"@atproto/api": "^0.18.12",

        "jose": "^6.1.3",

    "jose": ["jose@6.1.3", "", {}, "sha512-0TpaTfihd4QMNwrz/ob2Bp7X04yuxJkjRGi4aKmOqwhov54i6u79oCv7T+C7lo70MKH6BesI3vscD1yb/yzKXQ=="],

import { fileURLToPath } from "url";

import path from "path";

		resolve: {

			alias: {

				"@/components": path.resolve(

					path.dirname(fileURLToPath(import.meta.url)),

					"./src/components",

				),

				"@/layouts": path.resolve(

					path.dirname(fileURLToPath(import.meta.url)),

					"./src/layouts",

				),

				"@/utils": path.resolve(

					path.dirname(fileURLToPath(import.meta.url)),

					"./src/utils/index.ts",

				),

				"@/stores": path.resolve(

					path.dirname(fileURLToPath(import.meta.url)),

					"./src/stores",

				),

				"@/data": path.resolve(

					path.dirname(fileURLToPath(import.meta.url)),

					"./src/data",

				),

			},

			extensions: [".mjs", ".js", ".ts", ".jsx", ".tsx", ".json", ".astro"],

		},

import { useState, useEffect, createContext, useContext, type ReactNode } from "react";

interface AuthState {

	authenticated: boolean;

	did?: string;

	handle?: string;

	loading: boolean;

}

interface AuthContextType extends AuthState {

	login: () => void;

	logout: () => Promise<void>;

	refresh: () => Promise<void>;

}

const AuthContext = createContext<AuthContextType | null>(null);

const API_URL = import.meta.env.PUBLIC_API_URL || "https://api.stevedylan.dev";

export function AuthProvider({ children }: { children: ReactNode }) {

	const [authState, setAuthState] = useState<AuthState>({

		authenticated: false,

		loading: true,

	});

	const checkAuthStatus = async () => {

		try {

			const response = await fetch(`${API_URL}/auth/status`, {

				credentials: "include",

			});

			const data = await response.json();

			setAuthState({

				authenticated: data.authenticated,

				did: data.did,

				handle: data.handle,

				loading: false,

			});

		} catch (error) {

			console.error("Failed to check auth status:", error);

			setAuthState({ authenticated: false, loading: false });

		}

	};

	useEffect(() => {

		checkAuthStatus();

	}, []);

	const login = () => {

		window.location.href = `${API_URL}/auth/login`;

	};

	const logout = async () => {

		try {

			await fetch(`${API_URL}/auth/logout`, {

				method: "POST",

				credentials: "include",

			});

			setAuthState({ authenticated: false, loading: false });

		} catch (error) {

			console.error("Logout failed:", error);

		}

	};

	const refresh = async () => {

		await checkAuthStatus();

	};

	return (

		<AuthContext.Provider value={{ ...authState, login, logout, refresh }}>

			{children}

		</AuthContext.Provider>

	);

}

export function useAuth() {

	const context = useContext(AuthContext);

	if (!context) {

		throw new Error("useAuth must be used within an AuthProvider");

	}

	return context;

}

export function LoginButton() {

	const { authenticated, loading, login, logout } = useAuth();

	if (loading) {

		return (

			<div className="text-sm text-gray-500">

				Checking auth...

			</div>

		);

	}

	if (authenticated) {

		return (

			<button

				onClick={logout}

				className="text-sm px-3 py-1.5 border border-gray-300 dark:border-gray-600 rounded hover:bg-gray-100 dark:hover:bg-gray-800 transition-colors"

			>

				Logout

			</button>

		);

	}

	return (

		<button

			onClick={login}

			className="text-sm px-3 py-1.5 bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors"

		>

			Login with ATProto

		</button>

	);

}

import { AuthProvider, LoginButton } from "../auth/AuthStatus";

import { PostComposer } from "./PostComposer";

declare global {

	interface Window {

		fetchPosts?: () => Promise<void>;

	}

}

export function NowAdmin() {

	const handlePostCreated = () => {

		// Call the global fetchPosts function to refresh the posts list

		if (typeof window !== "undefined" && window.fetchPosts) {

			window.fetchPosts();

