feat: add PAR and post-login validation,

* improve auth interceptor's concurrent token refresh handling

.github/FUNDING.yml

···
+github: [desertthunder]
+ko_fi: desertthunder

lib/src/features/auth/application/auth_providers.dart

···
 
 @Riverpod(keepAlive: true)
 OAuthClient oauthClient(Ref ref) {
-  return OAuthClient(dio: Dio());
+  return OAuthClient(
+    dio: Dio(),
+    logger: ref.watch(loggerProvider('OAuthClient')),
+  );
 }
 
 @Riverpod(keepAlive: true)

lib/src/infrastructure/auth/auth_repository.dart

···
       );
 
       _logger.debug('Token exchange successful');
+      _validateScopes(tokenResponse.scope, OAuthClient.kScope);
+      _validateTokenClaims(tokenResponse.accessToken, did, pdsUrl);
 
       final session = Session(
         did: did,
···
         key: dpopKey,
         nonce: nonce,
       );
+
+      _validateScopes(tokenResponse.scope, OAuthClient.kScope);
+      _validateTokenClaims(tokenResponse.accessToken, session.did, session.pdsUrl);
 
       final newSession = session.copyWith(
         accessJwt: tokenResponse.accessToken,
···
       }
     } catch (e) {
       await _secureStorage.delete(key: _keyPendingSession);
+    }
+  }
+
+  /// Validates that granted scopes match requested scopes.
+  ///
+  /// Logs a warning if the server returned fewer scopes than requested.
+  void _validateScopes(String? grantedScope, String requestedScope) {
+    if (grantedScope == null || grantedScope.isEmpty) {
+      _logger.warning('No scopes granted by server. Requested: $requestedScope');
+      return;
+    }
+
+    final grantedScopes = grantedScope.split(' ').toSet();
+    final requestedScopes = requestedScope.split(' ').toSet();
+
+    final missingScopes = requestedScopes.difference(grantedScopes);
+    if (missingScopes.isNotEmpty) {
+      _logger.warning(
+        'Server granted reduced scopes. Requested: $requestedScope, Granted: $grantedScope, Missing: ${missingScopes.join(' ')}',
+      );
+    }
+  }
+
+  /// Validates JWT claims (sub and iss) match expected values.
+  ///
+  /// Decodes the access token and verifies:
+  /// - `sub` claim matches the expected DID
+  /// - `iss` claim matches the expected PDS URL
+  void _validateTokenClaims(String accessToken, String expectedDid, String expectedPdsUrl) {
+    try {
+      final jwt = JsonWebToken.unverified(accessToken);
+      final claims = jwt.claims;
+
+      final sub = claims.getTyped<String>('sub');
+      if (sub != expectedDid) {
+        _logger.warning(
+          'Token sub claim mismatch. Expected: $expectedDid, Got: $sub',
+        );
+      }
+
+      final iss = claims.getTyped<String>('iss');
+      if (iss != null && iss != expectedPdsUrl) {
+        _logger.warning(
+          'Token iss claim mismatch. Expected: $expectedPdsUrl, Got: $iss',
+        );
+      }
+    } catch (e) {
+      _logger.warning('Failed to validate token claims: $e');
     }
   }
 

lib/src/infrastructure/auth/oauth_client.dart

···
 import 'package:dio/dio.dart';
 import 'package:jose/jose.dart';
 
