feat: implement ATProto OAuth flow (PAR + PKCE + DPoP)

Add ATProto OAuth handlers (ClientMetadata, ATProtoLoginPage,
ATProtoLoginSubmit, ATProtoCallback) with full PAR + PKCE + DPoP
support; remove defunct OAuthGitHub/OAuthGoogle handlers and update
server routes accordingly.

Co-Authored-By: Claude Sonnet 4.6 <[e-mail]>

cmd/server/main.go

···
 	mux.HandleFunc("GET /auth/register", h.RegisterPage)
 	mux.HandleFunc("POST /auth/register", h.RegisterSubmit)
 	mux.HandleFunc("POST /auth/logout", h.Logout)
-	mux.HandleFunc("GET /auth/github", h.OAuthGitHub)
-	mux.HandleFunc("GET /auth/google", h.OAuthGoogle)
+	mux.HandleFunc("GET /client-metadata.json", h.ClientMetadata)
+	mux.HandleFunc("GET /auth/atproto", h.ATProtoLoginPage)
+	mux.HandleFunc("POST /auth/atproto", h.ATProtoLoginSubmit)
+	mux.HandleFunc("GET /auth/atproto/callback", h.ATProtoCallback)
 
 	// Dashboard
 	mux.HandleFunc("GET /", h.Dashboard)

go.mod

···
 	github.com/sergi/go-diff v1.3.1
 	github.com/yuin/goldmark v1.7.1
 	golang.org/x/crypto v0.22.0
-	golang.org/x/oauth2 v0.19.0
 )
 
-require (
-	cloud.google.com/go/compute v1.20.1 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	github.com/gorilla/securecookie v1.1.2 // indirect
-)
+require github.com/gorilla/securecookie v1.1.2 // indirect

go.sum

···
-cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg=
-cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
-cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
 github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
···
 github.com/yuin/goldmark v1.7.1/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
-golang.org/x/oauth2 v0.19.0 h1:9+E/EZBCbTLNrbN35fHv/a/d/mOBatymz1zbtQrXpIg=
-golang.org/x/oauth2 v0.19.0/go.mod h1:vYi7skDa1x015PmRRYZ7+s1cWyPgrPiSYRe4rnsexc8=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

