+2 -4

api/scripts/generate-typescript.ts

··· 298 298 ], 299 299 }); 300 300 301 301 - sourceFile.addInterface({ 301 301 + sourceFile.addTypeAlias({ 302 302 name: "GetJobHistoryResponse", 303 303 isExported: true, 304 304 - properties: [ 305 305 - { name: "jobs", type: "JobStatus[]" }, 306 306 - ], 304 304 + type: "JobStatus[]", 307 305 }); 308 306 309 307 sourceFile.addInterface({

+2 -2

frontend/deno.json

··· 15 15 }, 16 16 "compilerOptions": { 17 17 "jsx": "precompile", 18 18 - "jsxImportSource": "preact", 19 19 - "types": ["./globals.d.ts"] 18 18 + "jsxImportSource": "preact" 20 19 }, 21 20 "imports": { 22 21 "@slices/oauth": "jsr:@slices/oauth@^0.3.0", 22 22 + "@slices/session": "jsr:@slices/session@^0.1.0", 23 23 "@std/assert": "jsr:@std/assert@^1.0.14", 24 24 "preact": "npm:preact@^10.27.1", 25 25 "preact-render-to-string": "npm:preact-render-to-string@^6.5.13",

+79

frontend/deno.lock

··· 3 3 "specifiers": { 4 4 "jsr:@shikijs/shiki@*": "3.7.0", 5 5 "jsr:@slices/oauth@0.3": "0.3.0", 6 6 + "jsr:@slices/session@0.1": "0.1.0", 6 7 "jsr:@std/assert@^1.0.14": "1.0.14", 7 8 "jsr:@std/cli@^1.0.21": "1.0.21", 8 9 "jsr:@std/encoding@^1.0.10": "1.0.10", ··· 19 20 "npm:@shikijs/engine-oniguruma@^3.7.0": "3.11.0", 20 21 "npm:@shikijs/types@^3.7.0": "3.11.0", 21 22 "npm:@types/node@*": "22.15.15", 23 23 + "npm:pg@^8.11.0": "8.16.3", 24 24 + "npm:pg@^8.16.3": "8.16.3", 22 25 "npm:preact-render-to-string@^6.5.13": "6.5.13_preact@10.27.1", 23 26 "npm:preact@^10.27.1": "10.27.1", 24 27 "npm:shiki@^3.7.0": "3.11.0", 28 28 + "npm:typed-htmx@*": "0.3.1", 25 29 "npm:typed-htmx@~0.3.1": "0.3.1" 26 30 }, 27 31 "jsr": { ··· 35 39 }, 36 40 "@slices/oauth@0.3.0": { 37 41 "integrity": "a6f3296e701291f14b4c8491a7f7a86bd3c8d5caf006eb1d371627558439e3b5" 42 42 + }, 43 43 + "@slices/session@0.1.0": { 44 44 + "integrity": "63a4e35d70dcb2bb58e6117fdccf308f4a86cd9d94cf99412a3de9d35862cabc", 45 45 + "dependencies": [ 46 46 + "npm:pg@^8.16.3" 47 47 + ] 38 48 }, 39 49 "@std/assert@1.0.14": { 40 50 "integrity": "68d0d4a43b365abc927f45a9b85c639ea18a9fab96ad92281e493e4ed84abaa4", ··· 256 266 "regex-recursion" 257 267 ] 258 268 }, 269 269 + "pg-cloudflare@1.2.7": { 270 270 + "integrity": "sha512-YgCtzMH0ptvZJslLM1ffsY4EuGaU0cx4XSdXLRFae8bPP4dS5xL1tNB3k2o/N64cHJpwU7dxKli/nZ2lUa5fLg==" 271 271 + }, 272 272 + "pg-connection-string@2.9.1": { 273 273 + "integrity": "sha512-nkc6NpDcvPVpZXxrreI/FOtX3XemeLl8E0qFr6F2Lrm/I8WOnaWNhIPK2Z7OHpw7gh5XJThi6j6ppgNoaT1w4w==" 274 274 + }, 275 275 + "pg-int8@1.0.1": { 276 276 + "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==" 277 277 + }, 278 278 + "pg-pool@3.10.1_pg@8.16.3": { 279 279 + "integrity": "sha512-Tu8jMlcX+9d8+QVzKIvM/uJtp07PKr82IUOYEphaWcoBhIYkoHpLXN3qO59nAI11ripznDsEzEv8nUxBVWajGg==", 280 280 + "dependencies": [ 281 281 + "pg" 282 282 + ] 283 283 + }, 284 284 + "pg-protocol@1.10.3": { 285 285 + "integrity": "sha512-6DIBgBQaTKDJyxnXaLiLR8wBpQQcGWuAESkRBX/t6OwA8YsqP+iVSiond2EDy6Y/dsGk8rh/jtax3js5NeV7JQ==" 286 286 + }, 287 287 + "pg-types@2.2.0": { 288 288 + "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==", 289 289 + "dependencies": [ 290 290 + "pg-int8", 291 291 + "postgres-array", 292 292 + "postgres-bytea", 293 293 + "postgres-date", 294 294 + "postgres-interval" 295 295 + ] 296 296 + }, 297 297 + "pg@8.16.3": { 298 298 + "integrity": "sha512-enxc1h0jA/aq5oSDMvqyW3q89ra6XIIDZgCX9vkMrnz5DFTw/Ny3Li2lFQ+pt3L6MCgm/5o2o8HW9hiJji+xvw==", 299 299 + "dependencies": [ 300 300 + "pg-connection-string", 301 301 + "pg-pool", 302 302 + "pg-protocol", 303 303 + "pg-types", 304 304 + "pgpass" 305 305 + ], 306 306 + "optionalDependencies": [ 307 307 + "pg-cloudflare" 308 308 + ] 309 309 + }, 310 310 + "pgpass@1.0.5": { 311 311 + "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==", 312 312 + "dependencies": [ 313 313 + "split2" 314 314 + ] 315 315 + }, 316 316 + "postgres-array@2.0.0": { 317 317 + "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==" 318 318 + }, 319 319 + "postgres-bytea@1.0.0": { 320 320 + "integrity": "sha512-xy3pmLuQqRBZBXDULy7KbaitYqLcmxigw14Q5sj8QBVLqEwXfeybIKVWiqAXTlcvdvb0+xkOtDbfQMOf4lST1w==" 321 321 + }, 322 322 + "postgres-date@1.0.7": { 323 323 + "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==" 324 324 + }, 325 325 + "postgres-interval@1.2.0": { 326 326 + "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==", 327 327 + "dependencies": [ 328 328 + "xtend" 329 329 + ] 330 330 + }, 259 331 "preact-render-to-string@6.5.13_preact@10.27.1": { 260 332 "integrity": "sha512-iGPd+hKPMFKsfpR2vL4kJ6ZPcFIoWZEcBf0Dpm3zOpdVvj77aY8RlLiQji5OMrngEyaxGogeakTb54uS2FvA6w==", 261 333 "dependencies": [ ··· 298 370 }, 299 371 "space-separated-tokens@2.0.2": { 300 372 "integrity": "sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==" 373 373 + }, 374 374 + "split2@4.2.0": { 375 375 + "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==" 301 376 }, 302 377 "stringify-entities@4.0.4": { 303 378 "integrity": "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==", ··· 368 443 "vfile-message" 369 444 ] 370 445 }, 446 446 + "xtend@4.0.2": { 447 447 + "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==" 448 448 + }, 371 449 "zwitch@2.0.4": { 372 450 "integrity": "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==" 373 451 } ··· 375 453 "workspace": { 376 454 "dependencies": [ 377 455 "jsr:@slices/oauth@0.3", 456 456 + "jsr:@slices/session@0.1", 378 457 "jsr:@std/assert@^1.0.14", 379 458 "jsr:@std/http@^1.0.20", 380 459 "npm:preact-render-to-string@^6.5.13",

+1 -3

frontend/globals.d.ts

··· 2 2 3 3 declare module "preact" { 4 4 namespace JSX { 5 5 - interface HTMLAttributes extends HtmxAttributes { 6 6 - _?: string; 7 7 - } 5 5 + interface HTMLAttributes extends HtmxAttributes {} 8 6 } 9 7 }

