oauth refactor: revoke oauth if logout, eliminate code dup, add error mssgs, session managers

netlify.toml

···
 [[headers]]
   for = "/.well-known/*"
   [headers.values]
-    Access-Control-Allow-Origin = "*"
+    Access-Control-Allow-Origin = "*"

netlify/functions/batch-follow-users.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from "@netlify/functions";
-import {
-  NodeOAuthClient,
-  atprotoLoopbackClientMetadata,
-} from "@atproto/oauth-client-node";
-import { JoseKey } from "@atproto/jwk-jose";
-import { stateStore, sessionStore, userSessions } from "./oauth-stores-db";
-import { getOAuthConfig } from "./oauth-config";
-import { Agent } from "@atproto/api";
+import { SessionManager } from "./session-manager";
 import cookie from "cookie";
-
-function normalizePrivateKey(key: string): string {
-  if (!key.includes("\n") && key.includes("\\n")) {
-    return key.replace(/\\n/g, "\n");
-  }
-  return key;
-}
 
 export const handler: Handler = async (
   event: HandlerEvent,
···
       };
     }
 
-    // Get DID from session
-    const userSession = await userSessions.get(sessionId);
-    if (!userSession) {
-      return {
-        statusCode: 401,
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ error: "Invalid or expired session" }),
-      };
-    }
-
-    const config = getOAuthConfig();
-    const isDev = config.clientType === "loopback";
-
-    let client: NodeOAuthClient;
-
-    if (isDev) {
-      // Loopback
-      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
-      client = new NodeOAuthClient({
-        clientMetadata: clientMetadata,
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    } else {
-      // Production with private key
-      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
-      const privateKey = await JoseKey.fromImportable(
-        normalizedKey,
-        "main-key",
-      );
-
-      client = new NodeOAuthClient({
-        clientMetadata: {
-          client_id: config.clientId,
-          client_name: "ATlast",
-          client_uri: config.clientId.replace(
-            "/oauth-client-metadata.json",
-            "",
-          ),
-          redirect_uris: [config.redirectUri],
-          scope: "atproto transition:generic",
-          grant_types: ["authorization_code", "refresh_token"],
-          response_types: ["code"],
-          application_type: "web",
-          token_endpoint_auth_method: "private_key_jwt",
-          token_endpoint_auth_signing_alg: "ES256",
-          dpop_bound_access_tokens: true,
-          jwks_uri: config.jwksUri,
-        },
-        keyset: [privateKey],
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    }
-
-    // Restore OAuth session
-    const oauthSession = await client.restore(userSession.did);
-
-    // Create agent from OAuth session
-    const agent = new Agent(oauthSession);
+    // Get authenticated agent using SessionManager
+    const { agent, did: userDid } =
+      await SessionManager.getAgentForSession(sessionId);
 
     // Follow all users
     const results = [];
···
     for (const did of dids) {
       try {
         await agent.api.com.atproto.repo.createRecord({
-          repo: userSession.did,
+          repo: userDid,
           collection: "app.bsky.graph.follow",
           record: {
             $type: "app.bsky.graph.follow",
···
     };
   } catch (error) {
     console.error("Batch follow error:", error);
+
+    // Handle authentication errors specifically
+    if (error instanceof Error && error.message.includes("session")) {
+      return {
+        statusCode: 401,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          error: "Invalid or expired session",
+          details: error.message,
+        }),
+      };
+    }
+
     return {
       statusCode: 500,
       headers: { "Content-Type": "application/json" },

netlify/functions/batch-search-actors.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from "@netlify/functions";
-import {
-  NodeOAuthClient,
-  atprotoLoopbackClientMetadata,
-} from "@atproto/oauth-client-node";
-import { JoseKey } from "@atproto/jwk-jose";
-import { stateStore, sessionStore, userSessions } from "./oauth-stores-db";
-import { getOAuthConfig } from "./oauth-config";
-import { Agent } from "@atproto/api";
+import { SessionManager } from "./session-manager";
 import cookie from "cookie";
-
-function normalizePrivateKey(key: string): string {
-  if (!key.includes("\n") && key.includes("\\n")) {
-    return key.replace(/\\n/g, "\n");
-  }
-  return key;
-}
 
 export const handler: Handler = async (
   event: HandlerEvent,
···
       };
     }
 