+import '../../core/utils/logger.dart';
 import 'dpop_utils.dart';
 import 'oauth_exceptions.dart';
 import 'server_metadata.dart';
 
 class OAuthClient {
-  OAuthClient({required Dio dio}) : _dio = dio;
+  OAuthClient({required Dio dio, Logger? logger})
+      : _dio = dio,
+        _logger = logger ?? const Logger('OAuthClient');
 
   final Dio _dio;
+  final Logger _logger;
 
   static const kClientId = 'https://lazurite.stormlightlabs.org/client-metadata.json';
   static const kRedirectUri = 'org.stormlightlabs.lazurite://callback';
···
       }
 
       final data = response.data!;
-      return data['request_uri'] as String;
+      final requestUri = data['request_uri'] as String?;
+
+      if (requestUri == null || requestUri.isEmpty) {
+        throw Exception('PAR response missing or empty request_uri');
+      }
+
+      // Validate request_uri format (should start with 'urn:ietf:params:oauth:request_uri:')
+      if (!requestUri.startsWith('urn:ietf:params:oauth:request_uri:')) {
+        throw Exception('Invalid request_uri format: $requestUri');
+      }
+
+      final expiresIn = data['expires_in'] as int?;
+      if (expiresIn == null) {
+        throw Exception('PAR response missing expires_in');
+      }
+
+      // Warn if expires_in is too short (less than 30 seconds)
+      if (expiresIn < 30) {
+        _logger.warning('PAR expires_in is very short: $expiresIn seconds');
+      }
+
+      return requestUri;
     } on DioException catch (e) {
       if (e.response?.data != null && e.response!.data is Map<String, dynamic>) {
         throw OAuthException.fromJson(e.response!.data as Map<String, dynamic>);
···
       );
     } on DioException catch (e) {
       if (e.response?.data != null && e.response!.data is Map<String, dynamic>) {
-        // TODO: Log error for debugging: $error
-        OAuthException.fromJson(e.response!.data as Map<String, dynamic>);
+        final error = OAuthException.fromJson(e.response!.data as Map<String, dynamic>);
+        _logger.warning('Token revocation failed', error);
       }
     }
   }

lib/src/infrastructure/network/interceptors/auth_interceptor.dart

···
+import 'dart:async';
+
 import 'package:dio/dio.dart';
 import 'package:jose/jose.dart';
 import 'package:lazurite/src/core/auth/session_model.dart';
+import 'package:lazurite/src/core/utils/logger.dart';
 import 'package:lazurite/src/infrastructure/auth/dpop_nonce_store.dart';
 import 'package:lazurite/src/infrastructure/auth/dpop_utils.dart';
 
···
     required this.getSession,
     required this.refreshSession,
     DPoPNonceStore? nonceStore,
-  }) : _nonceStore = nonceStore ?? DPoPNonceStore();
+    Logger? logger,
+  })  : _nonceStore = nonceStore ?? DPoPNonceStore(),
+        _logger = logger ?? const Logger('AuthInterceptor');
 
   /// Callback to get the current session.
   final SessionGetter getSession;
···
   /// Store for DPoP nonces.
   final DPoPNonceStore _nonceStore;
 
-  /// Lock to prevent concurrent refresh attempts.
-  bool _isRefreshing = false;
+  /// Logger instance.
+  final Logger _logger;
+
+  /// Completer used to queue requests during token refresh.
+  ///
+  /// When null, no refresh is in progress. When non-null, a refresh is in progress
+  /// and concurrent requests should wait for the completer to complete.
+  Completer<Session?>? _refreshCompleter;
 
   /// Key used to mark requests as requiring auth in options.extra.
   static const requiresAuthKey = 'requiresAuth';
+
+  /// Retries a request with a new session.
+  Future<void> _retryRequestWithSession(
+    DioException err,
+    Session newSession,
+    ErrorInterceptorHandler handler,
+  ) async {
+    final options = err.requestOptions;
+    options.headers['Authorization'] = 'Bearer ${newSession.accessJwt}';
+
+    try {
+      final dpopKey = JsonWebKey.fromJson(newSession.dpopKey);
+      final url = options.uri.toString();
+      final method = options.method;
+      final nonce = _nonceStore.get(newSession.pdsUrl);
+
+      final proof = await DPoPUtils.createProof(
+        url: url,
+        method: method,
+        privateKey: dpopKey,
+        accessToken: newSession.accessJwt,
+        nonce: nonce,
+      );
+
+      options.headers['DPoP'] = proof;
+    } catch (e) {
+      _logger.warning('Failed to create DPoP proof for retry', e);
+    }
+
+    options.extra['_authRetried'] = true;
+    final retryDio = Dio(
+      BaseOptions(
+        baseUrl: options.baseUrl,
+        connectTimeout: options.connectTimeout,
+        receiveTimeout: options.receiveTimeout,
+        sendTimeout: options.sendTimeout,
+      ),
+    );
+
+    try {
+      final response = await retryDio.fetch(options);
+      handler.resolve(response);
+    } catch (e) {
+      handler.next(err);
+    }
+  }
 
