various improvements to oauth stuff

crates/jacquard-identity/src/resolver.rs

···
         let mut handle_order = vec![];
         #[cfg(not(target_family = "wasm"))]
         handle_order.push(HandleStep::DnsTxt);
+        #[cfg(not(target_family = "wasm"))]
         handle_order.push(HandleStep::HttpsWellKnown);
         handle_order.push(HandleStep::PdsResolveHandle);
+        #[cfg(target_family = "wasm")]
+        handle_order.push(HandleStep::HttpsWellKnown);
+
+        let mut did_order = vec![];
+        #[cfg(not(target_family = "wasm"))]
+        did_order.push(DidStep::DidWebHttps);
+        did_order.push(DidStep::PlcHttp);
+        did_order.push(DidStep::PdsResolveDid);
+        #[cfg(target_family = "wasm")]
+        did_order.push(DidStep::DidWebHttps);
 
         Self::new()
             .plc_source(PlcSource::default())
             .handle_order(handle_order)
-            .did_order(vec![
-                DidStep::DidWebHttps,
-                DidStep::PlcHttp,
-                DidStep::PdsResolveDid,
-            ])
+            .did_order(did_order)
             .validate_doc_id(true)
             .public_fallback_for_handle(true)
             .build()

crates/jacquard-oauth/src/atproto.rs

···
 use crate::{keyset::Keyset, scopes::Scope};
 use jacquard_common::CowStr;
 use serde::{Deserialize, Serialize};
+use smol_str::{SmolStr, ToSmolStr};
 use thiserror::Error;
 use url::Url;
 
···
     #[serde(borrow)]
     pub scopes: Vec<Scope<'m>>,
     pub jwks_uri: Option<Url>,
+    pub client_name: Option<SmolStr>,
+    pub logo_uri: Option<Url>,
+    pub tos_uri: Option<Url>,
+    pub privacy_policy_uri: Option<Url>,
 }
 
 impl<'m> AtprotoClientMetadata<'m> {
···
             grant_types,
             scopes,
             jwks_uri,
+            client_name: None,
+            logo_uri: None,
+            tos_uri: None,
+            privacy_policy_uri: None,
         }
     }
 
+    pub fn with_prod_info(
+        mut self,
+        client_name: &str,
+        logo_uri: Option<Url>,
+        tos_uri: Option<Url>,
+        privacy_policy_uri: Option<Url>,
+    ) -> Self {
+        self.client_name = Some(client_name.to_smolstr());
+        self.logo_uri = logo_uri;
+        self.tos_uri = tos_uri;
+        self.privacy_policy_uri = privacy_policy_uri;
+        self
+    }
+
     pub fn default_localhost() -> Self {
         Self::new_localhost(
             None,
···
             grant_types: vec![GrantType::AuthorizationCode, GrantType::RefreshToken],
             scopes: scopes.unwrap_or(vec![Scope::Atproto]),
             jwks_uri: None,
+            client_name: None,
+            logo_uri: None,
+            tos_uri: None,
+            privacy_policy_uri: None,
         }
     }
 }
···
         } else {
             None
         },
+        client_name: metadata.client_name,
+        logo_uri: metadata.logo_uri,
+        tos_uri: metadata.tos_uri,
+        privacy_policy_uri: metadata.privacy_policy_uri,
     })
 }
 
···
                 jwks_uri: None,
                 jwks: None,
                 token_endpoint_auth_signing_alg: None,
+                tos_uri: None,
+                privacy_policy_uri: None,
+                client_name: None,
+                logo_uri: None,
             }
         );
     }
···
                 jwks_uri: None,
                 jwks: None,
                 token_endpoint_auth_signing_alg: None,
+                tos_uri: None,
+                privacy_policy_uri: None,
+                client_name: None,
+                logo_uri: None,
             }
         );
     }
···
                     jwks_uri: None,
                     jwks: None,
                     token_endpoint_auth_signing_alg: None,
+                    tos_uri: None,
+                    privacy_policy_uri: None,
+                    client_name: None,
+                    logo_uri: None,
                 }
             );
         }
···
                     jwks_uri: None,
                     jwks: None,
                     token_endpoint_auth_signing_alg: None,
+                    tos_uri: None,
+                    privacy_policy_uri: None,
+                    client_name: None,
+                    logo_uri: None,
                 }
             );
         }
···
                     jwks_uri: None,
                     jwks: None,
                     token_endpoint_auth_signing_alg: None,
+                    tos_uri: None,
+                    privacy_policy_uri: None,
+                    client_name: None,
+                    logo_uri: None,
                 }
             );
         }
···
             grant_types: vec![GrantType::AuthorizationCode],
             scopes: vec![Scope::Atproto],
             jwks_uri: None,
+            client_name: None,
+            logo_uri: None,
+            tos_uri: None,
+            privacy_policy_uri: None,
         };
         {
             // Non-loopback clients without a keyset should fail (must provide JWKS)
···
                     jwks_uri: None,
                     jwks: Some(keyset.public_jwks()),
                     token_endpoint_auth_signing_alg: Some(CowStr::new_static("ES256")),
+                    client_name: None,
+                    logo_uri: None,
+                    tos_uri: None,
+                    privacy_policy_uri: None,
                 }
             );
         }

