feat: Implement authentication and DPoP client

- Added Auth class for handling user login, session management, and token storage using Flutter Secure Storage.
- Introduced DpopHttpClient for making HTTP requests with DPoP proof, including nonce management and JWK thumbprint calculation.
- Created AtprotoSession model for managing session data.
- Updated main.dart to integrate authentication flow and handle sign-in state.
- Enhanced CreateGalleryPage to create galleries and navigate to the GalleryPage upon success.
- Improved error handling and loading states in ProfilePage and SplashPage.
- Added necessary imports and plugin registrations for secure storage across platforms (Linux, macOS, Windows).
- Updated pubspec.yaml to include new dependencies for secure storage, JOSE, and crypto functionalities.

ios/Podfile.lock

···
 PODS:
   - Flutter (1.0.0)
+  - flutter_secure_storage (6.0.0):
+    - Flutter
   - flutter_web_auth_2 (3.0.0):
     - Flutter
   - image_picker_ios (0.0.1):
···
 
 DEPENDENCIES:
   - Flutter (from `Flutter`)
+  - flutter_secure_storage (from `.symlinks/plugins/flutter_secure_storage/ios`)
   - flutter_web_auth_2 (from `.symlinks/plugins/flutter_web_auth_2/ios`)
   - image_picker_ios (from `.symlinks/plugins/image_picker_ios/ios`)
   - package_info_plus (from `.symlinks/plugins/package_info_plus/ios`)
···
 EXTERNAL SOURCES:
   Flutter:
     :path: Flutter
+  flutter_secure_storage:
+    :path: ".symlinks/plugins/flutter_secure_storage/ios"
   flutter_web_auth_2:
     :path: ".symlinks/plugins/flutter_web_auth_2/ios"
   image_picker_ios:
···
 
 SPEC CHECKSUMS:
   Flutter: e0871f40cf51350855a761d2e70bf5af5b9b5de7
+  flutter_secure_storage: d33dac7ae2ea08509be337e775f6b59f1ff45f12
   flutter_web_auth_2: 06d500582775790a0d4c323222fcb6d7990f9603
   image_picker_ios: c560581cceedb403a6ff17f2f816d7fea1421fc1
   package_info_plus: c0502532a26c7662a62a356cebe2692ec5fe4ec4

lib/api.dart

···
 import 'package:grain/app_logger.dart';
 import 'package:grain/main.dart';
-import 'package:http/http.dart' as http;
-import 'dart:convert';
+import 'package:grain/models/atproto_session.dart';
 import 'models/profile.dart';
 import 'models/gallery.dart';
 import 'models/notification.dart' as grain;
+import './auth.dart';
+import 'package:xrpc/xrpc.dart' as xrpc;
+import 'package:http/http.dart' as http;
+import 'dart:convert';
+import 'package:grain/dpop_client.dart';
 
 class ApiService {
   String? _accessToken;
···
 
   String get _apiUrl => AppConfig.apiUrl;
 
-  void setToken(String token) {
+  setToken(String? token) {
     _accessToken = token;
   }
 
-  Future<Profile?> fetchProfile({required String did}) async {
+  Future<AtprotoSession?> fetchSession() async {
     if (_accessToken == null) return null;
-    appLogger.i('Fetching profile for actor: $did');
 
     final response = await http.get(
-      Uri.parse('$_apiUrl/xrpc/social.grain.actor.getProfile?actor=$did'),
-      headers: {'Authorization': 'Bearer $_accessToken'},
+      Uri.parse('$_apiUrl/oauth/session'),
+      headers: {
+        'Authorization': 'Bearer $_accessToken',
+        'Content-Type': 'application/json',
+      },
     );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      loadedProfile = Profile.fromJson(data);
-      return loadedProfile;
-    } else {
-      appLogger.e(
-        'Failed to load profile: status ${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to load profile: \\${response.statusCode}');
+
+    if (response.statusCode != 200) {
+      throw Exception('Failed to fetch session');
     }
+
+    return AtprotoSession.fromJson(jsonDecode(response.body));
   }
 
-  Future<List<Gallery>> fetchActorGalleries({required String did}) async {
-    if (_accessToken == null) return [];
-    appLogger.i('Fetching galleries for actor: $did');
+  Future<Profile?> fetchCurrentUser() async {
+    final session = await auth.getValidSession();
 
-    final response = await http.get(
-      Uri.parse(
-        '$_apiUrl/xrpc/social.grain.gallery.getActorGalleries?actor=$did',
-      ),
-      headers: {'Authorization': 'Bearer $_accessToken'},
-    );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      final items = data['items'] as List<dynamic>?;
-      if (items != null) {
-        galleries = items.map((item) => Gallery.fromJson(item)).toList();
-      } else {
-        galleries = [];
-      }
-      return galleries;
-    } else {
-      appLogger.e(
-        'Failed to load galleries: status ${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to load galleries: ${response.statusCode}');
+    if (session == null || session.subject.isEmpty) {
+      return null;
     }
+
+    final user = await fetchProfile(did: session.subject);
+
+    currentUser = user;
+
+    return user;
   }
 
-  Future<void> fetchCurrentUser() async {
-    if (_accessToken == null) return;
-    appLogger.i('Fetching current user');
+  Future<Profile?> fetchProfile({required String did}) async {
+    appLogger.i('Fetching profile for did: $did');
+    final response = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('actor.grain.social', 'getProfile'),
+      parameters: {'actor': did},
+      to: Profile.fromJson,
+    );
+    return response.data;
+  }
 