		}

	};

	return (

		<AuthProvider>

			<div className="mb-6">

				<div className="flex justify-end mb-4">

					<LoginButton />

				</div>

				<PostComposer onPostCreated={handlePostCreated} />

			</div>

		</AuthProvider>

	);

}

import { useState } from "react";

import { useAuth } from "../auth/AuthStatus";

const API_URL = import.meta.env.PUBLIC_API_URL || "https://api.stevedylan.dev";

const MAX_LENGTH = 300;

interface PostComposerProps {

	onPostCreated?: () => void;

}

export function PostComposer({ onPostCreated }: PostComposerProps) {

	const { authenticated } = useAuth();

	const [text, setText] = useState("");

	const [isSubmitting, setIsSubmitting] = useState(false);

	const [error, setError] = useState<string | null>(null);

	const [success, setSuccess] = useState(false);

	if (!authenticated) {

		return null;

	}

	const handleSubmit = async (e: React.FormEvent) => {

		e.preventDefault();

		if (!text.trim()) {

			setError("Post cannot be empty");

			return;

		}

		if (text.length > MAX_LENGTH) {

			setError(`Post must be ${MAX_LENGTH} characters or less`);

			return;

		}

		setIsSubmitting(true);

		setError(null);

		setSuccess(false);

		try {

			const response = await fetch(`${API_URL}/now/post`, {

				method: "POST",

				credentials: "include",

				headers: {

					"Content-Type": "application/json",

				},

				body: JSON.stringify({ text: text.trim() }),

			});

			const data = await response.json();

			if (!response.ok) {

				throw new Error(data.error || "Failed to create post");

			}

			setText("");

			setSuccess(true);

			setTimeout(() => setSuccess(false), 3000);

			// Notify parent to refresh posts

			onPostCreated?.();

		} catch (err) {

			setError(err instanceof Error ? err.message : "Failed to create post");

		} finally {

			setIsSubmitting(false);

		}

	};

	const remaining = MAX_LENGTH - text.length;

	const isOverLimit = remaining < 0;

	return (

		<form

			onSubmit={handleSubmit}

			className="mb-8 p-4 border border-gray-200 dark:border-gray-700 rounded-lg"

		>

			<label htmlFor="post-text" className="block text-sm font-medium mb-2">

				New Update

			</label>

			<textarea

				id="post-text"

				value={text}

				onChange={(e) => setText(e.target.value)}

				placeholder="What's happening?"

				rows={3}

				className="w-full p-3 border border-gray-300 dark:border-gray-600 rounded-lg bg-gray-800 resize-none focus:outline-none text-white focus:ring-2 focus:ring-blue-500 focus:border-transparent"

				disabled={isSubmitting}

			/>

			<div className="flex items-center justify-between mt-3">

				<div className="flex items-center gap-3">

					<span

						className={`text-sm ${isOverLimit ? "text-red-500" : remaining <= 20 ? "text-yellow-500" : "text-gray-500"}`}

					>

						{remaining}

					</span>

					{error && <span className="text-sm text-red-500">{error}</span>}

					{success && (

						<span className="text-sm text-green-500">Posted successfully!</span>

					)}

				</div>

				<button

					type="submit"

					disabled={isSubmitting || isOverLimit || !text.trim()}

					className="px-4 py-2 bg-blue-600 text-white rounded-lg hover:bg-blue-700 disabled:opacity-50 disabled:cursor-not-allowed transition-colors"

				>

					{isSubmitting ? "Posting..." : "Post"}

				</button>

			</div>

		</form>

	);

}

---

import PageLayout from "@/layouts/Base";

import { NowAdmin } from "@/components/post/NowAdmin";

const meta = {

	title: "Post Update",

	description: "Create a new update",

};

---

<PageLayout meta={meta}>

  <div class="space-y-6">

    <h1 class="title">Post Update</h1>

    <p>Create a new update for the <a href="/now" class="text-link">Now</a> page.</p>

    <NowAdmin client:load />

  </div>

</PageLayout>

	"extends": "astro/tsconfigs/base",

	"compilerOptions": {

		"strict": true,

		"baseUrl": ".",

		"paths": {

			"@/components/*": ["src/components/*"],

			"@/layouts/*": ["src/layouts/*"],

			"@/utils": ["src/utils/index.ts"],

			"@/stores/*": ["src/stores/*"],

			"@/data/*": ["src/data/*"],

			"@/site-config": ["src/site.config.ts"]

