Merge pull request #17 from fatfingers23/ferature/oauth-rebase

Moved to indigo's oauth sdk and rebased on #15

.env.template

···
 ATPROTO_CLIENT_ID=
 ATPROTO_METADATA_URL=
 ATPROTO_CALLBACK_URL=
+ATPROTO_CLIENT_SECRET_KEY={goat key generate -t P-256}
+ATPROTO_CLIENT_SECRET_KEY_ID={can be whatever usually a timestamp}
 
 # Last.fm
 LASTFM_API_KEY=

Dockerfile

···
 #Overwrite the main.css with the one from the builder
 COPY --from=node_builder /app/static/main.css /app/pages/static/main.css
  #generate the jwks
-RUN go run github.com/haileyok/atproto-oauth-golang/cmd/helper generate-jwks
 RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags='-w -s -extldflags "-static"' -o main ./cmd
 ARG TARGETOS=${TARGETPLATFORM%%/*}
 ARG TARGETARCH=${TARGETPLATFORM##*/}

Makefile

···
 		--build-file ./lexcfg.json \
 		../atproto/lexicons \
 		./lexicons/teal
-
-.PHONY: jwtgen
-jwtgen:
-	go run github.com/haileyok/atproto-oauth-golang/cmd/helper generate-jwks

README.md

···
 
 This is a break down of what each env variable is and what it may look like
 
+**_breaking piper/v0.0.2 changes env_**
+
+You now have to bring your own private key to run piper. Can do this via goat `goat key generate -t P-256`. You want the one that is labeled under "Secret Key (Multibase Syntax): save this securely (eg, add to password manager)"
+
+- `ATPROTO_CLIENT_SECRET_KEY` - Private key for oauth confidential client. This can be generated via goat `goat key generate -t P-256`
+- `ATPROTO_CLIENT_SECRET_KEY_ID` - Key ID for oauth confidential client. This needs to be persistent and unique, can use a timestamp. Here's one for you: `1758199756`
+
+
 - `SERVER_PORT` - The port piper is hosted on
 - `SERVER_HOST` - The server host. `localhost` is fine here, or `0.0.0.0` for docker
 - `SERVER_ROOT_URL` - This needs to be the pubically accessible url created in [Setup](#setup). Like `https://piper.teal.fm`
···
 run some make scripts:
 
 ```
-make jwtgen
 
 make dev-setup
 ```

cmd/handlers.go

···
 
 			// Submit to PDS as feed.play record
 			if user.ATProtoDID != nil && atprotoService != nil {
-				if err := atprotoservice.SubmitPlayToPDS(r.Context(), *user.ATProtoDID, &track, atprotoService); err != nil {
+				if err := atprotoservice.SubmitPlayToPDS(r.Context(), *user.ATProtoDID, *user.MostRecentAtProtoSessionID, &track, atprotoService); err != nil {
 					log.Printf("apiSubmitListensHandler: Error submitting play to PDS for user %d: %v", userID, err)
 					// Don't fail the request, just log the error
 				}

cmd/main.go

···
 	"fmt"
 	"log"
 	"net/http"
-	"os"
 	"time"
 
 	"github.com/teal-fm/piper/service/lastfm"
···
 		log.Fatalf("Error initializing database: %v", err)
 	}
 
+	sessionManager := session.NewSessionManager(database)
+
 	// --- Service Initializations ---
-	jwksBytes, err := os.ReadFile("./jwks.json")
-	if err != nil {
-		// run `make jwtgen`
-		log.Fatalf("Error reading JWK file: %v", err)
+
+	var newJwkPrivateKey = viper.GetString("atproto.client_secret_key")
+	if newJwkPrivateKey == "" {
+		fmt.Printf("You now have to set the ATPROTO_CLIENT_SECRET_KEY env var to a private key. This can be done via goat key generate -t P-256")
+		return
 	}
-	jwks, err := atproto.LoadJwks(jwksBytes)
-	if err != nil {
-		log.Fatalf("Error loading JWK: %v", err)
+	var clientSecretKeyId = viper.GetString("atproto.client_secret_key_id")
+	if clientSecretKeyId == "" {
+		fmt.Printf("You also now have to set the ATPROTO_CLIENT_SECRET_KEY_ID env var to a key ID. This needs to be persistent and unique. Here's one for you: %d", time.Now().Unix())
+		return
 	}
+
 	atprotoService, err := atproto.NewATprotoAuthService(
 		database,
-		jwks,
+		sessionManager,
+		newJwkPrivateKey,
 		viper.GetString("atproto.client_id"),
 		viper.GetString("atproto.callback_url"),
+		clientSecretKeyId,
 	)
 	if err != nil {
 		log.Fatalf("Error creating ATproto auth service: %v", err)
···
 	spotifyService := spotify.NewSpotifyService(database, atprotoService, mbService, playingNowService)
 	lastfmService := lastfm.NewLastFMService(database, viper.GetString("lastfm.api_key"), mbService, atprotoService, playingNowService)
 
-	sessionManager := session.NewSessionManager(database)
-	oauthManager := oauth.NewOAuthServiceManager(sessionManager)
+	oauthManager := oauth.NewOAuthServiceManager()
 
 	spotifyOAuth := oauth.NewOAuth2Service(
 		viper.GetString("spotify.client_id"),

cmd/routes.go

···
 	mux.HandleFunc("/api-keys", session.WithAuth(app.apiKeyService.HandleAPIKeyManagement(app.database, app.pages), app.sessionManager))
 	mux.HandleFunc("/link-lastfm", session.WithAuth(handleLinkLastfmForm(app.database, app.pages), app.sessionManager)) // GET form
 	mux.HandleFunc("/link-lastfm/submit", session.WithAuth(handleLinkLastfmSubmit(app.database), app.sessionManager))   // POST submit - Changed route slightly
-	mux.HandleFunc("/logout", app.sessionManager.HandleLogout)
+	mux.HandleFunc("/logout", app.oauthManager.HandleLogout("atproto"))
 	mux.HandleFunc("/debug/", session.WithAuth(app.sessionManager.HandleDebug, app.sessionManager))
 
 	mux.HandleFunc("/api/v1/me", session.WithAPIAuth(apiMeHandler(app.database), app.sessionManager))
···
 	serverUrlRoot := viper.GetString("server.root_url")
 	atpClientId := viper.GetString("atproto.client_id")
 	atpCallbackUrl := viper.GetString("atproto.callback_url")
-	mux.HandleFunc("/.well-known/client-metadata.json", func(w http.ResponseWriter, r *http.Request) {
+	mux.HandleFunc("/oauth-client-metadata.json", func(w http.ResponseWriter, r *http.Request) {
 		app.atprotoService.HandleClientMetadata(w, r, serverUrlRoot, atpClientId, atpCallbackUrl)
 	})
 	mux.HandleFunc("/oauth/jwks.json", app.atprotoService.HandleJwks)

db/atproto.go

···
 import (
 	"context"
 	"database/sql"
-	"encoding/json"
 	"fmt"
+	"strings"
 	"time"
 
-	oauth "github.com/haileyok/atproto-oauth-golang"
-	"github.com/haileyok/atproto-oauth-golang/helpers"
-	"github.com/lestrrat-go/jwx/v2/jwk"
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/teal-fm/piper/models"
 )
 
-type ATprotoAuthData struct {
-	State               string    `json:"state"`
-	DID                 string    `json:"did"`
-	PDSUrl              string    `json:"pds_url"`
-	AuthServerIssuer    string    `json:"authserver_issuer"`
-	PKCEVerifier        string    `json:"pkce_verifier"`
-	DPoPAuthServerNonce string    `json:"dpop_authserver_nonce"`
-	DPoPPrivateJWK      jwk.Key   `json:"dpop_private_jwk"`
-	CreatedAt           time.Time `json:"created_at"`
-}
-
-func (db *DB) SaveATprotoAuthData(data *models.ATprotoAuthData) error {
-	dpopPrivateJWKBytes, err := json.Marshal(data.DPoPPrivateJWK)
-	if err != nil {
-		return err
-	}
-
-	_, err = db.Exec(`
-	INSERT INTO atproto_auth_data (state, did, pds_url, authserver_issuer, pkce_verifier, dpop_authserver_nonce, dpop_private_jwk)
-	VALUES (?, ?, ?, ?, ?, ?, ?)`,
-		data.State, data.DID, data.PDSUrl, data.AuthServerIssuer, data.PKCEVerifier, data.DPoPAuthServerNonce, string(dpopPrivateJWKBytes))
-
-	return err
-}
-
-func (db *DB) GetATprotoAuthData(state string) (*models.ATprotoAuthData, error) {
-	var data models.ATprotoAuthData
-	var dpopPrivateJWKString string
-
-	err := db.QueryRow(`
-	SELECT state, did, pds_url, authserver_issuer, pkce_verifier, dpop_authserver_nonce, dpop_private_jwk
-	FROM atproto_auth_data
-	WHERE state = ?`,
-		state).Scan(
-		&data.State,
-		&data.DID,
-		&data.PDSUrl,
-		&data.AuthServerIssuer,
-		&data.PKCEVerifier,
-		&data.DPoPAuthServerNonce,
-		&dpopPrivateJWKString,
-	)
-	if err != nil {
-		if err == sql.ErrNoRows {
-			return nil, fmt.Errorf("no auth data found for state %s: %w", state, err)
-		}
-		return nil, fmt.Errorf("failed to scan auth data for state %s: %w", state, err)
-	}
-
-	key, err := helpers.ParseJWKFromBytes([]byte(dpopPrivateJWKString))
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse DPoPPrivateJWK for state %s: %w", state, err)
-	}
-	data.DPoPPrivateJWK = key
-
-	return &data, nil
-}
-
 func (db *DB) FindOrCreateUserByDID(did string) (*models.User, error) {
 	var user models.User
 	err := db.QueryRow(`
···
 	return &user, err
 }
 
-// create or update the current user's ATproto session data.
-func (db *DB) SaveATprotoSession(tokenResp *oauth.TokenResponse, authserverIss string, dpopPrivateJWK jwk.Key, pdsUrl string) error {
-	db.logger.Printf("Saving session with PDS url %s", pdsUrl)
-	expiryTime := time.Now().UTC().Add(time.Second * time.Duration(tokenResp.ExpiresIn))
+func (db *DB) SetLatestATProtoSessionId(did string, atProtoSessionID string) error {
+	db.logger.Printf("Setting latest atproto session id for did %s to %s", did, atProtoSessionID)
 	now := time.Now().UTC()
 
