clean up comments + code

config/config.go

···
 
 // Load initializes the configuration with viper
 func Load() {
-	// Load .env file if it exists
 	if err := godotenv.Load(); err != nil {
 		log.Println("No .env file found or error loading it. Using default values and environment variables.")
 	}
 
-	// Set default configurations
 	viper.SetDefault("server.port", "8080")
 	viper.SetDefault("server.host", "localhost")
 	viper.SetDefault("callback.spotify", "http://localhost:8080/callback/spotify")
···
 	viper.SetDefault("atproto.metadata_url", "http://localhost:8080/metadata")
 	viper.SetDefault("atproto.callback_url", "/metadata")
 
-	// Configure Viper to read environment variables
 	viper.AutomaticEnv()
 
-	// Replace dots with underscores for environment variables
 	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 
-	// Set the config name and paths
 	viper.SetConfigName("config")
 	viper.SetConfigType("yaml")
 	viper.AddConfigPath("./config")
 	viper.AddConfigPath(".")
 
-	// Try to read the config file
 	if err := viper.ReadInConfig(); err != nil {
 		if _, ok := err.(viper.ConfigFileNotFoundError); !ok {
-			// It's not a "file not found" error, so it's a real error
 			log.Fatalf("Error reading config file: %v", err)
 		}
-		// Config file not found, using defaults and environment variables
 		log.Println("Config file not found, using default values and environment variables")
 	} else {
 		log.Println("Using config file:", viper.ConfigFileUsed())
 	}
 
-	// Check if required values are present
+	// check for required settings
 	requiredVars := []string{"spotify.client_id", "spotify.client_secret"}
 	missingVars := []string{}
 

db/atproto.go

···
 
 func (db *DB) GetATprotoAuthData(state string) (*models.ATprotoAuthData, error) {
 	var data models.ATprotoAuthData
-	var dpopPrivateJWKString string // Temporary variable to hold the JSON string
+	var dpopPrivateJWKString string
 
 	err := db.QueryRow(`
 	SELECT state, did, pds_url, authserver_issuer, pkce_verifier, dpop_authserver_nonce, dpop_private_jwk
···
 		&data.AuthServerIssuer,
 		&data.PKCEVerifier,
 		&data.DPoPAuthServerNonce,
-		&dpopPrivateJWKString, // Scan into the temporary string
+		&dpopPrivateJWKString,
 	)
 	if err != nil {
-		// Return the original scan error if it occurred
 		if err == sql.ErrNoRows {
 			return nil, fmt.Errorf("no auth data found for state %s: %w", state, err)
 		}
···
 
 	key, err := helpers.ParseJWKFromBytes([]byte(dpopPrivateJWKString))
 	if err != nil {
-		// Return an error if parsing fails
 		return nil, fmt.Errorf("failed to parse DPoPPrivateJWK for state %s: %w", state, err)
 	}
 	data.DPoPPrivateJWK = key
 
-	return &data, nil // Return nil error on success
+	return &data, nil
 }
 
 func (db *DB) FindOrCreateUserByDID(did string) (*models.User, error) {
···
 		if idErr != nil {
 			return nil, fmt.Errorf("failed to get last insert id: %w", idErr)
 		}
-		// Populate the user struct with the newly created user's data
 		user.ID = lastID
 		user.ATProtoDID = &did
 		user.CreatedAt = now
 		user.UpdatedAt = now
-		return &user, nil // Return the created user and nil error
+		return &user, nil
 	} else if err != nil {
-		// Handle other potential errors from QueryRow
 		return nil, fmt.Errorf("failed to find user by DID: %w", err)
 	}
 
 	return &user, err
 }
 
-// Create or update the current user's ATproto session data.
+// create or update the current user's ATproto session data.
 func (db *DB) SaveATprotoSession(tokenResp *oauth.TokenResponse) error {
 
 	expiryTime := time.Now().Add(time.Second * time.Duration(tokenResp.ExpiresIn))
···
 
 	rowsAffected, err := result.RowsAffected()
 	if err != nil {
-		// Error checking RowsAffected, but the update might have succeeded
+		// it's possible the update succeeded here?
 		return fmt.Errorf("failed to check rows affected after updating atproto session for did %s: %w", tokenResp.Sub, err)
 	}
 

db/db.go

···
 	"github.com/teal-fm/piper/models"
 )
 
