Signed-off-by: Seongmin Lee <git@boltless.me>

the final addition to my collection of oauth fixes: the session cookie
is not a sufficient indication of a logged-in-ness of a user, we
additionally validate this cookie against the session on redis using
ResumeSession and kick users out if their session is invalid.

previously, a user may have appeared to be logged in (via the profile
picture on the top right), but creating an auth'd request would have
login-prompted them.

Signed-off-by: oppiliappan <me@oppi.li>

if sessions are inactive for too long, tokens will not be refreshed, and
calling authorized xrpc methods will error out with invalid_grant. this
changeset does two things:

- tracks the last time a session was active using a new redis pair:
`oauth:session_meta:<did>:<session>`, this is updated every time
`SaveSession` is called
- checks for session inactivity every time `GetSession` is called, and
deletes the session if so

this way, `GetSession` will never return a session with expired tokens.

Signed-off-by: oppiliappan <me@oppi.li>

Signed-off-by: oppiliappan <me@oppi.li>

this change makes our tangled appview a "confidential" client.

this change includes breaking changes to the appview service, it now
requires two different environment variables:

- TANGLED_OAUTH_CLIENT_SECRET: the secret component of the old JWKs
object
- TANGLED_OAUTH_CLIENT_KID: the key ID the old JWKs object

both of these can be extracted from the old JWKs object: `obj.d` and
`obj.kid` respectively.

Signed-off-by: oppiliappan <me@oppi.li>

Signed-off-by: oppiliappan <me@oppi.li>

we invalidate resolutions in our ingester, but the oauth SDK seems to
bring its own directory! this changeset shares them instead.

thanks to nel.pet <did:plc:h5wsnqetncv6lu2weom35lg2> for the hint.

Signed-off-by: oppiliappan <me@oppi.li>

Each methods will check if `page.limit` is higher than 0, and only
applies pagination when limit is higher than 0

Signed-off-by: Seongmin Lee <git@boltless.me>

introduce helper methods: `IntoContext` and `FromContext`
these will help using pagination obj form context easier and make it
less error-prune by using private empty struct as a key instead of raw
string

Signed-off-by: Seongmin Lee <git@boltless.me>

Close: #271
Signed-off-by: Seongmin Lee <git@boltless.me>

kaniko (and other docker build tools) require permission to change file ownership to successfully build containers.

i'm leaving this here for consideration, not sure about this security wise,, the better solution would be to use kvm, i think. in our case docker is running in sysbox without `privileged: true` so it _should_ be fine(??)

Signed-off-by: zenfyr.dev <mail@melontini.me>

this bug prevented following did:web accounts on tangled... because of a
htmx target error.

Signed-off-by: oppiliappan <me@oppi.li>

also uses reflection to unify implementations

Signed-off-by: oppiliappan <me@oppi.li>

Signed-off-by: oppiliappan <me@oppi.li>

`autocapitalize` and `autocorrect` will prevent mobile browsers from
autocorrecting the user handle

Signed-off-by: Seongmin Lee <git@boltless.me>

Signed-off-by: oppiliappan <me@oppi.li>