-	dpopPrivateJWKBytes, err := json.Marshal(dpopPrivateJWK)
-	if err != nil {
-		return err
-	}
-
 	result, err := db.Exec(`
 		UPDATE users
-		SET atproto_access_token = ?,
-			atproto_refresh_token = ?,
-			atproto_token_expiry = ?,
-			atproto_scope = ?,
-			atproto_sub = ?,
-			atproto_authserver_issuer = ?,
-			atproto_token_type = ?,
-			atproto_authserver_nonce = ?,
-			atproto_dpop_private_jwk = ?,
-			atproto_pds_url = ?,
-			atproto_pds_nonce = ?,
+		SET 
+		    most_recent_at_session_id = ?,
 			updated_at = ?
 		WHERE atproto_did = ?`,
-		tokenResp.AccessToken,
-		tokenResp.RefreshToken,
-		expiryTime,
-		tokenResp.Scope,
-		tokenResp.Sub,
-		authserverIss,
-		tokenResp.TokenType,
-		tokenResp.DpopAuthserverNonce,
-		string(dpopPrivateJWKBytes),
-		pdsUrl,
-		// will get set later
-		"",
+		atProtoSessionID,
 		now,
-		tokenResp.Sub,
+		did,
 	)
-
 	if err != nil {
-		return fmt.Errorf("failed to update atproto session for did %s: %w", tokenResp.Sub, err)
+		db.logger.Printf("%v", err)
+		return fmt.Errorf("failed to update atproto session for did %s: %w", did, atProtoSessionID)
 	}
 
 	rowsAffected, err := result.RowsAffected()
 	if err != nil {
 		// it's possible the update succeeded here?
-		return fmt.Errorf("failed to check rows affected after updating atproto session for did %s: %w", tokenResp.Sub, err)
+		return fmt.Errorf("failed to check rows affected after updating atproto session for did %s: %w", did, atProtoSessionID)
 	}
 
 	if rowsAffected == 0 {
-		return fmt.Errorf("no user found with did %s to update session, creating new session", tokenResp.Sub)
+		return fmt.Errorf("no user found with did %s to update session, creating new session", did)
 	}
 
 	return nil
 }
 
-func (db *DB) GetAtprotoSession(did string, ctx context.Context, oauthClient oauth.Client) (*models.ATprotoAuthSession, error) {
-	var oauthSession models.ATprotoAuthSession
-	var authserverIss string
-	var jwkBytes string
+type SqliteATProtoStore struct {
+	db *sql.DB
+}
 
-	err := db.QueryRow(
-		`
-		SELECT id, 
-		       atproto_did,
-		       atproto_pds_url,
-		       atproto_authserver_issuer,
-		       atproto_access_token,
-		       atproto_refresh_token,
-		       atproto_pds_nonce,
-		       atproto_authserver_nonce,
-		       atproto_dpop_private_jwk,
-		       atproto_token_expiry
-		FROM users
-		WHERE atproto_did = ?`,
-		did,
-	).Scan(
-		&oauthSession.ID,
-		&oauthSession.DID,
-		&oauthSession.PDSUrl,
-		&authserverIss,
-		&oauthSession.AccessToken,
-		&oauthSession.RefreshToken,
-		&oauthSession.DpopPdsNonce,
-		&oauthSession.DpopAuthServerNonce,
-		&jwkBytes,
-		&oauthSession.TokenExpiry,
+var _ oauth.ClientAuthStore = (*SqliteATProtoStore)(nil)
+
+func NewSqliteATProtoStore(db *sql.DB) *SqliteATProtoStore {
+	return &SqliteATProtoStore{
+		db: db,
+	}
+}
+
+func sessionKey(did syntax.DID, sessionID string) string {
+	return fmt.Sprintf("%s/%s", did, sessionID)
+}
+
+func splitScopes(s string) []string {
+	if s == "" {
+		return nil
+	}
+	return strings.Fields(s)
+}
+
+func joinScopes(scopes []string) string {
+	if len(scopes) == 0 {
+		return ""
+	}
+	return strings.Join(scopes, " ")
+}
+
+func (s *SqliteATProtoStore) GetSession(ctx context.Context, did syntax.DID, sessionID string) (*oauth.ClientSessionData, error) {
+	lookUpKey := sessionKey(did, sessionID)
+
+	var (
+		accountDIDStr                string
+		lookUpKeyStr                 string
+		sessionIDStr                 string
+		hostURL                      string
+		authServerURL                string
+		authServerTokenEndpoint      string
+		authServerRevocationEndpoint string
+		scopesStr                    string
+		accessToken                  string
+		refreshToken                 string
+		dpopAuthServerNonce          string
+		dpopHostNonce                string
+		dpopPrivateKeyMultibase      string
+	)
+
+	err := s.db.QueryRow(`
+		SELECT account_did,
+		       look_up_key,
+		       session_id,
+		       host_url,
+		       authserver_url,
+		       authserver_token_endpoint,
+		       authserver_revocation_endpoint,
+		       scopes,
+		       access_token,
+		       refresh_token,
+		       dpop_authserver_nonce,
+		       dpop_host_nonce,
+		       dpop_privatekey_multibase
+		FROM atproto_sessions
+		WHERE look_up_key = ?
+	`, lookUpKey).Scan(
+		&accountDIDStr,
+		&lookUpKeyStr,
+		&sessionIDStr,
+		&hostURL,
+		&authServerURL,
+		&authServerTokenEndpoint,
+		&authServerRevocationEndpoint,
+		&scopesStr,
+		&accessToken,
+		&refreshToken,
+		&dpopAuthServerNonce,
+		&dpopHostNonce,
+		&dpopPrivateKeyMultibase,
 	)
 
+	if err == sql.ErrNoRows {
+		return nil, fmt.Errorf("session not found: %s", lookUpKey)
+	}
 	if err != nil {
-		return nil, fmt.Errorf("failed to get atproto session for did %s: %w", did, err)
+		return nil, err
 	}
 
-	privateJwk, err := helpers.ParseJWKFromBytes([]byte(jwkBytes))
+	accDID, err := syntax.ParseDID(accountDIDStr)
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse DPoPPrivateJWK: %w", err)
-	} else {
-		// add jwk to the struct
-		oauthSession.DpopPrivateJWK = privateJwk
+		return nil, fmt.Errorf("invalid account DID in session: %w", err)
 	}
 
-	// printout the session details
-	db.logger.Printf("Getting session details for the did: %+v\n", oauthSession.DID)
+	sess := oauth.ClientSessionData{
+		AccountDID:                   accDID,
+		SessionID:                    sessionIDStr,
+		HostURL:                      hostURL,
+		AuthServerURL:                authServerURL,
+		AuthServerTokenEndpoint:      authServerTokenEndpoint,
+		AuthServerRevocationEndpoint: authServerRevocationEndpoint,
+		Scopes:                       splitScopes(scopesStr),
+		AccessToken:                  accessToken,
+		RefreshToken:                 refreshToken,
+		DPoPAuthServerNonce:          dpopAuthServerNonce,
+		DPoPHostNonce:                dpopHostNonce,
+		DPoPPrivateKeyMultibase:      dpopPrivateKeyMultibase,
+	}
 
-	// if token is expired, refresh it
-	if time.Now().UTC().After(oauthSession.TokenExpiry) {
+	return &sess, nil
+}
 
-		resp, err := oauthClient.RefreshTokenRequest(ctx, oauthSession.RefreshToken, authserverIss, oauthSession.DpopAuthServerNonce, privateJwk)
-		if err != nil {
-			return nil, err
-		}
+func (s *SqliteATProtoStore) SaveSession(ctx context.Context, sess oauth.ClientSessionData) error {
+	lookUpKey := sessionKey(sess.AccountDID, sess.SessionID)
+	// simple upsert: delete then insert
+	_, _ = s.db.Exec(`DELETE FROM atproto_sessions WHERE look_up_key = ?`, lookUpKey)
+	_, err := s.db.Exec(`
+		INSERT INTO atproto_sessions (
+			look_up_key,
+			account_did,
+			session_id,
+			host_url,
+			authserver_url,
+			authserver_token_endpoint,
+			authserver_revocation_endpoint,
+			scopes,
+			access_token,
+			refresh_token,
+			dpop_authserver_nonce,
+			dpop_host_nonce,
+			dpop_privatekey_multibase
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`,
+		lookUpKey,
+		sess.AccountDID.String(),
+		sess.SessionID,
+		sess.HostURL,
+		sess.AuthServerURL,
+		sess.AuthServerTokenEndpoint,
+		sess.AuthServerRevocationEndpoint,
+		joinScopes(sess.Scopes),
+		sess.AccessToken,
+		sess.RefreshToken,
+		sess.DPoPAuthServerNonce,
+		sess.DPoPHostNonce,
+		sess.DPoPPrivateKeyMultibase,
+	)
+	return err
+}
 
-		if err := db.SaveATprotoSession(resp, authserverIss, privateJwk, oauthSession.PDSUrl); err != nil {
-			return nil, fmt.Errorf("failed to save refreshed token: %w", err)
-		}
+func (s *SqliteATProtoStore) DeleteSession(ctx context.Context, did syntax.DID, sessionID string) error {
+	lookUpKey := sessionKey(did, sessionID)
+	_, err := s.db.Exec(`DELETE FROM atproto_sessions WHERE look_up_key = ?`, lookUpKey)
+	return err
+}
 