-// DB is a wrapper around sql.DB
 type DB struct {
 	*sql.DB
 }
···
 }
 
 func (db *DB) Initialize() error {
-	// Create users table
 	_, err := db.Exec(`
 	CREATE TABLE IF NOT EXISTS users (
 		id INTEGER PRIMARY KEY AUTOINCREMENT,
···
 		return err
 	}
 
-	// Create tracks table
 	_, err = db.Exec(`
 	CREATE TABLE IF NOT EXISTS tracks (
 		id INTEGER PRIMARY KEY AUTOINCREMENT,
···
 	return result.LastInsertId()
 }
 
-// Add spotify session to user, returning the updated user
+// add spotify session to user, returning the updated user
 func (db *DB) AddSpotifySession(userID int64, username, email, spotifyId, accessToken, refreshToken string, tokenExpiry time.Time) (*models.User, error) {
 	now := time.Now()
 
···
 }
 
 func (db *DB) SaveTrack(userID int64, track *models.Track) (int64, error) {
-	// Convert the Artist array to a string for storage
+	// marshal artist json
 	artistString := ""
 	if len(track.Artist) > 0 {
 		bytes, err := json.Marshal(track.Artist)
···
 }
 
 func (db *DB) UpdateTrack(trackID int64, track *models.Track) error {
-	// Convert the Artist array to a string for storage
-	// In a production environment, you'd want to use proper JSON serialization
+	// marshal artist json
 	artistString := ""
 	if len(track.Artist) > 0 {
 		bytes, err := json.Marshal(track.Artist)
···
 }
 
 func (db *DB) GetRecentTracks(userID int64, limit int) ([]*models.Track, error) {
-	// convert previous-format artist strings to current-format
-
 	rows, err := db.Query(`
     SELECT id, name, artist, album, url, timestamp, duration_ms, progress_ms, service_base_url, isrc, has_stamped
     FROM tracks
···
 		err := rows.Scan(
 			&track.PlayID,
 			&track.Name,
-			&artistString, // Scan into a string first
+			&artistString, // scan to be unmarshaled later
 			&track.Album,
 			&track.URL,
 			&track.Timestamp,
···
 			return nil, err
 		}
 
-		// Convert the artist string to the Artist array structure
+		// unmarshal artist json
 		var artists []models.Artist
 		err = json.Unmarshal([]byte(artistString), &artists)
 		if err != nil {

main.go

···
 func home(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html")
 
-	// Check if user has an active session cookie
+	// check if user has an active session cookie
 	cookie, err := r.Cookie("session")
 	isLoggedIn := err == nil && cookie != nil
-	// TODO: Add logic here to fetch user details from DB using session ID
-	// to check if Spotify is already connected, if desired for finer control.
-	// For now, we'll just check if *any* session exists.
+	// TODO: add logic here to fetch user details from DB using session ID
+	// to check if Spotify is already connected
 
 	html := `
 		<html>
···
 
 // JSON API handlers
 
-// jsonResponse returns a JSON response
 func jsonResponse(w http.ResponseWriter, statusCode int, data any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(statusCode)
···
 	}
 }
 
-// API endpoint for current track
 func apiCurrentTrack(spotifyService *spotify.SpotifyService) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := session.GetUserID(r.Context())
···
 	}
 }
 
-// API endpoint for history
 func apiTrackHistory(spotifyService *spotify.SpotifyService) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		userID, ok := session.GetUserID(r.Context())

models/atproto.go

···
-// Add this struct definition to piper/models/atproto.go
 package models
 
 import (

models/user.go

···
 
 import "time"
 
-// User represents a user of the application
+// an end user of piper
 type User struct {
-	ID                  int64
-	Username            string
-	Email               *string    // Use pointer for nullable fields
-	SpotifyID           *string    // Use pointer for nullable fields
-	AccessToken         *string    // Spotify Access Token
-	RefreshToken        *string    // Spotify Refresh Token
-	TokenExpiry         *time.Time // Spotify Token Expiry
-	CreatedAt           time.Time
-	UpdatedAt           time.Time
-	ATProtoDID          *string    // ATProto DID
-	ATProtoAccessToken  *string    // ATProto Access Token
-	ATProtoRefreshToken *string    // ATProto Refresh Token
-	ATProtoTokenExpiry  *time.Time // ATProto Token Expiry
+	ID       int64
+	Username string
+	Email    *string
+
+	// spotify information
+	SpotifyID    *string
+	AccessToken  *string
+	RefreshToken *string
+	TokenExpiry  *time.Time
+
+	// atp info
+	ATProtoDID          *string
+	ATProtoAccessToken  *string
+	ATProtoRefreshToken *string
+	ATProtoTokenExpiry  *time.Time
+
+	CreatedAt time.Time
+	UpdatedAt time.Time
 }

