use async await more

src/atproto/__init__.py

···
     return regex_match(DID_REGEX, did) is not None
 
 
-def resolve_identity(
+async def resolve_identity(
     query: str,
     didkv: KV = nokv,
 ) -> tuple[str, str, dict[str, Any]] | None:
···
         did = resolve_did_from_handle(handle, didkv)
         if not did:
             return None
-        doc = resolve_doc_from_did(did)
+        doc = await resolve_doc_from_did(did)
         if not doc:
             return None
         handles = handles_from_doc(doc)
···
 
     if is_valid_did(query):
         did = query
-        doc = resolve_doc_from_did(did)
+        doc = await resolve_doc_from_did(did)
         if not doc:
             return None
         handle = handle_from_doc(doc)
···
     return None
 
 
-def resolve_pds_from_did(
+async def resolve_pds_from_did(
     did: DID,
     kv: KV = nokv,
     reload: bool = False,
···
         print(f"returning cached pds for {did}")
         return pds
 
-    doc = resolve_doc_from_did(did)
+    doc = await resolve_doc_from_did(did)
     if doc is None:
         return None
     pds = doc["service"][0]["serviceEndpoint"]
···
     return pds
 
 
-def resolve_doc_from_did(
+async def resolve_doc_from_did(
     did: DID,
     directory: str = PLC_DIRECTORY,
 ) -> dict[str, Any] | None:
-    if did.startswith("did:plc:"):
-        response = httpx.get(f"{directory}/{did}")
-        if response.is_success:
-            return response.json()
-        return None
+    async with httpx.AsyncClient() as client:
+        if did.startswith("did:plc:"):
+            response = await client.get(f"{directory}/{did}")
+            if response.is_success:
+                return response.json()
+            return None
 
-    if did.startswith("did:web:"):
-        # TODO: resolve did:web
-        return None
+        if did.startswith("did:web:"):
+            # TODO: resolve did:web
+            return None
 
     return None
 
 
-def resolve_authserver_from_pds(
+async def resolve_authserver_from_pds(
     pds_url: PdsUrl,
     kv: KV = nokv,
     reload: bool = False,
···
 
     assert is_safe_url(pds_url)
     endpoint = f"{pds_url}/.well-known/oauth-protected-resource"
-    response = httpx.get(endpoint)
-    if response.status_code != 200:
-        return None
-    parsed: dict[str, list[str]] = response.json()
-    authserver_url = parsed["authorization_servers"][0]
-    print(f"caching authserver {authserver_url} for PDS {pds_url}")
-    kv.set(pds_url, value=authserver_url)
-    return authserver_url
+    async with httpx.AsyncClient() as client:
+        response = await client.get(endpoint)
+        if response.status_code != 200:
+            return None
+        parsed: dict[str, list[str]] = response.json()
+        authserver_url = parsed["authorization_servers"][0]
+        print(f"caching authserver {authserver_url} for PDS {pds_url}")
+        kv.set(pds_url, value=authserver_url)
+        return authserver_url
 
 
-def fetch_authserver_meta(authserver_url: str) -> dict[str, str] | None:
+async def fetch_authserver_meta(authserver_url: str) -> dict[str, str] | None:
     """Returns metadata from the authserver"""
     assert is_safe_url(authserver_url)
     endpoint = f"{authserver_url}/.well-known/oauth-authorization-server"
-    response = httpx.get(endpoint)
-    if not response.is_success:
-        return None
-    meta: dict[str, Any] = response.json()
-    assert is_valid_authserver_meta(meta, authserver_url)
-    return meta
+    async with httpx.AsyncClient() as client:
+        response = await client.get(endpoint)
+        if not response.is_success:
+            return None
+        meta: dict[str, Any] = response.json()
+        assert is_valid_authserver_meta(meta, authserver_url)
+        return meta
 
 
 async def get_record(

src/atproto/oauth.py

···
 from typing import Any, Callable, NamedTuple
 import time
 import json
-from authlib.jose import JsonWebKey, Key
+from authlib.jose import JsonWebKey, Key, jwt
 from authlib.common.security import generate_token
-from authlib.jose import jwt
 from authlib.oauth2.rfc7636 import create_s256_code_challenge
 from httpx import Response
 