-		oauthSession = models.ATprotoAuthSession{
-			ID:                  oauthSession.ID,
-			DID:                 oauthSession.DID,
-			PDSUrl:              oauthSession.PDSUrl,
-			AuthServerIssuer:    authserverIss,
-			AccessToken:         resp.AccessToken,
-			RefreshToken:        resp.RefreshToken,
-			DpopPdsNonce:        oauthSession.DpopPdsNonce,
-			DpopAuthServerNonce: resp.DpopAuthserverNonce,
-			DpopPrivateJWK:      privateJwk,
-			TokenExpiry:         time.Now().UTC().Add(time.Duration(resp.ExpiresIn) * time.Second),
+func (s *SqliteATProtoStore) GetAuthRequestInfo(ctx context.Context, state string) (*oauth.AuthRequestData, error) {
+	var (
+		authServerURL                string
+		accountDIDStr                sql.NullString
+		scopesStr                    string
+		requestURI                   string
+		authServerTokenEndpoint      string
+		authServerRevocationEndpoint string
+		pkceVerifier                 string
+		dpopAuthServerNonce          string
+		dpopPrivateKeyMultibase      string
+	)
+	err := s.db.QueryRow(`
+		SELECT authserver_url,
+		       account_did,
+		       scopes,
+		       request_uri,
+		       authserver_token_endpoint,
+		       authserver_revocation_endpoint,
+		       pkce_verifier,
+		       dpop_authserver_nonce,
+		       dpop_privatekey_multibase
+		FROM atproto_state
+		WHERE state = ?
+	`, state).Scan(
+		&authServerURL,
+		&accountDIDStr,
+		&scopesStr,
+		&requestURI,
+		&authServerTokenEndpoint,
+		&authServerRevocationEndpoint,
+		&pkceVerifier,
+		&dpopAuthServerNonce,
+		&dpopPrivateKeyMultibase,
+	)
+	if err == sql.ErrNoRows {
+		return nil, fmt.Errorf("request info not found: %s", state)
+	}
+	if err != nil {
+		return nil, err
+	}
+	var accountDIDPtr *syntax.DID
+	if accountDIDStr.Valid && accountDIDStr.String != "" {
+		acc, err := syntax.ParseDID(accountDIDStr.String)
+		if err != nil {
+			return nil, fmt.Errorf("invalid account DID in auth request: %w", err)
 		}
+		accountDIDPtr = &acc
+	}
+	info := oauth.AuthRequestData{
+		State:                        state,
+		AuthServerURL:                authServerURL,
+		AccountDID:                   accountDIDPtr,
+		Scopes:                       splitScopes(scopesStr),
+		RequestURI:                   requestURI,
+		AuthServerTokenEndpoint:      authServerTokenEndpoint,
+		AuthServerRevocationEndpoint: authServerRevocationEndpoint,
+		PKCEVerifier:                 pkceVerifier,
+		DPoPAuthServerNonce:          dpopAuthServerNonce,
+		DPoPPrivateKeyMultibase:      dpopPrivateKeyMultibase,
+	}
+	return &info, nil
+}
 
+func (s *SqliteATProtoStore) SaveAuthRequestInfo(ctx context.Context, info oauth.AuthRequestData) error {
+	// ensure not already exists
+	var exists int
+	err := s.db.QueryRow(`SELECT 1 FROM atproto_state WHERE state = ?`, info.State).Scan(&exists)
+	if err == nil {
+		return fmt.Errorf("auth request already saved for state %s", info.State)
 	}
-
-	return &oauthSession, nil
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+	var accountDIDStr interface{}
+	if info.AccountDID != nil {
+		accountDIDStr = info.AccountDID.String()
+	} else {
+		accountDIDStr = nil
+	}
+	_, err = s.db.Exec(`
+		INSERT INTO atproto_state (
+			state,
+			authserver_url,
+			account_did,
+			scopes,
+			request_uri,
+			authserver_token_endpoint,
+			authserver_revocation_endpoint,
+			pkce_verifier,
+			dpop_authserver_nonce,
+			dpop_privatekey_multibase
+		) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	`,
+		info.State,
+		info.AuthServerURL,
+		accountDIDStr,
+		joinScopes(info.Scopes),
+		info.RequestURI,
+		info.AuthServerTokenEndpoint,
+		info.AuthServerRevocationEndpoint,
+		info.PKCEVerifier,
+		info.DPoPAuthServerNonce,
+		info.DPoPPrivateKeyMultibase,
+	)
+	return err
 }
 
-func AtpSessionToAuthArgs(sess *models.ATprotoAuthSession) *oauth.XrpcAuthedRequestArgs {
-	//Commenting out so jwts and tokens are not in logs
-	//fmt.Printf("DID: %s\nPDS URL: %s\nISS: %s\nAccess Token: %s\nNonce: %s\nPrivate JWK: %s\n", sess.DID, sess.PDSUrl, sess.AuthServerIssuer, sess.AccessToken, sess.DpopPdsNonce, sess.DpopPrivateJWK)
-	return &oauth.XrpcAuthedRequestArgs{
-		Did:            sess.DID,
-		PdsUrl:         sess.PDSUrl,
-		Issuer:         sess.AuthServerIssuer,
-		AccessToken:    sess.AccessToken,
-		DpopPdsNonce:   sess.DpopPdsNonce,
-		DpopPrivateJwk: sess.DpopPrivateJWK,
-	}
+func (s *SqliteATProtoStore) DeleteAuthRequestInfo(ctx context.Context, state string) error {
+	_, err := s.db.Exec(`DELETE FROM atproto_state WHERE state = ?`, state)
+	return err
 }

db/db.go

···
 		username TEXT,                      -- Made nullable, might not have username initially
 		email TEXT UNIQUE,                  -- Made nullable
 		atproto_did TEXT UNIQUE,            -- Atproto DID (identifier)
-		atproto_pds_url TEXT,
-		atproto_authserver_issuer TEXT,
-		atproto_access_token TEXT,          -- Atproto access token
-		atproto_refresh_token TEXT,         -- Atproto refresh token
-		atproto_token_expiry TIMESTAMP,     -- Atproto token expiry
-		atproto_sub TEXT,
-		atproto_scope TEXT,                 -- Atproto token scope
-		atproto_token_type TEXT,            -- Atproto token type
-		atproto_authserver_nonce TEXT,
-		atproto_pds_nonce TEXT,
-		atproto_dpop_private_jwk TEXT,
+		most_recent_at_session_id TEXT,     -- Most recent oAuth session id
 		spotify_id TEXT UNIQUE,             -- Spotify specific ID
 		access_token TEXT,                  -- Spotify access token
 		refresh_token TEXT,                 -- Spotify refresh token
···
 	}
 
 	_, err = db.Exec(`
-		CREATE TABLE IF NOT EXISTS atproto_auth_data (
-		id INTEGER PRIMARY KEY AUTOINCREMENT,
-		state TEXT NOT NULL,
-		did TEXT,
-		pds_url TEXT NOT NULL,
-		authserver_issuer TEXT NOT NULL,
-		pkce_verifier TEXT NOT NULL,
-		dpop_authserver_nonce TEXT NOT NULL,
-		dpop_private_jwk TEXT NOT NULL,
-		created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-	)`)
+		CREATE TABLE IF NOT EXISTS atproto_state (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			state TEXT NOT NULL,
+			authserver_url TEXT,
+			account_did TEXT,
+			scopes TEXT,
+			request_uri TEXT,
+			authserver_token_endpoint TEXT,
+			authserver_revocation_endpoint TEXT,
+			pkce_verifier TEXT,
+			dpop_authserver_nonce TEXT,
+			dpop_privatekey_multibase TEXT,
+			created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+		);
+	  CREATE INDEX IF NOT EXISTS atproto_state_state ON atproto_state(state);
+
+`)
+	if err != nil {
+		return err
+	}
+
+	_, err = db.Exec(`
+		CREATE TABLE IF NOT EXISTS atproto_sessions (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			look_up_key TEXT NOT NULL,
+			account_did TEXT,
+			session_id TEXT,
+			host_url TEXT,
+			authserver_url TEXT,
+			authserver_token_endpoint TEXT,
+			authserver_revocation_endpoint TEXT,
+			scopes TEXT,
+			access_token TEXT,
+			refresh_token TEXT,
+			dpop_authserver_nonce TEXT,
+			dpop_host_nonce TEXT,
+			dpop_privatekey_multibase TEXT,
+			created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+		);
+	CREATE INDEX IF NOT EXISTS idx_atproto_sessions_look_up_key ON atproto_sessions(look_up_key);
+`)
 	if err != nil {
 		return err
 	}
···
 	user := &models.User{}
 
 	err := db.QueryRow(`
-	SELECT id, username, email, atproto_did, spotify_id, access_token, refresh_token, token_expiry, lastfm_username, created_at, updated_at
+	SELECT id, 
+	       username,
+	       email,
+	       atproto_did,
+	       most_recent_at_session_id,
+	       spotify_id,
+	       access_token,
+	       refresh_token,
+	       token_expiry,
+	       lastfm_username,
+	       created_at,
+	       updated_at
 	FROM users WHERE id = ?`, ID).Scan(
-		&user.ID, &user.Username, &user.Email, &user.ATProtoDID, &user.SpotifyID,
+		&user.ID, &user.Username, &user.Email, &user.ATProtoDID, &user.MostRecentAtProtoSessionID, &user.SpotifyID,
 		&user.AccessToken, &user.RefreshToken, &user.TokenExpiry,
 		&user.LastFMUsername,
 		&user.CreatedAt, &user.UpdatedAt)
···
 
 	return &lastTimestamp, nil
 }
+
+//

db/lfm.go

···
 
 func (db *DB) GetUserByLastFM(lastfmUsername string) (*models.User, error) {
 	row := db.QueryRow(`
-    SELECT id, username, email, atproto_did, created_at, updated_at, lastfm_username
+    SELECT id, username, email, atproto_did, most_recent_at_session_id, created_at, updated_at, lastfm_username
     FROM users
     WHERE lastfm_username = ?`, lastfmUsername)
 
 	user := &models.User{}
 	err := row.Scan(
-		&user.ID, &user.Username, &user.Email, &user.ATProtoDID,
+		&user.ID, &user.MostRecentAtProtoSessionID, &user.Username, &user.Email, &user.ATProtoDID,
 		&user.CreatedAt, &user.UpdatedAt, &user.LastFMUsername)
 	if err != nil {
 		return nil, err

