feat: implement token mgmt with DPoP and db persistence.

Cargo.lock

···
 dependencies = [
  "serde",
  "serde_json",
- "thiserror",
+ "thiserror 2.0.17",
 ]
 
 [[package]]
···
  "reqwest 0.12.28",
  "serde",
  "serde_json",
+ "serde_qs",
  "sha2",
  "tokio",
  "tokio-postgres",
···
 ]
 
 [[package]]
+name = "serde_qs"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd34f36fe4c5ba9654417139a9b3a20d2e1de6012ee678ad14d240c22c78d8d6"
+dependencies = [
+ "percent-encoding",
+ "serde",
+ "thiserror 1.0.69",
+]
+
+[[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 
 [[package]]
 name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
 version = "2.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f63587ca0f12b72a0600bcba1d40081f830876000bb46dd2337a3051618f4fc8"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.17",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.111",
 ]
 
 [[package]]

crates/server/Cargo.toml

···
 reqwest = { version = "0.12.28", features = ["json"] }
 serde = "1.0.228"
 serde_json = "1.0.148"
+serde_qs = "0.13"
 sha2 = "0.10"
 tokio = { version = "1.48.0", features = ["full"] }
 urlencoding = "2.1"

crates/server/src/api/mod.rs

···
 pub mod deck;
 pub mod importer;
 pub mod note;
+pub mod oauth;

