refactor: refactoring location of url utils

Cargo.lock

···
  "thiserror 2.0.12",
  "tokio",
  "tracing",
+ "urlencoding",
  "zeroize",
 ]
 
···
 version = "0.11.3"
 dependencies = [
  "anyhow",
+ "atproto-identity",
  "atproto-oauth",
  "chrono",
  "reqwest",

crates/atproto-client/src/com_atproto_identity.rs

···
 use std::collections::HashMap;
 
 use anyhow::Result;
+use atproto_identity::url::URLBuilder;
 use serde::{Deserialize, de::DeserializeOwned};
 
 use crate::{
     client::{Auth, get_apppassword_json, get_dpop_json, get_json},
     errors::SimpleError,
-    url::URLBuilder,
 };
 
 /// Response from the com.atproto.identity.resolveHandle XRPC method.

crates/atproto-client/src/com_atproto_repo.rs

···
 use std::collections::HashMap;
 
 use anyhow::Result;
+use atproto_identity::url::URLBuilder;
 use bytes::Bytes;
 use serde::{Deserialize, Serialize, de::DeserializeOwned};
 
···
         post_dpop_json, post_json,
     },
     errors::SimpleError,
-    url::URLBuilder,
 };
 
 /// Response from getting a record from an AT Protocol repository.

crates/atproto-client/src/com_atproto_server.rs

···
 //! an access JWT token from an authenticated session.
 
 use anyhow::Result;
+use atproto_identity::url::URLBuilder;
 use serde::{Deserialize, Serialize};
 
-use crate::{client::post_json, url::URLBuilder};
+use crate::client::post_json;
 
 /// Request to create a new authentication session.
 #[cfg_attr(debug_assertions, derive(Debug))]

crates/atproto-client/src/lib.rs

···
 
 pub mod client;
 pub mod errors;
-pub mod url;
 
 mod com_atproto_identity;
 mod com_atproto_repo;

crates/atproto-identity/Cargo.toml

···
 
 [dependencies]
 anyhow.workspace = true
+async-trait.workspace = true
+clap = { workspace = true, optional = true }
 ecdsa.workspace = true
+elliptic-curve.workspace = true
 hickory-resolver = { workspace = true, optional = true }
 k256 = { workspace = true, features = ["jwk"] }
+lru = { workspace = true, optional = true }
 multibase.workspace = true
 p256 = { workspace = true, features = ["jwk"] }
 p384 = { workspace = true, features = ["jwk"] }
+rand.workspace = true
 reqwest.workspace = true
 serde_ipld_dagcbor.workspace = true
 serde_json.workspace = true
···
 thiserror.workspace = true
 tokio.workspace = true
 tracing.workspace = true
-elliptic-curve.workspace = true
-rand.workspace = true
-async-trait = "0.1.88"
-lru = { workspace = true, optional = true }
-clap = { workspace = true, optional = true }
+urlencoding.workspace = true
 zeroize = { workspace = true, optional = true }
 
 [features]

crates/atproto-identity/src/lib.rs

···
 pub mod storage;
 #[cfg(feature = "lru")]
 pub mod storage_lru;
+pub mod url;
 pub mod validation;
 pub mod web;

crates/atproto-oauth-aip/Cargo.toml

···
 
 [dependencies]
 atproto-oauth.workspace = true
+atproto-identity.workspace = true
 
 anyhow.workspace = true
 chrono.workspace = true

crates/atproto-oauth-aip/src/lib.rs

···
 //! let session = session_exchange(
 //!     &http_client,
 //!     &protected_resource.resource,
-//!     &token_response.access_token
+//!     &token_response.access_token,
+//!     &None
 //! ).await?;
 //! # Ok(())
 //! # }

crates/atproto-oauth-aip/src/workflow.rs

···
 //! let session = session_exchange(
 //!     &http_client,
 //!     &protected_resource.resource,
-//!     &token_response.access_token
+//!     &token_response.access_token,
+//!     &None
 //! ).await?;
 //! # Ok(())
 //! # }
···
 //! and protocol violations.
 