go.mod

···
 go 1.24.0
 
 require (
-	github.com/bluesky-social/indigo v0.0.0-20250506174012-7075cf22f63e
+	github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e
 	github.com/dlclark/regexp2 v1.11.5
-	github.com/haileyok/atproto-oauth-golang v0.0.2
 	github.com/ipfs/go-cid v0.4.1
 	github.com/joho/godotenv v1.5.1
 	github.com/justinas/alice v1.2.0
···
 require (
 	dario.cat/mergo v1.0.1 // indirect
 	github.com/air-verse/air v1.61.7 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bep/godartsass v1.2.0 // indirect
 	github.com/bep/godartsass/v2 v2.1.0 // indirect
 	github.com/bep/golibsass v1.2.0 // indirect
 	github.com/carlmjohnson/versioninfo v0.22.5 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cli/safeexec v1.0.1 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
 	github.com/creack/pty v1.1.23 // indirect
···
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/gohugoio/hugo v0.134.3 // indirect
-	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
+	github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/context v1.1.2 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/gorilla/sessions v1.4.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/ipfs/bbloom v0.0.4 // indirect
 	github.com/ipfs/go-block-format v0.2.0 // indirect
 	github.com/ipfs/go-datastore v0.6.0 // indirect
···
 	github.com/ipfs/go-log/v2 v2.5.1 // indirect
 	github.com/ipfs/go-metrics-interface v0.0.1 // indirect
 	github.com/jbenet/goprocess v0.1.4 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/labstack/echo-contrib v0.17.2 // indirect
+	github.com/labstack/echo/v4 v4.13.3 // indirect
+	github.com/labstack/gommon v0.4.2 // indirect
 	github.com/lestrrat-go/blackmagic v1.0.2 // indirect
 	github.com/lestrrat-go/httpcc v1.0.1 // indirect
 	github.com/lestrrat-go/httprc v1.0.4 // indirect
···
 	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/minio/sha256-simd v1.0.1 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-base32 v0.1.0 // indirect
···
 	github.com/multiformats/go-multibase v0.2.0 // indirect
 	github.com/multiformats/go-multihash v0.2.3 // indirect
 	github.com/multiformats/go-varint v0.0.7 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f // indirect
+	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.61.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sagikazarmark/locafero v0.7.0 // indirect
+	github.com/samber/lo v1.47.0 // indirect
+	github.com/samber/slog-echo v1.15.1 // indirect
 	github.com/segmentio/asm v1.2.0 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
···
 	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/tdewolff/parse/v2 v2.7.15 // indirect
 	github.com/urfave/cli/v2 v2.27.5 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
+	github.com/valyala/fasttemplate v1.2.2 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect
+	gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
 	go.opentelemetry.io/otel v1.29.0 // indirect
 	go.opentelemetry.io/otel/metric v1.29.0 // indirect
···
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/crypto v0.32.0 // indirect
 	golang.org/x/mod v0.21.0 // indirect
+	golang.org/x/net v0.33.0 // indirect
 	golang.org/x/sys v0.29.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	google.golang.org/protobuf v1.36.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gorm.io/driver/sqlite v1.5.7 // indirect
+	gorm.io/gorm v1.25.9 // indirect
 	lukechampine.com/blake3 v1.2.1 // indirect
 )
 

go.sum

···
 github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c h1:651/eoCRnQ7YtSjAnSzRucrJz+3iGEFt+ysraELS81M=
 github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bep/clocks v0.5.0 h1:hhvKVGLPQWRVsBP/UB7ErrHYIO42gINVbvqxvYTPVps=
 github.com/bep/clocks v0.5.0/go.mod h1:SUq3q+OOq41y2lRQqH5fsOoxN8GbxSiT6jvoVVLCVhU=
 github.com/bep/debounce v1.2.1 h1:v67fRdBA9UQu2NhLFXrSg0Brw7CexQekrBwDMM8bzeY=
···
 github.com/bep/overlayfs v0.9.2/go.mod h1:aYY9W7aXQsGcA7V9x/pzeR8LjEgIxbtisZm8Q7zPz40=
 github.com/bep/tmc v0.5.1 h1:CsQnSC6MsomH64gw0cT5f+EwQDcvZz4AazKunFwTpuI=
 github.com/bep/tmc v0.5.1/go.mod h1:tGYHN8fS85aJPhDLgXETVKp+PR382OvFi2+q2GkGsq0=
-github.com/bluesky-social/indigo v0.0.0-20250506174012-7075cf22f63e h1:yEW1njmALj7i1AjLhq6Lsxts48JUCTT+wpM9m7GNLVY=
-github.com/bluesky-social/indigo v0.0.0-20250506174012-7075cf22f63e/go.mod h1:ovyxp8AMO1Hoe838vMJUbqHTZaAR8ABM3g3TXu+A5Ng=
+github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e h1:IutKPwmbU0LrYqw03EuwJtMdAe67rDTrL1U8S8dicRU=
+github.com/bluesky-social/indigo v0.0.0-20251003000214-3259b215110e/go.mod h1:n6QE1NDPFoi7PRbMUZmc2y7FibCqiVU4ePpsvhHUBR8=
 github.com/carlmjohnson/versioninfo v0.22.5 h1:O00sjOLUAFxYQjlN/bzYTuZiS0y6fWDQjMRvwtKgwwc=
 github.com/carlmjohnson/versioninfo v0.22.5/go.mod h1:QT9mph3wcVfISUKd0i9sZfVrPviHuSF+cUtLjm2WSf8=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
···
 github.com/gohugoio/locales v0.14.0/go.mod h1:ip8cCAv/cnmVLzzXtiTpPwgJ4xhKZranqNqtoIu0b/4=
 github.com/gohugoio/localescompressed v1.0.1 h1:KTYMi8fCWYLswFyJAeOtuk/EkXR/KPTHHNN9OS+RTxo=
 github.com/gohugoio/localescompressed v1.0.1/go.mod h1:jBF6q8D7a0vaEmcWPNcAjUZLJaIVNiwvM3WlmTvooB0=
-github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
-github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
+github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
+github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
···
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
+github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o=
+github.com/gorilla/context v1.1.2/go.mod h1:KDPwT9i/MeWHiLl90fuTgrt4/wPcv75vFAZLaOOcbxM=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ=
+github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik=
 github.com/haileyok/atproto-oauth-golang v0.0.2 h1:61KPkLB615LQXR2f5x1v3sf6vPe6dOXqNpTYCgZ0Fz8=
 github.com/haileyok/atproto-oauth-golang v0.0.2/go.mod h1:jcZ4GCjo5I5RuE/RsAXg1/b6udw7R4W+2rb/cGyTDK8=
 github.com/hairyhenderson/go-codeowners v0.5.0 h1:dpQB+hVHiRc2VVvc2BHxkuM+tmu9Qej/as3apqUbsWc=
···
 github.com/jbenet/goprocess v0.1.4/go.mod h1:5yspPrukOVuOLORacaBi858NqyClJPQxYZlqdZVfqY4=
 github.com/jdkato/prose v1.2.1 h1:Fp3UnJmLVISmlc57BgKUzdjr0lOtjqTZicL3PaYy6cU=
 github.com/jdkato/prose v1.2.1/go.mod h1:AiRHgVagnEx2JbQRQowVBKjG0bcs/vtkGCH1dYAL1rA=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
···
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kyokomi/emoji/v2 v2.2.13 h1:GhTfQa67venUUvmleTNFnb+bi7S3aocF7ZCXU9fSO7U=
 github.com/kyokomi/emoji/v2 v2.2.13/go.mod h1:JUcn42DTdsXJo1SWanHh4HKDEyPaR5CqkmoirZZP9qE=
+github.com/labstack/echo-contrib v0.17.2 h1:K1zivqmtcC70X9VdBFdLomjPDEVHlrcAObqmuFj1c6w=
+github.com/labstack/echo-contrib v0.17.2/go.mod h1:NeDh3PX7j/u+jR4iuDt1zHmWZSCz9c/p9mxXcDpyS8E=
+github.com/labstack/echo/v4 v4.13.3 h1:pwhpCPrTl5qry5HRdM5FwdXnhXSLSY+WE+YQSeCaafY=
+github.com/labstack/echo/v4 v4.13.3/go.mod h1:o90YNEeQWjDozo584l7AwhJMHN0bOC4tAfg+Xox9q5g=
+github.com/labstack/gommon v0.4.2 h1:F8qTUNXgG1+6WQmqoUWnz8WiEU60mXVVw0P4ht1WRA0=
+github.com/labstack/gommon v0.4.2/go.mod h1:QlUFxVM+SNXhDL/Z7YhocGIBYOiwB0mXm1+1bAPHPyU=
 github.com/lestrrat-go/blackmagic v1.0.1/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
 github.com/lestrrat-go/blackmagic v1.0.2 h1:Cg2gVSc9h7sz9NOByczrbUvLopQmXrfFx//N+AkAr5k=
 github.com/lestrrat-go/blackmagic v1.0.2/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
···
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mattn/go-sqlite3 v1.14.27 h1:drZCnuvf37yPfs95E5jd9s3XhdVWLal+6BOK6qrv6IU=
 github.com/mattn/go-sqlite3 v1.14.27/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
 github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE=
···
 github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
 github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8=
 github.com/multiformats/go-varint v0.0.7/go.mod h1:r8PUYw/fD/SjBCiKOoDlGF6QawOELpZAu9eioSos/OU=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/niklasfasching/go-org v1.7.0 h1:vyMdcMWWTe/XmANk19F4k8XGBYg0GQ/gJGMimOjGMek=
 github.com/niklasfasching/go-org v1.7.0/go.mod h1:WuVm4d45oePiE0eX25GqTDQIt/qPW1T9DGkRscqLW5o=
 github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
···
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f h1:VXTQfuJj9vKR4TCkEuWIckKvdHFeJH/huIFJ9/cXOB0=
 github.com/polydawn/refmt v0.89.1-0.20221221234430-40501e09de1f/go.mod h1:/zvteZs/GwLtCgZ4BL6CBsk9IKIlexP43ObX9AxTqTw=
+github.com/prometheus/client_golang v1.17.0 h1:rl2sfwZMtSthVU752MqfjQozy7blglC+1SOtjMAMh+Q=
+github.com/prometheus/client_golang v1.17.0/go.mod h1:VeL+gMmOAxkS2IqfCq0ZmHSL+LjWfWDUmp1mBz9JgUY=
+github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
+github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
+github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
+github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
+github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/common v0.61.0 h1:3gv/GThfX0cV2lpO7gkTUwZru38mxevy90Bj8YFSRQQ=
+github.com/prometheus/common v0.61.0/go.mod h1:zr29OCN/2BsJRaFwG8QOBr41D6kkchKbpeNH7pAjb/s=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
+github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
···
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo=
 github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k=
+github.com/samber/lo v1.47.0 h1:z7RynLwP5nbyRscyvcD043DWYoOcYRv3mV8lBeqOCLc=
+github.com/samber/lo v1.47.0/go.mod h1:RmDH9Ct32Qy3gduHQuKJ3gW1fMHAnE/fAzQuf6He5cU=
+github.com/samber/slog-echo v1.15.1 h1:mzeQNPYPxmpehIRtgQJRgJMVvrRbZHp5D2maxSljTBw=
+github.com/samber/slog-echo v1.15.1/go.mod h1:K21nbusPmai/MYm8PFactmZoFctkMmkeaTdXXyvhY1c=
 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
···
 github.com/urfave/cli v1.22.10/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/urfave/cli/v2 v2.27.5 h1:WoHEJLdsXr6dDWoJgMq/CboDmyY/8HMMH1fTECbih+w=
 github.com/urfave/cli/v2 v2.27.5/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
+github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
+github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
+github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
+github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0 h1:GDDkbFiaK8jsSDJfjId/PEGEShv6ugrt4kYsC5UIDaQ=
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/whyrusleeping/cbor v0.0.0-20171005072247-63513f603b11 h1:5HZfQkwe0mIfyDmc1Em5GqlNRzcdtlv4HTNmdpt7XH0=
···
 github.com/yuin/goldmark v1.7.4/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark-emoji v1.0.3 h1:aLRkLHOuBR2czCY4R8olwMjID+tENfhyFDMCRhbIQY4=
 github.com/yuin/goldmark-emoji v1.0.3/go.mod h1:tTkZEbwu5wkPmgTcitqddVxY9osFZiavD+r4AzQrh1U=
+gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b h1:CzigHMRySiX3drau9C6Q5CAbNIApmLdat5jPMqChvDA=
+gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b/go.mod h1:/y/V339mxv2sZmYYR64O07VuCpdNZqCTwO8ZcouTMI8=
+gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 h1:qwDnMxjkyLmAFgcfgTnfJrmYKWhHnci3GjDqcZp1M3Q=
+gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02/go.mod h1:JTnUj0mpYiAsuZLmKjTx/ex3AtMowcCgnE7YNyCEP0I=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
 go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
···
 gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/sqlite v1.5.7 h1:8NvsrhP0ifM7LX9G4zPB97NwovUakUxc+2V2uuf3Z1I=
+gorm.io/driver/sqlite v1.5.7/go.mod h1:U+J8craQU6Fzkcvu8oLeAQmi50TkwPEhHDEjQZXDah4=
+gorm.io/gorm v1.25.9 h1:wct0gxZIELDk8+ZqF/MVnHLkA1rvYlBWUMv2EdsK1g8=
+gorm.io/gorm v1.25.9/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=

