Remove unused mobile OAuth support (v2.0.0)

Breaking change: Removes mobile-specific features that were unused by the
iOS app (which uses cookie-based auth via WebView instead):
- mobileScheme config option
- mobile and code_challenge query params on /login
- Mobile callback with session_token redirect
- Bearer token auth in getSessionFromRequest()

Now focuses solely on cookie-based session management.
Updates @tijs/atproto-sessions to 2.0.0.

CHANGELOG.md

···
 
 All notable changes to this project will be documented in this file.
 
+## [2.0.0] - 2025-11-29
+
+### Breaking Changes
+
+- **Removed mobile OAuth support**: The following features have been removed as
+  they were unused (the Anchor iOS app uses cookie-based auth via a WebView):
+  - `mobileScheme` config option - No longer needed
+  - `mobile` query parameter on `/login` - Removed
+  - `code_challenge` query parameter on `/login` - Removed
+  - Mobile callback with `session_token` - Removed
+  - Bearer token authentication in `getSessionFromRequest()` - Removed (now
+    cookie-only)
+- **Removed types**: `MobileOAuthStartRequest`, `MobileOAuthStartResponse`
+- **Simplified `OAuthState`**: Removed `mobile` and `codeChallenge` fields
+
+The library now focuses solely on cookie-based session management for web
+applications. Mobile apps should use app-specific WebView flows with cookie
+authentication.
+
+### Changed
+
+- Updated `@tijs/atproto-sessions` dependency to 2.0.0
+
 ## [1.1.1] - 2025-11-28
 
 ### Fixed

deno.json

···
 {
   "$schema": "https://jsr.io/schema/config-file.v1.json",
   "name": "@tijs/atproto-oauth",
-  "version": "1.1.1",
+  "version": "2.0.0",
   "license": "MIT",
   "exports": "./mod.ts",
   "publish": {
···
   "imports": {
     "@std/assert": "jsr:@std/assert@1.0.16",
     "@tijs/oauth-client-deno": "jsr:@tijs/oauth-client-deno@4.0.2",
-    "@tijs/atproto-sessions": "jsr:@tijs/atproto-sessions@1.0.1",
+    "@tijs/atproto-sessions": "jsr:@tijs/atproto-sessions@2.0.0",
     "@tijs/atproto-storage": "jsr:@tijs/atproto-storage@0.1.1",
     "@atproto/syntax": "npm:@atproto/syntax@0.3.0"
   },

mod.ts

···
   ATProtoOAuthInstance,
   ClientMetadata,
   Logger,
-  MobileOAuthStartRequest,
-  MobileOAuthStartResponse,
   OAuthClientInterface,
   OAuthSessionFromRequestResult,
   OAuthSessionsInterface,

src/oauth.ts

···
 /** Default session TTL: 7 days in seconds */
 const DEFAULT_SESSION_TTL = 60 * 60 * 24 * 7;
 
-/** Default mobile callback scheme */
-const DEFAULT_MOBILE_SCHEME = "app://auth-callback";
-
 /**
  * Create a complete ATProto OAuth integration for any framework.
  *
···
   // Normalize baseUrl
   const baseUrl = config.baseUrl.replace(/\/$/, "");
   const sessionTtl = config.sessionTtl ?? DEFAULT_SESSION_TTL;
-  const mobileScheme = config.mobileScheme ?? DEFAULT_MOBILE_SCHEME;
   const logger: Logger = config.logger ?? noopLogger;
 
   // Create OAuth client (Logger interfaces now match)
···
     oauthSessions,
     storage: config.storage,
     sessionTtl,
-    mobileScheme,
     logger,
   });
 

src/routes.ts

···
   oauthSessions: OAuthSessions;
   storage: OAuthStorage;
   sessionTtl: number;
-  mobileScheme: string;
   logger: Logger;
 }
 
···
     oauthSessions,
     storage,
     sessionTtl,
-    mobileScheme,
     logger,
   } = config;
 
···
    *
    * Query parameters:
    * - handle: User's AT Protocol handle (required)
-   * - redirect: Relative path to redirect after web OAuth (optional)
-   * - mobile: "true" to enable mobile flow with configured mobileScheme redirect (optional)
-   * - code_challenge: PKCE code_challenge from mobile client (optional, for future use)
-   *
-   * Security: Mobile redirects always use the server-configured mobileScheme.
-   * Client-specified redirect schemes are NOT allowed to prevent OAuth redirect attacks.
+   * - redirect: Relative path to redirect after OAuth (optional)
    */
   async function handleLogin(request: Request): Promise<Response> {
     const url = new URL(request.url);
     const handle = url.searchParams.get("handle");
     const redirect = url.searchParams.get("redirect");
-    const mobile = url.searchParams.get("mobile") === "true";
-    const codeChallenge = url.searchParams.get("code_challenge");
 
     if (!handle || typeof handle !== "string") {
       return new Response("Invalid handle", { status: 400 });
···
         timestamp: Date.now(),
       };
 