oauth/atproto/atproto.go

···
-// Modify piper/oauth/atproto/atproto.go
 package atproto
 
 import (
···
 		return nil, fmt.Errorf("failed PAR request to %s: %w", ui.AuthServer, err)
 	}
 
-	// Save state including generated PKCE verifier and DPoP key
+	// Save state
 	data := &models.ATprotoAuthData{
 		State:               parResp.State,
 		DID:                 ui.DID,
···
 	}
 
 	log.Printf("ATProto Callback Success: User %d (DID: %s) authenticated.", userID.ID, data.DID)
-	return userID.ID, nil // Return the piper user ID
+	return userID.ID, nil
 }

oauth/oauth2.go

···
-// Modify piper/oauth/oauth2.go
 package oauth
 
 import (
···
 	state         string
 	codeVerifier  string
 	codeChallenge string
-	// Added TokenReceiver field to handle user lookup/creation based on token
 	tokenReceiver TokenReceiver
 }
 
···
 	switch strings.ToLower(provider) {
 	case "spotify":
 		endpoint = spotify.Endpoint
-	// Add other providers like Last.fm here
 	default:
-		// Placeholder for unconfigured providers
+		// placeholder
 		log.Printf("Warning: OAuth2 provider '%s' not explicitly configured. Using placeholder endpoints.", provider)
 		endpoint = oauth2.Endpoint{
-			AuthURL:  "https://example.com/auth", // Replace with actual endpoints if needed
+			AuthURL:  "https://example.com/auth",
 			TokenURL: "https://example.com/token",
 		}
 	}
···
 		state:         GenerateRandomState(),
 		codeVerifier:  codeVerifier,
 		codeChallenge: codeChallenge,
-		tokenReceiver: tokenReceiver, // Store the token receiver
+		tokenReceiver: tokenReceiver,
 	}
 }
 
-// generateCodeVerifier creates a random code verifier for PKCE
+// generate a random code verifier, for PKCE
 func GenerateCodeVerifier() string {
 	b := make([]byte, 64)
 	rand.Read(b)
 	return base64.RawURLEncoding.EncodeToString(b)
 }
 
-// generateCodeChallenge creates a code challenge from the code verifier using S256 method
+// generate a code challenge for verification later
 func GenerateCodeChallenge(verifier string) string {
 	h := sha256.New()
 	h.Write([]byte(verifier))
 	return base64.RawURLEncoding.EncodeToString(h.Sum(nil))
 }
 
-// HandleLogin implements the AuthService interface method.
 func (o *OAuth2Service) HandleLogin(w http.ResponseWriter, r *http.Request) {
 	opts := []oauth2.AuthCodeOption{
 		oauth2.SetAuthURLParam("code_challenge", o.codeChallenge),
···
 
 	userId, hasSession := session.GetUserID(r.Context())
 
-	// Use the token receiver to store the token and get the user ID
+	// store token and get uid
 	userID, err := o.tokenReceiver.SetAccessToken(token.AccessToken, userId, hasSession)
 	if err != nil {
 		log.Printf("OAuth2 Callback Info: TokenReceiver did not return a valid user ID for token: %s...", token.AccessToken[:min(10, len(token.AccessToken))])
···
 	return userID, nil
 }
 
-// GetToken remains unchanged
 func (o *OAuth2Service) GetToken(code string) (*oauth2.Token, error) {
 	opts := []oauth2.AuthCodeOption{
 		oauth2.SetAuthURLParam("code_verifier", o.codeVerifier),
···
 	return o.config.Exchange(context.Background(), code, opts...)
 }
 
-// GetClient remains unchanged
 func (o *OAuth2Service) GetClient(token *oauth2.Token) *http.Client {
 	return o.config.Client(context.Background(), token)
 }
 