models/user.go

···
 	LastFMUsername *string
 
 	// atp info
-	ATProtoDID          *string
-	ATProtoAccessToken  *string
-	ATProtoRefreshToken *string
-	ATProtoTokenExpiry  *time.Time
+	ATProtoDID *string
+	//This is meant to only be used by the automated music stamping service. If the user ever does an
+	//atproto action from the web ui use the atproto session id for the logged-in session
+	MostRecentAtProtoSessionID *string
+	//ATProtoAccessToken  *string
+	//ATProtoRefreshToken *string
+	//ATProtoTokenExpiry  *time.Time
 
 	CreatedAt time.Time
 	UpdatedAt time.Time

oauth/atproto/atproto.go

···
 import (
 	"context"
 	"fmt"
+
+	"github.com/bluesky-social/indigo/atproto/auth/oauth"
+	_ "github.com/bluesky-social/indigo/atproto/auth/oauth"
+	"github.com/bluesky-social/indigo/atproto/client"
+	"github.com/bluesky-social/indigo/atproto/crypto"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	"github.com/teal-fm/piper/db"
+
+	"github.com/teal-fm/piper/session"
+
 	"log"
 	"net/http"
 	"net/url"
-
-	oauth "github.com/haileyok/atproto-oauth-golang"
-	"github.com/haileyok/atproto-oauth-golang/helpers"
-	"github.com/lestrrat-go/jwx/v2/jwk"
-	"github.com/teal-fm/piper/db"
-	"github.com/teal-fm/piper/models"
+	"os"
+	"slices"
 )
 
 type ATprotoAuthService struct {
-	client      *oauth.Client
-	jwks        jwk.Key
-	DB          *db.DB
-	clientId    string
-	callbackUrl string
-	xrpc        *oauth.XrpcClient
+	clientApp      *oauth.ClientApp
+	DB             *db.DB
+	sessionManager *session.SessionManager
+	clientId       string
+	callbackUrl    string
+	logger         *log.Logger
 }
 
-func NewATprotoAuthService(db *db.DB, jwks jwk.Key, clientId string, callbackUrl string) (*ATprotoAuthService, error) {
+func NewATprotoAuthService(database *db.DB, sessionManager *session.SessionManager, clientSecretKey string, clientId string, callbackUrl string, clientSecretId string) (*ATprotoAuthService, error) {
 	fmt.Println(clientId, callbackUrl)
-	cli, err := oauth.NewClient(oauth.ClientArgs{
-		ClientJwk:   jwks,
-		ClientId:    clientId,
-		RedirectUri: callbackUrl,
-	})
+
+	scopes := []string{"atproto", "repo:fm.teal.alpha.feed.play", "repo:fm.teal.alpha.actor.status"}
+
+	var config oauth.ClientConfig
+	config = oauth.NewPublicConfig(clientId, callbackUrl, scopes)
+
+	priv, err := crypto.ParsePrivateMultibase(clientSecretKey)
 	if err != nil {
-		return nil, fmt.Errorf("failed to create atproto oauth client: %w", err)
+		return nil, err
 	}
+	if err := config.SetClientSecret(priv, clientSecretId); err != nil {
+		return nil, err
+	}
+
+	oauthClient := oauth.NewClientApp(&config, db.NewSqliteATProtoStore(database.DB))
+
+	logger := log.New(os.Stdout, "ATProto oauth: ", log.LstdFlags|log.Lmsgprefix)
+
 	svc := &ATprotoAuthService{
-		client:      cli,
-		jwks:        jwks,
-		callbackUrl: callbackUrl,
-		DB:          db,
-		clientId:    clientId,
+		clientApp:      oauthClient,
+		callbackUrl:    callbackUrl,
+		DB:             database,
+		sessionManager: sessionManager,
+		clientId:       clientId,
+		logger:         logger,
 	}
-	svc.NewXrpcClient()
 	return svc, nil
 }
 
-func (a *ATprotoAuthService) GetATProtoClient() (*oauth.Client, error) {
-	if a.client != nil {
-		return a.client, nil
+func (a *ATprotoAuthService) GetATProtoClient(accountDID string, sessionID string, ctx context.Context) (*client.APIClient, error) {
+	did, err := syntax.ParseDID(accountDID)
+	if err != nil {
+		return nil, err
 	}
 
-	if a.client == nil {
-		cli, err := oauth.NewClient(oauth.ClientArgs{
-			ClientJwk:   a.jwks,
-			ClientId:    a.clientId,
-			RedirectUri: a.callbackUrl,
-		})
-		if err != nil {
-			return nil, fmt.Errorf("failed to create atproto oauth client: %w", err)
-		}
-		a.client = cli
+	oauthSess, err := a.clientApp.ResumeSession(ctx, did, sessionID)
+	if err != nil {
+		return nil, err
 	}
 
-	return a.client, nil
-}
+	return oauthSess.APIClient(), nil
 
-func LoadJwks(jwksBytes []byte) (jwk.Key, error) {
-	key, err := helpers.ParseJWKFromBytes(jwksBytes)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse JWK from bytes: %w", err)
-	}
-	return key, nil
 }
 
 func (a *ATprotoAuthService) HandleLogin(w http.ResponseWriter, r *http.Request) {
 	handle := r.URL.Query().Get("handle")
 	if handle == "" {
-		log.Printf("ATProto Login Error: handle is required")
+		a.logger.Printf("ATProto Login Error: handle is required")
 		http.Error(w, "handle query parameter is required", http.StatusBadRequest)
 		return
 	}
-
-	authUrl, err := a.getLoginUrlAndSaveState(r.Context(), handle)
+	ctx := r.Context()
+	redirectURL, err := a.clientApp.StartAuthFlow(ctx, handle)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Error initiating login: %v", err), http.StatusInternalServerError)
+	}
+	authUrl, err := url.Parse(redirectURL)
 	if err != nil {
-		log.Printf("ATProto Login Error: Failed to get login URL for handle %s: %v", handle, err)
 		http.Error(w, fmt.Sprintf("Error initiating login: %v", err), http.StatusInternalServerError)
-		return
 	}
 
-	log.Printf("ATProto Login: Redirecting user %s to %s", handle, authUrl.String())
+	a.logger.Printf("ATProto Login: Redirecting user %s to %s", handle, authUrl.String())
 	http.Redirect(w, r, authUrl.String(), http.StatusFound)
 }
 
-func (a *ATprotoAuthService) getLoginUrlAndSaveState(ctx context.Context, handle string) (*url.URL, error) {
-	scope := "atproto transition:generic"
-	// resolve
-	ui, err := a.getUserInformation(ctx, handle)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get user information for %s: %w", handle, err)
-	}
-
-	fmt.Println("user info: ", ui.AuthServer, ui.AuthService)
-
-	// create a dpop jwk for this session
-	k, err := helpers.GenerateKey(nil) // Generate ephemeral DPoP key for this flow
-	if err != nil {
-		return nil, fmt.Errorf("failed to generate DPoP key: %w", err)
-	}
+func (a *ATprotoAuthService) HandleLogout(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("session")
 
-	// Send PAR auth req
-	parResp, err := a.client.SendParAuthRequest(ctx, ui.AuthServer, ui.AuthMeta, ui.Handle, scope, k)
-	if err != nil {
-		return nil, fmt.Errorf("failed PAR request to %s: %w", ui.AuthServer, err)
-	}
+	if err == nil {
+		session, exists := a.sessionManager.GetSession(cookie.Value)
+		if !exists {
+			http.Redirect(w, r, "/", http.StatusSeeOther)
+			return
+		}
 
-	// Save state
-	data := &models.ATprotoAuthData{
-		State:               parResp.State,
-		DID:                 ui.DID,
-		PDSUrl:              ui.AuthService,
-		AuthServerIssuer:    ui.AuthMeta.Issuer,
-		PKCEVerifier:        parResp.PkceVerifier,
-		DPoPAuthServerNonce: parResp.DpopAuthserverNonce,
-		DPoPPrivateJWK:      k,
-	}
+		dbUser, err := a.DB.GetUserByID(session.UserID)
+		if err != nil {
+			http.Redirect(w, r, "/", http.StatusSeeOther)
+			return
+		}
+		did, err := syntax.ParseDID(*dbUser.ATProtoDID)
 
-	// print data
-	fmt.Println(data)
+		if err != nil {
+			a.logger.Printf("Should not happen: %s", err)
+			a.sessionManager.ClearSessionCookie(w)
+			http.Redirect(w, r, "/", http.StatusSeeOther)
+		}
 