···
 
 # Prepares and sends a pushed auth request (PAR) via HTTP POST to the Authorization Server.
 # Returns "state" id HTTP response on success, without checking HTTP response status
-def send_par_auth_request(
+async def send_par_auth_request(
     authserver_url: str,
     authserver_meta: dict[str, str],
     login_hint: str | None,
···
 
     # IMPORTANT: Pushed Authorization Request URL is untrusted input, SSRF mitigations are needed
     assert is_safe_url(par_url)
-    with hardened_http.get_session() as sess:
-        resp = sess.post(
+    async with hardened_http.get_session() as session:
+        resp = await session.post(
             par_url,
             headers={
                 "Content-Type": "application/x-www-form-urlencoded",
···
         dpop_proof = _authserver_dpop_jwt(
             "POST", par_url, dpop_authserver_nonce, dpop_private_jwk
         )
-        with hardened_http.get_session() as sess:
-            resp = sess.post(
+        async with hardened_http.get_session() as session:
+            resp = await session.post(
                 par_url,
                 headers={
                     "Content-Type": "application/x-www-form-urlencoded",
···
 # Completes the auth flow by sending an initial auth token request.
 # Returns token response (OAuthTokens) and DPoP nonce (str)
 # IMPORTANT: the 'tokens.sub' field must be verified against the original request by code calling this function.
-def initial_token_request(
+async def initial_token_request(
     auth_request: OAuthAuthRequest,
     code: str,
     app_url: str,
···
     authserver_url = auth_request.authserver_iss
 
     # Re-fetch server metadata
-    authserver_meta = fetch_authserver_meta(authserver_url)
+    authserver_meta = await fetch_authserver_meta(authserver_url)
     if not authserver_meta:
         raise Exception("missing authserver meta")
 
···
 
     # IMPORTANT: Token URL is untrusted input, SSRF mitigations are needed
     assert is_safe_url(token_url)
-    with hardened_http.get_session() as sess:
-        resp = sess.post(token_url, data=params, headers={"DPoP": dpop_proof})
+    async with hardened_http.get_session() as session:
+        resp = await session.post(token_url, data=params, headers={"DPoP": dpop_proof})
 
     # Handle DPoP missing/invalid nonce error by retrying with server-provided nonce
     if resp.status_code == 400 and resp.json()["error"] == "use_dpop_nonce":
···
         dpop_proof = _authserver_dpop_jwt(
             "POST", token_url, dpop_authserver_nonce, dpop_private_jwk
         )
-        with hardened_http.get_session() as sess:
-            resp = sess.post(token_url, data=params, headers={"DPoP": dpop_proof})
+        async with hardened_http.get_session() as session:
+            resp = await session.post(
+                token_url,
+                data=params,
+                headers={"DPoP": dpop_proof},
+            )
 
     resp.raise_for_status()
     token_body = resp.json()
···
 
 
 # Returns token response (OAuthTokens) and DPoP nonce (str)
-def refresh_token_request(
+async def refresh_token_request(
     user: OAuthSession,
     app_url: str,
     client_secret_jwk: Key,
···
     authserver_url = user.authserver_iss
 
     # Re-fetch server metadata
-    authserver_meta = fetch_authserver_meta(authserver_url)
+    authserver_meta = await fetch_authserver_meta(authserver_url)
     if not authserver_meta:
         raise Exception("missing authserver meta")
 
···
 
     # IMPORTANT: Token URL is untrusted input, SSRF mitigations are needed
     assert is_safe_url(token_url)
-    with hardened_http.get_session() as sess:
-        resp = sess.post(token_url, data=params, headers={"DPoP": dpop_proof})
+    async with hardened_http.get_session() as session:
+        resp = await session.post(token_url, data=params, headers={"DPoP": dpop_proof})
 