crates/server/src/api/oauth.rs

···
+//! OAuth API endpoints for AT Protocol authentication.
+//!
+//! Provides endpoints for:
+//! - Starting the OAuth authorization flow
+//! - Handling OAuth callbacks
+//! - Refreshing tokens
+
+use crate::db::DbPool;
+use crate::oauth::flow::{OAuthFlow, SessionStore, generate_state, new_session_store};
+use crate::repository::oauth::{DbOAuthRepository, OAuthRepository, StoreTokensRequest};
+use axum::{
+    Json,
+    extract::{Query, State},
+    http::StatusCode,
+    response::{IntoResponse, Redirect},
+};
+use chrono::{Duration, Utc};
+use serde::{Deserialize, Serialize};
+use serde_json::json;
+use std::sync::Arc;
+
+/// Shared OAuth state with database repository.
+pub struct OAuthState {
+    pub flow: OAuthFlow,
+    pub sessions: SessionStore,
+    pub repo: Arc<dyn OAuthRepository>,
+}
+
+impl OAuthState {
+    /// Create OAuth state with database connection.
+    pub fn with_pool(pool: DbPool) -> Self {
+        Self { flow: OAuthFlow::new(), sessions: new_session_store(), repo: Arc::new(DbOAuthRepository::new(pool)) }
+    }
+
+    /// Create OAuth state without database (for testing).
+    pub fn new() -> Self {
+        Self { flow: OAuthFlow::new(), sessions: new_session_store(), repo: Arc::new(MockOAuthRepository) }
+    }
+}
+
+impl Default for OAuthState {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+/// Mock repository for testing.
+struct MockOAuthRepository;
+
+#[async_trait::async_trait]
+impl OAuthRepository for MockOAuthRepository {
+    async fn store_tokens(&self, _req: StoreTokensRequest<'_>) -> Result<(), crate::repository::oauth::OAuthRepoError> {
+        Ok(())
+    }
+
+    async fn get_tokens(
+        &self, did: &str,
+    ) -> Result<crate::repository::oauth::StoredToken, crate::repository::oauth::OAuthRepoError> {
+        Err(crate::repository::oauth::OAuthRepoError::NotFound(did.to_string()))
+    }
+
+    async fn update_tokens(
+        &self, _did: &str, _access_token: &str, _refresh_token: Option<&str>,
+        _expires_at: Option<chrono::DateTime<Utc>>,
+    ) -> Result<(), crate::repository::oauth::OAuthRepoError> {
+        Ok(())
+    }
+
+    async fn delete_tokens(&self, _did: &str) -> Result<(), crate::repository::oauth::OAuthRepoError> {
+        Ok(())
+    }
+}
+
+/// Request to start OAuth authorization.
+#[derive(Deserialize)]
+pub struct AuthorizeRequest {
+    /// Handle or DID to authenticate
+    pub handle: String,
+}
+
+/// Response from starting authorization.
+#[derive(Serialize)]
+pub struct AuthorizeResponse {
+    /// URL to redirect the user to
+    pub authorization_url: String,
+    /// State parameter (for CSRF protection)
+    pub state: String,
+}
+
+/// Query parameters from OAuth callback.
+#[derive(Deserialize)]
+pub struct CallbackQuery {
+    pub code: String,
+    pub state: String,
+    #[serde(default)]
+    pub error: Option<String>,
+    #[serde(default)]
+    pub error_description: Option<String>,
+}
+
+/// Start the OAuth authorization flow.
+///
+/// POST /api/oauth/authorize
+/// Body: { "handle": "alice.bsky.social" }
+pub async fn authorize(
+    State(oauth): State<Arc<OAuthState>>, Json(payload): Json<AuthorizeRequest>,
+) -> impl IntoResponse {
+    let state = generate_state();
+
+    match oauth
+        .flow
+        .start_authorization(&payload.handle, &state, &oauth.sessions)
+        .await
+    {
+        Ok(auth_url) => (
+            StatusCode::OK,
+            Json(AuthorizeResponse { authorization_url: auth_url, state }),
+        )
+            .into_response(),
+        Err(e) => (StatusCode::BAD_REQUEST, Json(json!({ "error": e.to_string() }))).into_response(),
+    }
+}
+
+/// Handle OAuth callback from authorization server.
+///
+/// GET /api/oauth/callback?code=...&state=...
+pub async fn callback(State(oauth): State<Arc<OAuthState>>, Query(params): Query<CallbackQuery>) -> impl IntoResponse {
+    if let Some(error) = params.error {
+        let description = params.error_description.unwrap_or_default();
+        return Redirect::to(&format!(
+            "/login?error={}&description={}",
+            urlencoding::encode(&error),
+            urlencoding::encode(&description)
+        ))
+        .into_response();
+    }
+
+    let session = {
+        let sessions = oauth.sessions.read().unwrap();
+        sessions.get(&params.state).cloned()
+    };
+
+    let session = match session {
+        Some(s) => s,
+        None => {
+            return Redirect::to("/login?error=session_not_found").into_response();
+        }
+    };
+
+    match oauth
+        .flow
+        .exchange_code(&params.code, &params.state, &oauth.sessions)
+        .await
+    {
+        Ok(tokens) => {
+            let did = session.did.unwrap_or_default();
+            let pds_url = session.pds_url.unwrap_or_default();
+            let expires_at = tokens
+                .expires_in
+                .map(|secs| Utc::now() + Duration::seconds(secs as i64));
+
+            if let Err(e) = oauth
+                .repo
+                .store_tokens(StoreTokensRequest {
+                    did: &did,
+                    pds_url: &pds_url,