+2 -4

frontend/src/client.ts

··· 1 1 // Generated TypeScript client for AT Protocol records 2 2 - // Generated at: 2025-08-26 18:27:23 UTC 2 2 + // Generated at: 2025-08-27 05:10:34 UTC 3 3 // Lexicons: 3 4 4 5 5 /** ··· 128 128 limit?: number; 129 129 } 130 130 131 131 - export interface GetJobHistoryResponse { 132 132 - jobs: JobStatus[]; 133 133 - } 131 131 + export type GetJobHistoryResponse = JobStatus[]; 134 132 135 133 export interface CollectionStats { 136 134 collection: string;

+19 -1

frontend/src/config.ts

··· 1 1 import { AtProtoClient } from "./client.ts"; 2 2 import { OAuthClient, SQLiteOAuthStorage } from "@slices/oauth"; 3 3 + import { SessionStore, SQLiteAdapter, withOAuthSession } from "@slices/session"; 3 4 4 5 const OAUTH_CLIENT_ID = Deno.env.get("OAUTH_CLIENT_ID"); 5 6 const OAUTH_CLIENT_SECRET = Deno.env.get("OAUTH_CLIENT_SECRET"); ··· 23 24 } 24 25 25 26 const DATABASE_URL = Deno.env.get("DATABASE_URL") || "slices.db"; 27 27 + 28 28 + // OAuth setup 26 29 const oauthStorage = new SQLiteOAuthStorage(DATABASE_URL); 27 27 - 28 30 const oauthClient = new OAuthClient( 29 31 { 30 32 clientId: OAUTH_CLIENT_ID, ··· 41 43 }, 42 44 oauthStorage 43 45 ); 46 46 + 47 47 + // Session setup (shared database) 48 48 + export const sessionStore = new SessionStore({ 49 49 + adapter: new SQLiteAdapter(DATABASE_URL), 50 50 + cookieOptions: { 51 51 + httpOnly: true, 52 52 + secure: Deno.env.get("DENO_ENV") === "production", 53 53 + sameSite: "lax", 54 54 + path: "/", 55 55 + }, 56 56 + }); 57 57 + 58 58 + // OAuth + Session integration 59 59 + export const oauthSessions = withOAuthSession(sessionStore, oauthClient, { 60 60 + autoRefresh: true, 61 61 + }); 44 62 45 63 export const atprotoClient = new AtProtoClient(API_URL, SLICE_URI, oauthClient);