internal/handler/atproto.go

···
+package handler
+
+import (
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+
+	"github.com/limeleaf/markdownhub/internal/atproto"
+	"github.com/limeleaf/markdownhub/internal/atproto/dpop"
+	"github.com/limeleaf/markdownhub/internal/auth"
+	"github.com/limeleaf/markdownhub/internal/model"
+)
+
+func baseURL() string {
+	if u := os.Getenv("BASE_URL"); u != "" {
+		return strings.TrimRight(u, "/")
+	}
+	return "http://localhost:8080"
+}
+
+// ClientMetadata serves the OAuth client metadata document.
+// The client_id in ATProto OAuth must be a URL pointing to this document.
+func (h *Handler) ClientMetadata(w http.ResponseWriter, r *http.Request) {
+	base := baseURL()
+	meta := map[string]interface{}{
+		"client_id":                  base + "/client-metadata.json",
+		"client_name":                "MarkdownHub",
+		"client_uri":                 base,
+		"redirect_uris":              []string{base + "/auth/atproto/callback"},
+		"grant_types":                []string{"authorization_code", "refresh_token"},
+		"response_types":             []string{"code"},
+		"scope":                      "atproto",
+		"token_endpoint_auth_method": "none",
+		"dpop_bound_access_tokens":   true,
+		"application_type":           "web",
+	}
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(meta)
+}
+
+// ATProtoLoginPage renders the handle-entry form.
+func (h *Handler) ATProtoLoginPage(w http.ResponseWriter, r *http.Request) {
+	h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky"})
+}
+
+// ATProtoLoginSubmit starts the ATProto OAuth flow:
+// 1. Resolve handle → DID → PDS → auth server metadata
+// 2. Generate DPoP key + PKCE
+// 3. POST PAR request
+// 4. Store state in session, redirect user to authorization endpoint
+func (h *Handler) ATProtoLoginSubmit(w http.ResponseWriter, r *http.Request) {
+	handle := strings.TrimSpace(r.FormValue("handle"))
+	if handle == "" {
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Handle is required"})
+		return
+	}
+
+	// 1. Resolve identity
+	did, err := atproto.ResolveHandle(handle)
+	if err != nil {
+		log.Printf("ATProto: resolve handle %s: %v", handle, err)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Could not resolve handle — check it and try again"})
+		return
+	}
+
+	pds, err := atproto.ResolvePDS(did)
+	if err != nil {
+		log.Printf("ATProto: resolve PDS for %s: %v", did, err)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Could not reach your PDS"})
+		return
+	}
+
+	meta, err := atproto.FetchAuthServerMeta(pds)
+	if err != nil {
+		log.Printf("ATProto: fetch auth meta from %s: %v", pds, err)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "PDS does not support ATProto OAuth"})
+		return
+	}
+
+	// 2. Generate DPoP key pair and PKCE
+	kp, err := dpop.Generate()
+	if err != nil {
+		log.Printf("ATProto: generate DPoP key: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+	keyJSON, err := kp.MarshalPrivate()
+	if err != nil {
+		log.Printf("ATProto: marshal DPoP key: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+
+	verifier := auth.PKCEVerifier()
+	challenge := auth.PKCEChallenge(verifier)
+	state := auth.GenerateToken()
+	redirectURI := baseURL() + "/auth/atproto/callback"
+	clientID := baseURL() + "/client-metadata.json"
+
+	// 3. POST PAR request
+	parProof, err := kp.Proof("POST", meta.PushedAuthorizationRequestEndpoint, "")
+	if err != nil {
+		log.Printf("ATProto: build PAR DPoP proof: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+
+	parParams := url.Values{
+		"response_type":         {"code"},
+		"client_id":             {clientID},
+		"redirect_uri":          {redirectURI},
+		"scope":                 {"atproto"},
+		"state":                 {state},
+		"code_challenge":        {challenge},
+		"code_challenge_method": {"S256"},
+		"login_hint":            {handle},
+	}
+
+	req, _ := http.NewRequest("POST", meta.PushedAuthorizationRequestEndpoint, strings.NewReader(parParams.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("DPoP", parProof)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		log.Printf("ATProto: PAR request failed: %v", err)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Authorization request failed"})
+		return
+	}
+	defer resp.Body.Close()
+
+	// Handle DPoP nonce requirement (server may return 400 with nonce on first try)
+	nonce := resp.Header.Get("DPoP-Nonce")
+	if resp.StatusCode == http.StatusBadRequest && nonce != "" {
+		parProof, err = kp.Proof("POST", meta.PushedAuthorizationRequestEndpoint, nonce)
+		if err != nil {
+			http.Error(w, "Internal error", 500)
+			return
+		}
+		req2, _ := http.NewRequest("POST", meta.PushedAuthorizationRequestEndpoint, strings.NewReader(parParams.Encode()))
+		req2.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req2.Header.Set("DPoP", parProof)
+		resp.Body.Close()
+		resp, err = http.DefaultClient.Do(req2)
+		if err != nil {
+			log.Printf("ATProto: PAR retry failed: %v", err)
+			h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Authorization request failed"})
+			return
+		}
+		defer resp.Body.Close()
+		nonce = resp.Header.Get("DPoP-Nonce")
+	}
+
+	if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
+		log.Printf("ATProto: PAR response %d", resp.StatusCode)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Authorization request failed"})
+		return
+	}
+
+	var parResp struct {
+		RequestURI string `json:"request_uri"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&parResp); err != nil || parResp.RequestURI == "" {
+		log.Printf("ATProto: decode PAR response: %v", err)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Unexpected response from PDS"})
+		return
+	}
+
+	// 4. Store state in session
+	sess := auth.GetSession(r)
+	sess.Values["atproto_state"] = state
+	sess.Values["atproto_pkce_verifier"] = verifier
+	sess.Values["atproto_dpop_key"] = string(keyJSON)
+	sess.Values["atproto_dpop_nonce"] = nonce
+	sess.Values["atproto_token_endpoint"] = meta.TokenEndpoint