		},

		"plugins": [

			{

				"name": "@astrojs/ts-plugin"

			}

		],

		"jsx": "react-jsx",

		"jsxImportSource": "react"

	},

	"exclude": ["node_modules", "**/node_modules/*", ".vscode", "dist"]

		"@atproto/api": "^0.18.12",

		"hono": "^4.11.3",

		"jose": "^6.1.3"

import { home, now, auth } from "./routes";

interface Env {

	SESSIONS: KVNamespace;

	ALLOWED_DID: string;

	PDS_URL: string;

	CLIENT_URL: string;

	API_URL: string;

}

const app = new Hono<{ Bindings: Env }>();

// Configure CORS to allow credentials from the client

app.use(

	cors({

		origin: (origin) => {

			// Allow requests from the client URL and localhost for development

			const allowedOrigins = [

				"https://stevedylan.dev",

				"http://localhost:4321",

				"http://localhost:3000",

			];

			return allowedOrigins.includes(origin) ? origin : allowedOrigins[0];

		},

		credentials: true,

		allowMethods: ["GET", "POST", "OPTIONS"],

		allowHeaders: ["Content-Type"],

	}),

);

app.route("/auth", auth);

import * as jose from "jose";

export interface DPoPKeyPair {

	privateKey: CryptoKey;

	publicKey: CryptoKey;

	publicJwk: jose.JWK;

}

export interface DPoPProofOptions {

	method: string;

	url: string;

	nonce?: string;

	accessToken?: string;

}

/**

 * Generate a new ES256 keypair for DPoP proofs

 */

export async function generateDPoPKeyPair(): Promise<DPoPKeyPair> {

	const keyPair = (await crypto.subtle.generateKey(

		{

			name: "ECDSA",

			namedCurve: "P-256",

		},

		true,

		["sign", "verify"],

	)) as CryptoKeyPair;

	const publicJwk = await jose.exportJWK(keyPair.publicKey);

	return {

		privateKey: keyPair.privateKey,

		publicKey: keyPair.publicKey,

		publicJwk,

	};

}

/**

 * Export a DPoP keypair to a storable format

 */

export async function exportDPoPKeyPair(

	keyPair: DPoPKeyPair,

): Promise<{ privateJwk: jose.JWK; publicJwk: jose.JWK }> {

	const privateJwk = await jose.exportJWK(keyPair.privateKey);

	return {

		privateJwk,

		publicJwk: keyPair.publicJwk,

	};

}

/**

 * Import a DPoP keypair from stored JWKs

 */

export async function importDPoPKeyPair(stored: {

	privateJwk: jose.JWK;

	publicJwk: jose.JWK;

}): Promise<DPoPKeyPair> {

	// Use crypto.subtle.importKey with extractable: true

	// jose.importJWK creates non-extractable keys by default

	const privateKey = await crypto.subtle.importKey(

		"jwk",

		stored.privateJwk as JsonWebKey,

		{ name: "ECDSA", namedCurve: "P-256" },

		true, // extractable

		["sign"],

	);

	const publicKey = await crypto.subtle.importKey(

		"jwk",

		stored.publicJwk as JsonWebKey,

		{ name: "ECDSA", namedCurve: "P-256" },

		true, // extractable

		["verify"],

	);

	return {

		privateKey,

		publicKey,

		publicJwk: stored.publicJwk,

	};

}

/**

 * Create a DPoP proof JWT for a request

 */

export async function createDPoPProof(

	keyPair: DPoPKeyPair,

	options: DPoPProofOptions,

): Promise<string> {

	const now = Math.floor(Date.now() / 1000);

	const jti = crypto.randomUUID();

	const payload: jose.JWTPayload = {

		jti,

		htm: options.method.toUpperCase(),

		htu: options.url,

		iat: now,

	};

	// Add nonce if provided (required after first request)

	if (options.nonce) {

		payload.nonce = options.nonce;

	}

	// Add access token hash if provided (for resource server requests)

	if (options.accessToken) {

		const encoder = new TextEncoder();

		const data = encoder.encode(options.accessToken);

		const hashBuffer = await crypto.subtle.digest("SHA-256", data);

		const hashArray = new Uint8Array(hashBuffer);

		payload.ath = jose.base64url.encode(hashArray);