-// RefreshToken remains unchanged
 func (o *OAuth2Service) RefreshToken(token *oauth2.Token) (*oauth2.Token, error) {
 	source := o.config.TokenSource(context.Background(), token)
 	return oauth2.ReuseTokenSource(token, source).Token()
 }
 
-// Helper function
 func min(a, b int) int {
 	if a < b {
 		return a

oauth/oauth_manager.go

···
 
 // manages multiple oauth client services
 type OAuthServiceManager struct {
-	services       map[string]AuthService // Changed from *OAuth2Service to AuthService interface
+	services       map[string]AuthService
 	sessionManager *session.SessionManager
 	mu             sync.RWMutex
 }
 
 func NewOAuthServiceManager() *OAuthServiceManager {
 	return &OAuthServiceManager{
-		services:       make(map[string]AuthService), // Initialize the new map
+		services:       make(map[string]AuthService),
 		sessionManager: session.NewSessionManager(),
 	}
 }
 
-// RegisterService registers any service that implements the AuthService interface.
+// registers any service that impls AuthService
 func (m *OAuthServiceManager) RegisterService(name string, service AuthService) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
···
 	log.Printf("Registered auth service: %s", name)
 }
 
-// GetService retrieves a registered AuthService by name.
+// get an AuthService by registered name
 func (m *OAuthServiceManager) GetService(name string) (AuthService, bool) {
 	m.mu.RLock()
 	defer m.mu.RUnlock()
···
 		m.mu.RUnlock()
 
 		if exists {
-			service.HandleLogin(w, r) // Call interface method
+			service.HandleLogin(w, r)
 			return
 		}
 
···
 			return
 		}
 
-		// Call the service's HandleCallback, which now returns the user ID
-		userID, err := service.HandleCallback(w, r) // Call interface method
+		userID, err := service.HandleCallback(w, r)
 
 		if err != nil {
 			log.Printf("Error handling callback for service '%s': %v", serviceName, err)
···
 		}
 
 		if userID > 0 {
-			// Create session for the user
 			session := m.sessionManager.CreateSession(userID)
 
-			// Set session cookie
 			m.sessionManager.SetSessionCookie(w, session)
 
 			log.Printf("Created session for user %d via service %s", userID, serviceName)
 
-			// Redirect to homepage after successful login and session creation
 			http.Redirect(w, r, "/", http.StatusSeeOther)
 		} else {
 			log.Printf("Callback for service '%s' did not result in a valid user ID.", serviceName)
-			// Optionally redirect to an error page or show an error message
-			// For now, just redirecting home, but this might hide errors.
-			// Consider adding error handling based on why userID might be 0.
-			http.Redirect(w, r, "/", http.StatusSeeOther) // Or redirect to a login/error page
+			// todo: redirect to an error page
+			// right now this just redirects home but we don't want this behaviour ideally
+			http.Redirect(w, r, "/", http.StatusSeeOther)
 		}
 	}
 }

oauth/service.go

···
-// Create piper/oauth/auth_service.go
 package oauth
 
 import (
 	"net/http"
 )
 
-// AuthService defines the interface for different authentication services
-// that can be managed by the OAuthServiceManager.
 type AuthService interface {
-	// HandleLogin initiates the login flow for the specific service.
+	// inits the login flow for the service
 	HandleLogin(w http.ResponseWriter, r *http.Request)
-	// HandleCallback handles the callback from the authentication provider,
-	// processes the response (e.g., exchanges code for token), finds or creates
-	// the user in the local system, and returns the user ID.
-	// Returns 0 if authentication failed or user could not be determined.
+	// handles the callback for the provider. is responsible for inserting
+	// sessions in the db
 	HandleCallback(w http.ResponseWriter, r *http.Request) (int64, error)
 }
 