   @override
   Future<void> onRequest(RequestOptions options, RequestInterceptorHandler handler) async {
···
 
           options.headers['DPoP'] = proof;
         } catch (e) {
-          // TODO: Log error for debugging: $e
+          _logger.warning('Failed to create DPoP proof for request', e);
         }
       }
     }
···
       return handler.next(err);
     }
 
-    if (_isRefreshing) {
-      return handler.next(err);
-    }
     final hasRetried = err.requestOptions.extra['_authRetried'] == true;
     if (hasRetried) {
       return handler.next(err);
     }
 
-    _isRefreshing = true;
+    // If a refresh is already in progress, wait for it to complete
+    if (_refreshCompleter != null) {
+      try {
+        final newSession = await _refreshCompleter!.future;
+        if (newSession == null) {
+          return handler.next(err);
+        }
+
+        // Retry with the new session
+        return _retryRequestWithSession(err, newSession, handler);
+      } catch (e) {
+        return handler.next(err);
+      }
+    }
+
+    // Start a new refresh
+    _refreshCompleter = Completer<Session?>();
 
     try {
       final newSession = await refreshSession();
+      _refreshCompleter!.complete(newSession);
 
       if (newSession == null) {
         return handler.next(err);
       }
 
-      final options = err.requestOptions;
-      options.headers['Authorization'] = 'Bearer ${newSession.accessJwt}';
-
-      try {
-        final dpopKey = JsonWebKey.fromJson(newSession.dpopKey);
-        final url = options.uri.toString();
-        final method = options.method;
-        final nonce = _nonceStore.get(newSession.pdsUrl);
-
-        final proof = await DPoPUtils.createProof(
-          url: url,
-          method: method,
-          privateKey: dpopKey,
-          accessToken: newSession.accessJwt,
-          nonce: nonce,
-        );
-
-        options.headers['DPoP'] = proof;
-      } catch (e) {
-        // TODO: Log error for debugging: $e
-      }
-
-      options.extra['_authRetried'] = true;
-      final retryDio = Dio(
-        BaseOptions(
-          baseUrl: options.baseUrl,
-          connectTimeout: options.connectTimeout,
-          receiveTimeout: options.receiveTimeout,
-          sendTimeout: options.sendTimeout,
-        ),
-      );
-
-      final response = await retryDio.fetch(options);
-      return handler.resolve(response);
+      // Retry the original request
+      return _retryRequestWithSession(err, newSession, handler);
     } catch (e) {
+      _refreshCompleter!.completeError(e);
       return handler.next(err);
     } finally {
-      _isRefreshing = false;
+      _refreshCompleter = null;
     }
   }
 }

test/src/infrastructure/auth/auth_test.dart

···
     });
   });
 