-    // Get DID from session
-    const userSession = await userSessions.get(sessionId);
-    if (!userSession) {
-      return {
-        statusCode: 401,
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ error: "Invalid or expired session" }),
-      };
-    }
-
-    const config = getOAuthConfig();
-    const isDev = config.clientType === "loopback";
-
-    let client: NodeOAuthClient;
-
-    if (isDev) {
-      // Loopback
-      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
-      client = new NodeOAuthClient({
-        clientMetadata: clientMetadata,
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    } else {
-      // Production with private key
-      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY!);
-      const privateKey = await JoseKey.fromImportable(
-        normalizedKey,
-        "main-key",
-      );
-
-      client = new NodeOAuthClient({
-        clientMetadata: {
-          client_id: config.clientId,
-          client_name: "ATlast",
-          client_uri: config.clientId.replace(
-            "/oauth-client-metadata.json",
-            "",
-          ),
-          redirect_uris: [config.redirectUri],
-          scope: "atproto transition:generic",
-          grant_types: ["authorization_code", "refresh_token"],
-          response_types: ["code"],
-          application_type: "web",
-          token_endpoint_auth_method: "private_key_jwt",
-          token_endpoint_auth_signing_alg: "ES256",
-          dpop_bound_access_tokens: true,
-          jwks_uri: config.jwksUri,
-        },
-        keyset: [privateKey],
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    }
-
-    // Restore OAuth session
-    const oauthSession = await client.restore(userSession.did);
-
-    // Create agent from OAuth session
-    const agent = new Agent(oauthSession);
+    // Get authenticated agent using SessionManager
+    const { agent } = await SessionManager.getAgentForSession(sessionId);
 
     // Search all usernames in parallel
     const searchPromises = usernames.map(async (username) => {
···
     };
   } catch (error) {
     console.error("Batch search error:", error);
+
+    // Handle authentication errors specifically
+    if (error instanceof Error && error.message.includes("session")) {
+      return {
+        statusCode: 401,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          error: "Invalid or expired session",
+          details: error.message,
+        }),
+      };
+    }
+
     return {
       statusCode: 500,
       headers: { "Content-Type": "application/json" },

netlify/functions/client.ts

···
+import {
+  NodeOAuthClient,
+  atprotoLoopbackClientMetadata,
+} from "@atproto/oauth-client-node";
+import { JoseKey } from "@atproto/jwk-jose";
+import { stateStore, sessionStore } from "./oauth-stores-db";
+import { getOAuthConfig } from "./oauth-config";
+
+function normalizePrivateKey(key: string): string {
+  if (!key.includes("\n") && key.includes("\\n")) {
+    return key.replace(/\\n/g, "\n");
+  }
+  return key;
+}
+
+/**
+ * Creates and returns a configured OAuth client based on environment
+ * Centralizes the client creation logic used across all endpoints
+ */
+export async function createOAuthClient(): Promise<NodeOAuthClient> {
+  const config = getOAuthConfig();
+  const isDev = config.clientType === "loopback";
+
+  if (isDev) {
+    // Loopback mode for local development
+    console.log("[oauth-client] Creating loopback OAuth client");
+    const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
+
+    return new NodeOAuthClient({
+      clientMetadata: clientMetadata,
+      stateStore: stateStore as any,
+      sessionStore: sessionStore as any,
+    });
+  } else {
+    // Production mode with private key
+    console.log("[oauth-client] Creating production OAuth client");
+
+    if (!process.env.OAUTH_PRIVATE_KEY) {
+      throw new Error("OAUTH_PRIVATE_KEY is required for production");
+    }
+
+    const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
+    const privateKey = await JoseKey.fromImportable(normalizedKey, "main-key");
+
+    return new NodeOAuthClient({
+      clientMetadata: {
+        client_id: config.clientId,
+        client_name: "ATlast",
+        client_uri: config.clientId.replace("/oauth-client-metadata.json", ""),
+        redirect_uris: [config.redirectUri],
+        scope: "atproto transition:generic",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        application_type: "web",
+        token_endpoint_auth_method: "private_key_jwt",
+        token_endpoint_auth_signing_alg: "ES256",
+        dpop_bound_access_tokens: true,
+        jwks_uri: config.jwksUri,
+      },
+      keyset: [privateKey],
+      stateStore: stateStore as any,
+      sessionStore: sessionStore as any,
+    });
+  }
+}