+// optional but recommended
 type TokenReceiver interface {
-	// SetAccessToken stores the access token for the user and returns the user ID.
-	// If the user is already logged in, the current ID is provided.
+	// stores the access token in the db
+	// if there is a session, will associate the token with the session
 	SetAccessToken(token string, currentId int64, hasSession bool) (int64, error)
 }

service/spotify/spotify.go

···
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
···
 }
 
 func (s *SpotifyService) SetAccessToken(token string, userId int64, hasSession bool) (int64, error) {
-	// Identify the user synchronously instead of in a goroutine
 	userID, err := s.identifyAndStoreUser(token, userId, hasSession)
 	if err != nil {
 		log.Printf("Error identifying and storing user: %v", err)
···
 }
 
 func (s *SpotifyService) identifyAndStoreUser(token string, userId int64, hasSession bool) (int64, error) {
-	// Get Spotify user profile
 	userProfile, err := s.fetchSpotifyProfile(token)
 	if err != nil {
 		log.Printf("Error fetching Spotify profile: %v", err)
···
 
 	fmt.Printf("uid: %d hasSession: %t", userId, hasSession)
 
-	// Check if user exists
 	user, err := s.DB.GetUserBySpotifyID(userProfile.ID)
 	if err != nil {
 		// This error might mean DB connection issue, not just user not found.
···
 			}
 		}
 	} else {
-		// Update existing user's token and expiry
 		err = s.DB.UpdateUserToken(user.ID, token, "", tokenExpiryTime)
 		if err != nil {
+			// for now log and continue
 			log.Printf("Error updating user token for user ID %d: %v", user.ID, err)
-			// Consider if we should return 0 or the user ID even if update fails
-			// Sticking to original behavior: log and continue
 		} else {
 			log.Printf("Updated token for existing user: %s (ID: %d)", user.Username, user.ID)
 		}
 	}
-	// Keep the local 'user' object consistent (optional but good practice)
 	user.AccessToken = &token
 	user.TokenExpiry = &tokenExpiryTime
 
-	// Store token in memory cache regardless of new/existing user
 	s.mu.Lock()
 	s.userTokens[user.ID] = token
 	s.mu.Unlock()
···
 	Email       string `json:"email"`
 }
 
-// LoadAllUsers loads all active users from the database into memory
 func (s *SpotifyService) LoadAllUsers() error {
 	users, err := s.DB.GetAllActiveUsers()
 	if err != nil {
···
 
 	count := 0
 	for _, user := range users {
-		// Only load users with valid tokens
+		// load users with valid tokens
 		if user.AccessToken != nil && user.TokenExpiry.After(time.Now()) {
 			s.userTokens[user.ID] = *user.AccessToken
 			count++
···
 	return nil
 }
 
+func (s *SpotifyService) refreshTokenInner(user models.User) error {
+	// implement token refresh logic here using Spotify's token refresh endpoint
+	// this would make a request to Spotify's token endpoint with grant_type=refresh_token
+	return errors.New("Not implemented yet")
+	// if successful, update the database and in-memory cache
+}
+
 func (s *SpotifyService) RefreshToken(userID string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
···
 		return fmt.Errorf("no refresh token for user %s", userID)
 	}
 
-	// Implement token refresh logic here using Spotify's token refresh endpoint
-	// This would make a request to Spotify's token endpoint with grant_type=refresh_token
-
-	// If successful, update the database and in-memory cache
-	// we won't be now so just error out
-	return fmt.Errorf("token refresh not implemented")
-	//
-	//s.userTokens[user.ID] = newToken
-	//return nil
+	return s.refreshTokenInner(*user)
 }
 
-// RefreshExpiredTokens attempts to refresh expired tokens
+// attempt to refresh expired tokens
 func (s *SpotifyService) RefreshExpiredTokens() {
 	users, err := s.DB.GetUsersWithExpiredTokens()
 	if err != nil {
···
 
 	refreshed := 0
 	for _, user := range users {
-		// Skip users without refresh tokens
+		// skip users without refresh tokens
 		if user.RefreshToken == nil {
 			continue
 		}
 
-		// Implement token refresh logic here using Spotify's token refresh endpoint
-		// This would make a request to Spotify's token endpoint with grant_type=refresh_token
+		err := s.refreshTokenInner(*user)
+
+		if err != nil {
+			// just print out errors here for now
+			log.Printf("Error from service/spotify/spotify.go when refreshing tokens: %s", err.Error())
+		}
 
-		// If successful, update the database and in-memory cache
 		refreshed++
 	}
 
···
 		return
 	}
 
-	// Get recent tracks from database
 	tracks, err := s.DB.GetRecentTracks(userID, 20)
 	if err != nil {
 		http.Error(w, "Error retrieving track history", http.StatusInternalServerError)
···
 		return nil, fmt.Errorf("no access token for user %d", userID)
 	}
 
