Remove app password references

README.md

···
 
 ### Authentication
 
-Tap uses Bluesky App Passwords (not your main account password).
-
-- Enter your Bluesky handle and an App Password on the home page to sign in.
-- The server stores your access and refresh tokens in memory for the duration of your session.
-- Tokens are refreshed automatically via `com.atproto.server.refreshSession`.
-- You can revoke the App Password any time in your Bluesky account settings.
+Tap uses [Bluesky OAuth authentication](https://aaronparecki.com/2023/03/09/5/bluesky-and-oauth). Enter your Bluesky handle on the home page to sign in. You will be redirected to Bluesky to authorize the app.
 
 ### Export features
 

server/main.go

···
 	Text      string
 	UpdatedAt string
 }
+
 var devDocsMu sync.Mutex
 var devDocs = map[string]map[string]*devDoc{}
+
 func devGetStore(sid string) map[string]*devDoc {
 	devDocsMu.Lock()
 	defer devDocsMu.Unlock()
 	m, ok := devDocs[sid]
-	if !ok { m = map[string]*devDoc{}; devDocs[sid] = m }
+	if !ok {
+		m = map[string]*devDoc{}
+		devDocs[sid] = m
+	}
 	return m
 }
 
···
 		case http.MethodPost:
 			r.Body = http.MaxBytesReader(w, r.Body, maxJSONBody)
 			var body struct{ Name, Text string }
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil { http.Error(w, "invalid json", http.StatusBadRequest); return }
-			if body.Name == "" { body.Name = "Untitled" }
-			rb := make([]byte, 8); _, _ = rand.Read(rb); id := "d-" + hex.EncodeToString(rb)
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				http.Error(w, "invalid json", http.StatusBadRequest)
+				return
+			}
+			if body.Name == "" {
+				body.Name = "Untitled"
+			}
+			rb := make([]byte, 8)
+			_, _ = rand.Read(rb)
+			id := "d-" + hex.EncodeToString(rb)
 			now := time.Now().UTC().Format(time.RFC3339)
 			store[id] = &devDoc{ID: id, Name: body.Name, Text: body.Text, UpdatedAt: now}
 			w.WriteHeader(http.StatusCreated)
 			_ = json.NewEncoder(w).Encode(map[string]string{"id": id})
 			return
 		default:
-			w.WriteHeader(http.StatusMethodNotAllowed); return
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
 		}
 	}
 	did, _, ok := getDIDAndHandle(r)
···
 		// List records in the collection
 		url := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.listRecords?repo=" + did + "&collection=lol.tapapp.tap.doc&limit=100"
 		resp, err := pdsRequest(w, r, http.MethodGet, url, "", nil)
-		if err != nil { http.Error(w, "list failed", http.StatusBadGateway); return }
+		if err != nil {
+			http.Error(w, "list failed", http.StatusBadGateway)
+			return
+		}
 		defer resp.Body.Close()
-		if resp.StatusCode < 200 || resp.StatusCode >= 300 { w.WriteHeader(resp.StatusCode); return }
-		var lr struct{ Records []map[string]any `json:"records"` }
-		if err := json.NewDecoder(resp.Body).Decode(&lr); err != nil { http.Error(w, "decode list", http.StatusBadGateway); return }
-		type item struct{
+		if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+			w.WriteHeader(resp.StatusCode)
+			return
+		}
+		var lr struct {
+			Records []map[string]any `json:"records"`
+		}
+		if err := json.NewDecoder(resp.Body).Decode(&lr); err != nil {
+			http.Error(w, "decode list", http.StatusBadGateway)
+			return
+		}
+		type item struct {
 			ID        string `json:"id"`
 			Name      string `json:"name"`
 			UpdatedAt string `json:"updatedAt"`
···
 			val, _ := rec["value"].(map[string]any)
 			// Name fallback: try name, then title
 			name := "Untitled"
-			if v := val["name"]; v != nil { if s, ok := v.(string); ok && s != "" { name = s } }
-			if name == "Untitled" { if v := val["title"]; v != nil { if s, ok := v.(string); ok && s != "" { name = s } } }
+			if v := val["name"]; v != nil {
+				if s, ok := v.(string); ok && s != "" {
+					name = s
+				}
+			}
+			if name == "Untitled" {
+				if v := val["title"]; v != nil {
+					if s, ok := v.(string); ok && s != "" {
+						name = s
+					}
+				}
+			}
 			// Date fallback: try updatedAt, then updated. Normalize to RFC3339 if parseable.
