Better session management

.gitignore

···
 # production
 /build
 
+# keys
+*.b64
+*.pem
+
 # misc
 .DS_Store
-*.pem
 
 # debug
 npm-debug.log*
···
 
 # env files (can opt-in for committing if needed)
 .env*
-
-# vercel
-.vercel
 
 # typescript
 *.tsbuildinfo

server/main.go

···
 //   - POST: set/replace session from JSON body {did, handle, accessJwt, refreshJwt}
 //   - DELETE: clear session
 func handleATPSession(w http.ResponseWriter, r *http.Request) {
-    w.Header().Set("Content-Type", "application/json; charset=utf-8")
-    sid := getOrCreateSessionID(w, r)
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	sid := getOrCreateSessionID(w, r)
 
-    switch r.Method {
-    case http.MethodGet:
-        sessionsMu.Lock()
-        s, ok := userSessions[sid]
-        sessionsMu.Unlock()
-        if !ok || s.DID == "" {
-            w.WriteHeader(http.StatusNoContent)
-            return
-        }
-        _ = json.NewEncoder(w).Encode(s)
-    case http.MethodPost:
-        // Limit body size for session payload
-        r.Body = http.MaxBytesReader(w, r.Body, 16<<10) // 16 KiB
-        var s Session
-        if err := json.NewDecoder(r.Body).Decode(&s); err != nil {
-            http.Error(w, "invalid json", http.StatusBadRequest)
-            return
-        }
-        if s.Handle == "" || s.DID == "" {
-            http.Error(w, "missing did/handle", http.StatusBadRequest)
-            return
-        }
-        sessionsMu.Lock()
-        userSessions[sid] = s
-        sessionsMu.Unlock()
-        w.WriteHeader(http.StatusNoContent)
-    case http.MethodDelete:
-        sessionsMu.Lock()
-        delete(userSessions, sid)
-        sessionsMu.Unlock()
-        w.WriteHeader(http.StatusNoContent)
-    default:
-        w.WriteHeader(http.StatusMethodNotAllowed)
-    }
+	switch r.Method {
+	case http.MethodGet:
+		sessionsMu.Lock()
+		s, ok := userSessions[sid]
+		sessionsMu.Unlock()
+		if !ok || s.DID == "" {
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(s)
+	case http.MethodPost:
+		// Limit body size for session payload
+		r.Body = http.MaxBytesReader(w, r.Body, 16<<10) // 16 KiB
+		var s Session
+		if err := json.NewDecoder(r.Body).Decode(&s); err != nil {
+			http.Error(w, "invalid json", http.StatusBadRequest)
+			return
+		}
+		if s.Handle == "" || s.DID == "" {
+			http.Error(w, "missing did/handle", http.StatusBadRequest)
+			return
+		}
+		sessionsMu.Lock()
+		userSessions[sid] = s
+		sessionsMu.Unlock()
+		w.WriteHeader(http.StatusNoContent)
+	case http.MethodDelete:
+		sessionsMu.Lock()
+		delete(userSessions, sid)
+		sessionsMu.Unlock()
+		w.WriteHeader(http.StatusNoContent)
+	default:
+		w.WriteHeader(http.StatusMethodNotAllowed)
+	}
 }
 
 // resolveHandle resolves a Bluesky handle to a DID using the public AppView endpoint.
···
 		b, _ := io.ReadAll(res.Body)
 		return "", fmt.Errorf("resolveHandle %d: %s", res.StatusCode, string(b))
 	}
-	var out struct{ Did string `json:"did"` }
+	var out struct {
+		Did string `json:"did"`
+	}
 	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
 		return "", err
 	}
···
 // handleOAuthLogin starts the OAuth flow by redirecting the user to Bluesky's authorization endpoint.
 // Expects: GET /oauth/login?handle=<bsky-handle>&return_url=<optional>
 func handleOAuthLogin(w http.ResponseWriter, r *http.Request) {
-    if r.Method != http.MethodGet {
-        w.WriteHeader(http.StatusMethodNotAllowed)
-        return
-    }
-    handle := r.URL.Query().Get("handle")
-    if handle == "" {
-        http.Error(w, "missing handle", http.StatusBadRequest)
-        return
-    }
-    // Generate state and PKCE
-    state := generateState()
-    verifier, challenge, err := generatePKCE()
-    if err != nil {
-        http.Error(w, "internal error", http.StatusInternalServerError)
-        return
-    }
-    // Resolve PDS to request correct OAuth audience at authorization step
-    resourcePDS := "https://bsky.social"
-    if did, err := resolveHandle(handle); err == nil && strings.HasPrefix(did, "did:plc:") {
-        if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
-            resourcePDS = u
-        }
-    }
-    log.Printf("OAuth login: using resource=%s for authorize audience", resourcePDS)
+	if r.Method != http.MethodGet {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+	handle := r.URL.Query().Get("handle")
+	if handle == "" {
+		http.Error(w, "missing handle", http.StatusBadRequest)
+		return
+	}
+	// Generate state and PKCE
+	state := generateState()
+	verifier, challenge, err := generatePKCE()
+	if err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	// Resolve PDS to request correct OAuth audience at authorization step
+	resourcePDS := "https://bsky.social"
+	if did, err := resolveHandle(handle); err == nil && strings.HasPrefix(did, "did:plc:") {
+		if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
+			resourcePDS = u
+		}
+	}
+	log.Printf("OAuth login: using resource=%s for authorize audience", resourcePDS)
 
-    // Persist request in a short-lived cookie
-    req := OAuthRequest{
-        State:         state,
-        Handle:        handle,
-        ReturnUrl:     r.URL.Query().Get("return_url"),
-        PkceVerifier:  verifier,
-        PkceChallenge: challenge,
-        PdsUrl:        resourcePDS,
-    }
-    b, _ := json.Marshal(req)
-    http.SetCookie(w, &http.Cookie{
-        Name:     "oauth_request",
-        Value:    base64.StdEncoding.EncodeToString(b),
-        Path:     "/",
-        HttpOnly: true,
-        Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
-        SameSite: http.SameSiteLaxMode,
-        MaxAge:   300, // 5 min
-    })
+	// Persist request in a short-lived cookie
+	req := OAuthRequest{
+		State:         state,
+		Handle:        handle,
+		ReturnUrl:     r.URL.Query().Get("return_url"),
+		PkceVerifier:  verifier,
+		PkceChallenge: challenge,
+		PdsUrl:        resourcePDS,
+	}
+	b, _ := json.Marshal(req)
+	http.SetCookie(w, &http.Cookie{
+		Name:     "oauth_request",
+		Value:    base64.StdEncoding.EncodeToString(b),
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   300, // 5 min
+	})
 