-	// Call Spotify API to get currently playing track
 	req, err := http.NewRequest("GET", "https://api.spotify.com/v1/me/player/currently-playing", nil)
 	if err != nil {
 		return nil, err
···
 	}
 	defer resp.Body.Close()
 
-	// No track playing
+	// nothing playing
 	if resp.StatusCode == 204 {
 		return nil, nil
 	}
 
-	// Token expired
+	// oops, token expired
 	if resp.StatusCode == 401 {
 		// attempt to refresh token
 		if err := s.RefreshToken(strconv.FormatInt(userID, 10)); err != nil {
···
 		}
 	}
 
-	// Error response
 	if resp.StatusCode != 200 {
 		body, _ := io.ReadAll(resp.Body)
 		return nil, fmt.Errorf("spotify API error: %s", body)
 	}
 
-	// Parse response
 	var response struct {
 		Item struct {
 			Name    string `json:"name"`
···
 		return nil, err
 	}
 
-	// Extract artist names/ids
 	var artists []models.Artist
 	for _, artist := range response.Item.Artists {
 		artists = append(artists, models.Artist{
···
 		})
 	}
 
-	// Create Track model
+	// assemble Track
 	track := &models.Track{
 		Name:           response.Item.Name,
 		Artist:         artists,
···
 	defer ticker.Stop()
 
 	for range ticker.C {
-		// Copy userIDs to avoid holding the lock too long
+		// copy userIDs to avoid holding the lock too long
 		s.mu.RLock()
 		userIDs := make([]int64, 0, len(s.userTokens))
 		for userID := range s.userTokens {
···
 		}
 		s.mu.RUnlock()
 
-		// Check each user's currently playing track
 		for _, userID := range userIDs {
 			track, err := s.FetchCurrentTrack(userID)
 			if err != nil {
···
 				continue
 			}
 
-			// No change if no track is playing
 			if track == nil {
 				continue
 			}
 
-			// Check if this is a new track
 			s.mu.RLock()
 			currentTrack := s.userTracks[userID]
 			s.mu.RUnlock()
···
 				}
 			}
 
-			// If track is different or we've played more than either half of the track or 30 seconds since the start
-			// whichever is greater
+			// if flagged true, we have a new track
 			isNewTrack := currentTrack == nil ||
 				currentTrack.Name != track.Name ||
 				// just check the first one for now
···
 			}
 
 			if isNewTrack {
-				// Save to database
 				id, err := s.DB.SaveTrack(userID, track)
 				if err != nil {
 					log.Printf("Error saving track for user %d: %v", userID, err)

session/session.go

···
 	mu        sync.RWMutex
 }
 
-// NewSessionManager creates a new session manager
 func NewSessionManager() *SessionManager {
-	// Initialize session table if it doesn't exist
 	database, err := db.New("./data/piper.db")
 	if err != nil {
 		log.Printf("Error connecting to database for sessions, falling back to in memory only: %v", err)
···
 		log.Printf("Error creating sessions table: %v", err)
 	}
 
-	// Create API key manager
 	apiKeyMgr := apikey.NewApiKeyManager(database)
 
 	return &SessionManager{
···
 		return session, true
 	}
 
-	// If not in memory and we have a database, check there
+	// if not in memory and we have a database, check there
 	if sm.db != nil {
 		session = &Session{ID: sessionID}
 
···
 	http.SetCookie(w, cookie)
 }
 
-// HandleLogout handles user logout
 func (sm *SessionManager) HandleLogout(w http.ResponseWriter, r *http.Request) {
 	cookie, err := r.Cookie("session")
 	if err == nil {
···
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
-// GetAPIKeyManager returns the API key manager
 func (sm *SessionManager) GetAPIKeyManager() *apikey.ApiKeyManager {
 	return sm.apiKeyMgr
 }
 
-// CreateAPIKey creates a new API key for a user
 func (sm *SessionManager) CreateAPIKey(userID int64, name string, validityDays int) (*apikey.ApiKey, error) {
 	return sm.apiKeyMgr.CreateApiKey(userID, name, validityDays)
 }
 