 			updatedAt := ""
-			if v := val["updatedAt"]; v != nil { if s, ok := v.(string); ok { updatedAt = s } }
-			if updatedAt == "" { if v := val["updated"]; v != nil { if s, ok := v.(string); ok { updatedAt = s } } }
+			if v := val["updatedAt"]; v != nil {
+				if s, ok := v.(string); ok {
+					updatedAt = s
+				}
+			}
+			if updatedAt == "" {
+				if v := val["updated"]; v != nil {
+					if s, ok := v.(string); ok {
+						updatedAt = s
+					}
+				}
+			}
 			if updatedAt == "" { // fallback to top-level indexedAt if present
-				if v, ok := rec["indexedAt"].(string); ok { updatedAt = v }
+				if v, ok := rec["indexedAt"].(string); ok {
+					updatedAt = v
+				}
 			}
 			if updatedAt != "" {
 				if t, err := time.Parse(time.RFC3339Nano, updatedAt); err == nil {
···
 			}
 			// Derive id from rkey or uri
 			id := ""
-			if v, ok := rec["rkey"].(string); ok { id = v }
-			if id == "" { if v, ok := rec["uri"].(string); ok { parts := strings.Split(v, "/"); if len(parts) > 0 { id = parts[len(parts)-1] } } }
-			if id == "" { id = "current" }
+			if v, ok := rec["rkey"].(string); ok {
+				id = v
+			}
+			if id == "" {
+				if v, ok := rec["uri"].(string); ok {
+					parts := strings.Split(v, "/")
+					if len(parts) > 0 {
+						id = parts[len(parts)-1]
+					}
+				}
+			}
+			if id == "" {
+				id = "current"
+			}
 			out = append(out, item{ID: id, Name: name, UpdatedAt: updatedAt})
 		}
 		_ = json.NewEncoder(w).Encode(out)
···
 		// Create a new doc
 		r.Body = http.MaxBytesReader(w, r.Body, maxJSONBody)
 		var body struct{ Name, Text string }
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil { http.Error(w, "invalid json", http.StatusBadRequest); return }
-		if len(body.Text) > maxTextBytes { http.Error(w, "text too large", http.StatusRequestEntityTooLarge); return }
-		if body.Name == "" { body.Name = "Untitled" }
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			http.Error(w, "invalid json", http.StatusBadRequest)
+			return
+		}
+		if len(body.Text) > maxTextBytes {
+			http.Error(w, "text too large", http.StatusRequestEntityTooLarge)
+			return
+		}
+		if body.Name == "" {
+			body.Name = "Untitled"
+		}
 		// Upload blob
 		bRes, err := uploadBlobWithRetry(w, r, []byte(body.Text))
-		if err != nil { http.Error(w, "blob upload failed", http.StatusBadGateway); return }
+		if err != nil {
+			http.Error(w, "blob upload failed", http.StatusBadGateway)
+			return
+		}
 		defer bRes.Body.Close()
-		var bOut struct{ Blob map[string]any `json:"blob"` }
-		if err := json.NewDecoder(bRes.Body).Decode(&bOut); err != nil { http.Error(w, "blob decode failed", http.StatusBadGateway); return }
+		var bOut struct {
+			Blob map[string]any `json:"blob"`
+		}
+		if err := json.NewDecoder(bRes.Body).Decode(&bOut); err != nil {
+			http.Error(w, "blob decode failed", http.StatusBadGateway)
+			return
+		}
 		// New rkey
-		rb := make([]byte, 8); _, _ = rand.Read(rb); id := "d-" + hex.EncodeToString(rb)
+		rb := make([]byte, 8)
+		_, _ = rand.Read(rb)
+		id := "d-" + hex.EncodeToString(rb)
 		record := map[string]any{"$type": "lol.tapapp.tap.doc", "name": body.Name, "contentBlob": bOut.Blob, "updatedAt": time.Now().UTC().Format(time.RFC3339Nano)}
 		payload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": id, "record": record}
 		buf, _ := json.Marshal(payload)
 		createURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.createRecord"
 		cr, err := pdsRequest(w, r, http.MethodPost, createURL, "application/json", buf)
-		if err != nil { http.Error(w, "create failed", http.StatusBadGateway); return }
+		if err != nil {
+			http.Error(w, "create failed", http.StatusBadGateway)
+			return
+		}
 		defer cr.Body.Close()