-    // Build authorize URL (include resource to bind audience up-front)
-    authURL := "https://bsky.social/oauth/authorize?" + url.Values{
-        "client_id":             {oauthManager.clientURI + "/oauth/client-metadata.json"},
-        "redirect_uri":          {oauthManager.clientURI + "/oauth/callback"},
-        "response_type":         {"code"},
-        "scope":                 {oauthScope},
-        "state":                 {state},
-        "code_challenge":        {challenge},
-        "code_challenge_method": {"S256"},
-        "resource":              {resourcePDS},
-    }.Encode()
+	// Build authorize URL (include resource to bind audience up-front)
+	authURL := "https://bsky.social/oauth/authorize?" + url.Values{
+		"client_id":             {oauthManager.clientURI + "/oauth/client-metadata.json"},
+		"redirect_uri":          {oauthManager.clientURI + "/oauth/callback"},
+		"response_type":         {"code"},
+		"scope":                 {oauthScope},
+		"state":                 {state},
+		"code_challenge":        {challenge},
+		"code_challenge_method": {"S256"},
+		"resource":              {resourcePDS},
+	}.Encode()
 
-    http.Redirect(w, r, authURL, http.StatusFound)
+	http.Redirect(w, r, authURL, http.StatusFound)
 }
 
 // Serve OAuth client metadata (Bluesky will fetch this)
 func handleOAuthClientMetadata(w http.ResponseWriter, r *http.Request) {
-    w.Header().Set("Content-Type", "application/json")
-    _ = json.NewEncoder(w).Encode(oauthManager.ClientMetadata())
+	w.Header().Set("Content-Type", "application/json")
+	_ = json.NewEncoder(w).Encode(oauthManager.ClientMetadata())
 }
 
 // Serve JWKS for our private_key_jwt key
 func handleOAuthJWKS(w http.ResponseWriter, r *http.Request) {
-    w.Header().Set("Content-Type", "application/json")
-    _, _ = w.Write([]byte(oauthManager.jwks))
+	w.Header().Set("Content-Type", "application/json")
+	_, _ = w.Write([]byte(oauthManager.jwks))
 }
 
 // Minimal state generator for OAuth
 func generateState() string {
-    b := make([]byte, 16)
-    _, _ = rand.Read(b)
-    return hex.EncodeToString(b)
+	b := make([]byte, 16)
+	_, _ = rand.Read(b)
+	return hex.EncodeToString(b)
 }
 
 // NOTE: Minimal placeholder — implements a visible endpoint so the authorize
 // redirect can come back. Full token exchange can be restored later.
 func handleOAuthCallback(w http.ResponseWriter, r *http.Request) {
-    if r.Method != http.MethodGet {
-        w.WriteHeader(http.StatusMethodNotAllowed)
-        return
-    }
-    code := r.URL.Query().Get("code")
-    state := r.URL.Query().Get("state")
-    if code == "" || state == "" {
-        http.Error(w, "missing code or state", http.StatusBadRequest)
-        return
-    }
-    // Load request from cookie
-    c, err := r.Cookie("oauth_request")
-    if err != nil {
-        http.Error(w, "invalid state", http.StatusBadRequest)
-        return
-    }
-    raw, err := base64.StdEncoding.DecodeString(c.Value)
-    if err != nil {
-        http.Error(w, "invalid state", http.StatusBadRequest)
-        return
-    }
-    var ore OAuthRequest
-    if err := json.Unmarshal(raw, &ore); err != nil {
-        http.Error(w, "invalid state", http.StatusBadRequest)
-        return
-    }
-    if ore.State != state {
-        http.Error(w, "invalid state", http.StatusBadRequest)
-        return
-    }
+	if r.Method != http.MethodGet {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+	code := r.URL.Query().Get("code")
+	state := r.URL.Query().Get("state")
+	if code == "" || state == "" {
+		http.Error(w, "missing code or state", http.StatusBadRequest)
+		return
+	}
+	// Load request from cookie
+	c, err := r.Cookie("oauth_request")
+	if err != nil {
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
+	raw, err := base64.StdEncoding.DecodeString(c.Value)
+	if err != nil {
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
+	var ore OAuthRequest
+	if err := json.Unmarshal(raw, &ore); err != nil {
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
+	if ore.State != state {
+		http.Error(w, "invalid state", http.StatusBadRequest)
+		return
+	}
 
-    // Resolve user's PDS base upfront from handle so we can request the correct token audience via 'resource'
-    var resourcePDS string
-    if ore.PdsUrl != "" {
-        resourcePDS = ore.PdsUrl
-    } else if ore.Handle != "" {
-        if did, err := resolveHandle(ore.Handle); err == nil && strings.HasPrefix(did, "did:plc:") {
-            if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
-                resourcePDS = u
-            }
-        }
-    }
-    if resourcePDS == "" {
-        resourcePDS = "https://bsky.social"
-    }
-    log.Printf("OAuth callback: using resource=%s for token audience", resourcePDS)
+	// Resolve user's PDS base upfront from handle so we can request the correct token audience via 'resource'
+	var resourcePDS string
+	if ore.PdsUrl != "" {
+		resourcePDS = ore.PdsUrl
+	} else if ore.Handle != "" {
+		if did, err := resolveHandle(ore.Handle); err == nil && strings.HasPrefix(did, "did:plc:") {
+			if u, err2 := resolvePDSFromPLC(did); err2 == nil && u != "" {
+				resourcePDS = u
+			}
+		}
+	}
+	if resourcePDS == "" {
+		resourcePDS = "https://bsky.social"
+	}
+	log.Printf("OAuth callback: using resource=%s for token audience", resourcePDS)
 
-    // Token exchange
-    tokenURL := "https://bsky.social/oauth/token"
-    clientID := oauthManager.clientURI + "/oauth/client-metadata.json"
-    form := url.Values{
-        "grant_type":    {"authorization_code"},
-        "code":          {code},
-        "redirect_uri":  {oauthManager.clientURI + "/oauth/callback"},
-        "code_verifier": {ore.PkceVerifier},
-        "client_id":     {clientID},
-        // Request default OAuth scope and set resource to user's PDS so access token is audience-bound correctly
-        "scope":         {oauthScope},
-        "resource":      {resourcePDS},
-    }
-    assertion, err := oauthManager.generateClientAssertion(clientID, tokenURL)
-    if err != nil {
-        http.Error(w, "token exchange failed", http.StatusInternalServerError)
-        return
-    }
-    form.Set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
-    form.Set("client_assertion", assertion)
+	// Token exchange
+	tokenURL := "https://bsky.social/oauth/token"
+	clientID := oauthManager.clientURI + "/oauth/client-metadata.json"
+	form := url.Values{
+		"grant_type":    {"authorization_code"},
+		"code":          {code},
+		"redirect_uri":  {oauthManager.clientURI + "/oauth/callback"},
+		"code_verifier": {ore.PkceVerifier},
+		"client_id":     {clientID},
+		// Request default OAuth scope and set resource to user's PDS so access token is audience-bound correctly
+		"scope":    {oauthScope},
+		"resource": {resourcePDS},
+	}
+	assertion, err := oauthManager.generateClientAssertion(clientID, tokenURL)
+	if err != nil {
+		http.Error(w, "token exchange failed", http.StatusInternalServerError)
+		return
+	}
+	form.Set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
+	form.Set("client_assertion", assertion)
 