crates/jacquard-oauth/src/client.rs

···
     S: ClientAuthStore,
 {
     pub registry: Arc<SessionRegistry<T, S>>,
+    pub options: RwLock<CallOptions<'static>>,
+    pub endpoint: RwLock<Option<Url>>,
     pub client: Arc<T>,
 }
 
···
             redirect_uris = ?client_data.config.redirect_uris,
             scopes = ?client_data.config.scopes,
             has_keyset = client_data.keyset.is_some(),
-            "oauth client created"
+            "oauth client created:"
         );
 
         let client = Arc::new(client);
         let registry = Arc::new(SessionRegistry::new(store, client.clone(), client_data));
-        Self { registry, client }
+        Self {
+            registry,
+            client,
+            options: RwLock::new(CallOptions::default()),
+            endpoint: RwLock::new(None),
+        }
     }
 
     pub fn new_with_shared(
···
             client.clone(),
             client_data,
         ));
-        Self { registry, client }
+        Self {
+            registry,
+            client,
+            options: RwLock::new(CallOptions::default()),
+            endpoint: RwLock::new(None),
+        }
     }
 }
 
···
             self.registry.client_data.config.clone(),
             &self.registry.client_data.keyset,
         )?;
-
         let (server_metadata, identity) = self.client.resolve_oauth(input.as_ref()).await?;
         let login_hint = if identity.is_some() {
             Some(input.as_ref().into())
···
             client_metadata,
             keyset: self.registry.client_data.keyset.clone(),
         };
+
         let auth_req_info =
             par(self.client.as_ref(), login_hint, options.prompt, &metadata).await?;
+
         // Persist state for callback handling
         self.registry
             .store
···
     }
 }
 
+impl<T, S> HttpClient for OAuthClient<T, S>
+where
+    S: ClientAuthStore + Send + Sync + 'static,
+    T: OAuthResolver + DpopExt + Send + Sync + 'static,
+{
+    type Error = T::Error;
+
+    async fn send_http(
+        &self,
+        request: http::Request<Vec<u8>>,
+    ) -> core::result::Result<http::Response<Vec<u8>>, Self::Error> {
+        self.client.send_http(request).await
+    }
+}
+
+impl<T, S> IdentityResolver for OAuthClient<T, S>
+where
+    S: ClientAuthStore + Send + Sync + 'static,
+    T: OAuthResolver + DpopExt + Send + Sync + 'static,
+{
+    fn options(&self) -> &ResolverOptions {
+        self.client.options()
+    }
+
+    async fn resolve_handle(
+        &self,
+        handle: &Handle<'_>,
+    ) -> jacquard_identity::resolver::Result<Did<'static>> {
+        self.client.resolve_handle(handle).await
+    }
+
+    async fn resolve_did_doc(
+        &self,
+        did: &Did<'_>,
+    ) -> jacquard_identity::resolver::Result<DidDocResponse> {
+        self.client.resolve_did_doc(did).await
+    }
+}
+
+impl<T, S> XrpcClient for OAuthClient<T, S>
+where
+    S: ClientAuthStore + Send + Sync + 'static,
+    T: OAuthResolver + DpopExt + Send + Sync + 'static,
+{
+    async fn base_uri(&self) -> Url {
+        self.endpoint.read().await.clone().unwrap_or(
+            Url::parse("https://public.api.bsky.app").expect("public appview should be valid url"),
+        )
+    }
+
+    async fn opts(&self) -> CallOptions<'_> {
+        self.options.read().await.clone()
+    }
+
+    async fn set_opts(&self, opts: CallOptions<'_>) {
+        let mut guard = self.options.write().await;
+        *guard = opts.into_static();
+    }
+
+    async fn set_base_uri(&self, url: Url) {
+        let mut guard = self.endpoint.write().await;
+        *guard = Some(url);
+    }
+
+    async fn send<R>(&self, request: R) -> XrpcResult<XrpcResponse<R>>
+    where
+        R: XrpcRequest + Send + Sync,
+        <R as XrpcRequest>::Response: Send + Sync,
+    {
+        let opts = self.options.read().await.clone();
+        self.send_with_opts(request, opts).await
+    }
+
+    async fn send_with_opts<R>(
+        &self,
+        request: R,
+        opts: CallOptions<'_>,
+    ) -> XrpcResult<XrpcResponse<R>>
+    where
+        R: XrpcRequest + Send + Sync,
+        <R as XrpcRequest>::Response: Send + Sync,
+    {
+        let base_uri = self.base_uri().await;
+        self.client
+            .xrpc(base_uri.clone())
+            .with_options(opts.clone())
+            .send(&request)
+            .await
+    }
+}
+
 pub struct OAuthSession<T, S, W = ()>
 where
     T: OAuthResolver,
···
             .as_ref()
             .map(|t| AuthorizationToken::Dpop(t.clone()))
     }
+
+    pub fn to_client(&self) -> OAuthClient<T, S> {
+        OAuthClient::from_session(self)
+    }
 }
 impl<T, S, W> OAuthSession<T, S, W>
 where
···
         Self {
             registry: session.registry.clone(),
             client: session.client.clone(),
+            options: RwLock::new(CallOptions::default()),
+            endpoint: RwLock::new(None),
         }
     }
 }