 		if cr.StatusCode < 200 || cr.StatusCode >= 300 {
 			w.WriteHeader(cr.StatusCode)
···
 	if devOffline {
 		w.Header().Set("Content-Type", "application/json; charset=utf-8")
 		id := strings.TrimPrefix(r.URL.Path, "/docs/")
-		if id == "" { w.WriteHeader(http.StatusBadRequest); return }
+		if id == "" {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
 		sid := getOrCreateSessionID(w, r)
 		store := devGetStore(sid)
 		switch r.Method {
···
 			// PDF export support in offline mode
 			if strings.HasSuffix(id, ".pdf") {
 				baseID := strings.TrimSuffix(id, ".pdf")
-				d, ok := store[baseID]; if !ok { http.Error(w, "not found", http.StatusNotFound); return }
-				name := d.Name; if name == "" { name = "Untitled" }
+				d, ok := store[baseID]
+				if !ok {
+					http.Error(w, "not found", http.StatusNotFound)
+					return
+				}
+				name := d.Name
+				if name == "" {
+					name = "Untitled"
+				}
 				blocks := fountain.Parse(d.Text)
 				pdfBytes, err := renderPDF(blocks, name)
-				if err != nil { log.Printf("pdf render error: %v", err); http.Error(w, "PDF render failed", http.StatusInternalServerError); return }
+				if err != nil {
+					log.Printf("pdf render error: %v", err)
+					http.Error(w, "PDF render failed", http.StatusInternalServerError)
+					return
+				}
 				safeName := sanitizeFilename(name)
 				// Override content-type for PDF
 				w.Header().Del("Content-Type")
 				w.Header().Set("Content-Type", "application/pdf")
 				w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.pdf\"", safeName))
 				w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
-				w.Header().Set("Pragma", "no-cache"); w.Header().Set("Expires", "0")
+				w.Header().Set("Pragma", "no-cache")
+				w.Header().Set("Expires", "0")
 				_, _ = w.Write(pdfBytes)
 				return
 			}
 			// Plain text export (.fountain)
 			if strings.HasSuffix(id, ".fountain") {
 				baseID := strings.TrimSuffix(id, ".fountain")
-				d, ok := store[baseID]; if !ok { http.Error(w, "not found", http.StatusNotFound); return }
+				d, ok := store[baseID]
+				if !ok {
+					http.Error(w, "not found", http.StatusNotFound)
+					return
+				}
 				w.Header().Del("Content-Type")
 				w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-				name := d.Name; if name == "" { name = "screenplay" }
+				name := d.Name
+				if name == "" {
+					name = "screenplay"
+				}
 				w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.fountain\"", sanitizeFilename(name)))
 				_, _ = w.Write([]byte(d.Text))
 				return
 			}
 			// Delete via action query (for simple UI link)
 			if r.URL.Query().Get("action") == "delete" {
-				if _, ok := store[id]; !ok { http.Error(w, "not found", http.StatusNotFound); return }
+				if _, ok := store[id]; !ok {
+					http.Error(w, "not found", http.StatusNotFound)
+					return
+				}
 				delete(store, id)
 				http.Redirect(w, r, "/library", http.StatusSeeOther)
 				return
 			}
-			d, ok := store[id]; if !ok { http.Error(w, "not found", http.StatusNotFound); return }
+			d, ok := store[id]
+			if !ok {
+				http.Error(w, "not found", http.StatusNotFound)
+				return
+			}
 			_ = json.NewEncoder(w).Encode(map[string]any{"id": d.ID, "name": d.Name, "text": d.Text, "updatedAt": d.UpdatedAt})
 			return
 		case http.MethodPut:
-			var body struct{ Name *string `json:"name"`; Text *string `json:"text"` }
+			var body struct {
+				Name *string `json:"name"`
+				Text *string `json:"text"`
+			}
 			r.Body = http.MaxBytesReader(w, r.Body, maxJSONBody)
-			if err := json.NewDecoder(r.Body).Decode(&body); err != nil { http.Error(w, "invalid json", http.StatusBadRequest); return }
-			d, ok := store[id]; if !ok { http.Error(w, "not found", http.StatusNotFound); return }
