oauth: don't clobber the context you goof

pkg/api/api.go

···
 
 	"github.com/NYTimes/gziphandler"
 	"github.com/bluesky-social/indigo/api/bsky"
+	"github.com/google/uuid"
 	"github.com/julienschmidt/httprouter"
 	"github.com/rs/cors"
 	sloghttp "github.com/samber/slog-http"
···
 // api/playback/iame.li/hls/source/000000000000.ts
 
 func (a *StreamplaceAPI) Handler(ctx context.Context) (http.Handler, error) {
+
 	var xrpc http.Handler
 	xrpc, err := spxrpc.NewServer(ctx, a.CLI, a.Model)
 	if err != nil {
 		return nil, err
 	}
-
 	xrpc = a.op.OAuthMiddleware(xrpc)
 	router := httprouter.New()
+
 	router.Handler("GET", "/oauth/*anything", a.op.Handler())
 	router.Handler("POST", "/oauth/*anything", a.op.Handler())
 	router.Handler("GET", "/.well-known/oauth-authorization-server", a.op.Handler())
···
 	handler = sloghttp.New(slog.Default())(handler)
 	handler = a.RateLimitMiddleware(ctx)(handler)
 
+	// this needs to be LAST so nothing else clobbers the context
+	handler = a.ContextMiddleware(ctx)(handler)
+
 	return handler, nil
 }
-
+func (a *StreamplaceAPI) ContextMiddleware(ctx context.Context) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			uuid := uuid.New().String()
+			ctx = log.WithLogValues(ctx, "requestID", uuid, "method", r.Method, "path", r.URL.Path)
+			r = r.WithContext(ctx)
+			next.ServeHTTP(w, r)
+		})
+	}
+}
 func copyHeader(dst, src http.Header) {
 	for k, vv := range src {
 		// we'll handle CORS ourselves, thanks

pkg/oproxy/oauth_middleware.go

···
 		return nil, fmt.Errorf("could not get oauth session: %w", err)
 	}
 	if session == nil {
-		return nil, nil
+		return nil, echo.NewHTTPError(http.StatusUnauthorized, "oauth session not found")
 	}
 	if session.RevokedAt != nil {
 		return nil, fmt.Errorf("oauth session revoked")

pkg/spxrpc/spxrpc.go

···
 	"context"
 	"net/http"
 
-	"github.com/google/uuid"
 	"github.com/labstack/echo/v4"
 	"stream.place/streamplace/pkg/config"
 	"stream.place/streamplace/pkg/log"
···
 		cli:   cli,
 		model: model,
 	}
-	e.Use(s.ErrorHandlingMiddleware(ctx))
+	e.Use(s.ErrorHandlingMiddleware())
 	err := s.RegisterHandlersPlaceStream(e)
 	if err != nil {
 		return nil, err
···
 	s.e.ServeHTTP(w, r)
 }
 
-func (s *Server) ErrorHandlingMiddleware(ctx context.Context) echo.MiddlewareFunc {
+func (s *Server) ErrorHandlingMiddleware() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c echo.Context) error {
-			req := c.Request()
-			uuid := uuid.New().String()
-			ctx = log.WithLogValues(ctx, "requestID", uuid, "method", req.Method, "path", req.URL.Path)
-			c.SetRequest(req.WithContext(ctx))
 			err := next(c)
 			if err == nil {
 				return nil