	}

	const jwt = await new jose.SignJWT(payload)

		.setProtectedHeader({

			alg: "ES256",

			typ: "dpop+jwt",

			jwk: keyPair.publicJwk,

		})

		.sign(keyPair.privateKey);

	return jwt;

}

/**

 * Extract DPoP nonce from response headers

 */

export function extractDPoPNonce(response: Response): string | null {

	return response.headers.get("DPoP-Nonce");

}

import * as jose from "jose";

import { type DPoPKeyPair, createDPoPProof, extractDPoPNonce } from "./dpop";

export interface OAuthServerMetadata {

	issuer: string;

	authorization_endpoint: string;

	token_endpoint: string;

	pushed_authorization_request_endpoint: string;

	scopes_supported?: string[];

	response_types_supported?: string[];

	grant_types_supported?: string[];

	dpop_signing_alg_values_supported?: string[];

}

export interface PKCEPair {

	codeVerifier: string;

	codeChallenge: string;

}

export interface TokenResponse {

	access_token: string;

	token_type: string;

	expires_in: number;

	refresh_token?: string;

	scope: string;

	sub: string; // The DID of the authenticated user

}

export interface PARResponse {

	request_uri: string;

	expires_in: number;

}

interface OAuthErrorResponse {

	error: string;

	error_description?: string;

}

/**

 * Fetch OAuth server metadata from PDS

 */

export async function fetchOAuthMetadata(

	pdsUrl: string,

): Promise<OAuthServerMetadata> {

	const metadataUrl = `${pdsUrl}/.well-known/oauth-authorization-server`;

	const response = await fetch(metadataUrl);

	if (!response.ok) {

		throw new Error(

			`Failed to fetch OAuth metadata: ${response.status} ${response.statusText}`,

		);

	}

	return response.json();

}

/**

 * Generate PKCE code verifier and challenge

 */

export async function generatePKCE(): Promise<PKCEPair> {

	// Generate 32 random bytes for code verifier

	const verifierBytes = new Uint8Array(32);

	crypto.getRandomValues(verifierBytes);

	const codeVerifier = jose.base64url.encode(verifierBytes);

	// Generate S256 challenge

	const encoder = new TextEncoder();

	const data = encoder.encode(codeVerifier);

	const hashBuffer = await crypto.subtle.digest("SHA-256", data);

	const codeChallenge = jose.base64url.encode(new Uint8Array(hashBuffer));

	return { codeVerifier, codeChallenge };

}

/**

 * Generate a random state token

 */

export function generateState(): string {

	const stateBytes = new Uint8Array(32);

	crypto.getRandomValues(stateBytes);

	return jose.base64url.encode(stateBytes);

}

/**

 * Send a Pushed Authorization Request (PAR) to the PDS

 */

export async function sendPAR(

	metadata: OAuthServerMetadata,

	clientId: string,

	redirectUri: string,

	state: string,

	pkce: PKCEPair,

	dpopKeyPair: DPoPKeyPair,

	scope: string,

	dpopNonce?: string,

): Promise<{ parResponse: PARResponse; dpopNonce: string }> {

	const parEndpoint = metadata.pushed_authorization_request_endpoint;

	const params = new URLSearchParams({

		client_id: clientId,

		redirect_uri: redirectUri,

		response_type: "code",

		state,

		scope,

		code_challenge: pkce.codeChallenge,

		code_challenge_method: "S256",

	});

	// Create DPoP proof for this request

	const dpopProof = await createDPoPProof(dpopKeyPair, {

		method: "POST",

		url: parEndpoint,

		nonce: dpopNonce,

	});

	const response = await fetch(parEndpoint, {

		method: "POST",

		headers: {

			"Content-Type": "application/x-www-form-urlencoded",

			DPoP: dpopProof,

		},

		body: params.toString(),

	});

	// Handle DPoP nonce requirement

	const newNonce = extractDPoPNonce(response);

	if (response.status === 400 || response.status === 401) {

		const error: OAuthErrorResponse = await response.json();

		if (error.error === "use_dpop_nonce" && newNonce) {

			// Retry with the nonce

			return sendPAR(

				metadata,

				clientId,

				redirectUri,

				state,

				pkce,

				dpopKeyPair,

				scope,

				newNonce,

			);