netlify/functions/logout.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from "@netlify/functions";
-import { userSessions } from "./oauth-stores-db";
+import { SessionManager } from "./session-manager";
 import { getOAuthConfig } from "./oauth-config";
 import cookie from "cookie";
 
···
     console.log("[logout] Session ID from cookie:", sessionId);
 
     if (sessionId) {
-      // Get the DID before deleting
-      const userSession = await userSessions.get(sessionId);
-      const did = userSession?.did;
-
-      // Delete session from database
-      await userSessions.del(sessionId);
-      console.log("[logout] Deleted session from database");
+      // Use SessionManager to properly clean up both user and OAuth sessions
+      await SessionManager.deleteSession(sessionId);
+      console.log("[logout] Successfully deleted session:", sessionId);
     }
 
     // Clear the session cookie with matching flags from when it was set

netlify/functions/oauth-callback.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from "@netlify/functions";
-import {
-  NodeOAuthClient,
-  atprotoLoopbackClientMetadata,
-} from "@atproto/oauth-client-node";
-import { JoseKey } from "@atproto/jwk-jose";
-import { stateStore, sessionStore, userSessions } from "./oauth-stores-db";
+import { createOAuthClient } from "./client";
+import { userSessions } from "./oauth-stores-db";
 import { getOAuthConfig } from "./oauth-config";
 import * as crypto from "crypto";
 
-function normalizePrivateKey(key: string): string {
-  if (!key.includes("\n") && key.includes("\\n")) {
-    return key.replace(/\\n/g, "\n");
-  }
-  return key;
-}
-
 export const handler: Handler = async (
   event: HandlerEvent,
 ): Promise<HandlerResponse> => {
···
     const code = params.get("code");
     const state = params.get("state");
 
-    console.log("OAuth callback - Mode:", isDev ? "loopback" : "production");
-    console.log("OAuth callback - URL:", currentUrl);
+    console.log(
+      "[oauth-callback] Processing callback - Mode:",
+      isDev ? "loopback" : "production",
+    );
+    console.log("[oauth-callback] URL:", currentUrl);
 
     if (!code || !state) {
       return {
···
       };
     }
 
-    let client: NodeOAuthClient;
-
-    if (isDev) {
-      // LOOPBACK MODE: Use atprotoLoopbackClientMetadata and NO keyset
-      console.log("🔧 Loopback callback");
-
-      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
-
-      client = new NodeOAuthClient({
-        clientMetadata: clientMetadata,
-        // No keyset for loopback!
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    } else {
-      // PRODUCTION MODE
-      if (!process.env.OAUTH_PRIVATE_KEY) {
-        console.error("OAUTH_PRIVATE_KEY not set");
-        return {
-          statusCode: 302,
-          headers: {
-            Location: `${currentUrl}/?error=Server configuration error`,
-          },
-          body: "",
-        };
-      }
-
-      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
-      const privateKey = await JoseKey.fromImportable(
-        normalizedKey,
-        "main-key",
-      );
+    // Create OAuth client using shared helper
+    const client = await createOAuthClient();
 
