+	// Create session store
+	sessionStore := oauthCore.NewPostgresSessionStore(db)
+
+	// Create identity resolver (mock for now - we'll test with real PDS separately)
+	// For now, just test the handler structure and validation
+
+	tests := []struct {
+		name           string
+		requestBody    map[string]interface{}
+		envJWK         string
+		expectedStatus int
+	}{
+		{
+			name: "missing handle",
+			requestBody: map[string]interface{}{
+				"handle": "",
+			},
+			envJWK:         `{"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}`,
+			expectedStatus: http.StatusBadRequest,
+		},
+		{
+			name: "invalid handle format",
+			requestBody: map[string]interface{}{
+				"handle": "no-dots-invalid",
+			},
+			envJWK:         `{"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}`,
+			expectedStatus: http.StatusBadRequest,
+		},
+		{
+			name: "missing OAuth JWK",
+			requestBody: map[string]interface{}{
+				"handle": "alice.bsky.social",
+			},
+			envJWK:         "",
+			expectedStatus: http.StatusInternalServerError,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set environment
+			if tt.envJWK != "" {
+				os.Setenv("OAUTH_PRIVATE_JWK", tt.envJWK)
+				defer os.Unsetenv("OAUTH_PRIVATE_JWK")
+			} else {
+				os.Unsetenv("OAUTH_PRIVATE_JWK")
+			}
+
+			// Create mock identity resolver for validation tests
+			mockResolver := &mockIdentityResolver{}
+
+			// Create handler
+			handler := oauth.NewLoginHandler(mockResolver, sessionStore)
+
+			// Create request
+			bodyBytes, _ := json.Marshal(tt.requestBody)
+			req := httptest.NewRequest("POST", "/oauth/login", bytes.NewReader(bodyBytes))
+			req.Header.Set("Content-Type", "application/json")
+			w := httptest.NewRecorder()
+
+			// Call handler
+			handler.HandleLogin(w, req)
+
+			// Check status code
+			if w.Code != tt.expectedStatus {
+				t.Errorf("expected status %d, got %d: %s", tt.expectedStatus, w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
+// TestOAuthCallbackHandler tests the OAuth callback handling
+func TestOAuthCallbackHandler(t *testing.T) {
+	// Skip if running in CI without database
+	if os.Getenv("SKIP_INTEGRATION") == "true" {
+		t.Skip("Skipping integration test")
+	}
+
+	// Setup test database
+	db := setupTestDB(t)
+	defer db.Close()
+
+	// Create session store
+	sessionStore := oauthCore.NewPostgresSessionStore(db)
+
+	testJWK := `{"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}`
+	cookieSecret := "f1132c01b1a625a865c6c455a75ee793572cedb059cebe0c4c1ae4c446598f7d"
+
+	tests := []struct {
+		name           string
+		queryParams    map[string]string
+		expectedStatus int
+	}{
+		{
+			name: "missing code",
+			queryParams: map[string]string{
+				"state": "test-state",
+				"iss":   "https://bsky.social",
+			},
+			expectedStatus: http.StatusBadRequest,
+		},
+		{
+			name: "missing state",
+			queryParams: map[string]string{
+				"code": "test-code",
+				"iss":  "https://bsky.social",
+			},
+			expectedStatus: http.StatusBadRequest,
+		},
+		{
+			name: "missing issuer",
+			queryParams: map[string]string{
+				"code":  "test-code",
+				"state": "test-state",
+			},
+			expectedStatus: http.StatusBadRequest,
+		},
+		{
+			name: "OAuth error parameter",
+			queryParams: map[string]string{
+				"error":             "access_denied",
+				"error_description": "User denied access",
+			},
+			expectedStatus: http.StatusBadRequest,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set environment
+			os.Setenv("OAUTH_PRIVATE_JWK", testJWK)
+			defer os.Unsetenv("OAUTH_PRIVATE_JWK")
+
+			// Create handler
+			handler := oauth.NewCallbackHandler(sessionStore, cookieSecret)
+
+			// Build query string
+			req := httptest.NewRequest("GET", "/oauth/callback", nil)
+			q := req.URL.Query()
+			for k, v := range tt.queryParams {
+				q.Add(k, v)
+			}
+			req.URL.RawQuery = q.Encode()
+
+			w := httptest.NewRecorder()
+
+			// Call handler
+			handler.HandleCallback(w, req)
+
+			// Check status code
+			if w.Code != tt.expectedStatus {
+				t.Errorf("expected status %d, got %d: %s", tt.expectedStatus, w.Code, w.Body.String())
+			}
+		})
+	}
+}
+
+// mockIdentityResolver is a mock for testing
+type mockIdentityResolver struct{}
+
+func (m *mockIdentityResolver) Resolve(ctx context.Context, identifier string) (*identity.Identity, error) {
+	// Return a mock resolved identity
+	return &identity.Identity{
+		DID:    "did:plc:test123",
+		Handle: identifier,
+		PDSURL: "https://test.pds.example",
+	}, nil
+}
+
+func (m *mockIdentityResolver) ResolveHandle(ctx context.Context, handle string) (string, string, error) {
+	return "did:plc:test123", "https://test.pds.example", nil
+}
+
+func (m *mockIdentityResolver) ResolveDID(ctx context.Context, did string) (*identity.DIDDocument, error) {
+	return &identity.DIDDocument{
+		DID: did,
+		Service: []identity.Service{
+			{
+				ID:              "#atproto_pds",
+				Type:            "AtprotoPersonalDataServer",
+				ServiceEndpoint: "https://test.pds.example",
+			},
+		},
+	}, nil
+}
+
+func (m *mockIdentityResolver) Purge(ctx context.Context, identifier string) error {
+	return nil
+}
+
+// TestJWKParsing tests that we can parse JWKs correctly
+func TestJWKParsing(t *testing.T) {
+	testJWK := `{"alg":"ES256","crv":"P-256","d":"9tCMceYSgyZfO5KYOCm3rWEhXLqq2l4LjP7-PJtJKyk","kid":"oauth-client-key","kty":"EC","use":"sig","x":"EOYWEgZ2d-smTO6jh0f-9B7YSFYdlrvlryjuXTCrOjE","y":"_FR2jBcWNxoJl5cd1eq9sYtAs33No9AVtd42UyyWYi4"}`
+
+	// Parse the JWK
+	key, err := jwk.ParseKey([]byte(testJWK))
+	if err != nil {
+		t.Fatalf("failed to parse JWK: %v", err)
+	}
+
+	// Verify it's an EC key
+	if key.KeyType() != "EC" {
+		t.Errorf("expected key type 'EC', got %v", key.KeyType())
+	}
+
+	// Verify we can get the public key
+	pubKey, err := key.PublicKey()
+	if err != nil {
+		t.Fatalf("failed to get public key: %v", err)
+	}
+
+	// Verify public key doesn't have private component
+	pubKeyJSON, _ := json.Marshal(pubKey)
+	var pubKeyMap map[string]interface{}
+	json.Unmarshal(pubKeyJSON, &pubKeyMap)
+
+	if _, hasPrivate := pubKeyMap["d"]; hasPrivate {
+		t.Error("SECURITY: public key should not contain private 'd' component!")
+	}
+}