-			if body.Name != nil { n := strings.TrimSpace(*body.Name); if n == "" { n = "Untitled" }; d.Name = n }
-			if body.Text != nil { d.Text = *body.Text }
+			if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+				http.Error(w, "invalid json", http.StatusBadRequest)
+				return
+			}
+			d, ok := store[id]
+			if !ok {
+				http.Error(w, "not found", http.StatusNotFound)
+				return
+			}
+			if body.Name != nil {
+				n := strings.TrimSpace(*body.Name)
+				if n == "" {
+					n = "Untitled"
+				}
+				d.Name = n
+			}
+			if body.Text != nil {
+				d.Text = *body.Text
+			}
 			d.UpdatedAt = time.Now().UTC().Format(time.RFC3339)
 			w.WriteHeader(http.StatusNoContent)
 			return
 		case http.MethodDelete:
-			if _, ok := store[id]; !ok { http.Error(w, "not found", http.StatusNotFound); return }
+			if _, ok := store[id]; !ok {
+				http.Error(w, "not found", http.StatusNotFound)
+				return
+			}
 			delete(store, id)
 			w.WriteHeader(http.StatusNoContent)
 			return
 		default:
-			w.WriteHeader(http.StatusMethodNotAllowed); return
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
 		}
 	}
 	did, handle, ok := getDIDAndHandle(r)
···
 		return
 	}
 	id := strings.TrimPrefix(r.URL.Path, "/docs/")
-	if id == "" { w.Header().Set("Content-Type", "application/json; charset=utf-8"); w.WriteHeader(http.StatusBadRequest); return }
+	if id == "" {
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		w.WriteHeader(http.StatusBadRequest)
+		return
+	}
 	// PDF export
 	if r.Method == http.MethodGet && strings.HasSuffix(id, ".pdf") {
 		baseID := strings.TrimSuffix(id, ".pdf")
 		s2 := Session{DID: did, Handle: handle}
 		name, text, status, err := getDocNameAndText(w, r, r.Context(), s2, baseID)
-		if err != nil { w.WriteHeader(status); return }
-		if name == "" { name = "Untitled" }
+		if err != nil {
+			w.WriteHeader(status)
+			return
+		}
+		if name == "" {
+			name = "Untitled"
+		}
 		blocks := fountain.Parse(text)
 		pdfBytes, err := renderPDF(blocks, name)
-		if err != nil { log.Printf("pdf render error: %v", err); http.Error(w, "PDF render failed", http.StatusInternalServerError); return }
+		if err != nil {
+			log.Printf("pdf render error: %v", err)
+			http.Error(w, "PDF render failed", http.StatusInternalServerError)
+			return
+		}
 		safeName := sanitizeFilename(name)
 		w.Header().Set("Content-Type", "application/pdf")
 		w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.pdf\"", safeName))
 		w.Header().Set("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
-		w.Header().Set("Pragma", "no-cache"); w.Header().Set("Expires", "0")
-		_, _ = w.Write(pdfBytes); return
+		w.Header().Set("Pragma", "no-cache")
+		w.Header().Set("Expires", "0")
+		_, _ = w.Write(pdfBytes)
+		return
 	}
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	switch r.Method {
···
 		if strings.HasSuffix(id, ".fountain") {
 			baseID := strings.TrimSuffix(id, ".fountain")
 			name, text, status, err := getDocNameAndText(w, r, r.Context(), s2, baseID)
-			if err != nil { w.WriteHeader(status); return }
+			if err != nil {
+				w.WriteHeader(status)
+				return
+			}
 			w.Header().Del("Content-Type")
 			w.Header().Set("Content-Type", "text/plain; charset=utf-8")
-			if name == "" { name = "screenplay" }
+			if name == "" {
+				name = "screenplay"
+			}
 			w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=\"%s.fountain\"", sanitizeFilename(name)))
 			_, _ = w.Write([]byte(text))
 			return
···
 			dbuf, _ := json.Marshal(delPayload)
 			delURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.deleteRecord"
 			dRes, err := pdsRequest(w, r, http.MethodPost, delURL, "application/json", dbuf)