+  group('OAuthClient', () {
+    late MockDio dio;
+    late MockLogger logger;
+    late OAuthClient client;
+
+    setUp(() {
+      dio = MockDio();
+      logger = MockLogger();
+      client = OAuthClient(dio: dio, logger: logger);
+    });
+
+    test('pushedAuthorizationRequest validates request_uri format', () async {
+      const metadata = ServerMetadata(
+        issuer: 'https://pds.com',
+        authorizationEndpoint: 'https://pds.com/oauth/authorize',
+        tokenEndpoint: 'https://pds.com/oauth/token',
+        pushedAuthorizationRequestEndpoint: 'https://pds.com/oauth/par',
+      );
+
+      when(() => dio.post<Map<String, dynamic>>(any(), options: any(named: 'options'), data: any(named: 'data')))
+          .thenAnswer(
+        (_) async => Response(
+          requestOptions: RequestOptions(path: ''),
+          statusCode: 201,
+          data: {
+            'request_uri': 'invalid-format',
+            'expires_in': 60,
+          },
+        ),
+      );
+
+      final key = await DPoPUtils.generateKey();
+
+      await expectLater(
+        () => client.pushedAuthorizationRequest(
+          metadata: metadata,
+          key: key,
+          state: 'state',
+          codeChallenge: 'challenge',
+        ),
+        throwsA(isA<Exception>().having(
+          (e) => e.toString(),
+          'message',
+          contains('Invalid request_uri format'),
+        )),
+      );
+    });
+
+    test('pushedAuthorizationRequest throws on missing expires_in', () async {
+      const metadata = ServerMetadata(
+        issuer: 'https://pds.com',
+        authorizationEndpoint: 'https://pds.com/oauth/authorize',
+        tokenEndpoint: 'https://pds.com/oauth/token',
+        pushedAuthorizationRequestEndpoint: 'https://pds.com/oauth/par',
+      );
+
+      when(() => dio.post<Map<String, dynamic>>(any(), options: any(named: 'options'), data: any(named: 'data')))
+          .thenAnswer(
+        (_) async => Response(
+          requestOptions: RequestOptions(path: ''),
+          statusCode: 201,
+          data: {
+            'request_uri': 'urn:ietf:params:oauth:request_uri:test',
+          },
+        ),
+      );
+
+      final key = await DPoPUtils.generateKey();
+
+      await expectLater(
+        () => client.pushedAuthorizationRequest(
+          metadata: metadata,
+          key: key,
+          state: 'state',
+          codeChallenge: 'challenge',
+        ),
+        throwsA(isA<Exception>().having(
+          (e) => e.toString(),
+          'message',
+          contains('PAR response missing expires_in'),
+        )),
+      );
+    });
+
+    test('pushedAuthorizationRequest logs warning for short expires_in', () async {
+      const metadata = ServerMetadata(
+        issuer: 'https://pds.com',
+        authorizationEndpoint: 'https://pds.com/oauth/authorize',
+        tokenEndpoint: 'https://pds.com/oauth/token',
+        pushedAuthorizationRequestEndpoint: 'https://pds.com/oauth/par',
+      );
+
+      when(() => dio.post<Map<String, dynamic>>(any(), options: any(named: 'options'), data: any(named: 'data')))
+          .thenAnswer(
+        (_) async => Response(
+          requestOptions: RequestOptions(path: ''),
+          statusCode: 201,
+          data: {
+            'request_uri': 'urn:ietf:params:oauth:request_uri:test',
+            'expires_in': 15, // Less than 30 seconds
+          },
+        ),
+      );
+      when(() => logger.warning(any())).thenReturn(null);
+
+      final key = await DPoPUtils.generateKey();
+
+      final requestUri = await client.pushedAuthorizationRequest(
+        metadata: metadata,
+        key: key,
+        state: 'state',
+        codeChallenge: 'challenge',
+      );
+
+      expect(requestUri, 'urn:ietf:params:oauth:request_uri:test');
+      verify(() => logger.warning(any(that: contains('very short')))).called(1);
+    });
+
+    test('pushedAuthorizationRequest succeeds with valid response', () async {
+      const metadata = ServerMetadata(
+        issuer: 'https://pds.com',
+        authorizationEndpoint: 'https://pds.com/oauth/authorize',
+        tokenEndpoint: 'https://pds.com/oauth/token',
+        pushedAuthorizationRequestEndpoint: 'https://pds.com/oauth/par',
+      );
+
+      when(() => dio.post<Map<String, dynamic>>(any(), options: any(named: 'options'), data: any(named: 'data')))
+          .thenAnswer(
+        (_) async => Response(
+          requestOptions: RequestOptions(path: ''),
+          statusCode: 201,
+          data: {
+            'request_uri': 'urn:ietf:params:oauth:request_uri:6esc_11ACC5bwc014ltc14eY',
+            'expires_in': 60,
+          },
+        ),
+      );
+
+      final key = await DPoPUtils.generateKey();
+
+      final requestUri = await client.pushedAuthorizationRequest(