		}

		throw new Error(`PAR failed: ${error.error_description || error.error}`);

	}

	if (!response.ok) {

		throw new Error(`PAR failed: ${response.status} ${response.statusText}`);

	}

	const parResponse: PARResponse = await response.json();

	return {

		parResponse,

		dpopNonce: newNonce || dpopNonce || "",

	};

}

/**

 * Build the authorization URL for redirecting the user

 */

export function buildAuthorizationUrl(

	metadata: OAuthServerMetadata,

	requestUri: string,

	clientId: string,

): string {

	const url = new URL(metadata.authorization_endpoint);

	url.searchParams.set("request_uri", requestUri);

	url.searchParams.set("client_id", clientId);

	return url.toString();

}

/**

 * Exchange authorization code for tokens

 */

export async function exchangeCodeForTokens(

	metadata: OAuthServerMetadata,

	code: string,

	codeVerifier: string,

	clientId: string,

	redirectUri: string,

	dpopKeyPair: DPoPKeyPair,

	dpopNonce?: string,

): Promise<{ tokenResponse: TokenResponse; dpopNonce: string }> {

	const tokenEndpoint = metadata.token_endpoint;

	const params = new URLSearchParams({

		grant_type: "authorization_code",

		code,

		redirect_uri: redirectUri,

		client_id: clientId,

		code_verifier: codeVerifier,

	});

	// Create DPoP proof for token request

	const dpopProof = await createDPoPProof(dpopKeyPair, {

		method: "POST",

		url: tokenEndpoint,

		nonce: dpopNonce,

	});

	const response = await fetch(tokenEndpoint, {

		method: "POST",

		headers: {

			"Content-Type": "application/x-www-form-urlencoded",

			DPoP: dpopProof,

		},

		body: params.toString(),

	});

	// Handle DPoP nonce requirement

	const newNonce = extractDPoPNonce(response);

	if (response.status === 400 || response.status === 401) {

		const error: OAuthErrorResponse = await response.json();

		if (error.error === "use_dpop_nonce" && newNonce) {

			// Retry with the nonce

			return exchangeCodeForTokens(

				metadata,

				code,

				codeVerifier,

				clientId,

				redirectUri,

				dpopKeyPair,

				newNonce,

			);

		}

		throw new Error(

			`Token exchange failed: ${error.error_description || error.error}`,

		);

	}

	if (!response.ok) {

		throw new Error(

			`Token exchange failed: ${response.status} ${response.statusText}`,

		);

	}

	const tokenResponse: TokenResponse = await response.json();

	return {

		tokenResponse,

		dpopNonce: newNonce || dpopNonce || "",

	};

}

/**

 * Refresh an access token

 */

export async function refreshAccessToken(

	metadata: OAuthServerMetadata,

	refreshToken: string,

	clientId: string,

	dpopKeyPair: DPoPKeyPair,

	dpopNonce?: string,

): Promise<{ tokenResponse: TokenResponse; dpopNonce: string }> {

	const tokenEndpoint = metadata.token_endpoint;

	const params = new URLSearchParams({

		grant_type: "refresh_token",

		refresh_token: refreshToken,

		client_id: clientId,

	});

	// Create DPoP proof for token request

	const dpopProof = await createDPoPProof(dpopKeyPair, {

		method: "POST",

		url: tokenEndpoint,

		nonce: dpopNonce,

	});

	const response = await fetch(tokenEndpoint, {

		method: "POST",

		headers: {

			"Content-Type": "application/x-www-form-urlencoded",

			DPoP: dpopProof,

		},

		body: params.toString(),

	});

	// Handle DPoP nonce requirement

	const newNonce = extractDPoPNonce(response);

	if (response.status === 400 || response.status === 401) {

		const error: OAuthErrorResponse = await response.json();

		if (error.error === "use_dpop_nonce" && newNonce) {

			// Retry with the nonce

			return refreshAccessToken(

				metadata,

				refreshToken,

				clientId,

				dpopKeyPair,

				newNonce,

			);