-			if err != nil { http.Error(w, "delete failed", http.StatusBadGateway); return }
+			if err != nil {
+				http.Error(w, "delete failed", http.StatusBadGateway)
+				return
+			}
 			defer dRes.Body.Close()
-			if dRes.StatusCode < 200 || dRes.StatusCode >= 300 { w.WriteHeader(dRes.StatusCode); return }
+			if dRes.StatusCode < 200 || dRes.StatusCode >= 300 {
+				w.WriteHeader(dRes.StatusCode)
+				return
+			}
 			http.Redirect(w, r, "/library", http.StatusSeeOther)
 			return
 		}
 		name, text, status, err := getDocNameAndText(w, r, r.Context(), s2, id)
-		if err != nil { w.WriteHeader(status); return }
+		if err != nil {
+			w.WriteHeader(status)
+			return
+		}
 		_ = json.NewEncoder(w).Encode(map[string]any{"id": id, "name": name, "text": text, "updatedAt": ""})
 	case http.MethodPut:
 		r.Body = http.MaxBytesReader(w, r.Body, maxJSONBody)
-		var body struct{ Name *string `json:"name"`; Text *string `json:"text"` }
-		if err := json.NewDecoder(r.Body).Decode(&body); err != nil { http.Error(w, "invalid json", http.StatusBadRequest); return }
+		var body struct {
+			Name *string `json:"name"`
+			Text *string `json:"text"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+			http.Error(w, "invalid json", http.StatusBadRequest)
+			return
+		}
 		// Read current
 		getURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.getRecord?repo=" + did + "&collection=lol.tapapp.tap.doc&rkey=" + id
 		gRes, err := pdsRequest(w, r, http.MethodGet, getURL, "", nil)
-		if err != nil { http.Error(w, "get failed", http.StatusBadGateway); return }
+		if err != nil {
+			http.Error(w, "get failed", http.StatusBadGateway)
+			return
+		}
 		defer gRes.Body.Close()
-		if gRes.StatusCode == http.StatusNotFound { http.Error(w, "not found", http.StatusNotFound); return }
-		if gRes.StatusCode < 200 || gRes.StatusCode >= 300 { w.WriteHeader(gRes.StatusCode); return }
-		var cur struct{ Value map[string]any `json:"value"` }
-		if err := json.NewDecoder(gRes.Body).Decode(&cur); err != nil { http.Error(w, "decode current", http.StatusBadGateway); return }
-		name := "Untitled"; if v := cur.Value["name"]; v != nil { if s, ok := v.(string); ok && s != "" { name = s } }
-		var blob map[string]any; if v, ok := cur.Value["contentBlob"].(map[string]any); ok { blob = v }
-		if body.Name != nil { if *body.Name != "" { name = *body.Name } else { name = "Untitled" } }
+		if gRes.StatusCode == http.StatusNotFound {
+			http.Error(w, "not found", http.StatusNotFound)
+			return
+		}
+		if gRes.StatusCode < 200 || gRes.StatusCode >= 300 {
+			w.WriteHeader(gRes.StatusCode)
+			return
+		}
+		var cur struct {
+			Value map[string]any `json:"value"`
+		}
+		if err := json.NewDecoder(gRes.Body).Decode(&cur); err != nil {
+			http.Error(w, "decode current", http.StatusBadGateway)
+			return
+		}
+		name := "Untitled"
+		if v := cur.Value["name"]; v != nil {
+			if s, ok := v.(string); ok && s != "" {
+				name = s
+			}
+		}
+		var blob map[string]any
+		if v, ok := cur.Value["contentBlob"].(map[string]any); ok {
+			blob = v
+		}
+		if body.Name != nil {
+			if *body.Name != "" {
+				name = *body.Name
+			} else {
+				name = "Untitled"
+			}
+		}
 		if body.Text != nil {
-			if len(*body.Text) > maxTextBytes { http.Error(w, "text too large", http.StatusRequestEntityTooLarge); return }
+			if len(*body.Text) > maxTextBytes {
+				http.Error(w, "text too large", http.StatusRequestEntityTooLarge)
+				return
+			}
 			ubRes, err := uploadBlobWithRetry(w, r, []byte(*body.Text))
-			if err != nil { http.Error(w, "blob upload failed", http.StatusBadGateway); return }
+			if err != nil {
+				http.Error(w, "blob upload failed", http.StatusBadGateway)
+				return
+			}