-      const currentHost = process.env.DEPLOY_URL
-        ? new URL(process.env.DEPLOY_URL).host
-        : event.headers["x-forwarded-host"] || event.headers.host;
+    // Process the OAuth callback
+    const result = await client.callback(params);
 
-      currentUrl = `https://${currentHost}`;
-      const redirectUri = `${currentUrl}/.netlify/functions/oauth-callback`;
-      const jwksUri = `${currentUrl}/.netlify/functions/jwks`;
-      const clientId = `${currentUrl}/oauth-client-metadata.json`;
-
-      client = new NodeOAuthClient({
-        clientMetadata: {
-          client_id: clientId,
-          client_name: "ATlast",
-          client_uri: currentUrl,
-          redirect_uris: [redirectUri],
-          scope: "atproto transition:generic",
-          grant_types: ["authorization_code", "refresh_token"],
-          response_types: ["code"],
-          application_type: "web",
-          token_endpoint_auth_method: "private_key_jwt",
-          token_endpoint_auth_signing_alg: "ES256",
-          dpop_bound_access_tokens: true,
-          jwks_uri: jwksUri,
-        } as any,
-        keyset: [privateKey],
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    }
-
-    const result = await client.callback(params);
+    console.log(
+      "[oauth-callback] Successfully authenticated DID:",
+      result.session.did,
+    );
 
     // Store session
     const sessionId = crypto.randomUUID();
     const did = result.session.did;
     await userSessions.set(sessionId, { did });
+
+    console.log("[oauth-callback] Created user session:", sessionId);
 
     // Cookie flags - no Secure flag for loopback
     const cookieFlags = isDev

netlify/functions/oauth-start.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from "@netlify/functions";
-import {
-  NodeOAuthClient,
-  atprotoLoopbackClientMetadata,
-} from "@atproto/oauth-client-node";
-import { JoseKey } from "@atproto/jwk-jose";
-import { stateStore, sessionStore } from "./oauth-stores-db";
-import { getOAuthConfig } from "./oauth-config";
+import { createOAuthClient } from "./client";
 
 interface OAuthStartRequestBody {
   login_hint?: string;
   origin?: string;
 }
 
-function normalizePrivateKey(key: string): string {
-  if (!key.includes("\n") && key.includes("\\n")) {
-    return key.replace(/\\n/g, "\n");
-  }
-  return key;
-}
-
 export const handler: Handler = async (
   event: HandlerEvent,
 ): Promise<HandlerResponse> => {
···
       };
     }
 
-    const config = getOAuthConfig();
-    const isDev = config.clientType === "loopback";
-
-    let client: NodeOAuthClient;
-
-    if (isDev) {
-      // LOOPBACK MODE: Use atprotoLoopbackClientMetadata and NO keyset
-      console.log("🔧 Using loopback OAuth client for development");
-      console.log("Client ID:", config.clientId);
-
-      const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
-
-      client = new NodeOAuthClient({
-        clientMetadata: clientMetadata,
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    } else {
-      // PRODUCTION MODE: Full confidential client with keyset
-      console.log("🔐 Using confidential OAuth client for production");
-
-      if (!process.env.OAUTH_PRIVATE_KEY) {
-        throw new Error("OAUTH_PRIVATE_KEY required for production");
-      }
-
-      const normalizedKey = normalizePrivateKey(process.env.OAUTH_PRIVATE_KEY);
-      const privateKey = await JoseKey.fromImportable(
-        normalizedKey,
-        "main-key",
-      );
+    console.log("[oauth-start] Starting OAuth flow for:", loginHint);
 