		}

		throw new Error(

			`Token refresh failed: ${error.error_description || error.error}`,

		);

	}

	if (!response.ok) {

		throw new Error(

			`Token refresh failed: ${response.status} ${response.statusText}`,

		);

	}

	const tokenResponse: TokenResponse = await response.json();

	return {

		tokenResponse,

		dpopNonce: newNonce || dpopNonce || "",

	};

}

import type { Context } from "hono";

import type { JWK } from "jose";

import { exportDPoPKeyPair, importDPoPKeyPair, type DPoPKeyPair } from "./dpop";

export interface StoredSession {

	accessToken: string;

	refreshToken: string;

	dpopPrivateJwk: JWK;

	dpopPublicJwk: JWK;

	dpopNonce: string;

	did: string;

	handle?: string;

	expiresAt: number; // Unix timestamp

	createdAt: number;

}

export interface AuthState {

	codeVerifier: string;

	state: string;

	dpopPrivateJwk: JWK;

	dpopPublicJwk: JWK;

	dpopNonce: string;

	createdAt: number;

}

const SESSION_COOKIE_NAME = "session_id";

const SESSION_TTL = 60 * 60 * 24 * 14; // 14 days in seconds

const AUTH_STATE_TTL = 60 * 10; // 10 minutes in seconds

/**

 * Generate a unique session ID

 */

export function generateSessionId(): string {

	const bytes = new Uint8Array(32);

	crypto.getRandomValues(bytes);

	return Array.from(bytes)

		.map((b) => b.toString(16).padStart(2, "0"))

		.join("");

}

/**

 * Store auth state during OAuth flow

 */

export async function storeAuthState(

	kv: KVNamespace,

	state: string,

	codeVerifier: string,

	dpopKeyPair: DPoPKeyPair,

	dpopNonce: string,

): Promise<void> {

	const exported = await exportDPoPKeyPair(dpopKeyPair);

	const authState: AuthState = {

		codeVerifier,

		state,

		dpopPrivateJwk: exported.privateJwk,

		dpopPublicJwk: exported.publicJwk,

		dpopNonce,

		createdAt: Date.now(),

	};

	await kv.put(`auth_state:${state}`, JSON.stringify(authState), {

		expirationTtl: AUTH_STATE_TTL,

	});

}

/**

 * Retrieve and delete auth state

 */

export async function getAndDeleteAuthState(

	kv: KVNamespace,

	state: string,

): Promise<{

	codeVerifier: string;

	dpopKeyPair: DPoPKeyPair;

	dpopNonce: string;

} | null> {

	const data = await kv.get(`auth_state:${state}`);

	if (!data) return null;

	// Delete the auth state (one-time use)

	await kv.delete(`auth_state:${state}`);

	const authState: AuthState = JSON.parse(data);

	const dpopKeyPair = await importDPoPKeyPair({

		privateJwk: authState.dpopPrivateJwk,

		publicJwk: authState.dpopPublicJwk,

	});

	return {

		codeVerifier: authState.codeVerifier,

		dpopKeyPair,

		dpopNonce: authState.dpopNonce,

	};

}

/**

 * Create a new session and store it in KV

 */

export async function createSession(

	kv: KVNamespace,

	accessToken: string,

	refreshToken: string,

	dpopKeyPair: DPoPKeyPair,

	dpopNonce: string,

	did: string,

	expiresIn: number,

	handle?: string,

): Promise<string> {

	const sessionId = generateSessionId();

	const exported = await exportDPoPKeyPair(dpopKeyPair);

	const session: StoredSession = {

		accessToken,

		refreshToken,

		dpopPrivateJwk: exported.privateJwk,

		dpopPublicJwk: exported.publicJwk,

		dpopNonce,

		did,

		handle,

		expiresAt: Date.now() + expiresIn * 1000,

		createdAt: Date.now(),

	};

	await kv.put(`session:${sessionId}`, JSON.stringify(session), {

		expirationTtl: SESSION_TTL,

	});

	return sessionId;