 			defer ubRes.Body.Close()
-			var ub struct{ Blob map[string]any `json:"blob"` }
-			if err := json.NewDecoder(ubRes.Body).Decode(&ub); err != nil { http.Error(w, "blob decode failed", http.StatusBadGateway); return }
+			var ub struct {
+				Blob map[string]any `json:"blob"`
+			}
+			if err := json.NewDecoder(ubRes.Body).Decode(&ub); err != nil {
+				http.Error(w, "blob decode failed", http.StatusBadGateway)
+				return
+			}
 			blob = ub.Blob
 		} else if blob == nil {
 			ubRes, err := uploadBlobWithRetry(w, r, []byte(""))
-			if err != nil { http.Error(w, "blob upload failed", http.StatusBadGateway); return }
+			if err != nil {
+				http.Error(w, "blob upload failed", http.StatusBadGateway)
+				return
+			}
 			defer ubRes.Body.Close()
-			var ub struct{ Blob map[string]any `json:"blob"` }
-			if err := json.NewDecoder(ubRes.Body).Decode(&ub); err != nil { http.Error(w, "blob decode failed", http.StatusBadGateway); return }
+			var ub struct {
+				Blob map[string]any `json:"blob"`
+			}
+			if err := json.NewDecoder(ubRes.Body).Decode(&ub); err != nil {
+				http.Error(w, "blob decode failed", http.StatusBadGateway)
+				return
+			}
 			blob = ub.Blob
 		}
 		record := map[string]any{"$type": "lol.tapapp.tap.doc", "name": name, "contentBlob": blob, "updatedAt": time.Now().UTC().Format(time.RFC3339Nano)}
···
 		pbuf, _ := json.Marshal(putPayload)
 		putURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.putRecord"
 		pRes, err := pdsRequest(w, r, http.MethodPost, putURL, "application/json", pbuf)
-		if err != nil { http.Error(w, "put failed", http.StatusBadGateway); return }
+		if err != nil {
+			http.Error(w, "put failed", http.StatusBadGateway)
+			return
+		}
 		defer pRes.Body.Close()
-		if pRes.StatusCode < 200 || pRes.StatusCode >= 300 { w.WriteHeader(pRes.StatusCode); return }
+		if pRes.StatusCode < 200 || pRes.StatusCode >= 300 {
+			w.WriteHeader(pRes.StatusCode)
+			return
+		}
 		w.WriteHeader(http.StatusNoContent)
 	case http.MethodDelete:
 		delPayload := map[string]any{"repo": did, "collection": "lol.tapapp.tap.doc", "rkey": id}
 		dbuf, _ := json.Marshal(delPayload)
 		delURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.deleteRecord"
 		dRes, err := pdsRequest(w, r, http.MethodPost, delURL, "application/json", dbuf)
-		if err != nil { http.Error(w, "delete failed", http.StatusBadGateway); return }
+		if err != nil {
+			http.Error(w, "delete failed", http.StatusBadGateway)
+			return
+		}
 		defer dRes.Body.Close()
-		if dRes.StatusCode < 200 || dRes.StatusCode >= 300 { w.WriteHeader(dRes.StatusCode); return }
+		if dRes.StatusCode < 200 || dRes.StatusCode >= 300 {
+			w.WriteHeader(dRes.StatusCode)
+			return
+		}
 		w.WriteHeader(http.StatusNoContent)
 	default:
 		w.WriteHeader(http.StatusMethodNotAllowed)
···
 
 // handleATPPost posts a simple text note to Bluesky using the stored legacy session (for back-compat)
 func handleATPPost(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost { w.WriteHeader(http.StatusMethodNotAllowed); return }
+	if r.Method != http.MethodPost {
+		w.WriteHeader(http.StatusMethodNotAllowed)
+		return
+	}
 	w.Header().Set("Content-Type", "application/json; charset=utf-8")
 	sid := getOrCreateSessionID(w, r)
-	sessionsMu.Lock(); s, ok := userSessions[sid]; sessionsMu.Unlock()
-	if !ok || s.AccessJWT == "" || s.DID == "" { http.Error(w, "unauthorized", http.StatusUnauthorized); return }
+	sessionsMu.Lock()
+	s, ok := userSessions[sid]
+	sessionsMu.Unlock()
+	if !ok || s.AccessJWT == "" || s.DID == "" {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
 	r.Body = http.MaxBytesReader(w, r.Body, maxJSONBody)
-	var body struct{ Text string `json:"text"` }