-    // Build DPoP proof and send (with nonce retry)
-    buildReq := func(dpop string) (*http.Request, error) {
-        req, err := http.NewRequest(http.MethodPost, tokenURL, strings.NewReader(form.Encode()))
-        if err != nil { return nil, err }
-        req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-        req.Header.Set("Accept", "application/json")
-        if dpop != "" { req.Header.Set("DPoP", dpop) }
-        return req, nil
-    }
-    // 1st attempt
-    dpop, err := oauthManager.generateDPoPProof("POST", tokenURL, "")
-    if err != nil {
-        http.Error(w, "dpop generation failed", http.StatusInternalServerError)
-        return
-    }
-    req1, _ := buildReq(dpop)
-    res, err := http.DefaultClient.Do(req1)
-    if err != nil {
-        http.Error(w, "token exchange failed", http.StatusBadGateway)
-        return
-    }
-    body, _ := io.ReadAll(res.Body)
-    res.Body.Close()
-    log.Printf("OAuth callback: token exchange attempt1 status=%d, body=%s", res.StatusCode, string(body))
-    if n := res.Header.Get("DPoP-Nonce"); n != "" { log.Printf("OAuth callback: received DPoP-Nonce: %s", n) }
-    // use_dpop_nonce retry
-    if res.StatusCode == http.StatusBadRequest {
-        var er struct{ Error string `json:"error"` }
-        _ = json.Unmarshal(body, &er)
-        if er.Error == "use_dpop_nonce" {
-            if nonce := res.Header.Get("DPoP-Nonce"); nonce != "" {
-                dpop2, err2 := oauthManager.generateDPoPProof("POST", tokenURL, nonce)
-                if err2 != nil {
-                    http.Error(w, "dpop regeneration failed", http.StatusInternalServerError)
-                    return
-                }
-                req2, _ := buildReq(dpop2)
-                res, err = http.DefaultClient.Do(req2)
-                if err != nil {
-                    http.Error(w, "token exchange failed", http.StatusBadGateway)
-                    return
-                }
-                body, _ = io.ReadAll(res.Body)
-                res.Body.Close()
-                log.Printf("OAuth callback: token exchange attempt2 status=%d, body=%s", res.StatusCode, string(body))
-            }
-        }
-    }
-    if res.StatusCode != http.StatusOK {
-        log.Printf("OAuth callback: token exchange failed final status=%d, body=%s", res.StatusCode, string(body))
-        http.Error(w, "token exchange failed", http.StatusBadRequest)
-        return
-    }
-    // Parse tokens
-    var tok struct {
-        AccessToken  string `json:"access_token"`
-        RefreshToken string `json:"refresh_token"`
-        TokenType    string `json:"token_type"`
-        ExpiresIn    int    `json:"expires_in"`
-        Scope        string `json:"scope"`
-        Sub          string `json:"sub"`
-        Aud          string `json:"aud"`
-    }
-    if err := json.Unmarshal(body, &tok); err != nil {
-        http.Error(w, "token decode failed", http.StatusInternalServerError)
-        return
-    }
-    if tok.Sub == "" {
-        http.Error(w, "token decode failed", http.StatusInternalServerError)
-        return
-    }
-    // Derive PDS base:
-    // 1) If aud indicates did:web, use that host
-    // 2) Else, resolve from DID (plc) document service endpoint #atproto_pds
-    // 3) Fallback to bsky.social
-    pdsURL := "https://bsky.social"
-    if strings.HasPrefix(tok.Aud, "did:web:") {
-        host := strings.TrimPrefix(tok.Aud, "did:web:")
-        if host != "" {
-            pdsURL = "https://" + host
-        }
-    } else if strings.HasPrefix(tok.Sub, "did:plc:") {
-        if u, err := resolvePDSFromPLC(tok.Sub); err == nil && u != "" {
-            pdsURL = u
-        } else if err != nil {
-            log.Printf("OAuth callback: PLC resolve failed for %s: %v", tok.Sub, err)
-        }
-    }
-    log.Printf("OAuth callback: token aud=%q, chosen PDS base=%s, token_type=%s", tok.Aud, pdsURL, tok.TokenType)
-    // Save OAuth session
-    sess := OAuthSession{
-        Did:        tok.Sub,
-        Handle:     ore.Handle,
-        PdsUrl:     pdsURL,
-        TokenType:  tok.TokenType,
-        Scope:      tok.Scope,
-        AccessJwt:  tok.AccessToken,
-        RefreshJwt: tok.RefreshToken,
-        Expiry:     time.Now().Add(time.Duration(tok.ExpiresIn) * time.Second),
-    }
-    oauthManager.SaveSession(sess.Did, sess)
-    // Save cookie session
-    userSession, _ := oauthManager.store.Get(r, SessionName)
-    userSession.Values["did"] = sess.Did
-    userSession.Values["handle"] = sess.Handle
-    userSession.Values["authenticated"] = true
-    _ = userSession.Save(r, w)
+	// Build DPoP proof and send (with nonce retry)
+	buildReq := func(dpop string) (*http.Request, error) {
+		req, err := http.NewRequest(http.MethodPost, tokenURL, strings.NewReader(form.Encode()))
+		if err != nil {
+			return nil, err
+		}
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		req.Header.Set("Accept", "application/json")
+		if dpop != "" {
+			req.Header.Set("DPoP", dpop)
+		}
+		return req, nil
+	}
+	// 1st attempt
+	dpop, err := oauthManager.generateDPoPProof("POST", tokenURL, "")
+	if err != nil {
+		http.Error(w, "dpop generation failed", http.StatusInternalServerError)
+		return
+	}
+	req1, _ := buildReq(dpop)
+	res, err := http.DefaultClient.Do(req1)
+	if err != nil {
+		http.Error(w, "token exchange failed", http.StatusBadGateway)
+		return
+	}
+	body, _ := io.ReadAll(res.Body)
+	res.Body.Close()
+	log.Printf("OAuth callback: token exchange attempt1 status=%d, body=%s", res.StatusCode, string(body))
+	if n := res.Header.Get("DPoP-Nonce"); n != "" {
+		log.Printf("OAuth callback: received DPoP-Nonce: %s", n)
+	}
+	// use_dpop_nonce retry
+	if res.StatusCode == http.StatusBadRequest {
+		var er struct {
+			Error string `json:"error"`
+		}
+		_ = json.Unmarshal(body, &er)
+		if er.Error == "use_dpop_nonce" {
+			if nonce := res.Header.Get("DPoP-Nonce"); nonce != "" {
+				dpop2, err2 := oauthManager.generateDPoPProof("POST", tokenURL, nonce)
+				if err2 != nil {
+					http.Error(w, "dpop regeneration failed", http.StatusInternalServerError)
+					return
+				}
+				req2, _ := buildReq(dpop2)
+				res, err = http.DefaultClient.Do(req2)
+				if err != nil {
+					http.Error(w, "token exchange failed", http.StatusBadGateway)
+					return
+				}
+				body, _ = io.ReadAll(res.Body)
+				res.Body.Close()
+				log.Printf("OAuth callback: token exchange attempt2 status=%d, body=%s", res.StatusCode, string(body))
+			}
+		}
+	}
+	if res.StatusCode != http.StatusOK {
+		log.Printf("OAuth callback: token exchange failed final status=%d, body=%s", res.StatusCode, string(body))
+		http.Error(w, "token exchange failed", http.StatusBadRequest)
+		return
+	}
+	// Parse tokens
+	var tok struct {
+		AccessToken  string `json:"access_token"`
+		RefreshToken string `json:"refresh_token"`
+		TokenType    string `json:"token_type"`
+		ExpiresIn    int    `json:"expires_in"`
+		Scope        string `json:"scope"`
+		Sub          string `json:"sub"`
+		Aud          string `json:"aud"`
+	}
+	if err := json.Unmarshal(body, &tok); err != nil {
+		http.Error(w, "token decode failed", http.StatusInternalServerError)
+		return
+	}
+	if tok.Sub == "" {
+		http.Error(w, "token decode failed", http.StatusInternalServerError)
+		return
+	}
+	// Derive PDS base:
+	// 1) If aud indicates did:web, use that host
+	// 2) Else, resolve from DID (plc) document service endpoint #atproto_pds
+	// 3) Fallback to bsky.social
+	pdsURL := "https://bsky.social"
+	if strings.HasPrefix(tok.Aud, "did:web:") {
+		host := strings.TrimPrefix(tok.Aud, "did:web:")
+		if host != "" {
+			pdsURL = "https://" + host
+		}
+	} else if strings.HasPrefix(tok.Sub, "did:plc:") {
+		if u, err := resolvePDSFromPLC(tok.Sub); err == nil && u != "" {
+			pdsURL = u
+		} else if err != nil {
+			log.Printf("OAuth callback: PLC resolve failed for %s: %v", tok.Sub, err)
+		}
+	}
+	log.Printf("OAuth callback: token aud=%q, chosen PDS base=%s, token_type=%s", tok.Aud, pdsURL, tok.TokenType)
+	// Save OAuth session
+	sess := OAuthSession{
+		Did:        tok.Sub,
+		Handle:     ore.Handle,
+		PdsUrl:     pdsURL,
+		TokenType:  tok.TokenType,
+		Scope:      tok.Scope,
+		AccessJwt:  tok.AccessToken,
+		RefreshJwt: tok.RefreshToken,
+		Expiry:     time.Now().Add(time.Duration(tok.ExpiresIn) * time.Second),
+	}
+	oauthManager.SaveSession(sess.Did, sess)
+	// Save cookie session
+	userSession, _ := oauthManager.store.Get(r, SessionName)
+	userSession.Values["did"] = sess.Did
+	userSession.Values["handle"] = sess.Handle
+	userSession.Values["authenticated"] = true
+	_ = userSession.Save(r, w)
 