}

/**

 * Get session from KV by session ID

 */

export async function getSession(

	kv: KVNamespace,

	sessionId: string,

): Promise<{ session: StoredSession; dpopKeyPair: DPoPKeyPair } | null> {

	const data = await kv.get(`session:${sessionId}`);

	if (!data) return null;

	const session: StoredSession = JSON.parse(data);

	const dpopKeyPair = await importDPoPKeyPair({

		privateJwk: session.dpopPrivateJwk,

		publicJwk: session.dpopPublicJwk,

	});

	return { session, dpopKeyPair };

}

/**

 * Update session with new tokens

 */

export async function updateSession(

	kv: KVNamespace,

	sessionId: string,

	accessToken: string,

	refreshToken: string,

	dpopNonce: string,

	expiresIn: number,

): Promise<void> {

	const data = await kv.get(`session:${sessionId}`);

	if (!data) throw new Error("Session not found");

	const session: StoredSession = JSON.parse(data);

	session.accessToken = accessToken;

	session.refreshToken = refreshToken;

	session.dpopNonce = dpopNonce;

	session.expiresAt = Date.now() + expiresIn * 1000;

	await kv.put(`session:${sessionId}`, JSON.stringify(session), {

		expirationTtl: SESSION_TTL,

	});

}

/**

 * Delete a session

 */

export async function deleteSession(

	kv: KVNamespace,

	sessionId: string,

): Promise<void> {

	await kv.delete(`session:${sessionId}`);

}

/**

 * Get session ID from cookie

 */

export function getSessionIdFromCookie(c: Context): string | null {

	const cookie = c.req.header("Cookie");

	if (!cookie) return null;

	const match = cookie.match(new RegExp(`${SESSION_COOKIE_NAME}=([^;]+)`));

	return match ? match[1] : null;

}

/**

 * Set session cookie in response

 */

export function setSessionCookie(

	c: Context,

	sessionId: string,

	clientUrl: string,

): void {

	const isLocalhost = clientUrl.includes("localhost");

	const domain = isLocalhost ? "" : "; Domain=.stevedylan.dev";

	const secure = isLocalhost ? "" : "; Secure";

	c.header(

		"Set-Cookie",

		`${SESSION_COOKIE_NAME}=${sessionId}; HttpOnly; SameSite=Lax; Path=/${domain}${secure}; Max-Age=${SESSION_TTL}`,

	);

}

/**

 * Clear session cookie

 */

export function clearSessionCookie(c: Context, clientUrl: string): void {

	const isLocalhost = clientUrl.includes("localhost");

	const domain = isLocalhost ? "" : "; Domain=.stevedylan.dev";

	const secure = isLocalhost ? "" : "; Secure";

	c.header(

		"Set-Cookie",

		`${SESSION_COOKIE_NAME}=; HttpOnly; SameSite=Lax; Path=/${domain}${secure}; Max-Age=0`,

	);

}

/**

 * Check if token is expired or about to expire (within 1 minute)

 */

export function isTokenExpired(expiresAt: number): boolean {

	return Date.now() > expiresAt - 60000;

}

import { Hono } from "hono";

import { generateDPoPKeyPair } from "../lib/dpop";

import {

	fetchOAuthMetadata,

	generatePKCE,

	generateState,

	sendPAR,

	buildAuthorizationUrl,

	exchangeCodeForTokens,

} from "../lib/oauth";

import {

	storeAuthState,

	getAndDeleteAuthState,

	createSession,

	getSession,

	deleteSession,

	getSessionIdFromCookie,

	setSessionCookie,

	clearSessionCookie,

	isTokenExpired,

	updateSession,

} from "../lib/session";

import { refreshAccessToken } from "../lib/oauth";

interface Env {

	SESSIONS: KVNamespace;

	ALLOWED_DID: string;

	PDS_URL: string;

	CLIENT_URL: string;

	API_URL: string;

}

const auth = new Hono<{ Bindings: Env }>();

// OAuth client metadata endpoint

auth.get("/client-metadata.json", (c) => {

	const clientId = `${c.env.API_URL}/auth/client-metadata.json`;

	const redirectUri = `${c.env.API_URL}/auth/callback`;

	return c.json({

		client_id: clientId,

		client_name: "Steve Dylan's Blog",

		client_uri: c.env.API_URL,

		redirect_uris: [redirectUri],

		grant_types: ["authorization_code", "refresh_token"],

		response_types: ["code"],

		scope: "atproto transition:generic",

		token_endpoint_auth_method: "none",

		application_type: "web",

		dpop_bound_access_tokens: true,

	});