+        metadata: metadata,
+        key: key,
+        state: 'state',
+        codeChallenge: 'challenge',
+      );
+
+      expect(requestUri, 'urn:ietf:params:oauth:request_uri:6esc_11ACC5bwc014ltc14eY');
+    });
+  });
+
   group('DPoPUtils', () {
     test('generateKey returns ES256 key', () async {
       final key = await DPoPUtils.generateKey();
···
         ),
       ).called(1);
       verify(() => sessionStorage.saveSession(any())).called(1);
+    });
+
+    test('completeLogin validates scopes and logs warning on mismatch', () async {
+      final uri = Uri.parse('org.stormlightlabs.lazurite://callback?code=abc&state=xyz');
+      final key = await DPoPUtils.generateKey();
+      final pendingState = {
+        'did': 'did:plc:user',
+        'handle': 'user.bsky.social',
+        'pdsUrl': 'https://pds.com',
+        'verifier': 'verifier123',
+        'state': 'xyz',
+        'dpopKey': key.toJson(),
+      };
+
+      const testMetadata = ServerMetadata(
+        issuer: 'https://pds.com',
+        authorizationEndpoint: 'https://pds.com/oauth/authorize',
+        tokenEndpoint: 'https://pds.com/oauth/token',
+      );
+
+      when(() => secureStorage.read(key: any(named: 'key')))
+          .thenAnswer((_) async => jsonEncode(pendingState));
+      when(() => secureStorage.delete(key: any(named: 'key'))).thenAnswer((_) async {});
+      when(() => metadataRepo.discover(any())).thenAnswer((_) async => testMetadata);
+      when(
+        () => oauthClient.exchangeCodeForToken(
+          metadata: any(named: 'metadata'),
+          code: any(named: 'code'),
+          codeVerifier: any(named: 'codeVerifier'),
+          key: any(named: 'key'),
+          nonce: any(named: 'nonce'),
+        ),
+      ).thenAnswer(
+        (_) async => TokenResponse(
+          accessToken: 'access',
+          tokenType: 'Bearer',
+          refreshToken: 'refresh',
+          scope: 'atproto', // Missing 'transition:generic'
+          expiresIn: 3600,
+        ),
+      );
+      when(() => sessionStorage.saveSession(any())).thenAnswer((_) async {});
+      when(() => logger.warning(any())).thenReturn(null);
+
+      await authRepo.completeLogin(uri);
+
+      // Verify warning was logged for reduced scopes
+      verify(() => logger.warning(any(that: contains('reduced scopes')))).called(1);
+    });
+
+    test('completeLogin validates JWT claims and logs warning on mismatch', () async {
+      final uri = Uri.parse('org.stormlightlabs.lazurite://callback?code=abc&state=xyz');
+      final key = await DPoPUtils.generateKey();
+
+      // Create a JWT with mismatched sub claim
+      final jwtKey = await DPoPUtils.generateKey();
+      final builder = JsonWebSignatureBuilder()
+        ..jsonContent = {
+          'sub': 'did:plc:wrong-user',
+          'iss': 'https://pds.com',
+          'iat': DateTime.now().millisecondsSinceEpoch ~/ 1000,
+          'exp': DateTime.now().add(const Duration(hours: 1)).millisecondsSinceEpoch ~/ 1000,
+        }
+        ..addRecipient(jwtKey, algorithm: 'ES256');
+      final jws = builder.build();
+      final accessToken = jws.toCompactSerialization();
+
+      final pendingState = {
+        'did': 'did:plc:user',
+        'handle': 'user.bsky.social',
+        'pdsUrl': 'https://pds.com',
+        'verifier': 'verifier123',
+        'state': 'xyz',
+        'dpopKey': key.toJson(),
+      };
+
+      const testMetadata = ServerMetadata(
+        issuer: 'https://pds.com',
+        authorizationEndpoint: 'https://pds.com/oauth/authorize',
+        tokenEndpoint: 'https://pds.com/oauth/token',
+      );
+
+      when(() => secureStorage.read(key: any(named: 'key')))
+          .thenAnswer((_) async => jsonEncode(pendingState));
+      when(() => secureStorage.delete(key: any(named: 'key'))).thenAnswer((_) async {});
+      when(() => metadataRepo.discover(any())).thenAnswer((_) async => testMetadata);
+      when(
+        () => oauthClient.exchangeCodeForToken(
+          metadata: any(named: 'metadata'),
+          code: any(named: 'code'),
+          codeVerifier: any(named: 'codeVerifier'),
+          key: any(named: 'key'),
+          nonce: any(named: 'nonce'),
+        ),
+      ).thenAnswer(
+        (_) async => TokenResponse(
+          accessToken: accessToken,
+          tokenType: 'Bearer',
+          refreshToken: 'refresh',
+          scope: 'atproto transition:generic',
+          expiresIn: 3600,
+        ),
+      );
+      when(() => sessionStorage.saveSession(any())).thenAnswer((_) async {});
+      when(() => logger.warning(any(), any())).thenReturn(null);
+
+      await authRepo.completeLogin(uri);
+
+      // Verify warning was logged for sub claim mismatch
+      verify(() => logger.warning(any(that: contains('sub claim mismatch')), any())).called(1);
     });
 