-    // Also set legacy session cookie used by /atp/session
-    sid := "oauth_session_" + sess.Handle
-    sessionsMu.Lock()
-    userSessions[sid] = Session{DID: sess.Did, Handle: sess.Handle, AccessJWT: sess.AccessJwt, RefreshJWT: sess.RefreshJwt}
-    sessionsMu.Unlock()
-    // Set legacy session cookie used by getOrCreateSessionID()/atp/session
-    http.SetCookie(w, &http.Cookie{
-        Name:     "tap_session",
-        Value:    sid,
-        Path:     "/",
-        HttpOnly: true,
-        Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
-        SameSite: http.SameSiteLaxMode,
-        Expires:  time.Now().Add(30 * 24 * time.Hour),
-    })
-    // Clear the oauth_request cookie
-    http.SetCookie(w, &http.Cookie{
-        Name:     "oauth_request",
-        Value:    "",
-        Path:     "/",
-        HttpOnly: true,
-        Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
-        SameSite: http.SameSiteLaxMode,
-        MaxAge:   -1,
-    })
-    // Post-login sanity: validate token can call PDS using DPoP on describeRepo
-    go func(did, pds string) {
-        // Give a tiny delay to avoid racing cookie writes in some environments
-        time.Sleep(200 * time.Millisecond)
-        sanityURL := pds + "/xrpc/com.atproto.repo.describeRepo?repo=" + url.QueryEscape(did)
-        log.Printf("auth sanity: calling describeRepo for %s at %s", did, sanityURL)
-        resp, err := pdsRequest(w, r, http.MethodGet, sanityURL, "", nil)
-        if err != nil {
-            log.Printf("auth sanity: request error: %v", err)
-            return
-        }
-        defer resp.Body.Close()
-        b, _ := io.ReadAll(resp.Body)
-        if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-            log.Printf("auth sanity: describeRepo -> %d body=%s", resp.StatusCode, string(b))
-        } else {
-            log.Printf("auth sanity: describeRepo OK -> %d", resp.StatusCode)
-        }
-    }(sess.Did, sess.PdsUrl)
+	// Also set legacy session cookie used by /atp/session
+	sid := "oauth_session_" + sess.Handle
+	sessionsMu.Lock()
+	userSessions[sid] = Session{DID: sess.Did, Handle: sess.Handle, AccessJWT: sess.AccessJwt, RefreshJWT: sess.RefreshJwt}
+	sessionsMu.Unlock()
+	// Set legacy session cookie used by getOrCreateSessionID()/atp/session
+	http.SetCookie(w, &http.Cookie{
+		Name:     "tap_session",
+		Value:    sid,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
+		SameSite: http.SameSiteLaxMode,
+		Expires:  time.Now().Add(30 * 24 * time.Hour),
+	})
+	// Clear the oauth_request cookie
+	http.SetCookie(w, &http.Cookie{
+		Name:     "oauth_request",
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   strings.HasPrefix(oauthManager.clientURI, "https://"),
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1,
+	})
+	// Post-login sanity: validate token can call PDS using DPoP on describeRepo
+	go func(did, pds string) {
+		// Give a tiny delay to avoid racing cookie writes in some environments
+		time.Sleep(200 * time.Millisecond)
+		sanityURL := pds + "/xrpc/com.atproto.repo.describeRepo?repo=" + url.QueryEscape(did)
+		log.Printf("auth sanity: calling describeRepo for %s at %s", did, sanityURL)
+		resp, err := pdsRequest(w, r, http.MethodGet, sanityURL, "", nil)
+		if err != nil {
+			log.Printf("auth sanity: request error: %v", err)
+			return
+		}
+		defer resp.Body.Close()
+		b, _ := io.ReadAll(resp.Body)
+		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			log.Printf("auth sanity: describeRepo -> %d body=%s", resp.StatusCode, string(b))
+		} else {
+			log.Printf("auth sanity: describeRepo OK -> %d", resp.StatusCode)
+		}
+	}(sess.Did, sess.PdsUrl)
 
-    // Redirect back
-    ret := ore.ReturnUrl
-    if ret == "" { ret = "/" }
-    http.Redirect(w, r, ret, http.StatusFound)
+	// Redirect back
+	ret := ore.ReturnUrl
+	if ret == "" {
+		ret = "/"
+	}
+	http.Redirect(w, r, ret, http.StatusFound)
 }
 
 func handleOAuthLogout(w http.ResponseWriter, r *http.Request) {
-    if r.Method != http.MethodPost {
-        w.WriteHeader(http.StatusMethodNotAllowed)
-        return
-    }
-    http.Redirect(w, r, "/", http.StatusFound)
+	if r.Method != http.MethodPost {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
+	http.Redirect(w, r, "/", http.StatusFound)
 }
 
