refactor: adjusting oauth components to support blind oauth workflows

Signed-off-by: Nick Gerakines <[e-mail]>

crates/atproto-oauth-aip/src/lib.rs

···
 //!     &http_client,
 //!     &oauth_client,
 //!     Some("user_handle"),
-//!     &authorization_server,
+//!     &authorization_server.pushed_authorization_request_endpoint,
 //!     &oauth_request_state
 //! ).await?;
 //!
···
 //! # let oauth_request = atproto_oauth::workflow::OAuthRequest {
 //! #     oauth_state: "state".to_string(),
 //! #     issuer: "https://auth.example.com".to_string(),
-//! #     did: "did:plc:example".to_string(),
+//! #     authorization_server: "https://auth.example.com".to_string(),
 //! #     nonce: "nonce".to_string(),
 //! #     signing_public_key: "public_key".to_string(),
 //! #     pkce_verifier: "verifier".to_string(),
···
 //! let token_response = oauth_complete(
 //!     &http_client,
 //!     &oauth_client,
-//!     &authorization_server,
+//!     &authorization_server.token_endpoint,
 //!     "authorization_code",
 //!     &oauth_request
 //! ).await?;
···
 //! # };
 //! let session = session_exchange(
 //!     &http_client,
-//!     &protected_resource,
+//!     &protected_resource.resource,
 //!     &token_response.access_token
 //! ).await?;
 //! # Ok(())

crates/atproto-oauth-aip/src/workflow.rs

···
 //!     &http_client,
 //!     &oauth_client,
 //!     Some("user.bsky.social"),
-//!     &authorization_server,
+//!     &authorization_server.pushed_authorization_request_endpoint,
 //!     &oauth_request_state
 //! ).await?;
 //!
···
 //! # let oauth_request = OAuthRequest {
 //! #     oauth_state: "state".to_string(),
 //! #     issuer: "https://auth.example.com".to_string(),
-//! #     did: "did:plc:example".to_string(),
+//! #     authorization_server: "https://auth.example.com".to_string(),
 //! #     nonce: "nonce".to_string(),
 //! #     signing_public_key: "public_key".to_string(),
 //! #     pkce_verifier: "verifier".to_string(),
···
 //! let token_response = oauth_complete(
 //!     &http_client,
 //!     &oauth_client,
-//!     &authorization_server,
+//!     &authorization_server.token_endpoint,
 //!     "received_auth_code",
 //!     &oauth_request
 //! ).await?;
···
 //! # };
 //! let session = session_exchange(
 //!     &http_client,
-//!     &protected_resource,
+//!     &protected_resource.resource,
 //!     &token_response.access_token
 //! ).await?;
 //! # Ok(())
···
 //! and protocol violations.
 
 use anyhow::Result;
-use atproto_oauth::{
-    resources::{AuthorizationServer, OAuthProtectedResource},
-    workflow::{OAuthRequest, OAuthRequestState, ParResponse, TokenResponse},
-};
+use atproto_oauth::workflow::{OAuthRequest, OAuthRequestState, ParResponse, TokenResponse};
 use serde::Deserialize;
 
 use crate::errors::OAuthWorkflowError;
···
 ///     client_id: "client123".to_string(),
 ///     client_secret: "secret456".to_string(),
 /// };
-/// # let authorization_server = todo!();
+/// # let authorization_server = "https://auth.example.com/par";
 /// let oauth_request_state = OAuthRequestState {
 ///     state: "random-state".to_string(),
 ///     nonce: "random-nonce".to_string(),
···
 ///     &http_client,
 ///     &oauth_client,
 ///     Some("alice.bsky.social"),
-///     &authorization_server,
+///     authorization_server,
 ///     &oauth_request_state,
 /// ).await?;
 /// # Ok(())
···
     http_client: &reqwest::Client,
     oauth_client: &OAuthClient,
     login_hint: Option<&str>,
-    authorization_server: &AuthorizationServer,
+    par_url: &str,
     oauth_request_state: &OAuthRequestState,
 ) -> Result<ParResponse> {
-    let par_url = authorization_server
-        .pushed_authorization_request_endpoint
-        .clone();
-
     let scope = &oauth_request_state.scope;
 