-    final response = await http.get(
-      Uri.parse('$_apiUrl/oauth/session'),
-      headers: {'Authorization': 'Bearer $_accessToken'},
+  Future<List<Gallery>> fetchActorGalleries({required String did}) async {
+    appLogger.i('Fetching galleries for actor did: $did');
+    final record = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('gallery.grain.social', 'getActorGalleries'),
+      parameters: {'actor': did},
+      to: (json) =>
+          (json['items'] as List<dynamic>?)
+              ?.map((item) => Gallery.fromJson(item))
+              .toList() ??
+          [],
     );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      currentUser = Profile.fromJson(data);
-    } else {
-      appLogger.e(
-        'Failed to fetch current user: status ${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to fetch current user: \\${response.statusCode}');
-    }
+    galleries = record.data;
+    return galleries;
   }
 
   Future<List<Gallery>> getTimeline({String? algorithm}) async {
-    if (_accessToken == null) return [];
-    appLogger.i('Fetching timeline');
-
-    final uri = Uri.parse('$_apiUrl/xrpc/social.grain.feed.getTimeline')
-        .replace(
-          queryParameters: algorithm != null ? {'algorithm': algorithm} : null,
-        );
-
-    final response = await http.get(
-      uri,
-      headers: {'Authorization': 'Bearer $_accessToken'},
-    );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      final items = data['feed'] as List<dynamic>?;
-      if (items != null) {
-        return items
-            .map((item) => Gallery.fromJson(item as Map<String, dynamic>))
-            .toList();
-      } else {
-        return [];
-      }
-    } else {
-      appLogger.e(
-        'Failed to load timeline: status [${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to load timeline: ${response.statusCode}');
+    if (_accessToken == null) {
+      return [];
     }
+    appLogger.i('Fetching timeline with algorithm: ${algorithm ?? 'default'}');
+    final record = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('feed.grain.social', 'getTimeline'),
+      parameters: algorithm != null ? {'algorithm': algorithm} : null,
+      headers: {'Authorization': "Bearer $_accessToken"},
+      to: (json) =>
+          (json['feed'] as List<dynamic>?)
+              ?.map((item) => Gallery.fromJson(item as Map<String, dynamic>))
+              .toList() ??
+          [],
+    );
+    return record.data;
   }
 
   Future<Gallery?> getGallery({required String uri}) async {
-    if (_accessToken == null) return null;
-    appLogger.i('Fetching gallery for URI: $uri');
-
-    final response = await http.get(
-      Uri.parse('$_apiUrl/xrpc/social.grain.gallery.getGallery?uri=$uri'),
-      headers: {'Authorization': 'Bearer $_accessToken'},
+    appLogger.i('Fetching gallery for uri: $uri');
+    final record = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('gallery.grain.social', 'getGallery'),
+      parameters: {'uri': uri},
+      to: Gallery.fromJson,
     );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      return Gallery.fromJson(data);
-    } else {
-      appLogger.e(
-        'Failed to load gallery: status ${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to load gallery: ${response.statusCode}');
-    }
+    return record.data;
   }
 
   Future<Map<String, dynamic>> getGalleryThread({required String uri}) async {
-    if (_accessToken == null) throw Exception('No access token');
-    appLogger.i('Fetching gallery thread for URI: $uri');
-
-    final response = await http.get(
-      Uri.parse('$_apiUrl/xrpc/social.grain.gallery.getGalleryThread?uri=$uri'),
-      headers: {'Authorization': 'Bearer $_accessToken'},
+    appLogger.i('Fetching gallery thread for uri: $uri');
+    final record = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('gallery.grain.social', 'getGalleryThread'),
+      parameters: {'uri': uri},
+      to: (json) => json as Map<String, dynamic>,
     );
-    if (response.statusCode == 200) {
-      return json.decode(response.body) as Map<String, dynamic>;
-    } else {
-      appLogger.e(
-        'Failed to load gallery thread: status ${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to load gallery thread: ${response.statusCode}');
-    }
+    return record.data;
   }
 
   Future<List<grain.Notification>> getNotifications() async {
-    if (_accessToken == null) return [];
+    if (_accessToken == null) {
+      appLogger.w('No access token for getNotifications');
+      return [];
+    }
     appLogger.i('Fetching notifications');
-
-    final response = await http.get(
-      Uri.parse('$_apiUrl/xrpc/social.grain.notification.getNotifications'),
-      headers: {'Authorization': 'Bearer $_accessToken'},
+    final record = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('notification.grain.social', 'getNotifications'),
+      headers: {'Authorization': "Bearer \\$_accessToken"},
+      to: (json) =>
+          (json['notifications'] as List<dynamic>?)
+              ?.map(
+                (item) =>
+                    grain.Notification.fromJson(item as Map<String, dynamic>),
+              )
+              .toList() ??
+          [],
     );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      final items = data['notifications'] as List<dynamic>?;
-      if (items != null) {
-        return items
-            .map(
-              (item) =>
-                  grain.Notification.fromJson(item as Map<String, dynamic>),
-            )
-            .toList();
-      } else {
-        return [];
-      }
-    } else {
-      appLogger.e(
-        'Failed to load notifications: status ${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to load notifications: \\${response.statusCode}');
-    }
+    return record.data;
   }
 