 // pdsBaseFromUser returns the user's PDS base if an OAuth session exists; otherwise bsky.social.
 func pdsBaseFromUser(r *http.Request) string {
-    if oauthManager != nil {
-        if u := oauthManager.GetUser(r); u != nil && u.Pds != "" {
-            return u.Pds
-        }
-    }
-    return "https://bsky.social"
+	if oauthManager != nil {
+		if u := oauthManager.GetUser(r); u != nil && u.Pds != "" {
+			return u.Pds
+		}
+	}
+	return "https://bsky.social"
 }
 
 // resolvePDSFromPLC fetches the DID PLC document and returns the atproto_pds service endpoint if present.
 func resolvePDSFromPLC(did string) (string, error) {
-    // Example: https://plc.directory/did:plc:xyz
-    url := "https://plc.directory/" + did
-    req, _ := http.NewRequest(http.MethodGet, url, nil)
-    req.Header.Set("Accept", "application/json")
-    res, err := http.DefaultClient.Do(req)
-    if err != nil {
-        return "", err
-    }
-    defer res.Body.Close()
-    if res.StatusCode != http.StatusOK {
-        b, _ := io.ReadAll(res.Body)
-        return "", fmt.Errorf("plc %d: %s", res.StatusCode, string(b))
-    }
-    var doc struct {
-        Service []struct {
-            ID              string `json:"id"`
-            Type            string `json:"type"`
-            ServiceEndpoint string `json:"serviceEndpoint"`
-        } `json:"service"`
-    }
-    if err := json.NewDecoder(res.Body).Decode(&doc); err != nil {
-        return "", err
-    }
-    for _, s := range doc.Service {
-        if s.Type == "AtprotoPersonalDataServer" && s.ServiceEndpoint != "" {
-            return s.ServiceEndpoint, nil
-        }
-        if s.ID == "#atproto_pds" && s.ServiceEndpoint != "" { // legacy id
-            return s.ServiceEndpoint, nil
-        }
-    }
-    return "", fmt.Errorf("pds endpoint not found in DID doc")
+	// Example: https://plc.directory/did:plc:xyz
+	url := "https://plc.directory/" + did
+	req, _ := http.NewRequest(http.MethodGet, url, nil)
+	req.Header.Set("Accept", "application/json")
+	res, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		b, _ := io.ReadAll(res.Body)
+		return "", fmt.Errorf("plc %d: %s", res.StatusCode, string(b))
+	}
+	var doc struct {
+		Service []struct {
+			ID              string `json:"id"`
+			Type            string `json:"type"`
+			ServiceEndpoint string `json:"serviceEndpoint"`
+		} `json:"service"`
+	}
+	if err := json.NewDecoder(res.Body).Decode(&doc); err != nil {
+		return "", err
+	}
+	for _, s := range doc.Service {
+		if s.Type == "AtprotoPersonalDataServer" && s.ServiceEndpoint != "" {
+			return s.ServiceEndpoint, nil
+		}
+		if s.ID == "#atproto_pds" && s.ServiceEndpoint != "" { // legacy id
+			return s.ServiceEndpoint, nil
+		}
+	}
+	return "", fmt.Errorf("pds endpoint not found in DID doc")
 }
 
