Extract DPoP HTTP middleware into reusable DPoPClient helper

src/AtpClient.php

···
 
 namespace SocialDept\AtpClient;
 
-use Illuminate\Http\Client\Factory;
-use SocialDept\AtpClient\Client\Client;
 use SocialDept\AtpClient\Client\AtprotoClient;
 use SocialDept\AtpClient\Client\BskyClient;
 use SocialDept\AtpClient\Client\ChatClient;
+use SocialDept\AtpClient\Client\Client;
 use SocialDept\AtpClient\Client\OzoneClient;
 use SocialDept\AtpClient\Session\SessionManager;
 
···
 
     public function __construct(
         SessionManager $sessions,
-        Factory $http,
         string $identifier,
     ) {
         // Load the network client
-        $this->client = new Client($this, $sessions, $http, $identifier);
+        $this->client = new Client($this, $sessions, $identifier);
 
         // Load all function collections
         $this->bsky = new BskyClient($this);

src/AtpClientServiceProvider.php

···
 use SocialDept\AtpClient\Contracts\KeyStore;
 use SocialDept\AtpClient\Http\Controllers\ClientMetadataController;
 use SocialDept\AtpClient\Http\Controllers\JwksController;
+use SocialDept\AtpClient\Http\DPoPClient;
 use SocialDept\AtpClient\Session\SessionManager;
 use SocialDept\AtpClient\Storage\EncryptedFileKeyStore;
 
···
         $this->app->singleton(ClientMetadataManager::class);
         $this->app->singleton(DPoPKeyManager::class);
         $this->app->singleton(DPoPNonceManager::class);
+        $this->app->singleton(DPoPClient::class);
         $this->app->singleton(TokenRefresher::class);
         $this->app->singleton(SessionManager::class, function ($app) {
             return new SessionManager(
···
                 refresher: $app->make(TokenRefresher::class),
                 dpopManager: $app->make(DPoPKeyManager::class),
                 keyStore: $app->make(KeyStore::class),
-                http: $app->make('http'),
                 refreshThreshold: config('client.session.refresh_threshold', 300),
             );
         });
···
                 {
                     return new AtpClient(
                         $this->app->make(SessionManager::class),
-                        $this->app->make('http'),
                         $identifier
                     );
                 }

src/Auth/OAuthEngine.php

···
 
 namespace SocialDept\AtpClient\Auth;
 
-use Illuminate\Http\Client\Factory as HttpClient;
 use Illuminate\Support\Str;
 use SocialDept\AtpClient\Data\AccessToken;
 use SocialDept\AtpClient\Data\AuthorizationRequest;
+use SocialDept\AtpClient\Data\DPoPKey;
 use SocialDept\AtpClient\Exceptions\AuthenticationException;
+use SocialDept\AtpClient\Http\DPoPClient;
 use SocialDept\Resolver\Facades\Resolver;
 
 class OAuthEngine
 {
     public function __construct(
-        protected HttpClient $http,
         protected DPoPKeyManager $dpopManager,
         protected ClientMetadataManager $metadata,
-        protected DPoPNonceManager $nonceManager,
+        protected DPoPClient $dpopClient,
     ) {}
 
     /**
···
         // Get PDS endpoint from request
         $pdsEndpoint = $this->extractPdsFromRequestUri($request->requestUri);
         $tokenUrl = $pdsEndpoint.'/oauth/token';
-        $tokenData = [
-            'grant_type' => 'authorization_code',
-            'code' => $code,
-            'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
-            'client_id' => $this->metadata->getClientId(),
-            'code_verifier' => $request->codeVerifier,
-        ];
 