   Future<List<Profile>> searchActors(String query) async {
-    if (_accessToken == null) return [];
-    appLogger.i('Searching actors for query: $query');
-
-    final response = await http.get(
-      Uri.parse('$_apiUrl/xrpc/social.grain.actor.searchActors?q=$query'),
-      headers: {'Authorization': 'Bearer $_accessToken'},
+    if (_accessToken == null) {
+      appLogger.w('No access token for searchActors');
+      return [];
+    }
+    appLogger.i('Searching actors with query: $query');
+    final record = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('actor.grain.social', 'searchActors'),
+      parameters: {'q': query},
+      to: (json) =>
+          (json['actors'] as List<dynamic>?)
+              ?.map((item) => Profile.fromJson(item))
+              .toList() ??
+          [],
     );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      final items = data['actors'] as List<dynamic>?;
-      if (items != null) {
-        appLogger.i('Found ${items.length} actors for query: $query');
-        return items.map((item) => Profile.fromJson(item)).toList();
-      } else {
-        return [];
-      }
-    } else {
-      appLogger.e(
-        'Failed to search actors: status ${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception('Failed to search actors: ${response.statusCode}');
-    }
+    return record.data;
   }
 
   Future<List<Gallery>> getActorFavs({required String did}) async {
-    if (_accessToken == null) return [];
-    appLogger.i('Fetching favorite galleries for actor: $did');
+    appLogger.i('Fetching actor favs for did: $did');
+    final record = await xrpc.query(
+      service: _apiUrl.replaceFirst(RegExp(r'^https?://'), ''),
+      xrpc.NSID.create('actor.grain.social', 'getActorFavs'),
+      parameters: {'actor': did},
+      to: (json) =>
+          (json['items'] as List<dynamic>?)
+              ?.map((item) => Gallery.fromJson(item))
+              .toList() ??
+          [],
+    );
+    return record.data;
+  }
 
-    final response = await http.get(
-      Uri.parse('$_apiUrl/xrpc/social.grain.actor.getActorFavs?actor=$did'),
-      headers: {'Authorization': 'Bearer $_accessToken'},
+  Future<String?> createGallery({
+    required String title,
+    required String description,
+  }) async {
+    final session = await auth.getValidSession();
+    if (session == null) {
+      appLogger.w('No valid session for createGallery');
+      return null;
+    }
+    final dpopClient = DpopHttpClient(dpopKey: session.dpopJwk);
+    final issuer = session.issuer;
+    final did = session.subject;
+    final url = Uri.parse('$issuer/xrpc/com.atproto.repo.createRecord');
+    final record = {
+      'collection': 'social.grain.gallery',
+      'repo': did,
+      'record': {
+        'title': title,
+        'description': description,
+        'updatedAt': DateTime.now().toUtc().toIso8601String(),
+        'createdAt': DateTime.now().toUtc().toIso8601String(),
+      },
+    };
+    appLogger.i('Creating gallery: $record');
+    final response = await dpopClient.send(
+      method: 'POST',
+      url: url,
+      accessToken: session.accessToken,
+      body: jsonEncode(record),
     );
-    if (response.statusCode == 200) {
-      final data = json.decode(response.body);
-      final items = data['items'] as List<dynamic>?;
-      if (items != null) {
-        return items.map((item) => Gallery.fromJson(item)).toList();
-      } else {
-        return [];
-      }
-    } else {
-      appLogger.e(
-        'Failed to load favorite galleries: status [${response.statusCode}, body: ${response.body}',
-      );
-      throw Exception(
-        'Failed to load favorite galleries: ${response.statusCode}',
+    if (response.statusCode != 200 && response.statusCode != 201) {
+      appLogger.w(
+        'Failed to create gallery: ${response.statusCode} ${response.body}',
       );
+      throw Exception('Failed to create gallery: ${response.statusCode}');
     }
+    final result = jsonDecode(response.body) as Map<String, dynamic>;
+    appLogger.i('Created gallery result: $result');
+    return result['uri'];
   }
 }
 