-// WithAuth is a middleware that checks if a user is authenticated via cookies or API key
+// middleware that checks if a user is authenticated via cookies or API key
 func WithAuth(handler http.HandlerFunc, sm *SessionManager) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// First try API key authentication (for API requests)
+		// first: check API keys
 		apiKeyStr, apiKeyErr := apikey.ExtractApiKey(r)
 		if apiKeyErr == nil && apiKeyStr != "" {
-			// Validate API key
 			apiKey, valid := sm.apiKeyMgr.GetApiKey(apiKeyStr)
 			if valid {
-				// Add user ID to context
 				ctx := WithUserID(r.Context(), apiKey.UserID)
 				r = r.WithContext(ctx)
 
-				// Set a flag in the context that this is an API request
+				// set a flag for api requests
 				ctx = WithAPIRequest(r.Context(), true)
 				r = r.WithContext(ctx)
 
···
 			}
 		}
 
-		// Fall back to cookie authentication (for browser requests)
+		// if not found, check cookies for session value
 		cookie, err := r.Cookie("session")
 		if err != nil {
 			http.Redirect(w, r, "/login/spotify", http.StatusSeeOther)
 			return
 		}
 
-		// Verify cookie session
 		session, exists := sm.GetSession(cookie.Value)
 		if !exists {
 			http.Redirect(w, r, "/login/spotify", http.StatusSeeOther)
 			return
 		}
 
-		// Add session information to request context
 		ctx := WithUserID(r.Context(), session.UserID)
 		r = r.WithContext(ctx)
 
···
 	}
 }
 
+// middleware that checks if a user is authenticated but doesn't error out if not
 func WithPossibleAuth(handler http.HandlerFunc, sm *SessionManager) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
-		authenticated := false // Default to not authenticated
+		authenticated := false
 
-		// 1. Try API key authentication
 		apiKeyStr, apiKeyErr := apikey.ExtractApiKey(r)
 		if apiKeyErr == nil && apiKeyStr != "" {
 			apiKey, valid := sm.apiKeyMgr.GetApiKey(apiKeyStr)
 			if valid {
-				// API Key valid: Add UserID, API flag, and set auth status
 				ctx = WithUserID(ctx, apiKey.UserID)
 				ctx = WithAPIRequest(ctx, true)
 				authenticated = true
-				// Update request context and call handler
 				r = r.WithContext(WithAuthStatus(ctx, authenticated))
 				handler(w, r)
 				return
 			}
-			// If API key was provided but invalid, we still proceed without auth
 		}
 
-		// 2. If no valid API key, try cookie authentication
-		if !authenticated { // Only check cookies if API key didn't authenticate
+		if !authenticated {
 			cookie, err := r.Cookie("session")
-			if err == nil { // Cookie exists
+			if err == nil {
 				session, exists := sm.GetSession(cookie.Value)
 				if exists {
-					// Session valid: Add UserID and set auth status
 					ctx = WithUserID(ctx, session.UserID)
-					// ctx = WithAPIRequest(ctx, false) // Not strictly needed, default is false
 					authenticated = true
 				}
-				// If session cookie exists but is invalid/expired, we proceed without auth
 			}
 		}
 
-		// 3. Set final auth status (could be true or false) and call handler
 		r = r.WithContext(WithAuthStatus(ctx, authenticated))
 		handler(w, r)
 	}
 }
 
-// WithAPIAuth is a middleware specifically for API-only endpoints (no cookie fallback, returns 401 instead of redirect)
+// middleware that only accepts API keys
 func WithAPIAuth(handler http.HandlerFunc, sm *SessionManager) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		// Try API key authentication
 		apiKeyStr, apiKeyErr := apikey.ExtractApiKey(r)
 		if apiKeyErr != nil || apiKeyStr == "" {
 			w.Header().Set("Content-Type", "application/json")
···
 			return
 		}
 
-		// Validate API key
 		apiKey, valid := sm.apiKeyMgr.GetApiKey(apiKeyStr)
 		if !valid {
 			w.Header().Set("Content-Type", "application/json")
···
 			return
 		}
 
-		// Add user ID to context
 		ctx := WithUserID(r.Context(), apiKey.UserID)
-		// Mark as API request
 		ctx = WithAPIRequest(ctx, true)
 		r = r.WithContext(ctx)
 
···
 	}
 }
 
-// Context keys
 type contextKey int
 
 const (