     test('loginWithAppPassword failure', () async {

test/src/infrastructure/network/interceptors/auth_interceptor_test.dart

···
         expect(refreshCount, lessThanOrEqualTo(1));
       });
 
+      test('queues concurrent 401 requests and retries after single refresh', () async {
+        final dio = Dio(BaseOptions(baseUrl: 'https://test.api'));
+        final adapter = DioAdapter(dio: dio);
+
+        var refreshCount = 0;
+
+        dio.interceptors.add(
+          AuthInterceptor(
+            getSession: () async => _createTestSession(),
+            refreshSession: () async {
+              refreshCount++;
+              // Simulate slow refresh
+              await Future.delayed(const Duration(milliseconds: 100));
+              return _createTestSession(accessJwt: 'refreshed-token');
+            },
+          ),
+        );
+
+        adapter.onGet('/test1', (server) => server.reply(401, {'error': 'Unauthorized'}));
+        adapter.onGet('/test2', (server) => server.reply(401, {'error': 'Unauthorized'}));
+
+        // Fire two concurrent requests that will both get 401
+        final futures = [
+          dio.get('/test1', options: Options(extra: {AuthInterceptor.requiresAuthKey: true})),
+          dio.get('/test2', options: Options(extra: {AuthInterceptor.requiresAuthKey: true})),
+        ];
+
+        try {
+          await Future.wait(futures);
+        } catch (e) {
+          // Expected to fail since mock adapter can't handle retries properly
+        }
+
+        // Both requests should trigger only ONE refresh due to queueing
+        expect(refreshCount, equals(1));
+      });
+
       test('does not attempt refresh for non-auth requests', () async {
         final dio = Dio(BaseOptions(baseUrl: 'https://test.api'));
         final adapter = DioAdapter(dio: dio);