+                    access_token: &tokens.access_token,
+                    refresh_token: tokens.refresh_token.as_deref(),
+                    token_type: &tokens.token_type,
+                    expires_at,
+                    dpop_keypair: &session.dpop_keypair,
+                })
+                .await
+            {
+                tracing::error!("Failed to store tokens: {}", e);
+                return Redirect::to(&format!("/login?error={}", urlencoding::encode("token_storage_failed")))
+                    .into_response();
+            }
+
+            Redirect::to(&format!("/login/success?did={}", urlencoding::encode(&did))).into_response()
+        }
+        Err(e) => Redirect::to(&format!("/login?error={}", urlencoding::encode(&e.to_string()))).into_response(),
+    }
+}
+
+/// Request to refresh tokens.
+#[derive(Deserialize)]
+pub struct RefreshRequest {
+    pub did: String,
+}
+
+/// Response from token refresh.
+#[derive(Serialize)]
+pub struct RefreshResponse {
+    pub success: bool,
+    pub expires_at: Option<String>,
+}
+
+/// Refresh an access token.
+///
+/// POST /api/oauth/refresh
+/// Body: { "did": "did:plc:..." }
+pub async fn refresh(State(oauth): State<Arc<OAuthState>>, Json(payload): Json<RefreshRequest>) -> impl IntoResponse {
+    // Get stored tokens from database
+    let stored = match oauth.repo.get_tokens(&payload.did).await {
+        Ok(t) => t,
+        Err(e) => {
+            return (StatusCode::NOT_FOUND, Json(json!({ "error": e.to_string() }))).into_response();
+        }
+    };
+
+    // Reconstruct DPoP keypair
+    let dpop_keypair = match stored.dpop_keypair() {
+        Some(kp) => kp,
+        None => {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(json!({ "error": "Invalid stored keypair" })),
+            )
+                .into_response();
+        }
+    };
+
+    // Get refresh token
+    let refresh_token = match &stored.refresh_token {
+        Some(rt) => rt.clone(),
+        None => {
+            return (
+                StatusCode::BAD_REQUEST,
+                Json(json!({ "error": "No refresh token available" })),
+            )
+                .into_response();
+        }
+    };
+
+    // Refresh tokens via OAuth flow
+    match oauth
+        .flow
+        .refresh_token(&refresh_token, &stored.pds_url, &dpop_keypair)
+        .await
+    {
+        Ok(new_tokens) => {
+            let expires_at = new_tokens
+                .expires_in
+                .map(|secs| Utc::now() + Duration::seconds(secs as i64));
+
+            if let Err(e) = oauth
+                .repo
+                .update_tokens(
+                    &payload.did,
+                    &new_tokens.access_token,
+                    new_tokens.refresh_token.as_deref(),
+                    expires_at,
+                )
+                .await
+            {
+                tracing::error!("Failed to update tokens: {}", e);
+                return (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    Json(json!({ "error": "Failed to update tokens" })),
+                )
+                    .into_response();
+            }
+
+            (
+                StatusCode::OK,
+                Json(RefreshResponse { success: true, expires_at: expires_at.map(|dt| dt.to_rfc3339()) }),
+            )
+                .into_response()
+        }
+        Err(e) => (StatusCode::BAD_REQUEST, Json(json!({ "error": e.to_string() }))).into_response(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_oauth_state_creation() {
+        let state = OAuthState::new();
+        assert!(state.sessions.read().unwrap().is_empty());
+    }
+
+    #[test]
+    fn test_authorize_request_deserialization() {
+        let json = r#"{"handle": "alice.bsky.social"}"#;
+        let request: AuthorizeRequest = serde_json::from_str(json).unwrap();
+        assert_eq!(request.handle, "alice.bsky.social");
+    }
+
+    #[test]
+    fn test_authorize_response_serialization() {
+        let response = AuthorizeResponse {
+            authorization_url: "https://example.com/oauth".to_string(),
+            state: "abc123".to_string(),
+        };
+        let json = serde_json::to_string(&response).unwrap();
+        assert!(json.contains("authorization_url"));
+        assert!(json.contains("state"));
+    }
+
+    #[test]
+    fn test_callback_query_deserialization() {
+        let query = "code=abc123&state=xyz789";
+        let parsed: CallbackQuery = serde_qs::from_str(query).unwrap();
+        assert_eq!(parsed.code, "abc123");
+        assert_eq!(parsed.state, "xyz789");
+        assert!(parsed.error.is_none());
+    }
+
+    #[test]
+    fn test_callback_query_with_error() {
+        let query = "code=&state=xyz789&error=access_denied&error_description=User+denied";
+        let parsed: CallbackQuery = serde_qs::from_str(query).unwrap();
+        assert_eq!(parsed.error, Some("access_denied".to_string()));
+    }
+
+    #[test]
+    fn test_refresh_request_deserialization() {
+        let json = r#"{"did": "did:plc:abc123"}"#;
+        let request: RefreshRequest = serde_json::from_str(json).unwrap();
+        assert_eq!(request.did, "did:plc:abc123");
+    }
+}