-        // Get cached nonce
-        $nonce = $this->nonceManager->getNonce($pdsEndpoint);
-
-        $dpopProof = $this->dpopManager->createProof(
-            key: $request->dpopKey,
-            method: 'POST',
-            url: $tokenUrl,
-            nonce: $nonce,
-        );
-
-        $response = $this->http
-            ->withHeaders([
-                'DPoP' => $dpopProof,
-                'Content-Type' => 'application/x-www-form-urlencoded',
-            ])
+        $response = $this->dpopClient->request($pdsEndpoint, $tokenUrl, 'POST', $request->dpopKey)
             ->asForm()
-            ->post($tokenUrl, $tokenData);
-
-        // Handle use_dpop_nonce error - retry with server-provided nonce
-        if ($response->status() === 400) {
-            $error = $response->json('error');
-
-            if ($error === 'use_dpop_nonce' && $response->header('DPoP-Nonce')) {
-                $nonce = $response->header('DPoP-Nonce');
-                $this->nonceManager->storeNonce($pdsEndpoint, $nonce);
-
-                // Retry with new nonce
-                $dpopProof = $this->dpopManager->createProof(
-                    key: $request->dpopKey,
-                    method: 'POST',
-                    url: $tokenUrl,
-                    nonce: $nonce,
-                );
-
-                $response = $this->http
-                    ->withHeaders([
-                        'DPoP' => $dpopProof,
-                        'Content-Type' => 'application/x-www-form-urlencoded',
-                    ])
-                    ->asForm()
-                    ->post($tokenUrl, $tokenData);
-            }
-        }
-
-        // Store nonce from response for future requests
-        if ($response->header('DPoP-Nonce')) {
-            $this->nonceManager->storeNonce($pdsEndpoint, $response->header('DPoP-Nonce'));
-        }
+            ->post($tokenUrl, [
+                'grant_type' => 'authorization_code',
+                'code' => $code,
+                'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
+                'client_id' => $this->metadata->getClientId(),
+                'code_verifier' => $request->codeVerifier,
+            ]);
 
         if ($response->failed()) {
-            throw new AuthenticationException(
-                'Token exchange failed: '.$response->body()
-            );
+            throw new AuthenticationException('Token exchange failed: '.$response->body());
         }
 
         return AccessToken::fromResponse($response->json());
···
         string $pdsEndpoint,
         array $scopes,
         string $codeChallenge,
-        $dpopKey
+        DPoPKey $dpopKey
     ): array {
         $parUrl = $pdsEndpoint.'/oauth/par';
-        $parData = [
-            'client_id' => $this->metadata->getClientId(),
-            'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
-            'response_type' => 'code',
-            'scope' => implode(' ', $scopes),
-            'code_challenge' => $codeChallenge,
-            'code_challenge_method' => 'S256',
-            'state' => Str::random(32),
-        ];
 
-        // Try with cached nonce first (may be empty on first request)
-        $nonce = $this->nonceManager->getNonce($pdsEndpoint);
-
-        $dpopProof = $this->dpopManager->createProof(
-            key: $dpopKey,
-            method: 'POST',
-            url: $parUrl,
-            nonce: $nonce,
-        );
-
-        $response = $this->http
-            ->withHeaders(['DPoP' => $dpopProof])
+        $response = $this->dpopClient->request($pdsEndpoint, $parUrl, 'POST', $dpopKey)
             ->asForm()
-            ->post($parUrl, $parData);
-
-        // Handle use_dpop_nonce error - retry with server-provided nonce
-        if ($response->status() === 400) {
-            $error = $response->json('error');
-
-            if ($error === 'use_dpop_nonce' && $response->header('DPoP-Nonce')) {
-                $nonce = $response->header('DPoP-Nonce');
-                $this->nonceManager->storeNonce($pdsEndpoint, $nonce);
-
-                // Retry with new nonce
-                $dpopProof = $this->dpopManager->createProof(
-                    key: $dpopKey,
-                    method: 'POST',
-                    url: $parUrl,
-                    nonce: $nonce,
-                );
-
-                $response = $this->http
-                    ->withHeaders(['DPoP' => $dpopProof])
-                    ->asForm()
-                    ->post($parUrl, $parData);
-            }
-        }
-
-        // Store nonce from successful response for future requests
-        if ($response->header('DPoP-Nonce')) {
-            $this->nonceManager->storeNonce($pdsEndpoint, $response->header('DPoP-Nonce'));
-        }
+            ->post($parUrl, [
+                'client_id' => $this->metadata->getClientId(),
+                'redirect_uri' => $this->metadata->getRedirectUris()[0] ?? null,
+                'response_type' => 'code',
+                'scope' => implode(' ', $scopes),
+                'code_challenge' => $codeChallenge,
+                'code_challenge_method' => 'S256',
+                'state' => Str::random(32),
+            ]);
 