lib/auth.dart

···
+import 'dart:convert';
+import 'package:flutter_secure_storage/flutter_secure_storage.dart';
+import 'package:grain/api.dart';
+import 'package:grain/app_logger.dart';
+import 'package:grain/main.dart';
+import 'package:flutter_web_auth_2/flutter_web_auth_2.dart';
+import 'package:grain/models/atproto_session.dart';
+import 'package:jose/jose.dart';
+import 'package:uuid/uuid.dart';
+import 'package:http/http.dart' as http;
+import 'package:crypto/crypto.dart';
+
+class Auth {
+  static const _storage = FlutterSecureStorage();
+  Auth();
+
+  Future<void> login(String handle) async {
+    final apiUrl = AppConfig.apiUrl;
+    final redirectedUrl = await FlutterWebAuth2.authenticate(
+      url:
+          '$apiUrl/oauth/login?client=native&handle=${Uri.encodeComponent(handle)}',
+      callbackUrlScheme: 'grainflutter',
+    );
+    final uri = Uri.parse(redirectedUrl);
+    final token = uri.queryParameters['token'];
+
+    appLogger.i('Redirected URL: $redirectedUrl');
+    appLogger.i('User signed in with handle: $handle');
+
+    apiService.setToken(token);
+
+    final session = await apiService.fetchSession();
+    if (session == null) {
+      throw Exception('Failed to fetch session after login');
+    }
+
+    await _saveSession(session);
+  }
+
+  Future<void> _saveSession(AtprotoSession session) async {
+    final sessionJson = jsonEncode(session.toJson());
+    await _storage.write(key: 'atproto_session', value: sessionJson);
+  }
+
+  Future<AtprotoSession?> _loadSession() async {
+    final jsonString = await _storage.read(key: 'atproto_session');
+    if (jsonString == null) return null;
+
+    try {
+      final json = jsonDecode(jsonString);
+      return AtprotoSession.fromJson(json);
+    } catch (e) {
+      // Optionally log or clear storage if corrupted
+      return null;
+    }
+  }
+
+  bool isSessionExpired(
+    AtprotoSession session, {
+    Duration tolerance = const Duration(seconds: 30),
+  }) {
+    final now = DateTime.now().toUtc();
+    return session.expiresAt.subtract(tolerance).isBefore(now);
+  }
+
+  Future<AtprotoSession?> getValidSession() async {
+    final session = await _loadSession();
+    if (session == null || isSessionExpired(session)) {
+      appLogger.w('Session is expired or not found');
+      // Try refresh or return null
+      return null;
+    }
+    return session;
+  }
+}
+
+final auth = Auth();

lib/dpop_client.dart

···
+import 'dart:convert';
+import 'package:http/http.dart' as http;
+import 'package:jose/jose.dart';
+import 'package:crypto/crypto.dart';
+import 'package:uuid/uuid.dart';
+
+class DpopHttpClient {
+  final JsonWebKey dpopKey;
+  final Map<String, String> _nonces = {}; // origin -> nonce
+
+  DpopHttpClient({required this.dpopKey});
+
+  /// Extract origin (scheme + host + port) from a URL
+  String _extractOrigin(String url) {
+    final uri = Uri.parse(url);
+    final portPart = (uri.hasPort && uri.port != 80 && uri.port != 443)
+        ? ':${uri.port}'
+        : '';
+    return '${uri.scheme}://${uri.host}$portPart';
+  }
+
+  /// Strip query and fragment from URL per spec
+  String _buildHtu(String url) {
+    final uri = Uri.parse(url);
+    return '${uri.scheme}://${uri.host}${uri.path}';
+  }
+
+  /// Calculate ath claim: base64url(sha256(access_token))
+  String _calculateAth(String accessToken) {
+    final hash = sha256.convert(utf8.encode(accessToken));
+    return base64Url.encode(hash.bytes).replaceAll('=', '');
+  }
+
+  /// Calculate the JWK Thumbprint for EC or RSA keys per RFC 7638.
+  /// The input [jwk] is the public part of your key as a Map`<String, dynamic>`.
+  ///
+  /// For EC keys, required fields are: crv, kty, x, y
+  /// For RSA keys, required fields are: e, kty, n
+  String calculateJwkThumbprint(Map<String, dynamic> jwk) {
+    late Map<String, String> ordered;
+
+    if (jwk['kty'] == 'EC') {
+      ordered = {
+        'crv': jwk['crv'],
+        'kty': jwk['kty'],
+        'x': jwk['x'],
+        'y': jwk['y'],
+      };
+    } else if (jwk['kty'] == 'RSA') {
+      ordered = {'e': jwk['e'], 'kty': jwk['kty'], 'n': jwk['n']};
+    } else {
+      throw ArgumentError('Unsupported key type for thumbprint calculation');
+    }
+
+    final jsonString = jsonEncode(ordered);
+
+    final digest = sha256.convert(utf8.encode(jsonString));
+    return base64Url.encode(digest.bytes).replaceAll('=', '');
+  }
+
+  /// Build the DPoP JWT proof
+  Future<String> _buildProof({
+    required String htm,
+    required String htu,
+    String? nonce,
+    String? ath,
+  }) async {
+    final now = (DateTime.now().millisecondsSinceEpoch / 1000).floor();
+    final jti = Uuid().v4();
+
+    final publicJwk = Map<String, String>.from(dpopKey.toJson())..remove('d');
+
+    final payload = {
+      'htu': htu,
+      'htm': htm,
+      'iat': now,
+      'jti': jti,
+      if (nonce != null) 'nonce': nonce,
+      if (ath != null) 'ath': ath,
+    };
+
+    final builder = JsonWebSignatureBuilder()
+      ..jsonContent = payload
+      ..addRecipient(dpopKey, algorithm: dpopKey.algorithm)
+      ..setProtectedHeader('typ', 'dpop+jwt')
+      ..setProtectedHeader('jwk', publicJwk);
+
+    final jws = builder.build();
+    return jws.toCompactSerialization();
+  }
+
+  /// Public method to send requests with DPoP proof, retries once on use_dpop_nonce error
+  Future<http.Response> send({
+    required String method,
+    required Uri url,
+    required String accessToken,
+    Map<String, String>? headers,
+    Object? body,
+  }) async {
+    final origin = _extractOrigin(url.toString());
+    final nonce = _nonces[origin];
+
+    final htu = _buildHtu(url.toString());
+    final ath = _calculateAth(accessToken);
+
+    final proof = await _buildProof(
+      htm: method.toUpperCase(),
+      htu: htu,
+      nonce: nonce,
+      ath: ath,
+    );
+
+    final requestHeaders = <String, String>{
+      'Authorization': 'DPoP $accessToken',
+      'DPoP': proof,
+      'Content-Type': 'application/json',
+      if (headers != null) ...headers,
+    };
+
+    http.Response response;
+    switch (method.toUpperCase()) {
+      case 'GET':
+        response = await http.get(url, headers: requestHeaders);
+        break;
+      case 'POST':
+        response = await http.post(url, headers: requestHeaders, body: body);
+        break;
+      case 'PUT':
+        response = await http.put(url, headers: requestHeaders, body: body);
+        break;
+      case 'DELETE':
+        response = await http.delete(url, headers: requestHeaders);
+        break;
+      default:
+        throw UnsupportedError('Unsupported HTTP method: $method');
+    }
+
+    final newNonce = response.headers['dpop-nonce'];
+    if (newNonce != null && newNonce != nonce) {
+      // Save new nonce for origin
+      _nonces[origin] = newNonce;
+    }
+
+    if (response.statusCode == 401) {
+      final wwwAuth = response.headers['www-authenticate'];
+      if (wwwAuth != null &&
+          wwwAuth.contains('DPoP') &&
+          wwwAuth.contains('error="use_dpop_nonce"') &&
+          newNonce != null &&
+          newNonce != nonce) {
+        // Retry once with updated nonce
+        return send(
+          method: method,
+          url: url,
+          accessToken: accessToken,
+          headers: headers,
+          body: body,
+        );
+      }
+    }
+
+    return response;
+  }
+}