-      const currentHost = process.env.DEPLOY_URL
-        ? new URL(process.env.DEPLOY_URL).host
-        : event.headers["x-forwarded-host"] || event.headers.host;
-
-      if (!currentHost) {
-        throw new Error("Missing host header");
-      }
-
-      const currentUrl = `https://${currentHost}`;
-      const redirectUri = `${currentUrl}/.netlify/functions/oauth-callback`;
-      const jwksUri = `${currentUrl}/.netlify/functions/jwks`;
-      const clientId = `${currentUrl}/oauth-client-metadata.json`;
-
-      client = new NodeOAuthClient({
-        clientMetadata: {
-          client_id: clientId,
-          client_name: "ATlast",
-          client_uri: currentUrl,
-          redirect_uris: [redirectUri],
-          scope: "atproto transition:generic",
-          grant_types: ["authorization_code", "refresh_token"],
-          response_types: ["code"],
-          application_type: "web",
-          token_endpoint_auth_method: "private_key_jwt",
-          token_endpoint_auth_signing_alg: "ES256",
-          dpop_bound_access_tokens: true,
-          jwks_uri: jwksUri,
-        } as any,
-        keyset: [privateKey],
-        stateStore: stateStore as any,
-        sessionStore: sessionStore as any,
-      });
-    }
+    // Create OAuth client using shared helper
+    const client = await createOAuthClient();
 
+    // Start the authorization flow
     const authUrl = await client.authorize(loginHint, {
       scope: "atproto transition:generic",
     });
+
+    console.log("[oauth-start] Generated auth URL for:", loginHint);
 
     return {
       statusCode: 200,

netlify/functions/session-manager.ts

···
+import { Agent } from "@atproto/api";
+import { createOAuthClient } from "./client";
+import { userSessions } from "./oauth-stores-db";
+import type { NodeOAuthClient } from "@atproto/oauth-client-node";
+
+/**
+ * Session Manager - Coordinates between user sessions and OAuth sessions
+ * Provides a clean interface for session operations across the application
+ */
+export class SessionManager {
+  /**
+   * Get an authenticated Agent for a given session ID
+   * Handles both user session lookup and OAuth session restoration
+   */
+  static async getAgentForSession(sessionId: string): Promise<{
+    agent: Agent;
+    did: string;
+    client: NodeOAuthClient;
+  }> {
+    console.log("[SessionManager] Getting agent for session:", sessionId);
+
+    // Get user session
+    const userSession = await userSessions.get(sessionId);
+    if (!userSession) {
+      throw new Error("Invalid or expired session");
+    }
+
+    const did = userSession.did;
+    console.log("[SessionManager] Found user session for DID:", did);
+
+    // Create OAuth client
+    const client = await createOAuthClient();
+
+    // Restore OAuth session
+    const oauthSession = await client.restore(did);
+    console.log("[SessionManager] Restored OAuth session for DID:", did);
+
+    // Create agent from OAuth session
+    const agent = new Agent(oauthSession);
+
+    return { agent, did, client };
+  }
+
+  /**
+   * Delete a session and clean up associated OAuth sessions
+   * Ensures both user_sessions and oauth_sessions are cleaned up
+   */
+  static async deleteSession(sessionId: string): Promise<void> {
+    console.log("[SessionManager] Deleting session:", sessionId);
+
+    // Get user session first
+    const userSession = await userSessions.get(sessionId);
+    if (!userSession) {
+      console.log("[SessionManager] Session not found:", sessionId);
+      return;
+    }
+
+    const did = userSession.did;
+
+    try {
+      // Create OAuth client and revoke the session
+      const client = await createOAuthClient();
+
+      // Try to revoke at the PDS (this also deletes from oauth_sessions)
+      await client.revoke(did);
+      console.log("[SessionManager] Revoked OAuth session for DID:", did);
+    } catch (error) {
+      // If revocation fails, the OAuth session might already be invalid
+      console.log("[SessionManager] Could not revoke OAuth session:", error);
+    }
+
+    // Delete user session
+    await userSessions.del(sessionId);
+    console.log("[SessionManager] Deleted user session:", sessionId);
+  }
+
+  /**
+   * Verify a session exists and is valid
+   */
+  static async verifySession(sessionId: string): Promise<boolean> {
+    const userSession = await userSessions.get(sessionId);
+    return userSession !== null;
+  }
+
+  /**
+   * Get the DID for a session without creating an agent
+   */
+  static async getDIDForSession(sessionId: string): Promise<string | null> {
+    const userSession = await userSessions.get(sessionId);
+    return userSession?.did || null;
+  }
+}