     let mut params = vec![
···
 /// use atproto_oauth_aip::workflow::oauth_complete;
 /// # let http_client = reqwest::Client::new();
 /// # let oauth_client = todo!();
-/// # let authorization_server = todo!();
+/// # let token_endpoint = "https://auth.example.com/token";
 /// # let oauth_request = todo!();
 /// let token_response = oauth_complete(
 ///     &http_client,
 ///     &oauth_client,
-///     &authorization_server,
+///     token_endpoint,
 ///     "auth_code_from_callback",
 ///     &oauth_request,
 /// ).await?;
···
 pub async fn oauth_complete(
     http_client: &reqwest::Client,
     oauth_client: &OAuthClient,
-    authorization_server: &AuthorizationServer,
+    token_endpoint: &str,
     callback_code: &str,
     oauth_request: &OAuthRequest,
 ) -> Result<TokenResponse> {
···
     ];
 
     http_client
-        .post(&authorization_server.token_endpoint)
+        .post(token_endpoint)
         .basic_auth(
             oauth_client.client_id.as_str(),
             Some(oauth_client.client_secret.as_str()),
···
         .form(&params)
         .send()
         .await
+        .inspect(|value| {
+            println!("{value:?}");
+        })
         .map_err(OAuthWorkflowError::TokenRequestFailed)?
         .json()
         .await
···
 /// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
 /// use atproto_oauth_aip::workflow::session_exchange;
 /// # let http_client = reqwest::Client::new();
-/// # let protected_resource = todo!();
+/// # let protected_resource = "https://pds.example.com";
 /// # let access_token = "example_token";
 /// let session = session_exchange(
 ///     &http_client,
-///     &protected_resource,
+///     protected_resource,
 ///     access_token,
 /// ).await?;
 /// println!("Authenticated as {} ({})", session.handle, session.did);
···
 /// ```
 pub async fn session_exchange(
     http_client: &reqwest::Client,
-    protected_resource: &OAuthProtectedResource,
+    protected_resource_base: &str,
     access_token: &str,
 ) -> Result<ATProtocolSession> {
     let response = http_client
         .get(format!(
             "{}/api/atprotocol/session",
-            protected_resource.resource
+            protected_resource_base
         ))
         .bearer_auth(access_token)
         .send()

crates/atproto-oauth-axum/src/bin/atproto-oauth-tool.rs

···
     let oauth_request = OAuthRequest {
         oauth_state: state.clone(),
         issuer: authorization_server.issuer.clone(),
-        did: did.clone(),
+        authorization_server: authorization_server.issuer.clone(),
         nonce: nonce.clone(),
         pkce_verifier,
         signing_public_key: public_signing_key.to_string(),

crates/atproto-oauth-axum/src/handle_complete.rs

···
 };
 use atproto_oauth::{
     axum::state::OAuthRequestStorageExtractor,
+    resources::pds_resources,
     workflow::{OAuthClient, oauth_complete},
 };
 use axum::{
···
         });
     }
 
-    let document = did_document_storage
-        .0
-        .get_document_by_did(&oauth_request.did)
-        .await?;
-
-    let document = document.ok_or(OAuthCallbackError::NoDIDDocumentFound)?;
-
     let private_signing_key_data = key_provider
         .0
         .get_private_key_by_id(&oauth_request.signing_public_key)
···
         private_signing_key_data,
     };
 
+    // We need to get the DID from the token response after OAuth completion
+    // First, get authorization server from the issuer to complete OAuth
+    let (_, authorization_server) =
+        pds_resources(&client, &oauth_request.authorization_server).await?;
+
     let token_response = oauth_complete(
         &client,
         &oauth_client,
         &private_dpop_key_data,
         &callback_form.code,
         &oauth_request,
-        &document,
+        &authorization_server,
     )
     .await?;
+
+    // Now get the DID from the token response subject claim
+    let did = token_response
+        .sub
+        .clone()
+        .ok_or(OAuthCallbackError::NoDIDDocumentFound)?;
+
+    let document = did_document_storage.0.get_document_by_did(&did).await?;
+
+    let document = document.ok_or(OAuthCallbackError::NoDIDDocumentFound)?;
 