 // pdsRequest sends an XRPC request to the user's PDS using dual-scheme auth:
···
 // 3) If still 400, fall back to Authorization: DPoP <token> with DPoP proof (nonce if provided)
 // If no OAuth session is present, falls back to authedDo (legacy app-password flow).
 func pdsRequest(w http.ResponseWriter, r *http.Request, method, url, contentType string, body []byte) (*http.Response, error) {
-    // Choose auth source: prefer OAuth session; fall back to legacy tap_session if present
-    var (
-        accToken string
-        tokType  string
-        scopeStr string
-    )
-    if oauthManager != nil {
-        if u := oauthManager.GetUser(r); u != nil {
-            if s, ok := oauthManager.GetSession(u.Did); ok {
-                accToken = s.AccessJwt
-                tokType = s.TokenType
-                scopeStr = s.Scope
-            }
-        }
-    }
-    if accToken == "" {
-        // try app-level session via legacy tap_session lookup helper
-        if s, ok := getSession(r); ok && s.AccessJWT != "" {
-            accToken = s.AccessJWT
-            tokType = "DPoP"
-            scopeStr = ""
-            log.Printf("pdsRequest: using getSession() token for auth")
-        }
-    }
-    if accToken == "" {
-        // read tap_session cookie directly without creating a new one
-        if c, err := r.Cookie("tap_session"); err == nil && c != nil && c.Value != "" {
-            sessionsMu.Lock()
-            legacy, ok := userSessions[c.Value]
-            sessionsMu.Unlock()
-            if ok && legacy.AccessJWT != "" {
-                accToken = legacy.AccessJWT
-                tokType = "DPoP"
-                scopeStr = ""
-                log.Printf("pdsRequest: using legacy tap_session map token for auth (sid=%s)", c.Value)
-            }
-        }
-    }
-    if accToken == "" {
-        // No token at all -> fall back to authedDo (may be anonymous)
-        req, _ := http.NewRequest(method, url, bytes.NewReader(body))
-        if contentType != "" { req.Header.Set("Content-Type", contentType) }
-        req.Header.Set("Accept", "application/json")
-        return authedDo(w, r, req)
-    }
-    // Builder for requests with a given scheme and optional nonce
-    doWith := func(scheme, nonce string) (*http.Response, []byte, error) {
-        // Bind proof to access token via 'ath' for stricter PDSes
-        proof, err := oauthManager.generateDPoPProofWithToken(method, url, accToken, nonce)
-        if err != nil { return nil, nil, err }
-        req, _ := http.NewRequest(method, url, bytes.NewReader(body))
-        if contentType != "" { req.Header.Set("Content-Type", contentType) }
-        req.Header.Set("Accept", "application/json")
-        req.Header.Set("Authorization", scheme+" "+accToken)
-        req.Header.Set("DPoP", proof)
-        // Log target PDS host and path
-        if req.URL != nil {
-            log.Printf("pdsRequest: attempt %s %s (host=%s, scheme=%s, nonce=%t)", method, req.URL.Path, req.URL.Host, scheme, nonce != "")
-        }
-        // Log Authorization header prefix and token_type for diagnostics (never log the token itself)
-        authHdr := req.Header.Get("Authorization")
-        authPrefix := authHdr
-        if sp := strings.IndexByte(authHdr, ' '); sp > 0 {
-            authPrefix = authHdr[:sp]
-        }
-        log.Printf("pdsRequest: auth prefix=%s, session.token_type=%s, session.scope=%s", authPrefix, tokType, scopeStr)
-        res, err := http.DefaultClient.Do(req)
-        if err != nil { return nil, nil, err }
-        b, _ := io.ReadAll(res.Body)
-        res.Body.Close()
-        // reattach
-        res.Body = io.NopCloser(bytes.NewReader(b))
-        if res.StatusCode >= 400 {
-            log.Printf("pdsRequest: %s %s -> %d (scheme=%s, nonce=%t) body=%s", method, url, res.StatusCode, scheme, nonce != "", string(b))
-        }
-        return res, b, nil
-    }
-    // 1) Prefer DPoP token scheme (token_type is DPoP)
-    res, b, err := doWith("DPoP", "")
-    if err != nil { return nil, err }
-    if res.StatusCode == http.StatusBadRequest || res.StatusCode == http.StatusUnauthorized {
-        if n := res.Header.Get("DPoP-Nonce"); n != "" {
-            log.Printf("pdsRequest: retrying with DPoP+nonce=%s", n)
-            r2, _, e2 := doWith("DPoP", n)
-            return r2, e2
-        }
-        // Some servers encode nonce hint in JSON too
-        var er struct{ Error string `json:"error"` }
-        _ = json.Unmarshal(b, &er)
-        if er.Error == "use_dpop_nonce" {
-            if n := res.Header.Get("DPoP-Nonce"); n != "" {
-                log.Printf("pdsRequest: retrying with DPoP+nonce(from body)=%s", n)
-                r2, _, e2 := doWith("DPoP", n)
-                return r2, e2
-            }
-        }
-    }
-    if res.StatusCode != http.StatusBadRequest && res.StatusCode != http.StatusUnauthorized {
-        return res, nil
-    }
-    // 2) Optionally fallback to Bearer+DPoP (for older servers), but only if our token is not DPoP-bound
-    if strings.EqualFold(tokType, "DPoP") {
-        log.Printf("pdsRequest: token_type=DPoP, skipping Bearer fallback")
-        return res, nil
-    }
-    // Otherwise, try Bearer fallback
-    log.Printf("pdsRequest: falling back to Bearer token scheme with DPoP proof")
-    res, b, err = doWith("Bearer", "")
-    if err != nil { return nil, err }
-    if res.StatusCode == http.StatusBadRequest {
-        if n := res.Header.Get("DPoP-Nonce"); n != "" {
-            log.Printf("pdsRequest: retrying with Bearer+DPoP nonce=%s", n)
-            r2, _, e2 := doWith("Bearer", n)
-            return r2, e2
-        }
-    }
-    return res, nil
+	// Choose auth source: prefer OAuth session; fall back to legacy tap_session if present
+	var (
+		accToken string
+		tokType  string
+		scopeStr string
+	)
+	oauthUserPresent := false
+	if oauthManager != nil {
+		if u := oauthManager.GetUser(r); u != nil && u.Did != "" {
+			oauthUserPresent = true
+			if s, ok := oauthManager.GetSession(u.Did); ok {
+				accToken = s.AccessJwt
+				tokType = s.TokenType
+				scopeStr = s.Scope
+			} else if s2, ok := oauthManager.GetSessionFromCookie(r); ok {
+				// Rehydrate from cookie automatically
+				oauthManager.SaveSession(s2.Did, s2)
+				accToken = s2.AccessJwt
+				tokType = s2.TokenType
+				scopeStr = s2.Scope
+			}
+		}
+	}
+	// If OAuth user is present but we couldn't load tokens, do NOT silently fall back
+	if oauthUserPresent && accToken == "" {
+		log.Printf("pdsRequest: oauth cookie present but no tokens available; refusing legacy fallback")
+		return &http.Response{StatusCode: http.StatusUnauthorized, Body: io.NopCloser(strings.NewReader(`{"error":"oauth_session_missing"}`))}, nil
+	}
+	if accToken == "" {
+		// try app-level session via legacy tap_session lookup helper
+		if s, ok := getSession(r); ok && s.AccessJWT != "" {
+			accToken = s.AccessJWT
+			tokType = "DPoP"
+			scopeStr = ""
+			log.Printf("pdsRequest: using getSession() token for auth")
+		}
+	}
+	if accToken == "" {
+		// read tap_session cookie directly without creating a new one
+		if c, err := r.Cookie("tap_session"); err == nil && c != nil && c.Value != "" {
+			sessionsMu.Lock()
+			legacy, ok := userSessions[c.Value]
+			sessionsMu.Unlock()
+			if ok && legacy.AccessJWT != "" {
+				accToken = legacy.AccessJWT
+				tokType = "DPoP"
+				scopeStr = ""
+				log.Printf("pdsRequest: using legacy tap_session map token for auth (sid=%s)", c.Value)
+			}
+		}
+	}
+	if accToken == "" {
+		// No token at all -> fall back to authedDo (may be anonymous)
+		req, _ := http.NewRequest(method, url, bytes.NewReader(body))
+		if contentType != "" {
+			req.Header.Set("Content-Type", contentType)
+		}
+		req.Header.Set("Accept", "application/json")
+		return authedDo(w, r, req)
+	}
+	// Builder for requests with a given scheme and optional nonce
+	doWith := func(scheme, nonce string) (*http.Response, []byte, error) {
+		// Bind proof to access token via 'ath' for stricter PDSes
+		proof, err := oauthManager.generateDPoPProofWithToken(method, url, accToken, nonce)
+		if err != nil {
+			return nil, nil, err
+		}
+		req, _ := http.NewRequest(method, url, bytes.NewReader(body))
+		if contentType != "" {
+			req.Header.Set("Content-Type", contentType)
+		}
+		req.Header.Set("Accept", "application/json")
+		req.Header.Set("Authorization", scheme+" "+accToken)
+		req.Header.Set("DPoP", proof)
+		// Log target PDS host and path
+		if req.URL != nil {
+			log.Printf("pdsRequest: attempt %s %s (host=%s, scheme=%s, nonce=%t)", method, req.URL.Path, req.URL.Host, scheme, nonce != "")
+		}
+		// Log Authorization header prefix and token_type for diagnostics (never log the token itself)
+		authHdr := req.Header.Get("Authorization")
+		authPrefix := authHdr
+		if sp := strings.IndexByte(authHdr, ' '); sp > 0 {
+			authPrefix = authHdr[:sp]
+		}
+		log.Printf("pdsRequest: auth prefix=%s, session.token_type=%s, session.scope=%s", authPrefix, tokType, scopeStr)
+		res, err := http.DefaultClient.Do(req)
+		if err != nil {
+			return nil, nil, err
+		}
+		b, _ := io.ReadAll(res.Body)
+		res.Body.Close()
+		// reattach
+		res.Body = io.NopCloser(bytes.NewReader(b))
+		if res.StatusCode >= 400 {
+			log.Printf("pdsRequest: %s %s -> %d (scheme=%s, nonce=%t) body=%s", method, url, res.StatusCode, scheme, nonce != "", string(b))
+		}
+		return res, b, nil
+	}
+	// 1) Prefer DPoP token scheme (token_type is DPoP)
+	res, b, err := doWith("DPoP", "")
+	if err != nil {
+		return nil, err
+	}
+	if res.StatusCode == http.StatusBadRequest || res.StatusCode == http.StatusUnauthorized {
+		if n := res.Header.Get("DPoP-Nonce"); n != "" {
+			log.Printf("pdsRequest: retrying with DPoP+nonce=%s", n)
+			r2, _, e2 := doWith("DPoP", n)
+			return r2, e2
+		}
+		// Some servers encode nonce hint in JSON too
+		var er struct {
+			Error string `json:"error"`
+		}
+		_ = json.Unmarshal(b, &er)
+		if er.Error == "use_dpop_nonce" {
+			if n := res.Header.Get("DPoP-Nonce"); n != "" {
+				log.Printf("pdsRequest: retrying with DPoP+nonce(from body)=%s", n)
+				r2, _, e2 := doWith("DPoP", n)
+				return r2, e2
+			}
+		}
+	}
+	if res.StatusCode != http.StatusBadRequest && res.StatusCode != http.StatusUnauthorized {
+		return res, nil
+	}
+	// 2) Optionally fallback to Bearer+DPoP (for older servers), but only if our token is not DPoP-bound
+	if strings.EqualFold(tokType, "DPoP") {
+		log.Printf("pdsRequest: token_type=DPoP, skipping Bearer fallback")
+		return res, nil
+	}
+	// Otherwise, try Bearer fallback
+	log.Printf("pdsRequest: falling back to Bearer token scheme with DPoP proof")
+	res, b, err = doWith("Bearer", "")
+	if err != nil {
+		return nil, err
+	}
+	if res.StatusCode == http.StatusBadRequest {
+		if n := res.Header.Get("DPoP-Nonce"); n != "" {
+			log.Printf("pdsRequest: retrying with Bearer+DPoP nonce=%s", n)
+			r2, _, e2 := doWith("Bearer", n)
+			return r2, e2
+		}
+	}
+	return res, nil
 }
 
