Handle session timeouts and clearing t he cookie session

src/hooks.server.ts

···
 import { STATE_STORE } from '$lib/server/cache';
 import { logger } from '$lib/server/logger';
 import { HOUR } from '@atproto/common';
-import { getSessionManager } from '$lib/server/session';
+import { getSessionManager, SessionRestorationError } from '$lib/server/session';
 
 const clearExpiredStates = async () => {
     try {
···
         event.locals.atpAgent = null;
         return resolve(event);
     }
+
     const sessionManager = await getSessionManager();
-    const { atpAgent, did, handle } = await sessionManager.getSessionFromRequest(event);
 
-    if(atpAgent == null){
+    try {
+        const { atpAgent, did, handle } = await sessionManager.getSessionFromRequest(event);
+
+        if(atpAgent == null){
+            event.locals.session = null;
+            event.locals.atpAgent = null;
+            return resolve(event);
+        }
+
+        // Store atpAgent in locals (server-side only, not serialized)
+        event.locals.atpAgent = atpAgent;
+
+        // Store only serializable data in session (gets passed to client via load functions)
+        event.locals.session = {
+            did,
+            handle
+        };
+    } catch (err) {
+        if (err instanceof SessionRestorationError) {
+            //You can propagate this error to the frontend to let your users know their session unexpectedly ended
+            //I opted out of not completely implementing this since everyone may have a different idea of what to do in their apps
+            //For instance I would use the cache to create a flash message that when loaded it deletes and show it on the layout
+        } else {
+            // Unexpected error, re-throw
+            throw err;
+        }
+
         event.locals.session = null;
         event.locals.atpAgent = null;
-        return resolve(event);
     }
-
-    // Store atpAgent in locals (server-side only, not serialized)
-    event.locals.atpAgent = atpAgent;
-
-    // Store only serializable data in session (gets passed to client via load functions)
-    event.locals.session = {
-        did,
-        handle
-    };
 
     return resolve(event);
 };

src/lib/server/session.ts

···
 import type { NodeOAuthClient } from '@atproto/oauth-client-node';
 import { logger } from '$lib/server/logger';
 
+export class SessionRestorationError extends Error {
+    constructor(message: string) {
+        super(message);
+        this.name = 'SessionRestorationError';
+    }
+}
 
 // This is a sliding expiration for the cookie session. Can change it if you want it to be less or more.
 // The actual atproto session goes for a while if it's a confidential client as long as it's refreshed
···
             session.expiresAt = new Date(Date.now() + DEFAULT_EXPIRY);
             await this.db.update(sessionStore).set(session).where(eq(sessionStore.id, sessionId));
         }
+        try{
+            const oAuthSession = await this.atpOAuthClient.restore(session.did);
 
-        const oAuthSession = await this.atpOAuthClient.restore(session.did);
-        const agent = new Agent(oAuthSession);
-        return { atpAgent: agent, did: session.did, handle: session.handle };
+            const agent = new Agent(oAuthSession);
+            return { atpAgent: agent, did: session.did, handle: session.handle };
+        }catch (err){
+            const errorMessage = (err as Error).message;
+            logger.warn(`Error restoring session for did: ${session.did}, error: ${errorMessage}`);
+            //Counting any error when restoring a session as a failed session resume and deleting the users web browser session
+            //You can go further and capture different types of errors
+            await this.invalidateUserSessions(session.did);
+            throw new SessionRestorationError(`Failed to restore your session: ${errorMessage}. Please log in again.`);
+        }
     }
 
     private setSessionTokenCookie(event: RequestEvent, token: string, expiresAt: Date): void {
···
         if (!token) {
             return NULL_SESSION_RESPONSE;
         }
-        return this.validateSessionToken(token);
+        try {
+            return await this.validateSessionToken(token);
+        } catch (err) {
+            //We delete the cookie on any error and pass along the error
+            this.deleteSessionTokenCookie(event);
+            throw err;
+        }
     }
 
 }