});

// Start OAuth login flow

auth.get("/login", async (c) => {

	try {

		const clientId = `${c.env.API_URL}/auth/client-metadata.json`;

		const redirectUri = `${c.env.API_URL}/auth/callback`;

		// Fetch OAuth metadata from PDS

		const metadata = await fetchOAuthMetadata(c.env.PDS_URL);

		// Generate PKCE and state

		const pkce = await generatePKCE();

		const state = generateState();

		// Generate DPoP keypair

		const dpopKeyPair = await generateDPoPKeyPair();

		// Send PAR request

		const { parResponse, dpopNonce } = await sendPAR(

			metadata,

			clientId,

			redirectUri,

			state,

			pkce,

			dpopKeyPair,

			"atproto transition:generic",

		);

		// Store auth state in KV

		await storeAuthState(

			c.env.SESSIONS,

			state,

			pkce.codeVerifier,

			dpopKeyPair,

			dpopNonce,

		);

		// Build authorization URL and redirect

		const authUrl = buildAuthorizationUrl(

			metadata,

			parResponse.request_uri,

			clientId,

		);

		return c.redirect(authUrl);

	} catch (error) {

		console.error("Login error:", error);

		return c.redirect(`${c.env.CLIENT_URL}/now?error=login_failed`);

	}

});

// OAuth callback handler

auth.get("/callback", async (c) => {

	try {

		const code = c.req.query("code");

		const state = c.req.query("state");

		const error = c.req.query("error");

		const errorDescription = c.req.query("error_description");

		// Handle OAuth errors

		if (error) {

			console.error("OAuth error:", error, errorDescription);

			return c.redirect(

				`${c.env.CLIENT_URL}/now?error=${encodeURIComponent(error)}`,

			);

		}

		if (!code || !state) {

			return c.redirect(`${c.env.CLIENT_URL}/now?error=missing_params`);

		}

		// Retrieve and validate auth state

		const authState = await getAndDeleteAuthState(c.env.SESSIONS, state);

		if (!authState) {

			return c.redirect(`${c.env.CLIENT_URL}/now?error=invalid_state`);

		}

		const clientId = `${c.env.API_URL}/auth/client-metadata.json`;

		const redirectUri = `${c.env.API_URL}/auth/callback`;

		// Fetch OAuth metadata

		const metadata = await fetchOAuthMetadata(c.env.PDS_URL);

		// Exchange code for tokens

		const { tokenResponse, dpopNonce } = await exchangeCodeForTokens(

			metadata,

			code,

			authState.codeVerifier,

			clientId,

			redirectUri,

			authState.dpopKeyPair,

			authState.dpopNonce,

		);

		// CRITICAL: Only allow the site owner

		if (tokenResponse.sub !== c.env.ALLOWED_DID) {

			console.error("Unauthorized login attempt from:", tokenResponse.sub);

			return c.redirect(`${c.env.CLIENT_URL}/now?error=unauthorized`);

		}

		// Create session

		const sessionId = await createSession(

			c.env.SESSIONS,

			tokenResponse.access_token,

			tokenResponse.refresh_token || "",

			authState.dpopKeyPair,

			dpopNonce,

			tokenResponse.sub,

			tokenResponse.expires_in,

		);

		// Set session cookie and redirect to /now

		setSessionCookie(c, sessionId, c.env.CLIENT_URL);

		return c.redirect(`${c.env.CLIENT_URL}/now/post`);

	} catch (error) {

		console.error("Callback error:", error);

		return c.redirect(`${c.env.CLIENT_URL}/now?error=callback_failed`);

	}

});

// Logout endpoint

auth.post("/logout", async (c) => {

	const sessionId = getSessionIdFromCookie(c);

	if (sessionId) {

		await deleteSession(c.env.SESSIONS, sessionId);

	}

	clearSessionCookie(c, c.env.CLIENT_URL);

	return c.json({ success: true });

});

// Check auth status

auth.get("/status", async (c) => {

	const sessionId = getSessionIdFromCookie(c);

	if (!sessionId) {

		return c.json({ authenticated: false });

	}

	const sessionData = await getSession(c.env.SESSIONS, sessionId);