 // handleATPDoc returns the current document from lol.tapapp.tap.doc/current
···
 		if bRes.StatusCode >= 500 {
 			bRes.Body.Close()
 			bReq2, _ := http.NewRequest(http.MethodGet, blobURL, nil)
-			bReq2.Header.Set("Authorization", "Bearer " + s.AccessJWT)
+			bReq2.Header.Set("Authorization", "Bearer "+s.AccessJWT)
 			if bRes2, err2 := authedDo(w, r, bReq2); err2 == nil {
 				defer bRes2.Body.Close()
 				if bRes2.StatusCode >= 200 && bRes2.StatusCode < 300 {
···
 			w.WriteHeader(cres.StatusCode)
 			w.Header().Set("Content-Type", "application/json; charset=utf-8")
 			// echo upstream error to client to aid debugging
-			if len(b) > 0 { _, _ = w.Write(b) }
+			if len(b) > 0 {
+				_, _ = w.Write(b)
+			}
 			return
 		}
 		w.WriteHeader(http.StatusCreated)
···
 			log.Printf("putRecord failed: status=%d body=%s", pRes.StatusCode, string(pb))
 			w.WriteHeader(pRes.StatusCode)
 			w.Header().Set("Content-Type", "application/json; charset=utf-8")
-			if len(pb) > 0 { _, _ = w.Write(pb) }
+			if len(pb) > 0 {
+				_, _ = w.Write(pb)
+			}
 			return
 		}
 		// Verify by re-reading the record and (best-effort) the blob
···
 			w.WriteHeader(http.StatusBadGateway)
 			return
 		}
-		var vRec struct { Value map[string]any `json:"value"` }
+		var vRec struct {
+			Value map[string]any `json:"value"`
+		}
 		if e := json.NewDecoder(vRes.Body).Decode(&vRec); e != nil {
 			http.Error(w, "verify decode failed", http.StatusBadGateway)
 			return
···
 		}
 		w.Header().Set("Content-Type", "application/json; charset=utf-8")
 		_ = json.NewEncoder(w).Encode(map[string]any{
-			"id": id,
-			"name": vRec.Value["name"],
-			"text": txt,
+			"id":        id,
+			"name":      vRec.Value["name"],
+			"text":      txt,
 			"updatedAt": vRec.Value["updatedAt"],
 		})
 		return
···
 		return
 	}
 	defer blobRes.Body.Close()
-	var blobResp struct { Blob map[string]any `json:"blob"` }
+	var blobResp struct {
+		Blob map[string]any `json:"blob"`
+	}
 	if err := json.NewDecoder(blobRes.Body).Decode(&blobResp); err != nil {
 		http.Error(w, "blob decode failed", http.StatusBadGateway)
 		return
···
 		w.WriteHeader(http.StatusNoContent)
 		return
 	}
-	if pRes != nil { defer pRes.Body.Close() }
+	if pRes != nil {
+		defer pRes.Body.Close()
+	}
 
 	// 3) Fallback to create
 	createPayload := map[string]any{
···
 	}
 
 	// Initialize OAuth (required for public OAuth flow)
-	addr := getEnv("PORT", "8088")
+	addr := getEnv("PORT", "80")
 	clientURI := getEnv("CLIENT_URI", "http://localhost:"+addr)
 	cookieSecret := getEnv("COOKIE_SECRET", "your-secret-key")
 	initOAuth(clientURI, cookieSecret)
···
 	mux.HandleFunc("/oauth/logout", handleOAuthLogout)
 	mux.HandleFunc("/oauth/client-metadata.json", handleOAuthClientMetadata)
 	mux.HandleFunc("/oauth/jwks.json", handleOAuthJWKS)
+	// Allow the web client to repopulate server-side OAuth session after restarts
+	mux.HandleFunc("/oauth/resume", handleOAuthResume)
 
 	log.Printf("tap (Go) server listening on http://localhost:%s", addr)
 	// Enforce strict redirect for legacy hosts -> tapapp.lol