         if ($response->failed()) {
             throw new AuthenticationException('PAR failed: '.$response->body());
···
      */
     protected function extractPdsFromRequestUri(string $requestUri): string
     {
-        // Parse the request URI to extract the base PDS endpoint
         $parts = parse_url($requestUri);
 
         return ($parts['scheme'] ?? 'https').'://'.($parts['host'] ?? '');

src/Auth/TokenRefresher.php

···
 
 namespace SocialDept\AtpClient\Auth;
 
-use Illuminate\Http\Client\Factory as HttpClient;
 use SocialDept\AtpClient\Data\AccessToken;
 use SocialDept\AtpClient\Data\DPoPKey;
 use SocialDept\AtpClient\Exceptions\AuthenticationException;
+use SocialDept\AtpClient\Http\DPoPClient;
 
 class TokenRefresher
 {
     public function __construct(
-        protected HttpClient $http,
-        protected DPoPKeyManager $dpopManager,
+        protected DPoPClient $dpopClient,
     ) {}
 
     /**
···
         string $pdsEndpoint,
         DPoPKey $dpopKey
     ): AccessToken {
-        $dpopProof = $this->dpopManager->createProof(
-            key: $dpopKey,
-            method: 'POST',
-            url: $pdsEndpoint.'/oauth/token',
-            nonce: $this->getDpopNonce($pdsEndpoint),
-        );
+        $tokenUrl = $pdsEndpoint.'/oauth/token';
 
-        $response = $this->http
-            ->withHeaders([
-                'DPoP' => $dpopProof,
-                'Content-Type' => 'application/x-www-form-urlencoded',
-            ])
+        $response = $this->dpopClient->request($pdsEndpoint, $tokenUrl, 'POST', $dpopKey)
             ->asForm()
-            ->post($pdsEndpoint.'/oauth/token', [
+            ->post($tokenUrl, [
                 'grant_type' => 'refresh_token',
                 'refresh_token' => $refreshToken,
             ]);
 
         if ($response->failed()) {
-            throw new AuthenticationException(
-                'Token refresh failed: '.$response->body()
-            );
+            throw new AuthenticationException('Token refresh failed: '.$response->body());
         }
 
         return AccessToken::fromResponse($response->json());
-    }
-
-    protected function getDpopNonce(string $pdsEndpoint): string
-    {
-        // TODO: Implement proper DPoP nonce fetching and caching
-        // For now, return a placeholder that will need to be replaced
-        return 'temp-nonce-'.time();
     }
 }

src/Client/Client.php

···
 
 namespace SocialDept\AtpClient\Client;
 
-use Illuminate\Http\Client\Factory;
 use SocialDept\AtpClient\AtpClient;
-use SocialDept\AtpClient\Auth\DPoPNonceManager;
+use SocialDept\AtpClient\Http\DPoPClient;
 use SocialDept\AtpClient\Http\HasHttp;
 use SocialDept\AtpClient\Session\SessionManager;
 
···
     public function __construct(
         AtpClient $parent,
         SessionManager $sessions,
-        Factory $http,
         string $identifier,
     ) {
         $this->atp = $parent;
         $this->sessions = $sessions;
-        $this->http = $http;
         $this->identifier = $identifier;
-        $this->nonceManager = app(DPoPNonceManager::class);
+        $this->dpopClient = app(DPoPClient::class);
     }
 }