lib/main.dart

···
 import 'package:grain/app_logger.dart';
 import 'package:grain/screens/splash_page.dart';
 import 'package:grain/screens/home_page.dart';
+import 'package:grain/auth.dart';
 
 class AppConfig {
   static late final String apiUrl;
···
 
 class _MyAppState extends State<MyApp> {
   bool isSignedIn = false;
-  dynamic session;
   String? displayName;
 
-  void handleSignIn(dynamic newSession) async {
-    // Accept both Map and object with accessToken property
-    final accessToken = newSession is Map<String, String>
-        ? newSession['accessToken']
-        : newSession.accessToken;
+  void handleSignIn() async {
     setState(() {
       isSignedIn = true;
-      session = newSession;
     });
-    apiService.setToken(accessToken);
     // Fetch current user profile from /oauth/session after login
+    appLogger.i('Fetching current user after sign in');
     await apiService.fetchCurrentUser();
   }
 
   void handleSignOut() {
     setState(() {
       isSignedIn = false;
-      session = null;
     });
   }
 

lib/models/atproto_session.dart

···
+import 'package:jose/jose.dart';
+
+class AtprotoSession {
+  final String accessToken;
+  final String? refreshToken;
+  final String tokenType;
+  final DateTime expiresAt;
+  final JsonWebKey dpopJwk;
+  final String issuer;
+  final String subject;
+
+  AtprotoSession({
+    required this.accessToken,
+    this.refreshToken,
+    required this.tokenType,
+    required this.expiresAt,
+    required this.dpopJwk,
+    required this.issuer,
+    required this.subject,
+  });
+
+  factory AtprotoSession.fromJson(Map<String, dynamic> json) {
+    final token = json['tokenSet'] ?? {};
+    final dpopJwkJson = json['dpopJwk'] ?? {};
+
+    return AtprotoSession(
+      accessToken: token['access_token'],
+      refreshToken: token['refresh_token'],
+      tokenType: token['token_type'],
+      expiresAt: DateTime.parse(token['expires_at']),
+      dpopJwk: JsonWebKey.fromJson(dpopJwkJson),
+      issuer: token['iss'],
+      subject: token['sub'],
+    );
+  }
+
+  Map<String, dynamic> toJson() => {
+    'tokenSet': {
+      'access_token': accessToken,
+      'refresh_token': refreshToken,
+      'token_type': tokenType,
+      'expires_at': expiresAt.toIso8601String(),
+      'iss': issuer,
+      'sub': subject,
+    },
+    'dpopJwk': dpopJwk.toJson(),
+  };
+}

lib/screens/create_gallery_page.dart

···
 import 'dart:io';
 import 'package:flutter/material.dart';
+import 'package:grain/api.dart';
 import 'package:image_picker/image_picker.dart';
 import 'package:grain/widgets/plain_text_field.dart';
 import 'package:grain/widgets/app_button.dart';
+import 'gallery_page.dart';
 
 class CreateGalleryPage extends StatefulWidget {
   const CreateGalleryPage({super.key});
···
 
   Future<void> _submit() async {
     setState(() => _submitting = true);
-    // TODO: Implement API call to create gallery
-    await Future.delayed(const Duration(seconds: 2));
+    final galleryUri = await apiService.createGallery(
+      title: _titleController.text.trim(),
+      description: _descController.text.trim(),
+    );
     setState(() => _submitting = false);
-    if (mounted) Navigator.of(context).pop(true);
+    if (mounted && galleryUri != null) {
+      Navigator.of(context).pop();
+      Navigator.of(context).push(
+        MaterialPageRoute(
+          builder: (context) => GalleryPage(
+            uri: galleryUri,
+            currentUserDid: apiService.currentUser?.did,
+          ),
+        ),
+      );
+    } else if (mounted) {
+      Navigator.of(context).pop(true);
+    }
   }
 