crates/jacquard-oauth/src/request.rs

···
         login_hint: login_hint,
         prompt: prompt.map(CowStr::from),
     };
+
+    #[cfg(feature = "tracing")]
+    tracing::debug!(
+        parameters = ?parameters,
+        "par:"
+    );
     if metadata
         .server_metadata
         .pushed_authorization_request_endpoint
···
                 jwks_uri: None,
                 jwks: None,
                 token_endpoint_auth_signing_alg: None,
+                client_name: None,
+                privacy_policy_uri: None,
+                tos_uri: None,
+                logo_uri: None,
             },
             keyset: None,
         }

crates/jacquard-oauth/src/session.rs

···
     pub config: AtprotoClientMetadata<'s>,
 }
 
+impl<'s> ClientData<'s> {
+    pub fn new(keyset: Option<Keyset>, config: AtprotoClientMetadata<'s>) -> Self {
+        Self { keyset, config }
+    }
+
+    pub fn new_public(config: AtprotoClientMetadata<'s>) -> Self {
+        Self {
+            keyset: None,
+            config,
+        }
+    }
+}
+
 pub struct ClientSession<'s> {
     pub keyset: Option<Keyset>,
     pub config: AtprotoClientMetadata<'s>,

crates/jacquard-oauth/src/types.rs

···
 pub use self::response::*;
 pub use self::token::*;
 use jacquard_common::CowStr;
+use jacquard_common::IntoStatic;
 use serde::Deserialize;
 use url::Url;
 
···
     }
 }
 
+impl<'s> AuthorizeOptions<'s> {
+    pub fn with_prompt(mut self, prompt: AuthorizeOptionPrompt) -> Self {
+        self.prompt = Some(prompt);
+        self
+    }
+
+    pub fn with_state(mut self, state: CowStr<'s>) -> Self {
+        self.state = Some(state);
+        self
+    }
+
+    pub fn with_redirect_uri(mut self, redirect_uri: Url) -> Self {
+        self.redirect_uri = Some(redirect_uri);
+        self
+    }
+
+    pub fn with_scopes(mut self, scopes: Vec<Scope<'s>>) -> Self {
+        self.scopes = scopes;
+        self
+    }
+}
+
 #[derive(Debug, Deserialize)]
 pub struct CallbackParams<'s> {
     #[serde(borrow)]
···
     pub state: Option<CowStr<'s>>,
     pub iss: Option<CowStr<'s>>,
 }
+
+impl IntoStatic for CallbackParams<'_> {
+    type Output = CallbackParams<'static>;
+
+    fn into_static(self) -> Self::Output {
+        CallbackParams {
+            code: self.code.into_static(),
+            state: self.state.map(|s| s.into_static()),
+            iss: self.iss.map(|s| s.into_static()),
+        }
+    }
+}

crates/jacquard-oauth/src/types/client_metadata.rs

···
 use jacquard_common::{CowStr, IntoStatic};
 use jose_jwk::JwkSet;
 use serde::{Deserialize, Serialize};
+use smol_str::SmolStr;
 use url::Url;
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq)]
···
     // https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata
     #[serde(skip_serializing_if = "Option::is_none")]
     pub token_endpoint_auth_signing_alg: Option<CowStr<'c>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub client_name: Option<SmolStr>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub logo_uri: Option<Url>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub tos_uri: Option<Url>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub privacy_policy_uri: Option<Url>,
 }
 
 impl OAuthClientMetadata<'_> {}
···
             token_endpoint_auth_signing_alg: self
                 .token_endpoint_auth_signing_alg
                 .map(|alg| alg.into_static()),
+            client_name: self.client_name,
+            logo_uri: self.logo_uri,
+            tos_uri: self.tos_uri,
+            privacy_policy_uri: self.privacy_policy_uri,
         }
     }
 }