     // Format the response with OAuth tokens and DPoP key information
     let response_body = format!(
···
             Scope: {}\n\
             Subject: {}\n\
             Private DPoP Key: {}\n",
-        oauth_request.did,
+        document.id,
         oauth_request.issuer,
         token_response.access_token,
         token_response.refresh_token,

crates/atproto-oauth/src/storage.rs

···
 ///     async fn insert_oauth_request(&self, request: OAuthRequest) -> Result<()> {
 ///         sqlx::query!(
 ///             "INSERT INTO oauth_requests
-///              (oauth_state, issuer, did, nonce, pkce_verifier, signing_public_key,
+///              (oauth_state, issuer, authorization_server, nonce, pkce_verifier, signing_public_key,
 ///               dpop_private_key, created_at, expires_at)
 ///              VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
 ///             request.oauth_state,
 ///             request.issuer,
-///             request.did,
+///             request.authorization_server,
 ///             request.nonce,
 ///             request.pkce_verifier,
 ///             request.signing_public_key,
···
     /// let request = storage.get_oauth_request_by_state("unique-state-value").await?;
     /// match request {
     ///     Some(req) => {
-    ///         println!("Found OAuth request for DID: {}", req.did);
+    ///         println!("Found OAuth request for issuer: {}", req.issuer);
     ///         // Continue with OAuth flow
     ///     },
     ///     None => {

crates/atproto-oauth/src/storage_lru.rs

···
 /// let request = OAuthRequest {
 ///     oauth_state: "unique-state-123".to_string(),
 ///     issuer: "https://pds.example.com".to_string(),
-///     did: "did:plc:bv6ggog3tya2z3vxsub7hnal".to_string(),
+///     authorization_server: "https://pds.example.com".to_string(),
 ///     nonce: "secure-nonce".to_string(),
 ///     pkce_verifier: "code-verifier".to_string(),
 ///     signing_public_key: "public-key-data".to_string(),
···
     /// let request = OAuthRequest {
     ///     oauth_state: "state1".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:example1".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "nonce1".to_string(),
     ///     pkce_verifier: "verifier1".to_string(),
     ///     signing_public_key: "pubkey1".to_string(),
···
     /// let request = OAuthRequest {
     ///     oauth_state: "test-state".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:example".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "test-nonce".to_string(),
     ///     pkce_verifier: "test-verifier".to_string(),
     ///     signing_public_key: "test-pubkey".to_string(),
···
     /// let oauth_req = OAuthRequest {
     ///     oauth_state: "valid-state-123".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:bv6ggog3tya2z3vxsub7hnal".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "secure-nonce".to_string(),
     ///     pkce_verifier: "code-verifier".to_string(),
     ///     signing_public_key: "public-key-data".to_string(),
···
     /// let request = OAuthRequest {
     ///     oauth_state: "deletable-state".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:bv6ggog3tya2z3vxsub7hnal".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "test-nonce".to_string(),
     ///     pkce_verifier: "test-verifier".to_string(),
     ///     signing_public_key: "test-pubkey".to_string(),
···
     /// let req1 = OAuthRequest {
     ///     oauth_state: "state1".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:user1".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "nonce1".to_string(),
     ///     pkce_verifier: "verifier1".to_string(),
     ///     signing_public_key: "pubkey1".to_string(),
···
     /// let req2 = OAuthRequest {
     ///     oauth_state: "state2".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:user2".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "nonce2".to_string(),
     ///     pkce_verifier: "verifier2".to_string(),
     ///     signing_public_key: "pubkey2".to_string(),
···
     /// let req3 = OAuthRequest {
     ///     oauth_state: "state3".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:user3".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "nonce3".to_string(),
     ///     pkce_verifier: "verifier3".to_string(),
     ///     signing_public_key: "pubkey3".to_string(),
···
     /// let expired_request = OAuthRequest {
     ///     oauth_state: "soon-expired".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:user1".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "nonce1".to_string(),
     ///     pkce_verifier: "verifier1".to_string(),
     ///     signing_public_key: "pubkey1".to_string(),
···
     /// let valid_request = OAuthRequest {
     ///     oauth_state: "still-valid".to_string(),
     ///     issuer: "https://pds.example.com".to_string(),
-    ///     did: "did:plc:user2".to_string(),
+    ///     authorization_server: "https://pds.example.com".to_string(),
     ///     nonce: "nonce2".to_string(),
     ///     pkce_verifier: "verifier2".to_string(),
     ///     signing_public_key: "pubkey2".to_string(),
···
     use chrono::{Duration, Utc};
     use std::num::NonZeroUsize;
 