-254

frontend/src/lib/session-store.ts

··· 1 1 - // SQLite-based session storage for user authentication 2 2 - import { atprotoClient } from "../config.ts"; 3 3 - import { DatabaseSync } from "node:sqlite"; 4 4 - 5 5 - export interface SessionData { 6 6 - userDid: string; 7 7 - handle?: string; 8 8 - isAuthenticated: boolean; 9 9 - createdAt: number; 10 10 - } 11 11 - 12 12 - interface UserData { 13 13 - handle?: string; 14 14 - sub?: string; 15 15 - isAuthenticated: boolean; 16 16 - } 17 17 - 18 18 - export class SessionStore { 19 19 - private db: DatabaseSync; 20 20 - 21 21 - constructor(databaseUrl: string) { 22 22 - // Extract path from sqlite:// URL or use as-is 23 23 - const dbPath = databaseUrl.startsWith("sqlite://") 24 24 - ? databaseUrl.slice(9) 25 25 - : databaseUrl; 26 26 - 27 27 - this.db = new DatabaseSync(dbPath); 28 28 - this.initializeDatabase(); 29 29 - } 30 30 - 31 31 - private initializeDatabase() { 32 32 - this.db.exec(` 33 33 - CREATE TABLE IF NOT EXISTS sessions ( 34 34 - session_id TEXT PRIMARY KEY, 35 35 - user_did TEXT NOT NULL, 36 36 - handle TEXT, 37 37 - is_authenticated INTEGER NOT NULL, 38 38 - created_at INTEGER NOT NULL, 39 39 - expires_at INTEGER NOT NULL 40 40 - ) 41 41 - `); 42 42 - 43 43 - // Create index for faster cleanup of expired sessions 44 44 - this.db.exec(` 45 45 - CREATE INDEX IF NOT EXISTS idx_sessions_expires_at 46 46 - ON sessions(expires_at) 47 47 - `); 48 48 - } 49 49 - 50 50 - // Create a new session 51 51 - createSession(userDid: string, handle?: string): string { 52 52 - const sessionId = crypto.randomUUID(); 53 53 - const createdAt = Date.now(); 54 54 - const expiresAt = createdAt + 30 * 24 * 60 * 60 * 1000; // 30 days 55 55 - 56 56 - const stmt = this.db.prepare(` 57 57 - INSERT INTO sessions (session_id, user_did, handle, is_authenticated, created_at, expires_at) 58 58 - VALUES (?, ?, ?, ?, ?, ?) 59 59 - `); 60 60 - 61 61 - stmt.run(sessionId, userDid, handle || null, 1, createdAt, expiresAt); 62 62 - 63 63 - return sessionId; 64 64 - } 65 65 - 66 66 - // Get session data 67 67 - getSession(sessionId: string): SessionData | null { 68 68 - // Clean up expired sessions first 69 69 - const cleanupStmt = this.db.prepare( 70 70 - `DELETE FROM sessions WHERE expires_at < ?` 71 71 - ); 72 72 - cleanupStmt.run(Date.now()); 73 73 - 74 74 - const stmt = this.db.prepare(` 75 75 - SELECT user_did, handle, is_authenticated, created_at 76 76 - FROM sessions 77 77 - WHERE session_id = ? AND expires_at > ? 78 78 - `); 79 79 - 80 80 - const row = stmt.get(sessionId, Date.now()) as 81 81 - | { 82 82 - user_did: string; 83 83 - handle: string | null; 84 84 - is_authenticated: number; 85 85 - created_at: number; 86 86 - } 87 87 - | undefined; 88 88 - 89 89 - if (!row) { 90 90 - return null; 91 91 - } 92 92 - 93 93 - return { 94 94 - userDid: row.user_did, 95 95 - handle: row.handle || undefined, 96 96 - isAuthenticated: Boolean(row.is_authenticated), 97 97 - createdAt: row.created_at, 98 98 - }; 99 99 - } 100 100 - 101 101 - // Update session data 102 102 - updateSession( 103 103 - sessionId: string, 104 104 - updates: { handle?: string; isAuthenticated?: boolean } 105 105 - ): boolean { 106 106 - const parts = []; 107 107 - const values = []; 108 108 - 109 109 - if (updates.handle !== undefined) { 110 110 - parts.push("handle = ?"); 111 111 - values.push(updates.handle); 112 112 - } 113 113 - 114 114 - if (updates.isAuthenticated !== undefined) { 115 115 - parts.push("is_authenticated = ?"); 116 116 - values.push(updates.isAuthenticated ? 1 : 0); 117 117 - } 118 118 - 119 119 - if (parts.length === 0) { 120 120 - return false; 121 121 - } 122 122 - 123 123 - // Extend expiration on update 124 124 - parts.push("expires_at = ?"); 125 125 - values.push(Date.now() + 30 * 24 * 60 * 60 * 1000); 126 126 - 127 127 - values.push(sessionId); 128 128 - values.push(Date.now()); // Only update non-expired sessions 129 129 - 130 130 - const stmt = this.db.prepare(` 131 131 - UPDATE sessions 132 132 - SET ${parts.join(", ")} 133 133 - WHERE session_id = ? AND expires_at > ? 