-	err = a.DB.SaveATprotoAuthData(data)
-	if err != nil {
-		return nil, fmt.Errorf("failed to save ATProto auth data for state %s: %w", parResp.State, err)
+		ctx := r.Context()
+		err = a.clientApp.Logout(ctx, did, session.ATProtoSessionID)
+		if err != nil {
+			a.logger.Printf("Error logging the user: %s out: %s", did, err)
+		}
+		a.sessionManager.DeleteSession(cookie.Value)
 	}
 
-	// Construct authorization URL using the request_uri from PAR response
-	authEndpointURL, err := url.Parse(ui.AuthMeta.AuthorizationEndpoint)
-	if err != nil {
-		return nil, fmt.Errorf("invalid authorization endpoint URL %s: %w", ui.AuthMeta.AuthorizationEndpoint, err)
-	}
-	q := authEndpointURL.Query()
-	q.Set("client_id", a.clientId)
-	q.Set("request_uri", parResp.RequestUri)
-	q.Set("state", parResp.State)
-	authEndpointURL.RawQuery = q.Encode()
+	a.sessionManager.ClearSessionCookie(w)
 
-	return authEndpointURL, nil
+	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
 func (a *ATprotoAuthService) HandleCallback(w http.ResponseWriter, r *http.Request) (int64, error) {
-	state := r.URL.Query().Get("state")
-	code := r.URL.Query().Get("code")
-	issuer := r.URL.Query().Get("iss") // Issuer (auth base URL) is needed for token request
-
-	if state == "" || code == "" || issuer == "" {
-		errMsg := r.URL.Query().Get("error")
-		errDesc := r.URL.Query().Get("error_description")
-		log.Printf("ATProto Callback Error: Missing parameters. State: '%s', Code: '%s', Issuer: '%s'. Error: '%s', Description: '%s'", state, code, issuer, errMsg, errDesc)
-		http.Error(w, fmt.Sprintf("Authorization callback failed: %s (%s). Missing state, code, or issuer.", errMsg, errDesc), http.StatusBadRequest)
-		return 0, fmt.Errorf("missing state, code, or issuer")
-	}
+	ctx := r.Context()
 
-	// Retrieve saved data using state
-	data, err := a.DB.GetATprotoAuthData(state)
+	sessData, err := a.clientApp.ProcessCallback(ctx, r.URL.Query())
 	if err != nil {
-		log.Printf("ATProto Callback Error: Failed to retrieve auth data for state '%s': %v", state, err)
-		http.Error(w, "Invalid or expired state.", http.StatusBadRequest)
-		return 0, fmt.Errorf("invalid or expired state")
+		errMsg := fmt.Errorf("processing OAuth callback: %w", err)
+		http.Error(w, errMsg.Error(), http.StatusBadRequest)
+		return 0, errMsg
 	}
 
-	// Clean up the temporary auth data now that we've retrieved it
-	// defer a.DB.DeleteATprotoAuthData(state) // Consider adding deletion logic
-	// if issuers don't match, return an error
-	if data.AuthServerIssuer != issuer {
-		log.Printf("ATProto Callback Error: Issuer mismatch for state '%s', expected '%s', got '%s'", state, data.AuthServerIssuer, issuer)
-		http.Error(w, "Invalid or expired state.", http.StatusBadRequest)
-		return 0, fmt.Errorf("issuer mismatch")
+	// It's in the example repo and leaving for some debugging cause i've seen different scopes cause issues before
+	// so may be some nice debugging info to have
+	if !slices.Equal(sessData.Scopes, a.clientApp.Config.Scopes) {
+		a.logger.Printf("session auth scopes did not match those requested")
 	}
 
-	resp, err := a.client.InitialTokenRequest(r.Context(), code, issuer, data.PKCEVerifier, data.DPoPAuthServerNonce, data.DPoPPrivateJWK)
+	user, err := a.DB.FindOrCreateUserByDID(sessData.AccountDID.String())
 	if err != nil {
-		log.Printf("ATProto Callback Error: Failed initial token request for state '%s', issuer '%s': %v", state, issuer, err)
-		http.Error(w, fmt.Sprintf("Error exchanging code for token: %v", err), http.StatusInternalServerError)
-		return 0, fmt.Errorf("failed initial token request")
-	}
-
-	userID, err := a.DB.FindOrCreateUserByDID(data.DID)
-	if err != nil {
-		log.Printf("ATProto Callback Error: Failed to find or create user for DID %s: %v", data.DID, err)
+		a.logger.Printf("ATProto Callback Error: Failed to find or create user for DID %s: %v", sessData.AccountDID.String(), err)
 		http.Error(w, "Failed to process user information.", http.StatusInternalServerError)
 		return 0, fmt.Errorf("failed to find or create user")
 	}
 
-	err = a.DB.SaveATprotoSession(resp, data.AuthServerIssuer, data.DPoPPrivateJWK, data.PDSUrl)
+	//This is piper's session for manging piper, not atproto sessions
+	createdSession := a.sessionManager.CreateSession(user.ID, sessData.SessionID)
+	a.sessionManager.SetSessionCookie(w, createdSession)
+	a.logger.Printf("Created session for user %d via service atproto", user.ATProtoDID)
+
+	err = a.DB.SetLatestATProtoSessionId(sessData.AccountDID.String(), sessData.SessionID)
 	if err != nil {
-		log.Printf("ATProto Callback Error: Failed to save ATProto tokens for user %d (DID %s): %v", userID.ID, data.DID, err)
+		a.logger.Printf("Failed to set latest atproto session id for user %d: %v", user.ID, err)
 	}
 
-	log.Printf("ATProto Callback Success: User %d (DID: %s) authenticated.", userID.ID, data.DID)
-	return userID.ID, nil
+	a.logger.Printf("ATProto Callback Success: User %d (DID: %s) authenticated.", user.ID, user.ATProtoDID)
+	return user.ID, nil
 }

oauth/atproto/http.go

···
 import (
 	"encoding/json"
 	"fmt"
-	"log"
 	"net/http"
-
-	"github.com/haileyok/atproto-oauth-golang/helpers"
 )
 
-func (a *ATprotoAuthService) HandleJwks(w http.ResponseWriter, r *http.Request) {
-	pubKey, err := a.jwks.PublicKey()
-	if err != nil {
-		http.Error(w, fmt.Sprintf("Error getting public key from JWK: %v", err), http.StatusInternalServerError)
-		log.Printf("Error getting public key from JWK: %v", err)
-		return
-	}
+func strPtr(raw string) *string {
+	return &raw
+}
 
+func (a *ATprotoAuthService) HandleJwks(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(helpers.CreateJwksResponseObject(pubKey)); err != nil {
-		log.Printf("Error encoding JWKS response: %v", err)
+	body := a.clientApp.Config.PublicJWKS()
+	if err := json.NewEncoder(w).Encode(body); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
 	}
 }
 
 func (a *ATprotoAuthService) HandleClientMetadata(w http.ResponseWriter, r *http.Request, serverUrlRoot, serverMetadataUrl, serverCallbackUrl string) {
-	metadata := map[string]any{
-		"client_id":                       serverMetadataUrl,
-		"client_name":                     "Piper Telekinesis",
-		"client_uri":                      serverUrlRoot,
-		"logo_uri":                        fmt.Sprintf("%s/logo.png", serverUrlRoot),
-		"tos_uri":                         fmt.Sprintf("%s/tos", serverUrlRoot),
-		"policy_url":                      fmt.Sprintf("%s/policy", serverUrlRoot),
-		"redirect_uris":                   []string{serverCallbackUrl},
-		"grant_types":                     []string{"authorization_code", "refresh_token"},
-		"response_types":                  []string{"code"},
-		"application_type":                "web",
-		"dpop_bound_access_tokens":        true,
-		"jwks_uri":                        fmt.Sprintf("%s/oauth/jwks.json", serverUrlRoot),
-		"scope":                           "atproto transition:generic",
-		"token_endpoint_auth_method":      "private_key_jwt",
-		"token_endpoint_auth_signing_alg": "ES256",
+
+	meta := a.clientApp.Config.ClientMetadata()
+	if a.clientApp.Config.IsConfidential() {
+		meta.JWKSURI = strPtr(fmt.Sprintf("%s/oauth/jwks.json", serverUrlRoot))
 	}
+	meta.ClientName = strPtr("Piper Telekinesis")
+	meta.ClientURI = strPtr(serverUrlRoot)
+
+	// internal consistency check
+	if err := meta.Validate(a.clientApp.Config.ClientID); err != nil {
+		a.logger.Printf("validating client metadata", "err", err)
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
 	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(metadata); err != nil {
-		log.Printf("Error encoding client metadata: %v", err)
+	if err := json.NewEncoder(w).Encode(meta); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
 	}
+
 }

oauth/atproto/resolve.go

···
 	"strings"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
-	oauth "github.com/haileyok/atproto-oauth-golang"
 )
 