crates/jacquard/src/client.rs

···
 use core::future::Future;
 pub use error::*;
 #[cfg(feature = "api")]
+use jacquard_api::com_atproto::repo::get_record::GetRecordOutput;
+#[cfg(feature = "api")]
 use jacquard_api::com_atproto::{
     repo::{
         create_record::CreateRecordOutput, delete_record::DeleteRecordOutput,
···
 use jacquard_common::types::string::AtUri;
 #[cfg(feature = "api")]
 use jacquard_common::types::uri::RecordUri;
-#[cfg(not(target_arch = "wasm32"))]
 use jacquard_common::xrpc::XrpcResponse;
 use jacquard_common::xrpc::{
     CallOptions, Response, XrpcClient, XrpcError, XrpcExt, XrpcRequest, XrpcResp,
···
 };
 use jacquard_identity::{JacquardResolver, slingshot_resolver_default};
 use jacquard_oauth::authstore::ClientAuthStore;
-use jacquard_oauth::client::OAuthSession;
+use jacquard_oauth::client::{OAuthClient, OAuthSession};
 use jacquard_oauth::dpop::DpopExt;
 use jacquard_oauth::resolver::OAuthResolver;
 use serde::Serialize;
···
         Self { inner }
     }
 
+    pub fn inner(&self) -> &A {
+        &self.inner
+    }
+
     /// Return the underlying session kind.
     pub fn kind(&self) -> AgentKind {
         self.inner.session_kind()
···
         }
     }
 
+    /// Untyped, freeform record fetcher.
+    /// Hits [https://slingshot.microcosm.blue]
+    fn fetch_record_slingshot(
+        &self,
+        uri: &AtUri<'_>,
+    ) -> impl Future<Output = Result<GetRecordOutput<'static>>> {
+        async move {
+            #[cfg(feature = "tracing")]
+            let _span = tracing::debug_span!("fetch_record_slingshot", uri = %uri).entered();
+
+            // Make stateless XRPC call to that PDS (no auth required for public records)
+            use jacquard_api::com_atproto::repo::get_record::GetRecord;
+            let collection = uri.collection().clone().ok_or(AgentError::sub_operation(
+                "no collection",
+                ClientError::invalid_request("no collection"),
+            ))?;
+            let rkey = uri.rkey().ok_or(AgentError::sub_operation(
+                "no rkey",
+                ClientError::invalid_request("no rkey"),
+            ))?;
+            let request = GetRecord::new()
+                .repo(uri.authority().clone())
+                .collection(collection.clone())
+                .rkey(rkey.clone())
+                .build();
+
+            let response: Response<GetRecordResponse> = {
+                use url::Url;
+
+                let http_request = xrpc::build_http_request(
+                    &Url::parse("https://slingshot.microcosm.blue")
+                        .expect("slingshot url is valid"),
+                    &request,
+                    &self.opts().await,
+                )?;
+
+                let http_response = self
+                    .send_http(http_request)
+                    .await
+                    .map_err(|e| ClientError::transport(e))?;
+
+                xrpc::process_response(http_response)
+            }?;
+            let output = response.into_output().map_err(|e| match e {
+                XrpcError::Auth(auth) => AgentError::from(auth),
+                e @ (XrpcError::Generic(_) | XrpcError::Decode(_)) => AgentError::xrpc(e),
+                XrpcError::Xrpc(typed) => AgentError::new(
+                    AgentErrorKind::SubOperation {
+                        step: "fetch record",
+                    },
+                    None,
+                )
+                .with_details(typed.to_string()),
+            })?;
+            Ok(output)
+        }
+    }
+
     /// Fetches a record from the PDS. Returns an owned, parsed response.
     ///
     /// Takes an at:// URI annotated with the collection type, which be constructed with `R::uri(uri)`
···
                 .await
                 .map(|t| t.into_static())
                 .map_err(|e| ClientError::transport(e).with_context("OAuth token refresh failed"))
+        }
+    }
+}
+
+impl<T, S> AgentSession for OAuthClient<T, S>
+where
+    S: ClientAuthStore + Send + Sync + 'static,
+    T: OAuthResolver + DpopExt + Send + Sync + 'static,
+{
+    fn session_kind(&self) -> AgentKind {
+        AgentKind::OAuth
+    }
+    fn session_info(
+        &self,
+    ) -> impl Future<Output = Option<(Did<'static>, Option<CowStr<'static>>)>> {
+        async { None }
+    }
+    fn endpoint(&self) -> impl Future<Output = url::Url> {
+        async { self.base_uri().await }
+    }
+    fn set_options<'a>(&'a self, opts: CallOptions<'a>) -> impl Future<Output = ()> {
+        async { self.set_opts(opts).await }
+    }
+    fn refresh(&self) -> impl Future<Output = ClientResult<AuthorizationToken<'static>>> {
+        async {
+            Err(ClientError::auth(
+                jacquard_common::error::AuthError::NotAuthenticated,
+            ))
         }
     }
 }