   @override

lib/screens/home_page.dart

···
     if (apiService.currentUser == null) {
       return const Scaffold(
         body: Center(
-          child: CircularProgressIndicator(strokeWidth: 2, Color(0xFF0EA5E9)),
+          child: CircularProgressIndicator(
+            strokeWidth: 2,
+            color: Color(0xFF0EA5E9),
+          ),
         ),
       );
     }

lib/screens/profile_page.dart

···
 
   void _onTabChanged() async {
     if (_tabController!.index == 1 && _favs.isEmpty && !_favsLoading) {
-      setState(() {
-        _favsLoading = true;
-      });
+      if (mounted) {
+        setState(() {
+          _favsLoading = true;
+        });
+      }
       String? did = (_profile ?? widget.profile)?.did;
       if (did != null && did.isNotEmpty) {
         try {
···
           }
         }
       } else {
-        setState(() {
-          _favsLoading = false;
-        });
+        if (mounted) {
+          setState(() {
+            _favsLoading = false;
+          });
+        }
       }
     }
   }
 
   Future<void> _fetchProfileAndGalleries() async {
-    setState(() {
-      _loading = true;
-    });
-    String? did = widget.did ?? widget.profile?.did;
-    if (did == null || did.isEmpty) {
+    if (mounted) {
       setState(() {
-        _loading = false;
+        _loading = true;
       });
+    }
+    String? did = widget.did ?? widget.profile?.did;
+    if (did == null || did.isEmpty) {
+      if (mounted) {
+        setState(() {
+          _loading = false;
+        });
+      }
       return;
     }
     final profile = await apiService.fetchProfile(did: did);
     final galleries = await apiService.fetchActorGalleries(did: did);
-    setState(() {
-      _profile = profile;
-      _galleries = galleries;
-      _loading = false;
-    });
+    if (mounted) {
+      setState(() {
+        _profile = profile;
+        _galleries = galleries;
+        _loading = false;
+      });
+    }
   }
 
   @override

lib/screens/splash_page.dart

···
 import 'package:flutter/material.dart';
-import 'package:flutter_web_auth_2/flutter_web_auth_2.dart';
-import 'package:grain/app_logger.dart';
-import 'package:grain/main.dart';
+import 'package:grain/auth.dart';
 import 'package:grain/widgets/app_image.dart';
 
 class SplashPage extends StatefulWidget {
-  final void Function(dynamic session)? onSignIn;
+  final void Function()? onSignIn;
   const SplashPage({super.key, this.onSignIn});
 
   @override
···
 
   Future<void> _signInWithBluesky(BuildContext context) async {
     final handle = _handleController.text.trim();
+
     if (handle.isEmpty) return;
     setState(() {
       _signingIn = true;
     });
+
     try {
-      final apiUrl = AppConfig.apiUrl;
-      final redirectedUrl = await FlutterWebAuth2.authenticate(
-        url:
-            '$apiUrl/oauth/login?client=native&handle=${Uri.encodeComponent(handle)}',
-        callbackUrlScheme: 'grainflutter',
-      );
-      final uri = Uri.parse(redirectedUrl);
-      final token = uri.queryParameters['token'];
+      await auth.login(handle);
 
-      appLogger.i('Redirected URL: $redirectedUrl');
-      appLogger.i('User signed in with handle: $handle');
-
-      if (token == null) {
-        throw Exception('Token not found in redirect URL');
-      }
       if (widget.onSignIn != null) {
-        widget.onSignIn!({'accessToken': token});
+        widget.onSignIn!();
       }
     } finally {
       setState(() {

lib/widgets/app_button.dart

···
   @override
   Widget build(BuildContext context) {
     final Color primaryColor = const Color(0xFF0EA5E9); // Tailwind sky-500
-    final Color secondaryColor = Theme.of(context).colorScheme.surfaceContainerHighest;
+    final Color secondaryColor = Theme.of(
+      context,
+    ).colorScheme.surfaceContainerHighest;
     final Color secondaryBorder = Colors.grey[300]!;
     final Color secondaryText = Colors.black87;
     final Color primaryText = Colors.white;
···
                 : BorderSide(color: secondaryBorder, width: 1),
           ),
           padding: padding ?? const EdgeInsets.symmetric(horizontal: 16),
-          textStyle: TextStyle(
-            fontWeight: FontWeight.w600,
-            fontSize: fontSize,
-          ),
+          textStyle: TextStyle(fontWeight: FontWeight.w600, fontSize: fontSize),
         ),
         child: loading
             ? SizedBox(
···
                 mainAxisAlignment: MainAxisAlignment.center,
                 children: [
                   if (icon != null) ...[
-                    Icon(icon, size: 20, color: isPrimary ? Colors.white : primaryColor),
+                    Icon(
+                      icon,
+                      size: 20,
+                      color: isPrimary ? Colors.white : primaryColor,
+                    ),
                     const SizedBox(width: 8),
                   ],
                   Text(label),

lib/widgets/plain_text_field.dart

···
             decoration: InputDecoration(
               hintText: hintText,
               border: InputBorder.none,
-              contentPadding: const EdgeInsets.symmetric(horizontal: 12, vertical: 12),
+              contentPadding: const EdgeInsets.symmetric(
+                horizontal: 12,
+                vertical: 12,
+              ),
               isDense: true,
             ),
           ),

linux/flutter/generated_plugin_registrant.cc

···
 
 #include <desktop_webview_window/desktop_webview_window_plugin.h>
 #include <file_selector_linux/file_selector_plugin.h>
+#include <flutter_secure_storage_linux/flutter_secure_storage_linux_plugin.h>
 #include <url_launcher_linux/url_launcher_plugin.h>
 #include <window_to_front/window_to_front_plugin.h>
 