crates/server/src/lib.rs

···
     tracing::info!("Database connection pool created");
 
     let state = state::AppState::new(pool);
+    let oauth_state = std::sync::Arc::new(api::oauth::OAuthState::new());
 
     let auth_routes = Router::new()
         .route("/me", get(api::auth::me))
···
         .route("/notes/{id}", get(api::note::get_note))
         .layer(axum_middleware::from_fn(middleware::auth::optional_auth_middleware));
 
+    let oauth_routes = Router::new()
+        .route("/authorize", post(api::oauth::authorize))
+        .route("/callback", get(api::oauth::callback))
+        .route("/refresh", post(api::oauth::refresh))
+        .with_state(oauth_state.clone());
+
     let app = Router::new()
         .route("/health", get(health_check))
+        .route(
+            "/.well-known/oauth-client-metadata",
+            get(oauth::client_metadata::client_metadata_handler),
+        )
         .route("/api/auth/login", post(api::auth::login))
         .route("/api/import/article", post(api::importer::import_article))
+        .nest("/api/oauth", oauth_routes)
         .nest("/api", optional_auth_routes)
         .nest("/api", auth_routes)
         .layer(TraceLayer::new_for_http())

crates/server/src/oauth/dpop.rs

···
 
         format!("{}.{}.{}", header_b64, payload_b64, signature_b64)
     }
+
+    /// Create a DpopKeypair from an existing SigningKey.
+    pub fn from_signing_key(signing_key: SigningKey) -> Self {
+        Self { signing_key }
+    }
+
+    /// Get the private key bytes for storage.
+    pub fn private_key_bytes(&self) -> Vec<u8> {
+        self.signing_key.to_bytes().to_vec()
+    }
 }
 
 /// Generate a unique JWT ID.

crates/server/src/repository/mod.rs

···
 pub mod card;
 pub mod note;
+pub mod oauth;