server/oauth.go

···
 	ReturnUrl           string
 }
 
+// handleOAuthResume allows the client to repopulate the server-side OAuth session
+// after restarts by POSTing current token state. Body JSON:
+// {
+//   "did": "...",
+//   "handle": "...",
+//   "pdsUrl": "https://...",
+//   "tokenType": "DPoP",
+//   "scope": "atproto transition:generic",
+//   "accessJwt": "...",
+//   "refreshJwt": "...",
+//   "expiry": "RFC3339 timestamp" // optional
+// }
+func handleOAuthResume(w http.ResponseWriter, r *http.Request) {
+    if r.Method != http.MethodPost {
+        w.WriteHeader(http.StatusMethodNotAllowed)
+        return
+    }
+    if oauthManager == nil {
+        http.Error(w, "oauth not initialized", http.StatusInternalServerError)
+        return
+    }
+    r.Body = http.MaxBytesReader(w, r.Body, 32<<10) // 32 KiB
+    var in struct {
+        Did        string `json:"did"`
+        Handle     string `json:"handle"`
+        PdsUrl     string `json:"pdsUrl"`
+        TokenType  string `json:"tokenType"`
+        Scope      string `json:"scope"`
+        AccessJwt  string `json:"accessJwt"`
+        RefreshJwt string `json:"refreshJwt"`
+        Expiry     string `json:"expiry"`
+    }
+    if err := json.NewDecoder(r.Body).Decode(&in); err != nil {
+        http.Error(w, "invalid json", http.StatusBadRequest)
+        return
+    }
+    if in.Did == "" || in.AccessJwt == "" {
+        http.Error(w, "missing did/accessJwt", http.StatusBadRequest)
+        return
+    }
+    var exp time.Time
+    if strings.TrimSpace(in.Expiry) != "" {
+        if t, err := time.Parse(time.RFC3339, in.Expiry); err == nil {
+            exp = t
+        }
+    }
+    sess := OAuthSession{
+        Did:        in.Did,
+        Handle:     in.Handle,
+        PdsUrl:     in.PdsUrl,
+        TokenType:  in.TokenType,
+        Scope:      in.Scope,
+        AccessJwt:  in.AccessJwt,
+        RefreshJwt: in.RefreshJwt,
+        Expiry:     exp,
+    }
+    // Save to memory and cookie
+    oauthManager.SaveSession(sess.Did, sess)
+    if err := oauthManager.SaveSessionToCookie(r, w, sess); err != nil {
+        http.Error(w, "failed to persist session", http.StatusInternalServerError)
+        return
+    }
+    w.WriteHeader(http.StatusNoContent)
+}
+
+// GetSessionFromCookie reconstructs an OAuthSession from the Gorilla cookie, if present.
+func (o *OAuthManager) GetSessionFromCookie(r *http.Request) (OAuthSession, bool) {
+    session, err := o.store.Get(r, SessionName)
+    if err != nil || session.IsNew {
+        return OAuthSession{}, false
+    }
+    did, _ := session.Values["did"].(string)
+    handle, _ := session.Values["handle"].(string)
+    pds, _ := session.Values["pds"].(string)
+    ttype, _ := session.Values["token_type"].(string)
+    scope, _ := session.Values["scope"].(string)
+    access, _ := session.Values["access_jwt"].(string)
+    refresh, _ := session.Values["refresh_jwt"].(string)
+    expStr, _ := session.Values["expiry"].(string)
+    var exp time.Time
+    if expStr != "" {
+        if t, err := time.Parse(time.RFC3339, expStr); err == nil {
+            exp = t
+        }
+    }
+    if did == "" || access == "" {
+        return OAuthSession{}, false
+    }
+    return OAuthSession{
+        Did:        did,
+        Handle:     handle,
+        PdsUrl:     pds,
+        TokenType:  ttype,
+        Scope:      scope,
+        AccessJwt:  access,
+        RefreshJwt: refresh,
+        Expiry:     exp,
+    }, true
+}
+
+// SaveSessionToCookie writes the OAuthSession fields into the Gorilla cookie for persistence.
+func (o *OAuthManager) SaveSessionToCookie(r *http.Request, w http.ResponseWriter, sess OAuthSession) error {
+    session, err := o.store.Get(r, SessionName)
+    if err != nil {
+        return err
+    }
+    session.Values["did"] = sess.Did
+    session.Values["handle"] = sess.Handle
+    session.Values["pds"] = sess.PdsUrl
+    session.Values["token_type"] = sess.TokenType
+    session.Values["scope"] = sess.Scope
+    session.Values["access_jwt"] = sess.AccessJwt
+    session.Values["refresh_jwt"] = sess.RefreshJwt
+    if !sess.Expiry.IsZero() {
+        session.Values["expiry"] = sess.Expiry.UTC().Format(time.RFC3339)
+    }
+    return session.Save(r, w)
+}
+
 // generateClientAssertion builds a private_key_jwt for token endpoint auth using ES256.
 // Claims:
 //
···
 	}
 
 	did, ok := session.Values["did"].(string)
-	if !ok {
+	if !ok || did == "" {
 		return nil
 	}
 
-	sess, ok := o.GetSession(did)
-	if !ok {
-		return nil
+	// Prefer in-memory session; otherwise, attempt to rehydrate from cookie
+	if sess, ok := o.GetSession(did); ok {
+		return &User{Handle: sess.Handle, Did: sess.Did, Pds: sess.PdsUrl}
 	}
-
-	return &User{
-		Handle: sess.Handle,
-		Did:    sess.Did,
-		Pds:    sess.PdsUrl,
+	if sess, ok := o.GetSessionFromCookie(r); ok {
+		// Cache it in memory for future lookups
+		o.SaveSession(sess.Did, sess)
+		return &User{Handle: sess.Handle, Did: sess.Did, Pds: sess.PdsUrl}
 	}
+	return &User{Did: did}
 }
 
 type User struct {

server/templates/about.html

···
   <main class="container prose">
     <p>Tap is a proof-of-concept editor (in other words, a toy) for creating screenplay files in the <a href="https://fountain.io" target="_blank" rel="noreferrer">Fountain</a> format. I wrote it as an exercise to learn how <a href="https://atproto.com" target="_blank" rel="noreferrer">AT Protocol</a> works. Someday, I might add support for other Markdown-based document types.</p>
     <ul>
-      <li>It does not post screenplays to your Bluesky timeline. It stores them in an AT Protocol collection (<code>lol.tapapp.tap.doc</code>) in your Bluesky profile on their personal data server (PDS). Someday, Tap might support personal AT Proto PDSes.</li>
+      <li>It does not post screenplays to your Bluesky timeline. It stores them in an AT Protocol collection (<code>lol.tapapp.tap.doc</code>) in your Bluesky profile on their personal data server (PDS). Someday, Tap will support non-Bluesky AT Protocol PDSes.</li>
       <li><strong>It is not intended for production use.</strong> If you use Tap or store screenplays in Tap, you do so at your own risk.</li>
       <li>It stores data unencrypted, and the data is publicly accessible on the Internet (Bluesky doesn't support private collections).</li>
       <li>It uses <a href="https://docs.bsky.app/blog/oauth-atproto" target="_blank" rel="noreferrer">OAuth</a> for authentication with Bluesky.</li>
       <li>It is designed for large screens. It is not optimized for mobile.</li>
-      <li>The editor may become sluggish if you are running a writing assistant browser extension like Grammarly or ProWritingAid.</li>
+      <li>The editor may become sluggish if you are running a writing extension like Grammarly or ProWritingAid.</li>
       <li>If you want a sample Fountain script to test with, you can download one from <a href="https://fountain.io/_downloads/Big-Fish.fountain" target="_blank" rel="noreferrer">the Fountain website</a>.</li>
     </ul>
     <h2>Source code</h2>
-    <p>Tap is open source under the <a href="https://choosealicense.com/licenses/mit/" target="_blank" rel="noreferrer">MIT license</a>. You can find the code on <a href="https://codeberg.org/limeleaf/tap-editor" target="_blank" rel="noreferrer">Codeberg</a>.</p>
+    <p>Tap is open-sourced under the <a href="https://choosealicense.com/licenses/mit/" target="_blank" rel="noreferrer">MIT license</a>. You can find the code on <a href="https://tangled.sh/@limeleaf.coop/tap-app" target="_blank" rel="noreferrer">tangled</a>.</p>
   </main>
 
   <footer class="container footer">

web/components/tap-toolbar.ts

···
            <button id="btn-save">Save Now</button>
          </div>`
       : `<div class="auth auth-login">
-          <input id="inp-handle" type="text" placeholder="bsky handle" />
+          <input id="inp-handle" type="text" placeholder="Bluesky handle" />
           <button id="btn-login">Login</button>
         </div>`;
     const outlineHidden = this.hasAttribute('outline-hidden');