-	if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.Text == "" { http.Error(w, "invalid body", http.StatusBadRequest); return }
-	if len(body.Text) > maxTextBytes { http.Error(w, "text too large", http.StatusRequestEntityTooLarge); return }
+	var body struct {
+		Text string `json:"text"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.Text == "" {
+		http.Error(w, "invalid body", http.StatusBadRequest)
+		return
+	}
+	if len(body.Text) > maxTextBytes {
+		http.Error(w, "text too large", http.StatusRequestEntityTooLarge)
+		return
+	}
 	// Upload blob
 	blobRes, err := uploadBlobWithRetry(w, r, []byte(body.Text))
-	if err != nil { http.Error(w, "blob upload failed", http.StatusBadGateway); return }
+	if err != nil {
+		http.Error(w, "blob upload failed", http.StatusBadGateway)
+		return
+	}
 	defer blobRes.Body.Close()
-	var blobResp struct{ Blob map[string]any `json:"blob"` }
-	if err := json.NewDecoder(blobRes.Body).Decode(&blobResp); err != nil { http.Error(w, "blob decode failed", http.StatusBadGateway); return }
+	var blobResp struct {
+		Blob map[string]any `json:"blob"`
+	}
+	if err := json.NewDecoder(blobRes.Body).Decode(&blobResp); err != nil {
+		http.Error(w, "blob decode failed", http.StatusBadGateway)
+		return
+	}
 	// Upsert current
 	record := map[string]any{"$type": "lol.tapapp.tap.doc", "contentBlob": blobResp.Blob, "updatedAt": time.Now().UTC().Format(time.RFC3339Nano)}
 	putPayload := map[string]any{"repo": s.DID, "collection": "lol.tapapp.tap.doc", "rkey": "current", "record": record}
 	pbuf, _ := json.Marshal(putPayload)
 	putURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.putRecord"
 	pRes, err := pdsRequest(w, r, http.MethodPost, putURL, "application/json", pbuf)
-	if err == nil && pRes.StatusCode >= 200 && pRes.StatusCode < 300 { defer pRes.Body.Close(); w.WriteHeader(http.StatusNoContent); return }
-	if pRes != nil { defer pRes.Body.Close() }
+	if err == nil && pRes.StatusCode >= 200 && pRes.StatusCode < 300 {
+		defer pRes.Body.Close()
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if pRes != nil {
+		defer pRes.Body.Close()
+	}
 	// fallback create
 	cPayload := map[string]any{"repo": s.DID, "collection": "lol.tapapp.tap.doc", "rkey": "current", "record": record}
 	cbuf, _ := json.Marshal(cPayload)
 	cURL := pdsBaseFromUser(r) + "/xrpc/com.atproto.repo.createRecord"
 	cRes, err := pdsRequest(w, r, http.MethodPost, cURL, "application/json", cbuf)
-	if err != nil { http.Error(w, "create failed", http.StatusBadGateway); return }
-	defer cRes.Body.Close(); w.WriteHeader(cRes.StatusCode)
+	if err != nil {
+		http.Error(w, "create failed", http.StatusBadGateway)
+		return
+	}
+	defer cRes.Body.Close()
+	w.WriteHeader(cRes.StatusCode)
 }
 
 // getDIDAndHandle returns the current user's DID and handle, preferring OAuth session
···
 			if devOffline {
 				// Provide a stub session in offline mode so UI treats user as logged in
 				stub := Session{DID: "did:example:dev", Handle: "dev.local"}
-				sessionsMu.Lock(); userSessions[sid] = stub; sessionsMu.Unlock()
+				sessionsMu.Lock()
+				userSessions[sid] = stub
+				sessionsMu.Unlock()
 				_ = json.NewEncoder(w).Encode(stub)
 				return
 			}
···
 // pdsRequest sends an XRPC request to the user's PDS using dual-scheme auth:
 // 1) Try Authorization: Bearer <token> with a DPoP proof
 // 2) On 400 responses, if a DPoP-Nonce is provided, retry once with that nonce
-// 3) If still 400, fall back to Authorization: DPoP <token> with DPoP proof (nonce if provided)
-// If no OAuth session is present, falls back to authedDo (legacy app-password flow).
+// 3) If still 400, fall back to Authorization: DPoP <token> with DPoP proof (nonce if provided).