crates/server/src/repository/oauth.rs

···
+//! OAuth token repository for database storage.
+//!
+//! Handles storage and retrieval of OAuth tokens and sessions.
+
+use crate::db::DbPool;
+use crate::oauth::dpop::DpopKeypair;
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use ed25519_dalek::SigningKey;
+use serde::{Deserialize, Serialize};
+
+/// Stored OAuth token record.
+#[derive(Clone, Serialize, Deserialize)]
+pub struct StoredToken {
+    pub did: String,
+    pub pds_url: String,
+    pub access_token: String,
+    pub refresh_token: Option<String>,
+    pub token_type: String,
+    pub expires_at: Option<DateTime<Utc>>,
+    pub dpop_private_key: Vec<u8>,
+    pub created_at: DateTime<Utc>,
+    pub updated_at: DateTime<Utc>,
+}
+
+impl StoredToken {
+    /// Reconstruct the DPoP keypair from stored bytes.
+    pub fn dpop_keypair(&self) -> Option<DpopKeypair> {
+        if self.dpop_private_key.len() != 32 {
+            return None;
+        }
+        let mut key_bytes = [0u8; 32];
+        key_bytes.copy_from_slice(&self.dpop_private_key);
+        let signing_key = SigningKey::from_bytes(&key_bytes);
+        Some(DpopKeypair::from_signing_key(signing_key))
+    }
+}
+
+/// Error type for OAuth repository operations.
+#[derive(Debug, Clone)]
+pub enum OAuthRepoError {
+    DatabaseError(String),
+    NotFound(String),
+    SerializationError(String),
+}
+
+impl std::fmt::Display for OAuthRepoError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            OAuthRepoError::DatabaseError(e) => write!(f, "Database error: {}", e),
+            OAuthRepoError::NotFound(e) => write!(f, "Not found: {}", e),
+            OAuthRepoError::SerializationError(e) => write!(f, "Serialization error: {}", e),
+        }
+    }
+}
+
+impl std::error::Error for OAuthRepoError {}
+
+/// Request to store OAuth tokens.
+pub struct StoreTokensRequest<'a> {
+    pub did: &'a str,
+    pub pds_url: &'a str,
+    pub access_token: &'a str,
+    pub refresh_token: Option<&'a str>,
+    pub token_type: &'a str,
+    pub expires_at: Option<DateTime<Utc>>,
+    pub dpop_keypair: &'a DpopKeypair,
+}
+
+/// Repository trait for OAuth token operations.
+#[async_trait]
+pub trait OAuthRepository: Send + Sync {
+    /// Store OAuth tokens for a user.
+    async fn store_tokens(&self, req: StoreTokensRequest<'_>) -> Result<(), OAuthRepoError>;
+
+    /// Get stored tokens for a user.
+    async fn get_tokens(&self, did: &str) -> Result<StoredToken, OAuthRepoError>;
+
+    /// Update tokens after refresh.
+    async fn update_tokens(
+        &self, did: &str, access_token: &str, refresh_token: Option<&str>, expires_at: Option<DateTime<Utc>>,
+    ) -> Result<(), OAuthRepoError>;
+
+    /// Delete tokens for a user (logout).
+    async fn delete_tokens(&self, did: &str) -> Result<(), OAuthRepoError>;
+}
+
+/// Database-backed OAuth repository.
+pub struct DbOAuthRepository {
+    pool: DbPool,
+}
+
+impl DbOAuthRepository {
+    pub fn new(pool: DbPool) -> Self {
+        Self { pool }
+    }
+}
+
+#[async_trait]
+impl OAuthRepository for DbOAuthRepository {
+    async fn store_tokens(&self, req: StoreTokensRequest<'_>) -> Result<(), OAuthRepoError> {
+        let client = self
+            .pool
+            .get()
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?;
+
+        let dpop_bytes = req.dpop_keypair.private_key_bytes();
+
+        client
+            .execute(
+                "INSERT INTO oauth_tokens (did, pds_url, access_token, refresh_token, token_type, expires_at, dpop_private_key)
+                 VALUES ($1, $2, $3, $4, $5, $6, $7)
+                 ON CONFLICT (did) DO UPDATE SET
+                     pds_url = EXCLUDED.pds_url,
+                     access_token = EXCLUDED.access_token,
+                     refresh_token = EXCLUDED.refresh_token,
+                     token_type = EXCLUDED.token_type,
+                     expires_at = EXCLUDED.expires_at,
+                     dpop_private_key = EXCLUDED.dpop_private_key,
+                     updated_at = NOW()",
+                &[&req.did, &req.pds_url, &req.access_token, &req.refresh_token, &req.token_type, &req.expires_at, &dpop_bytes.as_slice()],
+            )
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?;
+
+        Ok(())
+    }
+
+    async fn get_tokens(&self, did: &str) -> Result<StoredToken, OAuthRepoError> {
+        let client = self
+            .pool
+            .get()
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?;
+
+        let row = client
+            .query_opt(
+                "SELECT did, pds_url, access_token, refresh_token, token_type, expires_at, dpop_private_key, created_at, updated_at
+                 FROM oauth_tokens WHERE did = $1",
+                &[&did],
+            )
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?
+            .ok_or_else(|| OAuthRepoError::NotFound(format!("No tokens for DID: {}", did)))?;
+
+        Ok(StoredToken {
+            did: row.get("did"),
+            pds_url: row.get("pds_url"),
+            access_token: row.get("access_token"),
+            refresh_token: row.get("refresh_token"),
+            token_type: row.get("token_type"),
+            expires_at: row.get("expires_at"),
+            dpop_private_key: row.get("dpop_private_key"),
+            created_at: row.get("created_at"),
+            updated_at: row.get("updated_at"),
+        })
+    }
+
+    async fn update_tokens(
+        &self, did: &str, access_token: &str, refresh_token: Option<&str>, expires_at: Option<DateTime<Utc>>,
+    ) -> Result<(), OAuthRepoError> {
+        let client = self
+            .pool
+            .get()
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?;
+
+        let result = client
+            .execute(
+                "UPDATE oauth_tokens SET access_token = $2, refresh_token = $3, expires_at = $4, updated_at = NOW()
+                 WHERE did = $1",
+                &[&did, &access_token, &refresh_token, &expires_at],
+            )
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?;
+
+        if result == 0 {
+            return Err(OAuthRepoError::NotFound(format!("No tokens for DID: {}", did)));
+        }
+
+        Ok(())
+    }
+
+    async fn delete_tokens(&self, did: &str) -> Result<(), OAuthRepoError> {
+        let client = self
+            .pool
+            .get()
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?;
+
+        client
+            .execute("DELETE FROM oauth_tokens WHERE did = $1", &[&did])
+            .await
+            .map_err(|e| OAuthRepoError::DatabaseError(e.to_string()))?;
+
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_oauth_repo_error_display() {
+        let err = OAuthRepoError::NotFound("test".to_string());
+        assert!(err.to_string().contains("test"));
+
+        let err = OAuthRepoError::DatabaseError("connection failed".to_string());
+        assert!(err.to_string().contains("connection failed"));
+    }
+}