-    fn create_test_oauth_request(state: &str, issuer: &str, did: &str) -> OAuthRequest {
+    fn create_test_oauth_request(state: &str, issuer: &str, _did: &str) -> OAuthRequest {
         OAuthRequest {
             oauth_state: state.to_string(),
             issuer: issuer.to_string(),
-            did: did.to_string(),
+            authorization_server: issuer.to_string(),
             nonce: format!("nonce-{}", state),
             pkce_verifier: format!("verifier-{}", state),
             signing_public_key: format!("pubkey-{}", state),
···
         }
     }
 
-    fn create_expired_oauth_request(state: &str, issuer: &str, did: &str) -> OAuthRequest {
+    fn create_expired_oauth_request(state: &str, issuer: &str, _did: &str) -> OAuthRequest {
         OAuthRequest {
             oauth_state: state.to_string(),
             issuer: issuer.to_string(),
-            did: did.to_string(),
+            authorization_server: issuer.to_string(),
             nonce: format!("nonce-{}", state),
             pkce_verifier: format!("verifier-{}", state),
             signing_public_key: format!("pubkey-{}", state),
···
         // req1 and req3 should be present, req2 should be evicted
         let result1 = storage.get_oauth_request_by_state("state1").await?;
         assert!(result1.is_some());
-        assert_eq!(result1.unwrap().did, req1.did);
+        assert_eq!(result1.unwrap().oauth_state, req1.oauth_state);
 
         let result3 = storage.get_oauth_request_by_state("state3").await?;
         assert!(result3.is_some());
-        assert_eq!(result3.unwrap().did, req3.did);
+        assert_eq!(result3.unwrap().oauth_state, req3.oauth_state);
 
         assert_eq!(storage.get_oauth_request_by_state("state2").await?, None);
 

crates/atproto-oauth/src/workflow.rs

···
     #[cfg_attr(feature = "zeroize", zeroize(skip))]
     pub issuer: String,
 
-    /// The DID (Decentralized Identifier) of the user.
+    /// The authorization server identifier.
     #[cfg_attr(feature = "zeroize", zeroize(skip))]
-    pub did: String,
+    pub authorization_server: String,
 
     /// The nonce value for additional security.
     #[cfg_attr(feature = "zeroize", zeroize(skip))]
···
         f.debug_struct("OAuthRequest")
             .field("oauth_state", &self.oauth_state)
             .field("issuer", &self.issuer)
-            .field("did", &self.did)
+            .field("authorization_server", &self.authorization_server)
             .field("nonce", &self.nonce)
             .field("pkce_verifier", &"[REDACTED]")
             .field("signing_public_key", &self.signing_public_key)
···
     dpop_key_data: &KeyData,
     callback_code: &str,
     oauth_request: &OAuthRequest,
-    document: &atproto_identity::model::Document,
+    authorization_server: &AuthorizationServer,
 ) -> Result<TokenResponse, OAuthClientError> {
-    let pds_endpoints = document.pds_endpoints();
-    let pds_endpoint = pds_endpoints
-        .first()
-        .ok_or(OAuthClientError::InvalidOAuthProtectedResource)?;
-    let (_, authorization_server) = pds_resources(http_client, pds_endpoint).await?;
+    // let pds_endpoints = document.pds_endpoints();
+    // let pds_endpoint = pds_endpoints
+    //     .first()
+    //     .ok_or(OAuthClientError::InvalidOAuthProtectedResource)?;
+    // let (_, authorization_server) = pds_resources(http_client, pds_endpoint).await?;
 
     let client_assertion_header: Header = (oauth_client.private_signing_key_data.clone())
         .try_into()