 func pdsRequest(w http.ResponseWriter, r *http.Request, method, url, contentType string, body []byte) (*http.Response, error) {
 	// Choose auth source: prefer OAuth session; fall back to legacy tap_session if present
 	var (
···
 	var cid string
 	if cb := recResp.Value.ContentBlob; cb != nil {
 		if ref, ok := cb["ref"].(map[string]any); ok {
-			if l, ok := ref["$link"].(string); ok { cid = l }
+			if l, ok := ref["$link"].(string); ok {
+				cid = l
+			}
 		}
 	}
 	if cid == "" {
···
 		// small helper: compute strong ETag as sha256 hex of file contents
 		computeETag := func(path string) (string, []byte, error) {
 			f, err := os.Open(path)
-			if err != nil { return "", nil, err }
+			if err != nil {
+				return "", nil, err
+			}
 			defer f.Close()
 			h := sha256.New()
 			var buf bytes.Buffer
-			if _, err := io.Copy(io.MultiWriter(h, &buf), f); err != nil { return "", nil, err }
+			if _, err := io.Copy(io.MultiWriter(h, &buf), f); err != nil {
+				return "", nil, err
+			}
 			sum := hex.EncodeToString(h.Sum(nil))
 			return "\"" + sum + "\"", buf.Bytes(), nil
 		}
···
 				if f, err := os.Open(local + ".br"); err == nil {
 					f.Close()
 					// Compute ETag against compressed bytes
-					if etag, data, err := computeETag(local+".br"); err == nil {
+					if etag, data, err := computeETag(local + ".br"); err == nil {
 						if ifNoneMatch != "" && ifNoneMatch == etag {
 							w.WriteHeader(http.StatusNotModified)
 							return
···
 						}
 						// Encourage revalidation so clients pick up new builds when ETag changes
 						w.Header().Set("Cache-Control", "no-cache")
-						if _, err := w.Write(data); err != nil { http.Error(w, "read error", http.StatusInternalServerError) }
+						if _, err := w.Write(data); err != nil {
+							http.Error(w, "read error", http.StatusInternalServerError)
+						}
 						return
 					}
 					// fallback: stream if hashing failed
···
 						defer f2.Close()
 						w.Header().Set("Vary", "Accept-Encoding")
 						w.Header().Set("Content-Encoding", "br")
-						if strings.HasSuffix(local, ".js") { w.Header().Set("Content-Type", "application/javascript; charset=utf-8") }
-						if strings.HasSuffix(local, ".css") { w.Header().Set("Content-Type", "text/css; charset=utf-8") }
+						if strings.HasSuffix(local, ".js") {
+							w.Header().Set("Content-Type", "application/javascript; charset=utf-8")
+						}
+						if strings.HasSuffix(local, ".css") {
+							w.Header().Set("Content-Type", "text/css; charset=utf-8")
+						}
 						_, _ = io.Copy(w, f2)
 						return
 					}
···
 			if strings.Contains(ae, "gzip") {
 				if f, err := os.Open(local + ".gz"); err == nil {
 					f.Close()
-					if etag, data, err := computeETag(local+".gz"); err == nil {
+					if etag, data, err := computeETag(local + ".gz"); err == nil {
 						if ifNoneMatch != "" && ifNoneMatch == etag {
 							w.WriteHeader(http.StatusNotModified)
 							return
···
 						w.Header().Set("ETag", etag)
 						w.Header().Set("Vary", "Accept-Encoding")
 						w.Header().Set("Content-Encoding", "gzip")
-						if strings.HasSuffix(local, ".js") { w.Header().Set("Content-Type", "application/javascript; charset=utf-8") }
-						if strings.HasSuffix(local, ".css") { w.Header().Set("Content-Type", "text/css; charset=utf-8") }
+						if strings.HasSuffix(local, ".js") {
+							w.Header().Set("Content-Type", "application/javascript; charset=utf-8")
+						}
+						if strings.HasSuffix(local, ".css") {
+							w.Header().Set("Content-Type", "text/css; charset=utf-8")
+						}
 						w.Header().Set("Cache-Control", "no-cache")
-						if _, err := w.Write(data); err != nil { http.Error(w, "read error", http.StatusInternalServerError) }
+						if _, err := w.Write(data); err != nil {
+							http.Error(w, "read error", http.StatusInternalServerError)
+						}
 						return
 					}
 					if strings.HasSuffix(local, ".css") {

server/templates/index.html

···
   <footer class="container footer">
     <p>
       <span class="footer-left">
-        <a href="/about">About</a><span id="footer-apppw-wrap"> • <a href="https://www.dailykos.com/stories/2025/1/24/2298963/-Bluesky-Tips-and-Tricks-Third-party-Apps-App-Passwords" target="_blank" rel="noreferrer">What is an App Password?</a></span>
-        <span id="footer-sample-wrap"> •
+        <a href="/about">About</a><span id="footer-apppw-wrap"> •
           <a id="footer-sample" href="https://fountain.io/_downloads/Big-Fish.fountain" target="_blank" rel="noreferrer">Sample Fountain script</a>
         </span>
       </span>
···
         userEl.style.display = handle ? 'inline' : 'none';
         btn.style.display = handle ? 'inline-block' : 'none';
         if (sampleWrap) sampleWrap.style.display = handle ? 'inline' : 'none';
-        // Show the App Password link only on the login page (unauthenticated)
-        if (appPwWrap) appPwWrap.style.display = handle ? 'none' : 'inline';
+        
       };
       const hide = () => show('');
 

server/templates/privacy.html

···
     <ul>
         <li>Access the service without providing personal information</li>
         <li>Use the service without creating an account</li>
-        <li>Revoke your Bluesky App Password at any time</li>
+        <li>Revoke access to your Bluesky account at any time</li>
         <li>Clear your browser data to remove any local session information</li>
     </ul>