 use anyhow::Result;
+use atproto_identity::url::URLBuilder;
 use atproto_oauth::{
     jwk::WrappedJsonWebKey,
     workflow::{OAuthRequest, OAuthRequestState, ParResponse, TokenResponse},
···
 /// DID, handle, and PDS endpoint. This is specific to AT Protocol's OAuth
 /// implementation.
 ///
+/// This is a convenience function that calls `session_exchange_with_options`
+/// with no additional options.
+///
 /// # Arguments
 ///
 /// * `http_client` - The HTTP client to use for making requests
-/// * `protected_resource` - The protected resource metadata
+/// * `protected_resource_base` - The base URL of the protected resource (PDS)
 /// * `access_token` - The OAuth access token to exchange
 ///
 /// # Returns
···
     protected_resource_base: &str,
     access_token: &str,
 ) -> Result<ATProtocolSession> {
+    session_exchange_with_options(
+        http_client,
+        protected_resource_base,
+        access_token,
+        &None,
+        &None,
+    )
+    .await
+}
+
+/// Exchanges an OAuth access token for an AT Protocol session with additional options.
+///
+/// This function takes an OAuth access token and exchanges it for a full
+/// AT Protocol session, which includes additional information like the user's
+/// DID, handle, and PDS endpoint. This version allows specifying additional
+/// options for the session exchange.
+///
+/// # Arguments
+///
+/// * `http_client` - The HTTP client to use for making requests
+/// * `protected_resource_base` - The base URL of the protected resource (PDS)
+/// * `access_token` - The OAuth access token to exchange
+/// * `access_token_type` - Optional token type ("oauth_session", "app_password_session", or "best")
+/// * `subject` - Optional subject (DID) to specify which user's session to retrieve
+///
+/// # Returns
+///
+/// Returns an `ATProtocolSession` with full session information,
+/// or an error if the session exchange fails.
+///
+/// # Example
+///
+/// ```no_run
+/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// use atproto_oauth_aip::workflow::session_exchange_with_options;
+/// # let http_client = reqwest::Client::new();
+/// # let protected_resource = "https://pds.example.com";
+/// # let access_token = "example_token";
+/// // Basic usage without options
+/// let session = session_exchange_with_options(
+///     &http_client,
+///     protected_resource,
+///     access_token,
+///     &None,
+///     &None,
+/// ).await?;
+/// # Ok(())
+/// # }
+/// ```
+///
+/// # Example with access_token_type
+///
+/// ```no_run
+/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// use atproto_oauth_aip::workflow::session_exchange_with_options;
+/// # let http_client = reqwest::Client::new();
+/// # let protected_resource = "https://pds.example.com";
+/// # let access_token = "example_token";
+/// // Specify the token type
+/// let session = session_exchange_with_options(
+///     &http_client,
+///     protected_resource,
+///     access_token,
+///     &Some("oauth_session"),
+///     &None,
+/// ).await?;
+/// # Ok(())
+/// # }
+/// ```
+///
+/// # Example with subject
+///
+/// ```no_run
+/// # async fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// use atproto_oauth_aip::workflow::session_exchange_with_options;
+/// # let http_client = reqwest::Client::new();
+/// # let protected_resource = "https://pds.example.com";
+/// # let access_token = "example_token";
+/// # let user_did = "did:plc:example123";
+/// // Specify both token type and subject
+/// let session = session_exchange_with_options(
+///     &http_client,
+///     protected_resource,
+///     access_token,
+///     &Some("app_password_session"),
+///     &Some(user_did),
+/// ).await?;
+/// # Ok(())
+/// # }
+/// ```
+pub async fn session_exchange_with_options(
+    http_client: &reqwest::Client,
+    protected_resource_base: &str,
+    access_token: &str,
+    access_token_type: &Option<&str>,
+    subject: &Option<&str>,
+) -> Result<ATProtocolSession> {
+    let mut url_builder = URLBuilder::new(protected_resource_base);
+    url_builder.path("/api/atprotocol/session");
+
+    if let Some(value) = access_token_type {
+        url_builder.param("access_token_type", value);
+    }
+
+    if let Some(value) = subject {
+        url_builder.param("sub", value);
+    }
+
+    let url = url_builder.build();
+
     let response = http_client
-        .get(format!(
-            "{}/api/atprotocol/session",
-            protected_resource_base
-        ))
+        .get(url)
         .bearer_auth(access_token)
         .send()
         .await