     # Handle DPoP missing/invalid nonce error by retrying with server-provided nonce
     if resp.status_code == 400 and resp.json()["error"] == "use_dpop_nonce":
···
         dpop_proof = _authserver_dpop_jwt(
             "POST", token_url, dpop_authserver_nonce, dpop_private_jwk
         )
-        with hardened_http.get_session() as sess:
-            resp = sess.post(token_url, data=params, headers={"DPoP": dpop_proof})
+        async with hardened_http.get_session() as session:
+            resp = await session.post(
+                token_url, data=params, headers={"DPoP": dpop_proof}
+            )
 
     if resp.status_code not in [200, 201]:
         print(f"Token Refresh Error: {resp.json()}")
···
 
 # Helper to demonstrate making a request (HTTP GET or POST) to the user's PDS ("Resource Server" in OAuth terminology) using DPoP and access token.
 # This method returns a 'requests' reponse, without checking status code.
-def pds_authed_req(
+async def pds_authed_req(
     method: str,
     url: str,
     user: OAuthSession,
···
             dpop_private_jwk,
         )
 
-        with hardened_http.get_session() as sess:
-            response = sess.post(
+        async with hardened_http.get_session() as session:
+            response = await session.post(
                 url,
                 headers={
                     "Authorization": f"DPoP {access_token}",

src/main.py

···
         return render_template("error.html", message="profile not found"), 404
 
     kv = KV(app, "pds_from_did")
-    pds = resolve_pds_from_did(did, kv, reload=reload)
+    pds = await resolve_pds_from_did(did, kv, reload=reload)
     if pds is None:
         return render_template("error.html", message="pds not found"), 404
     (profile, _), links = await asyncio.gather(
···
 
 
 @app.post("/editor/profile")
-def post_editor_profile():
+async def post_editor_profile():
     user = get_user()
     if user is None:
         return redirect("/login", 303)
···
     if not display_name:
         return redirect("/editor", 303)
 
-    put_record(
+    await put_record(
         user=user,
         pds=user.pds_url,
         repo=user.did,
···
 
 
 @app.post("/editor/links")
-def post_editor_links():
+async def post_editor_links():
     user = get_user()
     if user is None:
         return redirect("/login", 303)
···
             link["detail"] = detail
         links.append(link)
 
-    put_record(
+    await put_record(
         user=user,
         pds=user.pds_url,
         repo=user.did,
···
 async def load_profile(
     pds: str,
     did: str,
+    fallback_with_bluesky: bool = True,
     reload: bool = False,
 ) -> tuple[tuple[str, str] | None, bool]:
     kv = KV(app, "profile_from_did")
···
 
     from_bluesky = False
     record = await get_record(pds, did, f"{SCHEMA}.actor.profile", "self")
-    if record is None:
+    if record is None and fallback_with_bluesky:
         record = await get_record(pds, did, "app.bsky.actor.profile", "self")
         from_bluesky = True
     if record is None:
···
     return profile, from_bluesky
 
 
-def put_record(
+# TODO: move to .atproto
+async def put_record(
     user: OAuthSession,
     pds: PdsUrl,
     repo: str,
···
         session_ = user._replace(dpop_pds_nonce=nonce)
         save_auth_session(session, session_)
 
-    response = pds_authed_req(
+    response = await pds_authed_req(
         method="POST",
         url=endpoint,
         body=body,

src/oauth.py

···
 
 
 @oauth.get("/start")
-def oauth_start():
+async def oauth_start():
     # Identity
     username = request.args.get("username") or request.args.get("authserver")
     if not username:
···
     if is_valid_handle(username) or is_valid_did(username):
         login_hint = username
         kv = KV(db, "did_from_handle")
-        identity = resolve_identity(username, didkv=kv)
+        identity = await resolve_identity(username, didkv=kv)
         if identity is None:
             return "couldnt resolve identity", 500
         did, handle, doc = identity
···
         if not pds_url:
             return "pds not found", 404
         current_app.logger.debug(f"account PDS: {pds_url}")
-        authserver_url = resolve_authserver_from_pds(pds_url, pdskv)
+        authserver_url = await resolve_authserver_from_pds(pds_url, pdskv)
         if not authserver_url:
             return "authserver not found", 404
 