 // user information struct
 type UserInformation struct {
-	AuthService string                            `json:"authService"`
-	AuthServer  string                            `json:"authServer"`
-	AuthMeta    *oauth.OauthAuthorizationMetadata `json:"authMeta"`
+	AuthService string `json:"authService"`
+	AuthServer  string `json:"authServer"`
 	// do NOT save the current handle permanently!
 	Handle string `json:"handle"`
 	DID    string `json:"did"`
···
 		Type            string `json:"type"`
 		ServiceEndpoint string `json:"serviceEndpoint"`
 	} `json:"service"`
-}
-
-func (a *ATprotoAuthService) getUserInformation(ctx context.Context, handleOrDid string) (*UserInformation, error) {
-	cli := a.client
-
-	// if we have a did skip this
-	did := handleOrDid
-	err := error(nil)
-	// technically checking SHOULD be more rigorous.
-	if !strings.HasPrefix(handleOrDid, "did:") {
-		did, err = resolveHandle(ctx, did)
-		if err != nil {
-			return nil, err
-		}
-	} else {
-		did = handleOrDid
-	}
-
-	doc, err := getIdentityDocument(ctx, did)
-	if err != nil {
-		return nil, err
-	}
-
-	service, err := getAtprotoPdsService(doc)
-	if err != nil {
-		return nil, err
-	}
-
-	authserver, err := cli.ResolvePdsAuthServer(ctx, service)
-	if err != nil {
-		return nil, err
-	}
-
-	authmeta, err := cli.FetchAuthServerMetadata(ctx, authserver)
-	if err != nil {
-		return nil, err
-	}
-
-	if len(doc.AlsoKnownAs) == 0 {
-		return nil, fmt.Errorf("alsoKnownAs is empty, couldn't acquire handle: %w", err)
-
-	}
-	handle := strings.Replace(doc.AlsoKnownAs[0], "at://", "", 1)
-
-	return &UserInformation{
-		AuthService: service,
-		AuthServer:  authserver,
-		AuthMeta:    authmeta,
-		Handle:      handle,
-		DID:         did,
-	}, nil
 }
 
 func resolveHandle(ctx context.Context, handle string) (string, error) {

oauth/atproto/xrpc.go

···
-package atproto
-
-import (
-	"log/slog"
-
-	oauth "github.com/haileyok/atproto-oauth-golang"
-)
-
-func (atp *ATprotoAuthService) NewXrpcClient() {
-	atp.xrpc = &oauth.XrpcClient{
-		OnDpopPdsNonceChanged: func(did, newNonce string) {
-			_, err := atp.DB.Exec("UPDATE users SET atproto_pds_nonce = ? WHERE atproto_did = ?", newNonce, did)
-			if err != nil {
-				slog.Default().Error("error updating pds nonce", "err", err)
-			}
-		},
-	}
-}
-
-func (atp *ATprotoAuthService) GetXrpcClient() *oauth.XrpcClient {
-	if atp.xrpc == nil {
-		atp.NewXrpcClient()
-	}
-	return atp.xrpc
-}

oauth/oauth2.go

···
 	http.Redirect(w, r, authURL, http.StatusSeeOther)
 }
 
+func (o *OAuth2Service) HandleLogout(w http.ResponseWriter, r *http.Request) {
+	//TODO not implemented yet. not sure what the api call is for this package
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
 func (o *OAuth2Service) HandleCallback(w http.ResponseWriter, r *http.Request) (int64, error) {
 	state := r.URL.Query().Get("state")
 	if state != o.state {

oauth/oauth_manager.go

···
 	"log"
 	"net/http"
 	"sync"
-
-	"github.com/teal-fm/piper/session"
 )
 
 // manages multiple oauth client services
 type OAuthServiceManager struct {
-	services       map[string]AuthService
-	sessionManager *session.SessionManager
-	mu             sync.RWMutex
-	logger         *log.Logger
+	services map[string]AuthService
+	mu       sync.RWMutex
+	logger   *log.Logger
 }
 
-func NewOAuthServiceManager(sessionManager *session.SessionManager) *OAuthServiceManager {
+func NewOAuthServiceManager() *OAuthServiceManager {
 	return &OAuthServiceManager{
-		services:       make(map[string]AuthService),
-		sessionManager: sessionManager,
-		logger:         log.New(log.Writer(), "oauth: ", log.LstdFlags|log.Lmsgprefix),
+		services: make(map[string]AuthService),
+		logger:   log.New(log.Writer(), "oauth: ", log.LstdFlags|log.Lmsgprefix),
 	}
 }
 
···
 	}
 }
 
+func (m *OAuthServiceManager) HandleLogout(serviceName string) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		m.mu.RLock()
+		service, exists := m.services[serviceName]
+		m.mu.RUnlock()
+
+		if exists {
+			service.HandleLogout(w, r)
+			return
+		}
+
+		m.logger.Printf("Auth service '%s' not found for login request", serviceName)
+		http.Error(w, fmt.Sprintf("Auth service '%s' not found", serviceName), http.StatusNotFound)
+	}
+}
+
 func (m *OAuthServiceManager) HandleCallback(serviceName string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		m.mu.RLock()
···
 		}
 
 		if userID > 0 {
-			session := m.sessionManager.CreateSession(userID)
-
-			m.sessionManager.SetSessionCookie(w, session)
-
-			m.logger.Printf("Created session for user %d via service %s", userID, serviceName)
 
 			http.Redirect(w, r, "/", http.StatusSeeOther)
 		} else {

oauth/service.go

···
 	// handles the callback for the provider. is responsible for inserting
 	// sessions in the db
 	HandleCallback(w http.ResponseWriter, r *http.Request) (int64, error)
+
+	HandleLogout(w http.ResponseWriter, r *http.Request)
 }
 
 // optional but recommended

service/atproto/submission.go

···
 	"log"
 	"time"
 
-	"github.com/bluesky-social/indigo/api/atproto"
+	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	lexutil "github.com/bluesky-social/indigo/lex/util"
-	"github.com/bluesky-social/indigo/xrpc"
 	"github.com/spf13/viper"
 	"github.com/teal-fm/piper/api/teal"
-	"github.com/teal-fm/piper/db"
 	"github.com/teal-fm/piper/models"
 	atprotoauth "github.com/teal-fm/piper/oauth/atproto"
 )
 
 // SubmitPlayToPDS submits a track play to the ATProto PDS as a feed.play record
-func SubmitPlayToPDS(ctx context.Context, did string, track *models.Track, atprotoService *atprotoauth.ATprotoAuthService) error {
+func SubmitPlayToPDS(ctx context.Context, did string, mostRecentAtProtoSessionID string, track *models.Track, atprotoService *atprotoauth.ATprotoAuthService) error {
 	if did == "" {
 		return fmt.Errorf("DID cannot be empty")
 	}
 
 	// Get ATProto client
-	client, err := atprotoService.GetATProtoClient()
+	client, err := atprotoService.GetATProtoClient(did, mostRecentAtProtoSessionID, ctx)
 	if err != nil || client == nil {
 		return fmt.Errorf("failed to get ATProto client: %w", err)
 	}
 
-	xrpcClient := atprotoService.GetXrpcClient()
-	if xrpcClient == nil {
-		return fmt.Errorf("xrpc client is not available")
-	}
-
-	// Get user session
-	sess, err := atprotoService.DB.GetAtprotoSession(did, ctx, *client)
-	if err != nil {
-		return fmt.Errorf("couldn't get Atproto session for DID %s: %w", did, err)
-	}
-
 	// Convert track to feed.play record
 	playRecord, err := TrackToPlayRecord(track)
 	if err != nil {
···
 	}
 
 	// Create the record
-	input := atproto.RepoCreateRecord_Input{
+	input := comatproto.RepoCreateRecord_Input{
 		Collection: "fm.teal.alpha.feed.play",
-		Repo:       sess.DID,
+		Repo:       client.AccountDID.String(),
 		Record:     &lexutil.LexiconTypeDecoder{Val: playRecord},
 	}
 
-	authArgs := db.AtpSessionToAuthArgs(sess)
-	var out atproto.RepoCreateRecord_Output
-	if err := xrpcClient.Do(ctx, authArgs, xrpc.Procedure, "application/json", "com.atproto.repo.createRecord", nil, input, &out); err != nil {
+	if _, err := comatproto.RepoCreateRecord(ctx, client, &input); err != nil {
 		return fmt.Errorf("failed to create play record for DID %s: %w", did, err)
 	}
 

service/lastfm/lastfm.go

···
 		}
 		l.db.SaveTrack(user.ID, hydratedTrack)
 		l.logger.Printf("Submitting track")
-		err = l.SubmitTrackToPDS(*user.ATProtoDID, hydratedTrack, ctx)
+		err = l.SubmitTrackToPDS(*user.ATProtoDID, *user.MostRecentAtProtoSessionID, hydratedTrack, ctx)
 		if err != nil {
 			l.logger.Printf("error submitting track for user %s: %s - %s: %v", username, track.Artist.Text, track.Name, err)
 		}
···
 	return nil
 }
 
-func (l *LastFMService) SubmitTrackToPDS(did string, track *models.Track, ctx context.Context) error {
+func (l *LastFMService) SubmitTrackToPDS(did string, mostRecentAtProtoSessionID string, track *models.Track, ctx context.Context) error {
 	// Use shared atproto service for submission
-	return atprotoservice.SubmitPlayToPDS(ctx, did, track, l.atprotoService)
+	return atprotoservice.SubmitPlayToPDS(ctx, did, mostRecentAtProtoSessionID, track, l.atprotoService)
 }
 
 // convertLastFMTrackToModelsTrack converts a Last.fm Track to models.Track format

service/playingnow/playingnow.go

···
 	"strconv"
 	"time"
 
-	"github.com/bluesky-social/indigo/api/atproto"
+	"github.com/bluesky-social/indigo/atproto/client"
 	lexutil "github.com/bluesky-social/indigo/lex/util"
-	"github.com/bluesky-social/indigo/xrpc"
-	oauth "github.com/haileyok/atproto-oauth-golang"
 	"github.com/spf13/viper"
+
+	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/teal-fm/piper/api/teal"
 	"github.com/teal-fm/piper/db"
 	"github.com/teal-fm/piper/models"
···
 
 	did := *user.ATProtoDID
 
-	// Get ATProto client
-	client, err := p.atprotoService.GetATProtoClient()
-	if err != nil || client == nil {
-		return fmt.Errorf("failed to get ATProto client: %w", err)
-	}
-
-	xrpcClient := p.atprotoService.GetXrpcClient()
-	if xrpcClient == nil {
-		return fmt.Errorf("xrpc client is not available")
-	}
-
-	// Get user session
-	sess, err := p.db.GetAtprotoSession(did, ctx, *client)
-	if err != nil {
-		return fmt.Errorf("couldn't get Atproto session for DID %s: %w", did, err)
+	// Get ATProto atProtoClient
+	atProtoClient, err := p.atprotoService.GetATProtoClient(did, *user.MostRecentAtProtoSessionID, ctx)
+	if err != nil || atProtoClient == nil {
+		return fmt.Errorf("failed to get ATProto atProtoClient: %w", err)
 	}
 
 	// Convert track to PlayView format
···
 		Item:          playView,
 	}
 
-	authArgs := db.AtpSessionToAuthArgs(sess)
 	var swapRecord *string
-	swapRecord, err = p.getStatusSwapRecord(ctx, xrpcClient, sess, authArgs)
+	swapRecord, err = p.getStatusSwapRecord(ctx, atProtoClient)
 	if err != nil {
 		return err
 	}
 
 	// Create the record input
-	input := atproto.RepoPutRecord_Input{
+	input := comatproto.RepoPutRecord_Input{
 		Collection: "fm.teal.alpha.actor.status",
-		Repo:       sess.DID,
+		Repo:       atProtoClient.AccountDID.String(),
 		Rkey:       "self", // Use "self" as the record key for current status
 		Record:     &lexutil.LexiconTypeDecoder{Val: status},
 		SwapRecord: swapRecord,
 	}
 