src/Http/DPoPClient.php

···
+<?php
+
+namespace SocialDept\AtpClient\Http;
+
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+use Psr\Http\Message\RequestInterface;
+use Psr\Http\Message\ResponseInterface;
+use SocialDept\AtpClient\Auth\DPoPKeyManager;
+use SocialDept\AtpClient\Auth\DPoPNonceManager;
+use SocialDept\AtpClient\Data\DPoPKey;
+
+class DPoPClient
+{
+    public function __construct(
+        protected DPoPKeyManager $dpopManager,
+        protected DPoPNonceManager $nonceManager,
+    ) {}
+
+    /**
+     * Build a DPoP-authenticated request with automatic nonce retry
+     */
+    public function request(
+        string $pdsEndpoint,
+        string $url,
+        string $method,
+        DPoPKey $dpopKey,
+        ?string $accessToken = null,
+    ): PendingRequest {
+        return Http::retry(times: 2, sleepMilliseconds: 0, throw: false)
+            ->withRequestMiddleware(
+                fn (RequestInterface $request) => $this->addDPoPProof(
+                    $request,
+                    $pdsEndpoint,
+                    $url,
+                    $method,
+                    $dpopKey,
+                    $accessToken,
+                )
+            )
+            ->withResponseMiddleware(
+                fn (ResponseInterface $response) => $this->captureNonce($response, $pdsEndpoint)
+            );
+    }
+
+    /**
+     * Add DPoP proof header to request
+     */
+    protected function addDPoPProof(
+        RequestInterface $request,
+        string $pdsEndpoint,
+        string $url,
+        string $method,
+        DPoPKey $dpopKey,
+        ?string $accessToken,
+    ): RequestInterface {
+        $nonce = $this->nonceManager->getNonce($pdsEndpoint);
+
+        $dpopProof = $this->dpopManager->createProof(
+            key: $dpopKey,
+            method: $method,
+            url: $url,
+            nonce: $nonce,
+            accessToken: $accessToken,
+        );
+
+        $request = $request->withHeader('DPoP', $dpopProof);
+
+        if ($accessToken) {
+            $request = $request->withHeader('Authorization', 'Bearer '.$accessToken);
+        }
+
+        return $request;
+    }
+
+    /**
+     * Capture DPoP nonce from response for future requests
+     */
+    protected function captureNonce(ResponseInterface $response, string $pdsEndpoint): ResponseInterface
+    {
+        $nonce = $response->getHeaderLine('DPoP-Nonce');
+
+        if ($nonce !== '') {
+            $this->nonceManager->storeNonce($pdsEndpoint, $nonce);
+        }
+
+        return $response;
+    }
+}

src/Http/HasHttp.php

···
 
 namespace SocialDept\AtpClient\Http;
 
-use Illuminate\Http\Client\Factory;
 use Illuminate\Http\Client\Response as LaravelResponse;
 use InvalidArgumentException;
-use SocialDept\AtpClient\Auth\DPoPKeyManager;
-use SocialDept\AtpClient\Auth\DPoPNonceManager;
 use SocialDept\AtpClient\Exceptions\ValidationException;
+use SocialDept\AtpClient\Session\Session;
 use SocialDept\AtpClient\Session\SessionManager;
 use SocialDept\AtpSchema\Facades\Schema;
 
 trait HasHttp
 {
     protected SessionManager $sessions;
-
-    protected Factory $http;
 
     protected string $identifier;
 
-    protected DPoPNonceManager $nonceManager;
+    protected DPoPClient $dpopClient;
 
     /**
      * Make XRPC call
···
         ?array $params = null,
         ?array $body = null
     ): Response {
-        // Ensure session is valid (auto-refresh)
         $session = $this->sessions->ensureValid($this->identifier);
-
-        // Build URL
         $url = rtrim($session->pdsEndpoint(), '/').'/xrpc/'.$endpoint;
 
-        // Get DPoP nonce
-        $nonce = $this->nonceManager->getNonce($session->pdsEndpoint());
-
-        // Create DPoP proof using DPoPKeyManager
-        $dpopProof = app(DPoPKeyManager::class)->createProof(
-            key: $session->dpopKey(),
-            method: $method,
-            url: $url,
-            nonce: $nonce,
-            accessToken: $session->accessToken(),
-        );
-
-        // Filter null parameters
         $params = array_filter($params ?? [], fn ($v) => ! is_null($v));
 
-        // Build request
-        $request = $this->http
-            ->withHeaders([
-                'Authorization' => 'Bearer '.$session->accessToken(),
-                'DPoP' => $dpopProof,
-            ]);
+        $request = $this->buildAuthenticatedRequest($session, $url, $method);
 