134 134 - `); 135 135 - 136 136 - const result = stmt.run(...values); 137 137 - return result.changes > 0; 138 138 - } 139 139 - 140 140 - // Delete a session (logout) 141 141 - deleteSession(sessionId: string): void { 142 142 - const stmt = this.db.prepare("DELETE FROM sessions WHERE session_id = ?"); 143 143 - stmt.run(sessionId); 144 144 - } 145 145 - 146 146 - // Get user info from OAuth client 147 147 - async getUserInfo(): Promise<UserData> { 148 148 - const userInfo = await atprotoClient.oauth?.getUserInfo(); 149 149 - console.log("Fetched user info:", userInfo); 150 150 - const isAuthenticated = 151 151 - (await atprotoClient.oauth?.isAuthenticated()) || false; 152 152 - 153 153 - if (userInfo && isAuthenticated) { 154 154 - return { 155 155 - handle: userInfo.name || undefined, // Use 'name' field which contains the handle 156 156 - sub: userInfo.sub, 157 157 - isAuthenticated: true, 158 158 - }; 159 159 - } 160 160 - return { isAuthenticated: false }; 161 161 - } 162 162 - 163 163 - // Get current user from request 164 164 - async getCurrentUser( 165 165 - req: Request 166 166 - ): Promise<{ handle?: string; sub?: string; isAuthenticated: boolean }> { 167 167 - const sessionId = getSessionIdFromRequest(req); 168 168 - 169 169 - if (!sessionId) { 170 170 - return { isAuthenticated: false }; 171 171 - } 172 172 - 173 173 - try { 174 174 - const sessionData = this.getSession(sessionId); 175 175 - 176 176 - if (!sessionData) { 177 177 - return { isAuthenticated: false }; 178 178 - } 179 179 - 180 180 - if (!sessionData.isAuthenticated) { 181 181 - return { isAuthenticated: false }; 182 182 - } 183 183 - 184 184 - // Try to ensure valid tokens (this will refresh if needed) 185 185 - try { 186 186 - await atprotoClient.oauth?.ensureValidToken(); 187 187 - 188 188 - const oauthAuthenticated = 189 189 - (await atprotoClient.oauth?.isAuthenticated()) || false; 190 190 - 191 191 - if (!oauthAuthenticated) { 192 192 - // Mark session as unauthenticated if OAuth tokens are invalid 193 193 - this.updateSession(sessionId, { isAuthenticated: false }); 194 194 - return { isAuthenticated: false }; 195 195 - } 196 196 - } catch (_tokenError) { 197 197 - // Mark session as unauthenticated if token refresh fails 198 198 - this.updateSession(sessionId, { isAuthenticated: false }); 199 199 - return { isAuthenticated: false }; 200 200 - } 201 201 - 202 202 - return { 203 203 - handle: sessionData.handle, 204 204 - sub: sessionData.userDid, 205 205 - isAuthenticated: true, 206 206 - }; 207 207 - } catch (error) { 208 208 - console.error("Session validation error:", error); 209 209 - return { isAuthenticated: false }; 210 210 - } 211 211 - } 212 212 - 213 213 - // Create session from user data 214 214 - createSessionFromUserData(userData: UserData): string { 215 215 - if (!userData.sub) { 216 216 - throw new Error("User DID (sub) is required for session creation"); 217 217 - } 218 218 - 219 219 - return this.createSession(userData.sub, userData.handle); 220 220 - } 221 221 - 222 222 - // Delete session from request 223 223 - deleteSessionFromRequest(req: Request): void { 224 224 - const sessionId = getSessionIdFromRequest(req); 225 225 - if (sessionId) { 226 226 - this.deleteSession(sessionId); 227 227 - } 228 228 - } 229 229 - } 230 230 - 231 231 - // Utility function to extract session ID from request 232 232 - export function getSessionIdFromRequest(request: Request): string | null { 233 233 - const cookies = request.headers.get("cookie") || ""; 234 234 - const sessionCookie = cookies 235 235 - .split("; ") 236 236 - .find((row) => row.startsWith("session_id=")); 237 237 - 238 238 - if (!sessionCookie) { 239 239 - return null; 240 240 - } 241 241 - 242 242 - return sessionCookie.split("=")[1]; 243 243 - } 244 244 - 245 245 - // Utility function to create session cookie 246 246 - export function createSessionCookie(sessionId: string): string { 247 247 - // HttpOnly, Secure, SameSite=Strict cookie with 30 day expiration 248 248 - return `session_id=${sessionId}; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=2592000`; // 30 days 249 249 - } 250 250 - 251 251 - // Utility function to clear session cookie 252 252 - export function clearSessionCookie(): string { 253 253 - return `session_id=; HttpOnly; Secure; SameSite=Strict; Path=/; Max-Age=0`; 254 254 - }