migrations/002_2025_12_28_oauth_tokens.sql

···
+-- OAuth tokens and AT-URI storage for AT Protocol integration
+-- Adds tables for OAuth session management and AT-URI references
+
+-- OAuth sessions for tracking authorization flow state
+CREATE TABLE oauth_sessions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    state TEXT NOT NULL UNIQUE,
+    code_verifier TEXT NOT NULL,
+    dpop_private_key BYTEA NOT NULL,
+    did TEXT,
+    pds_url TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    expires_at TIMESTAMPTZ NOT NULL DEFAULT NOW() + INTERVAL '10 minutes'
+);
+
+CREATE INDEX idx_oauth_sessions_state ON oauth_sessions(state);
+CREATE INDEX idx_oauth_sessions_expires_at ON oauth_sessions(expires_at);
+
+-- OAuth tokens for authenticated users
+CREATE TABLE oauth_tokens (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    did TEXT NOT NULL UNIQUE,
+    pds_url TEXT NOT NULL,
+    access_token TEXT NOT NULL,
+    refresh_token TEXT,
+    token_type TEXT NOT NULL DEFAULT 'DPoP',
+    expires_at TIMESTAMPTZ,
+    dpop_private_key BYTEA NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_oauth_tokens_did ON oauth_tokens(did);
+
+CREATE TRIGGER update_oauth_tokens_updated_at BEFORE UPDATE ON oauth_tokens
+    FOR EACH ROW EXECUTE FUNCTION update_updated_at_column();
+
+-- Add AT-URI columns to existing tables for tracking PDS record references
+ALTER TABLE decks ADD COLUMN at_uri TEXT;
+ALTER TABLE cards ADD COLUMN at_uri TEXT;
+ALTER TABLE notes ADD COLUMN at_uri TEXT;
+
+CREATE INDEX idx_decks_at_uri ON decks(at_uri) WHERE at_uri IS NOT NULL;
+CREATE INDEX idx_cards_at_uri ON cards(at_uri) WHERE at_uri IS NOT NULL;
+CREATE INDEX idx_notes_at_uri ON notes(at_uri) WHERE at_uri IS NOT NULL;
+
+-- Cleanup job for expired sessions (run periodically via cron or similar)
+-- DELETE FROM oauth_sessions WHERE expires_at < NOW();