-      // Mobile flow configuration
-      if (mobile) {
-        state.mobile = true;
-        logger.info(`Starting mobile OAuth flow for handle: ${handle}`);
-
-        // Store PKCE code_challenge for mobile (library generates its own, but
-        // in the future we could support external challenges for native apps)
-        if (codeChallenge) {
-          state.codeChallenge = codeChallenge;
-        }
-      } else {
-        // Web flow - store redirect path (validate it's a relative path)
-        if (redirect) {
-          // Security: Only allow relative paths starting with /
-          if (redirect.startsWith("/") && !redirect.startsWith("//")) {
-            state.redirectPath = redirect;
-          } else {
-            logger.warn(`Invalid redirect path ignored: ${redirect}`);
-          }
+      // Store redirect path (validate it's a relative path)
+      if (redirect) {
+        // Security: Only allow relative paths starting with /
+        if (redirect.startsWith("/") && !redirect.startsWith("//")) {
+          state.redirectPath = redirect;
+        } else {
+          logger.warn(`Invalid redirect path ignored: ${redirect}`);
         }
       }
 
···
         lastAccessed: now,
       });
 
-      // Handle mobile callback
-      if (state.mobile) {
-        const sealedToken = await sessionManager.sealToken({ did });
-
-        // Always use server-configured mobileScheme for security
-        const mobileCallbackUrl = new URL(mobileScheme);
-        mobileCallbackUrl.searchParams.set("session_token", sealedToken);
-        mobileCallbackUrl.searchParams.set("did", did);
-        mobileCallbackUrl.searchParams.set("handle", state.handle);
-
-        if (oauthSession.accessToken) {
-          mobileCallbackUrl.searchParams.set(
-            "access_token",
-            oauthSession.accessToken,
-          );
-        }
-        if (oauthSession.refreshToken) {
-          mobileCallbackUrl.searchParams.set(
-            "refresh_token",
-            oauthSession.refreshToken,
-          );
-        }
-
-        logger.info(
-          `Mobile OAuth callback complete for ${did}, redirecting to ${mobileScheme}`,
-        );
-
-        return new Response(null, {
-          status: 302,
-          headers: {
-            Location: mobileCallbackUrl.toString(),
-            "Set-Cookie": setCookieHeader,
-          },
-        });
-      }
-
-      // Web callback - redirect to stored path or home
+      // Redirect to stored path or home
       const redirectPath = state.redirectPath || "/";
 
       return new Response(null, {
···
   }
 
   /**
-   * Get OAuth session from request (cookie or Bearer token)
+   * Get OAuth session from request (cookie-based)
    */
   async function getSessionFromRequest(
     request: Request,
   ): Promise<OAuthSessionFromRequestResult> {
-    // Check for Bearer token first (mobile)
-    const authHeader = request.headers.get("Authorization");
-    if (authHeader && authHeader.startsWith("Bearer ")) {
-      const tokenResult = await sessionManager.validateBearerToken(authHeader);
-      if (tokenResult.data?.did) {
-        try {
-          const oauthSession = await oauthSessions.getOAuthSession(
-            tokenResult.data.did,
-          );
-          if (oauthSession) {
-            return { session: oauthSession };
-          }
-          return {
-            session: null,
-            error: {
-              type: "SESSION_EXPIRED",
-              message: "OAuth session not found in storage",
-            },
-          };
-        } catch (error) {
-          return {
-            session: null,
-            error: {
-              type: "OAUTH_ERROR",
-              message: error instanceof Error
-                ? error.message
-                : "OAuth session restore failed",
-              details: error,
-            },
-          };
-        }
-      }
-      return {
-        session: null,
-        error: tokenResult.error
-          ? {
-            type: "INVALID_COOKIE",
-            message: tokenResult.error.message,
-          }
-          : { type: "INVALID_COOKIE", message: "Invalid token" },
-      };
-    }
-
-    // Check for session cookie (web)
+    // Check for session cookie
     const sessionResult = await sessionManager.getSessionFromRequest(request);
     if (!sessionResult.data?.did) {
       return {

src/types.ts

···
   /** Display name for OAuth consent screen */
   appName: string;
 
-  /** Custom URL scheme for mobile app callbacks (default: "app://auth-callback") */
-  mobileScheme?: string;
-
   /** URL to app logo for OAuth consent screen */
   logoUri?: string;
 
···
   valid: boolean;
   did?: string;
   handle?: string;
-}
-
-/**
- * Mobile OAuth start request
- */
-export interface MobileOAuthStartRequest {
-  handle: string;
-  code_challenge: string;
-}
-
-/**
- * Mobile OAuth start response
- */
-export interface MobileOAuthStartResponse {
-  success: boolean;
-  authUrl?: string;
-  error?: string;
 }
 
 /**
···
 export interface OAuthState {
   handle: string;
   timestamp: number;
-  /** Whether this is a mobile OAuth flow */
-  mobile?: boolean;
-  /** PKCE code_challenge for mobile flows (generated by mobile client) */
-  codeChallenge?: string;
-  /** Redirect path for web flows */
+  /** Redirect path after successful web OAuth */
   redirectPath?: string;
 }