-        // Send request
         $response = match ($method) {
             'GET' => $request->get($url, $params),
             'POST' => $request->post($url, $body ?? $params),
···
             default => throw new InvalidArgumentException("Unsupported method: {$method}"),
         };
 
-        // Store nonce from response if present
-        if ($newNonce = $response->header('DPoP-Nonce')) {
-            $this->nonceManager->storeNonce($session->pdsEndpoint(), $newNonce);
-        }
-
-        // Validate response if schema exists
         if (Schema::exists($endpoint)) {
             $this->validateResponse($endpoint, $response);
         }
···
     }
 
     /**
+     * Build authenticated request with DPoP proof and automatic nonce retry
+     */
+    protected function buildAuthenticatedRequest(
+        Session $session,
+        string $url,
+        string $method
+    ): \Illuminate\Http\Client\PendingRequest {
+        return $this->dpopClient->request(
+            pdsEndpoint: $session->pdsEndpoint(),
+            url: $url,
+            method: $method,
+            dpopKey: $session->dpopKey(),
+            accessToken: $session->accessToken(),
+        );
+    }
+
+    /**
      * Validate response against schema
      */
     protected function validateResponse(string $endpoint, LaravelResponse $response): void
     {
         if (! $response->successful()) {
-            return; // Don't validate error responses
+            return;
         }
 
         $data = $response->json();
···
      */
     protected function postBlob(string $endpoint, string $data, string $mimeType): Response
     {
-        // Ensure session is valid (auto-refresh)
         $session = $this->sessions->ensureValid($this->identifier);
-
-        // Build URL
         $url = rtrim($session->pdsEndpoint(), '/').'/xrpc/'.$endpoint;
 
-        // Get DPoP nonce
-        $nonce = $this->nonceManager->getNonce($session->pdsEndpoint());
-
-        // Create DPoP proof using DPoPKeyManager
-        $dpopProof = app(DPoPKeyManager::class)->createProof(
-            key: $session->dpopKey(),
-            method: 'POST',
-            url: $url,
-            nonce: $nonce,
-            accessToken: $session->accessToken(),
-        );
-
-        // Build and send request with raw binary body
-        $response = $this->http
-            ->withHeaders([
-                'Authorization' => 'Bearer '.$session->accessToken(),
-                'DPoP' => $dpopProof,
-            ])
+        $response = $this->buildAuthenticatedRequest($session, $url, 'POST')
             ->withBody($data, $mimeType)
             ->post($url);
-
-        // Store nonce from response if present
-        if ($newNonce = $response->header('DPoP-Nonce')) {
-            $this->nonceManager->storeNonce($session->pdsEndpoint(), $newNonce);
-        }
 
         return new Response($response);
     }

src/Session/SessionManager.php

···
 
 namespace SocialDept\AtpClient\Session;
 
-use Illuminate\Http\Client\Factory as HttpClient;
+use Illuminate\Support\Facades\Http;
 use SocialDept\AtpClient\Auth\DPoPKeyManager;
 use SocialDept\AtpClient\Auth\TokenRefresher;
 use SocialDept\AtpClient\Contracts\CredentialProvider;
···
 use SocialDept\AtpClient\Events\TokenRefreshing;
 use SocialDept\AtpClient\Exceptions\AuthenticationException;
 use SocialDept\AtpClient\Exceptions\SessionExpiredException;
-use SocialDept\AtpResolver\Facades\Resolver;
+use SocialDept\Resolver\Facades\Resolver;
 
 class SessionManager
 {
···
         protected TokenRefresher $refresher,
         protected DPoPKeyManager $dpopManager,
         protected KeyStore $keyStore,
-        protected HttpClient $http,
         protected int $refreshThreshold = 300, // 5 minutes
     ) {}
 
···
     ): Session {
         $pdsEndpoint = Resolver::resolvePds($identifier);
 
-        $response = $this->http->post($pdsEndpoint.'/xrpc/com.atproto.server.createSession', [
+        $response = Http::post($pdsEndpoint.'/xrpc/com.atproto.server.createSession', [
             'identifier' => $identifier,
             'password' => $password,
         ]);