+	sess.Values["atproto_did"] = did
+	sess.Values["atproto_handle"] = handle
+	sess.Save(r, w)
+
+	// Redirect user to authorization endpoint
+	authURL := meta.AuthorizationEndpoint + "?client_id=" + url.QueryEscape(clientID) + "&request_uri=" + url.QueryEscape(parResp.RequestURI)
+	http.Redirect(w, r, authURL, http.StatusFound)
+}
+
+// ATProtoCallback handles the redirect back from the PDS after user approval:
+// 1. Validate state
+// 2. Exchange code for tokens (with DPoP)
+// 3. Verify sub (DID)
+// 4. Find or create user, set session
+func (h *Handler) ATProtoCallback(w http.ResponseWriter, r *http.Request) {
+	sess := auth.GetSession(r)
+
+	// 1. Validate state
+	state := r.URL.Query().Get("state")
+	expectedState, _ := sess.Values["atproto_state"].(string)
+	if state == "" || state != expectedState {
+		http.Error(w, "Invalid state", http.StatusBadRequest)
+		return
+	}
+
+	code := r.URL.Query().Get("code")
+	if code == "" {
+		errMsg := r.URL.Query().Get("error_description")
+		if errMsg == "" {
+			errMsg = r.URL.Query().Get("error")
+		}
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: fmt.Sprintf("Authorization denied: %s", errMsg)})
+		return
+	}
+
+	verifier, _ := sess.Values["atproto_pkce_verifier"].(string)
+	keyJSON, _ := sess.Values["atproto_dpop_key"].(string)
+	nonce, _ := sess.Values["atproto_dpop_nonce"].(string)
+	tokenEndpoint, _ := sess.Values["atproto_token_endpoint"].(string)
+	expectedDID, _ := sess.Values["atproto_did"].(string)
+	handle, _ := sess.Values["atproto_handle"].(string)
+
+	// Clean up session state
+	delete(sess.Values, "atproto_state")
+	delete(sess.Values, "atproto_pkce_verifier")
+	delete(sess.Values, "atproto_dpop_key")
+	delete(sess.Values, "atproto_dpop_nonce")
+	delete(sess.Values, "atproto_token_endpoint")
+	delete(sess.Values, "atproto_did")
+	delete(sess.Values, "atproto_handle")
+
+	// 2. Exchange code for tokens
+	kp, err := dpop.UnmarshalPrivate([]byte(keyJSON))
+	if err != nil {
+		log.Printf("ATProto callback: unmarshal DPoP key: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+
+	redirectURI := baseURL() + "/auth/atproto/callback"
+	clientID := baseURL() + "/client-metadata.json"
+
+	tokenParams := url.Values{
+		"grant_type":    {"authorization_code"},
+		"code":          {code},
+		"redirect_uri":  {redirectURI},
+		"client_id":     {clientID},
+		"code_verifier": {verifier},
+	}
+
+	tokenProof, err := kp.Proof("POST", tokenEndpoint, nonce)
+	if err != nil {
+		log.Printf("ATProto callback: build token DPoP proof: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+
+	tokenReq, _ := http.NewRequest("POST", tokenEndpoint, strings.NewReader(tokenParams.Encode()))
+	tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	tokenReq.Header.Set("DPoP", tokenProof)
+
+	tokenResp, err := http.DefaultClient.Do(tokenReq)
+	if err != nil {
+		log.Printf("ATProto callback: token request: %v", err)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Token exchange failed"})
+		return
+	}
+	defer tokenResp.Body.Close()
+
+	// Handle nonce refresh on token endpoint
+	newNonce := tokenResp.Header.Get("DPoP-Nonce")
+	if tokenResp.StatusCode == http.StatusBadRequest && newNonce != "" {
+		tokenProof, err = kp.Proof("POST", tokenEndpoint, newNonce)
+		if err != nil {
+			http.Error(w, "Internal error", 500)
+			return
+		}
+		tokenReq2, _ := http.NewRequest("POST", tokenEndpoint, strings.NewReader(tokenParams.Encode()))
+		tokenReq2.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		tokenReq2.Header.Set("DPoP", tokenProof)
+		tokenResp.Body.Close()
+		tokenResp, err = http.DefaultClient.Do(tokenReq2)
+		if err != nil {
+			h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Token exchange failed"})
+			return
+		}
+		defer tokenResp.Body.Close()
+	}
+
+	if tokenResp.StatusCode != http.StatusOK {
+		log.Printf("ATProto callback: token response %d", tokenResp.StatusCode)
+		h.render(w, "atproto_login.html", PageData{Title: "Sign in with Bluesky", Error: "Token exchange failed"})
+		return
+	}
+
+	var tokenBody struct {
+		Sub string `json:"sub"`
+	}
+	if err := json.NewDecoder(tokenResp.Body).Decode(&tokenBody); err != nil {
+		log.Printf("ATProto callback: decode token response: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+
+	// 3. Verify sub matches the DID we resolved at the start
+	if tokenBody.Sub == "" {
+		http.Error(w, "Token missing sub claim", http.StatusBadRequest)
+		return
+	}
+	if tokenBody.Sub != expectedDID {
+		log.Printf("ATProto callback: sub mismatch: got %s, expected %s", tokenBody.Sub, expectedDID)
+		http.Error(w, "DID mismatch", http.StatusBadRequest)
+		return
+	}
+
+	// 4. Find or create user
+	user, err := h.DB.GetUserByDID(tokenBody.Sub)
+	if err == sql.ErrNoRows {
+		if handle == "" {
+			handle = tokenBody.Sub
+		}
+		did := tokenBody.Sub
+		user = &model.User{
+			Name: handle,
+			DID:  &did,
+		}
+		if err := h.DB.CreateUser(user); err != nil {
+			log.Printf("ATProto callback: create user: %v", err)
+			http.Error(w, "Internal error", 500)
+			return
+		}
+	} else if err != nil {
+		log.Printf("ATProto callback: get user by DID: %v", err)
+		http.Error(w, "Internal error", 500)
+		return
+	}
+
+	auth.SetUserID(w, r, user.ID)
+	sess.Save(r, w)
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}

internal/handler/handler.go

···
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
-// --- OAuth handlers ---
-
-func (h *Handler) OAuthGitHub(w http.ResponseWriter, r *http.Request) {
-	state := auth.SetOAuthState(w, r)
-	url := auth.GitHubConfig().AuthCodeURL(state)
-	http.Redirect(w, r, url, http.StatusTemporaryRedirect)
-}
-
-func (h *Handler) OAuthGoogle(w http.ResponseWriter, r *http.Request) {
-	state := auth.SetOAuthState(w, r)
-	url := auth.GoogleConfig().AuthCodeURL(state)
-	http.Redirect(w, r, url, http.StatusTemporaryRedirect)
-}
-
 // --- Dashboard ---
 
 func (h *Handler) Dashboard(w http.ResponseWriter, r *http.Request) {