-6

frontend/src/lib/stores.ts

··· 1 1 - // Initialize all stores with shared database 2 2 - import { SessionStore } from "./session-store.ts"; 3 3 - 4 4 - const DATABASE_URL = Deno.env.get("DATABASE_URL") || "sqlite://slices.db"; 5 5 - 6 6 - export const sessionStore = new SessionStore(DATABASE_URL);

+1 -1

frontend/src/routes/middleware.ts

··· 1 1 - import { sessionStore } from "../lib/stores.ts"; 1 1 + import { sessionStore } from "../config.ts"; 2 2 3 3 export interface AuthenticatedUser { 4 4 handle?: string;

+25 -16

frontend/src/routes/oauth.ts

··· 1 1 import type { Route } from "@std/http/unstable-route"; 2 2 - import { atprotoClient } from "../config.ts"; 3 3 - import { sessionStore } from "../lib/stores.ts"; 4 4 - import { 5 5 - createSessionCookie, 6 6 - clearSessionCookie, 7 7 - } from "../lib/session-store.ts"; 2 2 + import { atprotoClient, oauthSessions, sessionStore } from "../config.ts"; 8 3 9 4 async function handleOAuthAuthorize(req: Request): Promise<Response> { 10 5 try { ··· 72 67 state, 73 68 }); 74 69 75 75 - // Get user info from OAuth client 76 76 - const userData = await sessionStore.getUserInfo(); 70 70 + // Create OAuth session with auto token management 71 71 + const sessionId = await oauthSessions.createOAuthSession(); 72 72 + 73 73 + if (!sessionId) { 74 74 + return Response.redirect( 75 75 + new URL( 76 76 + "/login?error=" + encodeURIComponent("Failed to create session"), 77 77 + req.url 78 78 + ), 79 79 + 302 80 80 + ); 81 81 + } 77 82 78 78 - // Create new session and get session cookie 79 79 - const sessionId = await sessionStore.createSessionFromUserData(userData); 80 80 - const sessionCookie = createSessionCookie(sessionId); 83 83 + // Create session cookie 84 84 + const sessionCookie = sessionStore.createSessionCookie(sessionId); 81 85 82 86 return new Response(null, { 83 87 status: 302, ··· 99 103 } 100 104 101 105 async function handleLogout(req: Request): Promise<Response> { 102 102 - // Delete the session from KV store 103 103 - await sessionStore.deleteSessionFromRequest(req); 106 106 + // Get session from request 107 107 + const session = await sessionStore.getSessionFromRequest(req); 108 108 + 109 109 + if (session) { 110 110 + // Use OAuth session manager to handle logout 111 111 + await oauthSessions.logout(session.sessionId); 112 112 + } 104 113 105 105 - // Logout from OAuth client 106 106 - await atprotoClient.oauth?.logout(); 114 114 + // Clear session cookie 115 115 + const clearCookie = sessionStore.createLogoutCookie(); 107 116 108 117 return new Response(null, { 109 118 status: 302, 110 119 headers: { 111 120 Location: new URL("/login", req.url).toString(), 112 112 - "Set-Cookie": clearSessionCookie(), 121 121 + "Set-Cookie": clearCookie, 113 122 }, 114 123 }); 115 124 }

+2 -1

frontend/src/routes/pages.tsx

··· 369 369 return Response.redirect(new URL("/", req.url), 302); 370 370 } 371 371 372 372 - // Get OAuth access token if available 372 372 + // Get OAuth access token directly from OAuth client (clean separation) 373 373 let accessToken: string | undefined; 374 374 try { 375 375 + // Tokens are managed by @slices/oauth, not stored in sessions 375 376 const tokens = await atprotoClient.oauth?.ensureValidToken(); 376 377 accessToken = tokens?.accessToken; 377 378 } catch (error) {