···
   g_autoptr(FlPluginRegistrar) file_selector_linux_registrar =
       fl_plugin_registry_get_registrar_for_plugin(registry, "FileSelectorPlugin");
   file_selector_plugin_register_with_registrar(file_selector_linux_registrar);
+  g_autoptr(FlPluginRegistrar) flutter_secure_storage_linux_registrar =
+      fl_plugin_registry_get_registrar_for_plugin(registry, "FlutterSecureStorageLinuxPlugin");
+  flutter_secure_storage_linux_plugin_register_with_registrar(flutter_secure_storage_linux_registrar);
   g_autoptr(FlPluginRegistrar) url_launcher_linux_registrar =
       fl_plugin_registry_get_registrar_for_plugin(registry, "UrlLauncherPlugin");
   url_launcher_plugin_register_with_registrar(url_launcher_linux_registrar);

linux/flutter/generated_plugins.cmake

···
 list(APPEND FLUTTER_PLUGIN_LIST
   desktop_webview_window
   file_selector_linux
+  flutter_secure_storage_linux
   url_launcher_linux
   window_to_front
 )

macos/Flutter/GeneratedPluginRegistrant.swift

···
 
 import desktop_webview_window
 import file_selector_macos
+import flutter_secure_storage_macos
 import flutter_web_auth_2
 import package_info_plus
 import path_provider_foundation
···
 func RegisterGeneratedPlugins(registry: FlutterPluginRegistry) {
   DesktopWebviewWindowPlugin.register(with: registry.registrar(forPlugin: "DesktopWebviewWindowPlugin"))
   FileSelectorPlugin.register(with: registry.registrar(forPlugin: "FileSelectorPlugin"))
+  FlutterSecureStoragePlugin.register(with: registry.registrar(forPlugin: "FlutterSecureStoragePlugin"))
   FlutterWebAuth2Plugin.register(with: registry.registrar(forPlugin: "FlutterWebAuth2Plugin"))
   FPPPackageInfoPlusPlugin.register(with: registry.registrar(forPlugin: "FPPPackageInfoPlusPlugin"))
   PathProviderPlugin.register(with: registry.registrar(forPlugin: "PathProviderPlugin"))