 	// Submit to PDS
-	var out atproto.RepoPutRecord_Output
-	if err := xrpcClient.Do(ctx, authArgs, xrpc.Procedure, "application/json", "com.atproto.repo.putRecord", nil, input, &out); err != nil {
+	if _, err := comatproto.RepoPutRecord(ctx, atProtoClient, &input); err != nil {
 		p.logger.Printf("Error creating playing now status for DID %s: %v", did, err)
 		return fmt.Errorf("failed to create playing now status for DID %s: %w", did, err)
 	}
···
 	did := *user.ATProtoDID
 
 	// Get ATProto clients
-	client, err := p.atprotoService.GetATProtoClient()
-	if err != nil || client == nil {
-		return fmt.Errorf("failed to get ATProto client: %w", err)
-	}
-
-	xrpcClient := p.atprotoService.GetXrpcClient()
-	if xrpcClient == nil {
-		return fmt.Errorf("xrpc client is not available")
-	}
-
-	// Get user session
-	sess, err := p.db.GetAtprotoSession(did, ctx, *client)
-	if err != nil {
-		return fmt.Errorf("couldn't get Atproto session for DID %s: %w", did, err)
+	atProtoClient, err := p.atprotoService.GetATProtoClient(did, *user.MostRecentAtProtoSessionID, ctx)
+	if err != nil || atProtoClient == nil {
+		return fmt.Errorf("failed to get ATProto atProtoClient: %w", err)
 	}
 
 	// Create an expired status (essentially clearing it)
···
 		Item:          emptyPlayView,
 	}
 
-	authArgs := db.AtpSessionToAuthArgs(sess)
 	var swapRecord *string
-	swapRecord, err = p.getStatusSwapRecord(ctx, xrpcClient, sess, authArgs)
+	swapRecord, err = p.getStatusSwapRecord(ctx, atProtoClient)
 	if err != nil {
 		return err
 	}
 
 	// Update the record
-	input := atproto.RepoPutRecord_Input{
+	input := comatproto.RepoPutRecord_Input{
 		Collection: "fm.teal.alpha.actor.status",
-		Repo:       sess.DID,
+		Repo:       atProtoClient.AccountDID.String(),
 		Rkey:       "self",
 		Record:     &lexutil.LexiconTypeDecoder{Val: status},
 		SwapRecord: swapRecord,
 	}
 
-	var out atproto.RepoPutRecord_Output
-	if err := xrpcClient.Do(ctx, authArgs, xrpc.Procedure, "application/json", "com.atproto.repo.putRecord", nil, input, &out); err != nil {
+	if _, err := comatproto.RepoPutRecord(ctx, atProtoClient, &input); err != nil {
 		p.logger.Printf("Error clearing playing now status for DID %s: %v", did, err)
 		return fmt.Errorf("failed to clear playing now status for DID %s: %w", did, err)
 	}
···
 	// Get submission client agent
 	submissionAgent := viper.GetString("app.submission_agent")
 	if submissionAgent == "" {
-		submissionAgent = "piper/v0.0.1"
+		submissionAgent = "piper/v0.0.2"
 	}
 
 	playView := &teal.AlphaFeedDefs_PlayView{
···
 
 // getStatusSwapRecord retrieves the current swap record (CID) for the actor status record.
 // Returns (nil, nil) if the record does not exist yet.
-func (p *PlayingNowService) getStatusSwapRecord(ctx context.Context, xrpcClient *oauth.XrpcClient, sess *models.ATprotoAuthSession, authArgs *oauth.XrpcAuthedRequestArgs) (*string, error) {
-	getOutput := atproto.RepoGetRecord_Output{}
-	if err := xrpcClient.Do(ctx, authArgs, xrpc.Query, "application/json", "com.atproto.repo.getRecord", map[string]any{
-		"repo":       sess.DID,
-		"collection": "fm.teal.alpha.actor.status",
-		"rkey":       "self",
-	}, nil, &getOutput); err != nil {
-		xErr, ok := err.(*xrpc.Error)
+func (p *PlayingNowService) getStatusSwapRecord(ctx context.Context, atApiClient *client.APIClient) (*string, error) {
+	result, err := comatproto.RepoGetRecord(ctx, atApiClient, "", "fm.teal.alpha.actor.status", atApiClient.AccountDID.String(), "self")
+
+	if err != nil {
+		xErr, ok := err.(*client.APIError)
 		if !ok {
-			return nil, fmt.Errorf("could not get record: %w", err)
+			return nil, fmt.Errorf("error getting the record: %w", err)
 		}
-		if xErr.StatusCode != 400 { // 400 means not found in this API
-			return nil, fmt.Errorf("could not get record: %w", err)
+		if xErr.StatusCode == 400 { // 400 means not found in this API, which would be the case if the record does not exist yet
+			return nil, nil
 		}
-		return nil, nil
+
+		return nil, fmt.Errorf("error getting the record: %w", err)
+
 	}
-	return getOutput.Cid, nil
+	return result.Cid, nil
 }

service/spotify/spotify.go

···
 	}
 }
 
-func (s *SpotifyService) SubmitTrackToPDS(did string, track *models.Track, ctx context.Context) error {
+func (s *SpotifyService) SubmitTrackToPDS(did string, mostRecentAtProtoSessionID string, track *models.Track, ctx context.Context) error {
 	//Had a empty feed.play get submitted not sure why. Tracking here
 	if track.Name == "" {
 		s.logger.Println("Track name is empty. Skipping submission. Please record the logs before and send to the teal.fm Discord")
···
 	}
 
 	// Use shared atproto service for submission
-	return atprotoservice.SubmitPlayToPDS(ctx, did, track, s.atprotoService)
+	return atprotoservice.SubmitPlayToPDS(ctx, did, mostRecentAtProtoSessionID, track, s.atprotoService)
 }
 
 func (s *SpotifyService) SetAccessToken(token string, refreshToken string, userId int64, hasSession bool) (int64, error) {
···
 
 				s.logger.Printf("User %d (%d): Attempting to submit track '%s' by %s to PDS (DID: %s)", userID, dbUser.ATProtoDID, trackToSubmitToPDS.Name, artistName, *dbUser.ATProtoDID)
 				// Use context.Background() for now, or pass down a context if available
-				if errPDS := s.SubmitTrackToPDS(*dbUser.ATProtoDID, trackToSubmitToPDS, context.Background()); errPDS != nil {
+				if errPDS := s.SubmitTrackToPDS(*dbUser.ATProtoDID, *dbUser.MostRecentAtProtoSessionID, trackToSubmitToPDS, context.Background()); errPDS != nil {
 					s.logger.Printf("User %d (%d): Error submitting track '%s' to PDS: %v", userID, dbUser.ATProtoDID, trackToSubmitToPDS.Name, errPDS)
 				} else {
 					s.logger.Printf("User %d (%d): Successfully submitted track '%s' to PDS.", userID, dbUser.ATProtoDID, trackToSubmitToPDS.Name)

session/session.go

···
 
 // session/session.go
 type Session struct {
-	ID                  string
-	UserID              int64
-	ATprotoDID          string
-	ATprotoAccessToken  string
-	ATprotoRefreshToken string
-	CreatedAt           time.Time
-	ExpiresAt           time.Time
+
+	//need to re work this. May add onto it for atproto oauth. But need to be careful about that expiresd
+	//Maybe a speerate oauth session store table and it has a created date? yeah do that then can look it up by session id from this table for user actions
+
+	ID               string
+	UserID           int64
+	ATProtoSessionID string
+	CreatedAt        time.Time
+	ExpiresAt        time.Time
 }
 
 type SessionManager struct {
···
 	_, err := database.Exec(`
 	CREATE TABLE IF NOT EXISTS sessions (
 		id TEXT PRIMARY KEY,
-		user_id INTEGER NOT NULL,
+		user_id INTEGER NOT NULL,		
+		at_proto_session_id TEXT NOT NULL,
 		created_at TIMESTAMP,
 		expires_at TIMESTAMP,
 		FOREIGN KEY (user_id) REFERENCES users(id)
···
 }
 
 // create a new session for a user
-func (sm *SessionManager) CreateSession(userID int64) *Session {
+func (sm *SessionManager) CreateSession(userID int64, atProtoSessionId string) *Session {
 	sm.mu.Lock()
 	defer sm.mu.Unlock()
 
···
 	expiresAt := now.Add(24 * time.Hour) // 24-hour session
 
 	session := &Session{
-		ID:        sessionID,
-		UserID:    userID,
-		CreatedAt: now,
-		ExpiresAt: expiresAt,
+		ID:               sessionID,
+		UserID:           userID,
+		ATProtoSessionID: atProtoSessionId,
+		CreatedAt:        now,
+		ExpiresAt:        expiresAt,
 	}
 
 	// store session in memory
···
 	// store session in database if available
 	if sm.db != nil {
 		_, err := sm.db.Exec(`
-		INSERT INTO sessions (id, user_id, created_at, expires_at)
-		VALUES (?, ?, ?, ?)`,
-			sessionID, userID, now, expiresAt)
+		INSERT INTO sessions (id, user_id, at_proto_session_id, created_at, expires_at)
+		VALUES (?, ?, ?, ?, ?)`,
+			sessionID, userID, atProtoSessionId, now, expiresAt)
 
 		if err != nil {
 			log.Printf("Error storing session in database: %v", err)
···
 		session = &Session{ID: sessionID}
 
 		err := sm.db.QueryRow(`
-		SELECT user_id, created_at, expires_at
+		SELECT user_id, at_proto_session_id, created_at, expires_at
 		FROM sessions WHERE id = ?`, sessionID).Scan(
-			&session.UserID, &session.CreatedAt, &session.ExpiresAt)
+			&session.UserID, &session.ATProtoSessionID, &session.CreatedAt, &session.ExpiresAt)
 
 		if err != nil {
 			return nil, false
···
 		MaxAge:   -1,
 	}
 	http.SetCookie(w, cookie)
-}
-
-func (sm *SessionManager) HandleLogout(w http.ResponseWriter, r *http.Request) {
-	cookie, err := r.Cookie("session")
-	if err == nil {
-		sm.DeleteSession(cookie.Value)
-	}
-
-	sm.ClearSessionCookie(w)
-
-	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
 func (sm *SessionManager) GetAPIKeyManager() *apikey.ApiKeyManager {