     elif username.startswith("https://") and is_safe_url(username):
         did, handle, pds_url = None, None, None
         login_hint = None
-        authserver_url = resolve_authserver_from_pds(username, pdskv) or username
+        authserver_url = await resolve_authserver_from_pds(username, pdskv) or username
 
     else:
         return "not a valid handle, did or auth server", 400
 
     current_app.logger.debug(f"Authserver: {authserver_url}")
     assert is_safe_url(authserver_url)
-    authserver_meta = fetch_authserver_meta(authserver_url)
+    authserver_meta = await fetch_authserver_meta(authserver_url)
     if not authserver_meta:
         return "no authserver meta", 404
 
···
 
     CLIENT_SECRET_JWK = JsonWebKey.import_key(current_app.config["CLIENT_SECRET_JWK"])
 
-    pkce_verifier, state, dpop_authserver_nonce, resp = send_par_auth_request(
+    pkce_verifier, state, dpop_authserver_nonce, resp = await send_par_auth_request(
         authserver_url,
         authserver_meta,
         login_hint,
···
         CLIENT_SECRET_JWK,
         dpop_private_jwk,
     )
+
     if resp.status_code == 400:
-        current_app.logger.debug(f"PAR HTTP 400: {resp.json()}")
-    resp.raise_for_status()
+        current_app.logger.debug("PAR request returned error 400")
+        current_app.logger.debug(resp.text)
+        return redirect(url_for("page_login"), 303)
+    _ = resp.raise_for_status()
 
     par_request_uri: str = resp.json()["request_uri"]
     current_app.logger.debug(f"saving oauth_auth_request to DB  state={state}")
···
 
 
 @oauth.get("/callback")
-def oauth_callback():
+async def oauth_callback():
     state = request.args["state"]
     authserver_iss = request.args["iss"]
     authorization_code = request.args["code"]
···
 
     app_url = request.url_root.replace("http://", "https://")
     CLIENT_SECRET_JWK = JsonWebKey.import_key(current_app.config["CLIENT_SECRET_JWK"])
-    tokens, dpop_authserver_nonce = initial_token_request(
+    tokens, dpop_authserver_nonce = await initial_token_request(
         auth_request,
         authorization_code,
         app_url,
···
     else:
         did = tokens.sub
         assert is_valid_did(did)
-        identity = resolve_identity(did, didkv=didkv)
+        identity = await resolve_identity(did, didkv=didkv)
         if not identity:
             return "could not resolve identity", 500
         did, handle, did_doc = identity
         pds_url = pds_endpoint_from_doc(did_doc)
         if not pds_url:
             return "could not resolve pds", 500
-        authserver_url = resolve_authserver_from_pds(pds_url, authserverkv)
+        authserver_url = await resolve_authserver_from_pds(pds_url, authserverkv)
         assert authserver_url == authserver_iss
 
     assert row.scope == tokens.scope

src/security.py

···
 
 
 class HardenedHttp:
-    def get_session(self) -> httpx.Client:
-        return httpx.Client(
+    def get_session(self) -> httpx.AsyncClient:
+        return httpx.AsyncClient(
             timeout=httpx.Timeout(20, connect=5),
             follow_redirects=False,
             headers={

src/templates/login.html

···
       <form action="{{ url_for('auth_login') }}" method="post">
         <label>
           <span>Handle</span>
-          <input type="text" name="username" placeholder="username.example.com" autocapitalize="off" autocomplete="off" spellcheck="false" required />
+          <input type="text" name="username" placeholder="username.example.com" autocapitalize="off" spellcheck="false" required />
         </label>
         <span class="caption">
           Use your AT Protocol handle to log in.