pubspec.lock

···
 # Generated by pub
 # See https://dart.dev/tools/pub/glossary#lockfile
 packages:
+  asn1lib:
+    dependency: transitive
+    description:
+      name: asn1lib
+      sha256: "9a8f69025044eb466b9b60ef3bc3ac99b4dc6c158ae9c56d25eeccf5bc56d024"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.6.5"
   async:
     dependency: transitive
     description:
···
       url: "https://pub.dev"
     source: hosted
     version: "1.19.1"
+  convert:
+    dependency: transitive
+    description:
+      name: convert
+      sha256: b30acd5944035672bc15c6b7a8b47d773e41e2f17de064350988c5d02adb1c68
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.2"
   cross_file:
     dependency: transitive
     description:
···
     source: hosted
     version: "0.3.4+2"
   crypto:
-    dependency: transitive
+    dependency: "direct main"
     description:
       name: crypto
       sha256: "1e445881f28f22d6140f181e07737b22f1e099a5e1ff94b0af2f9e4a463f4855"
       url: "https://pub.dev"
     source: hosted
     version: "3.0.6"
+  crypto_keys:
+    dependency: transitive
+    description:
+      name: crypto_keys
+      sha256: acc19abf34623d990a0e8aec69463d74a824c31f137128f42e2810befc509ad0
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.0+1"
   cupertino_icons:
     dependency: "direct main"
     description:
···
       url: "https://pub.dev"
     source: hosted
     version: "2.0.28"
+  flutter_secure_storage:
+    dependency: "direct main"
+    description:
+      name: flutter_secure_storage
+      sha256: "9cad52d75ebc511adfae3d447d5d13da15a55a92c9410e50f67335b6d21d16ea"
+      url: "https://pub.dev"
+    source: hosted
+    version: "9.2.4"
+  flutter_secure_storage_linux:
+    dependency: transitive
+    description:
+      name: flutter_secure_storage_linux
+      sha256: be76c1d24a97d0b98f8b54bce6b481a380a6590df992d0098f868ad54dc8f688
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.3"
+  flutter_secure_storage_macos:
+    dependency: transitive
+    description:
+      name: flutter_secure_storage_macos
+      sha256: "6c0a2795a2d1de26ae202a0d78527d163f4acbb11cde4c75c670f3a0fc064247"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.3"
+  flutter_secure_storage_platform_interface:
+    dependency: transitive
+    description:
+      name: flutter_secure_storage_platform_interface
+      sha256: cf91ad32ce5adef6fba4d736a542baca9daf3beac4db2d04be350b87f69ac4a8
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.2"
+  flutter_secure_storage_web:
+    dependency: transitive
+    description:
+      name: flutter_secure_storage_web
+      sha256: f4ebff989b4f07b2656fb16b47852c0aab9fed9b4ec1c70103368337bc1886a9
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
+  flutter_secure_storage_windows:
+    dependency: transitive
+    description:
+      name: flutter_secure_storage_windows
+      sha256: b20b07cb5ed4ed74fc567b78a72936203f587eba460af1df11281c9326cd3709
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.2"
   flutter_test:
     dependency: "direct dev"
     description: flutter
···
       url: "https://pub.dev"
     source: hosted
     version: "10.8.0"
+  freezed_annotation:
+    dependency: transitive
+    description:
+      name: freezed_annotation
+      sha256: c2e2d632dd9b8a2b7751117abcfc2b4888ecfe181bd9fca7170d9ef02e595fe2
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.4"
   google_fonts:
     dependency: "direct main"
     description:
···
       url: "https://pub.dev"
     source: hosted
     version: "0.2.1+1"
+  jose:
+    dependency: "direct main"
+    description:
+      name: jose
+      sha256: "7955ec5d131960104e81fbf151abacb9d835c16c9e793ed394b2809f28b2198d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.4"
+  js:
+    dependency: transitive
+    description:
+      name: js
+      sha256: f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.7"
+  json_annotation:
+    dependency: transitive
+    description:
+      name: json_annotation
+      sha256: "1ce844379ca14835a50d2f019a3099f419082cfdd231cd86a142af94dd5c6bb1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.9.0"
   leak_tracker:
     dependency: transitive
     description:
···
       url: "https://pub.dev"
     source: hosted
     version: "2.1.8"
+  pointycastle:
+    dependency: transitive
+    description:
+      name: pointycastle
+      sha256: "4be0097fcf3fd3e8449e53730c631200ebc7b88016acecab2b0da2f0149222fe"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.9.1"
+  quiver:
+    dependency: transitive
+    description:
+      name: quiver
+      sha256: ea0b925899e64ecdfbf9c7becb60d5b50e706ade44a85b2363be2a22d88117d2
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.2"
   rxdart:
     dependency: transitive
     description:
···
     source: hosted
     version: "3.1.4"
   uuid:
-    dependency: transitive
+    dependency: "direct main"
     description:
       name: uuid
       sha256: a5be9ef6618a7ac1e964353ef476418026db906c4facdedaa299b7a2e71690ff
···
       url: "https://pub.dev"
     source: hosted
     version: "1.1.1"
+  web_socket:
+    dependency: transitive
+    description:
+      name: web_socket
+      sha256: "34d64019aa8e36bf9842ac014bb5d2f5586ca73df5e4d9bf5c936975cae6982c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.1"
+  web_socket_channel:
+    dependency: transitive
+    description:
+      name: web_socket_channel
+      sha256: d645757fb0f4773d602444000a8131ff5d48c9e47adfe9772652dd1a4f2d45c8
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.3"
   win32:
     dependency: transitive
     description:
···
       url: "https://pub.dev"
     source: hosted
     version: "0.0.3"
+  x509:
+    dependency: transitive
+    description:
+      name: x509
+      sha256: cbd1a63846884afd273cda247b0365284c8d85a365ca98e110413f93d105b935
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.4+3"
   xdg_directories:
     dependency: transitive
     description:
···
       url: "https://pub.dev"
     source: hosted
     version: "1.1.0"
+  xrpc:
+    dependency: "direct main"
+    description:
+      name: xrpc
+      sha256: bacfa0f6824fdeaa631aad1a5fd064c3f140c771fed94cbd04df3b7d1e008709
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.1"
 sdks:
   dart: ">=3.8.1 <4.0.0"
   flutter: ">=3.27.0"

pubspec.yaml

···
   cached_network_image: ^3.4.1
   image_picker: ^1.1.2
   path_provider: ^2.1.5
+  flutter_secure_storage: ^9.0.0
+  jose: ^0.3.4
+  uuid: ^4.5.1
+  crypto: ^3.0.6
+  xrpc: ^0.6.1
 
 dev_dependencies:
   flutter_test:

windows/flutter/generated_plugin_registrant.cc

···
 
 #include <desktop_webview_window/desktop_webview_window_plugin.h>
 #include <file_selector_windows/file_selector_windows.h>
+#include <flutter_secure_storage_windows/flutter_secure_storage_windows_plugin.h>
 #include <share_plus/share_plus_windows_plugin_c_api.h>
 #include <url_launcher_windows/url_launcher_windows.h>
 #include <window_to_front/window_to_front_plugin.h>
···
       registry->GetRegistrarForPlugin("DesktopWebviewWindowPlugin"));
   FileSelectorWindowsRegisterWithRegistrar(
       registry->GetRegistrarForPlugin("FileSelectorWindows"));
+  FlutterSecureStorageWindowsPluginRegisterWithRegistrar(
+      registry->GetRegistrarForPlugin("FlutterSecureStorageWindowsPlugin"));
   SharePlusWindowsPluginCApiRegisterWithRegistrar(
       registry->GetRegistrarForPlugin("SharePlusWindowsPluginCApi"));
   UrlLauncherWindowsRegisterWithRegistrar(

windows/flutter/generated_plugins.cmake

···
 list(APPEND FLUTTER_PLUGIN_LIST
   desktop_webview_window
   file_selector_windows
+  flutter_secure_storage_windows
   share_plus
   url_launcher_windows
   window_to_front