netlify/functions/session.ts

···
 import { Handler, HandlerEvent, HandlerResponse } from "@netlify/functions";
-import {
-  NodeOAuthClient,
-  atprotoLoopbackClientMetadata,
-} from "@atproto/oauth-client-node";
-import { JoseKey } from "@atproto/jwk-jose";
-import { stateStore, sessionStore, userSessions } from "./oauth-stores-db";
-import { getOAuthConfig } from "./oauth-config";
-import { Agent } from "@atproto/api";
+import { SessionManager } from "./session-manager";
 import cookie from "cookie";
-
-function normalizePrivateKey(key: string): string {
-  if (!key.includes("\n") && key.includes("\\n")) {
-    return key.replace(/\\n/g, "\n");
-  }
-  return key;
-}
 
 // In-memory cache for profile
 const profileCache = new Map<string, { data: any; timestamp: number }>();
···
       };
     }
 
-    // Check database for session
-    const userSession = await userSessions.get(sessionId);
-
-    if (!userSession) {
+    // Verify session exists
+    const isValid = await SessionManager.verifySession(sessionId);
+    if (!isValid) {
       return {
         statusCode: 401,
         headers: { "Content-Type": "application/json" },
···
       };
     }
 
-    const did = userSession.did;
+    // Get DID from session
+    const did = await SessionManager.getDIDForSession(sessionId);
+    if (!did) {
+      return {
+        statusCode: 401,
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ error: "Invalid session" }),
+      };
+    }
+
     const now = Date.now();
 
     // Check profile cache
···
 
     // Cache miss - fetch full profile
     try {
-      const config = getOAuthConfig();
-      const isDev = config.clientType === "loopback";
-
-      let client: NodeOAuthClient;
-
-      if (isDev) {
-        // Loopback
-        const clientMetadata = atprotoLoopbackClientMetadata(config.clientId);
-        client = new NodeOAuthClient({
-          clientMetadata: clientMetadata,
-          stateStore: stateStore as any,
-          sessionStore: sessionStore as any,
-        });
-      } else {
-        // Production with private key
-        const normalizedKey = normalizePrivateKey(
-          process.env.OAUTH_PRIVATE_KEY!,
-        );
-        const privateKey = await JoseKey.fromImportable(
-          normalizedKey,
-          "main-key",
-        );
-
-        client = new NodeOAuthClient({
-          clientMetadata: {
-            client_id: config.clientId,
-            client_name: "ATlast",
-            client_uri: config.clientId.replace(
-              "/oauth-client-metadata.json",
-              "",
-            ),
-            redirect_uris: [config.redirectUri],
-            scope: "atproto transition:generic",
-            grant_types: ["authorization_code", "refresh_token"],
-            response_types: ["code"],
-            application_type: "web",
-            token_endpoint_auth_method: "private_key_jwt",
-            token_endpoint_auth_signing_alg: "ES256",
-            dpop_bound_access_tokens: true,
-            jwks_uri: config.jwksUri,
-          },
-          keyset: [privateKey],
-          stateStore: stateStore as any,
-          sessionStore: sessionStore as any,
-        });
-      }
-
-      // Restore OAuth session
-      const oauthSession = await client.restore(did);
-
-      // Create agent from OAuth session
-      const agent = new Agent(oauthSession);
+      // Get authenticated agent using SessionManager
+      const { agent } = await SessionManager.getAgentForSession(sessionId);
 
       // Get profile
       const profile = await agent.getProfile({ actor: did });